486 files changed, 9572 insertions, 6489 deletions

diff --git a/src/3rdparty/webkit/ChangeLog b/src/3rdparty/webkit/ChangeLog
index 4a08347..9065b3a 100644
--- a/src/3rdparty/webkit/ChangeLog
+++ b/src/3rdparty/webkit/ChangeLog
@@ -1,3 +1,84 @@
+2009-09-23  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Do not add unneeded include paths for gir files, and add the
+        include paths for headers manually instead of relying on our own
+        pc file and installed headers, since that adds a circular
+        dependency.
+
+        * GNUmakefile.am:
+
+2009-09-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        Minor reorganization to the patch landed in
+        http://trac.webkit.org/changeset/48670. Also move JSCore-1.0.gir
+        in the gtk directory as that's only useful to the Gtk port at the
+        moment.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
+2009-09-23  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] We should generate our own gir file for introspection
+        https://bugs.webkit.org/show_bug.cgi?id=29603
+
+        Generate gir and typelib files for WebKit and JSCore. The JSCore
+        gir file is handwritten (since it's only useful, for now, as a
+        dependency of the WebKit gir file), the WebKit one is
+        autogenerated from the headers.
+
+        * GNUmakefile.am:
+        * JSCore-1.0.gir: Added.
+        * configure.ac:
+
+2009-09-22  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        link errors due to wrong UNICODE_LIBS on Ubuntu Jaunty
+        https://bugs.webkit.org/show_bug.cgi?id=29638
+
+        Call icu-cconfig with ldflags-libsonly to prevent having a -L
+        statement that could override libs installed in another prefix.
+
+        * autotools/webkit.m4:
+
+2009-09-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump version for 1.1.15 release.
+
+        * configure.ac:
+
+2009-09-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha and Jan Alonzo.
+
+        [GTK] context menu overriding API is very limited
+        https://bugs.webkit.org/show_bug.cgi?id=27546
+
+        Add new tests to the build.
+
+        * GNUmakefile.am:
+
+2009-09-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha and Jan Alonzo.
+
+        [GTK] context menu overriding API is very limited
+        https://bugs.webkit.org/show_bug.cgi?id=27546
+
+        Add WebKitHitTestResult to the build.
+
+        * GNUmakefile.am:
+
 2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
         Reviewed by Ariya Hidayat.
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h
index 8b17ee2..c58b958 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h
@@ -37,7 +37,7 @@
 extern "C" {
 #endif
 
-#if !defined(WIN32) && !defined(_WIN32)
+#if !defined(WIN32) && !defined(_WIN32) && !defined(__WINSCW__)
 /*!
 @typedef JSChar
 @abstract A Unicode character.
diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 8aa8c1d..4899919 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,3 +1,532 @@
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        A piece of my last patch that I forgot.
+
+        * wtf/HashCountedSet.h:
+        (WTF::::clear): Added HashCountedSet::clear.
+
+2009-09-24  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Avoid __clear_cache built-in function if DISABLE_BUILTIN_CLEAR_CACHE define is set
+        https://bugs.webkit.org/show_bug.cgi?id=28886
+
+        There are some GCC packages (for example GCC-2006q3 from CodeSourcery)
+        which contain __clear_cache built-in function only for C while the C++
+        version of __clear_cache is missing on ARM architectures.
+
+        Fixed a small bug in the inline assembly of cacheFlush function on
+        ARM_TRADITIONAL.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added the ability to swap vectors with inline capacities, so you can
+        store a vector with inline capacity in a hash table.
+
+        * wtf/Vector.h:
+        (WTF::swap):
+        (WTF::VectorBuffer::swap):
+
+2009-09-23  David Kilzer  <ddkilzer@apple.com>
+
+        Move definition of USE(PLUGIN_HOST_PROCESS) from WebKitPrefix.h to Platform.h
+
+        Reviewed by Mark Rowe.
+
+        * wtf/Platform.h: Define WTF_USE_PLUGIN_HOST_PROCESS to 1 when
+        building on 64-bit SnowLeopard.  Define to 0 elsewhere.
+
+2009-09-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Code sampling builds are broken.
+        https://bugs.webkit.org/show_bug.cgi?id=29662
+
+        Fix build.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecode/SamplingTool.cpp:
+        (JSC::ScriptSampleRecord::sample):
+        (JSC::SamplingTool::doRun):
+        (JSC::SamplingTool::notifyOfScope):
+        (JSC::compareScriptSampleRecords):
+        (JSC::SamplingTool::dump):
+        * bytecode/SamplingTool.h:
+        (JSC::ScriptSampleRecord::ScriptSampleRecord):
+        (JSC::ScriptSampleRecord::~ScriptSampleRecord):
+        (JSC::SamplingTool::SamplingTool):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::create):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+2009-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * wtf/Forward.h: Added PassOwnPtr.
+
+2009-09-22  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+
+        Ported chromium.org's javascriptcore.gyp for the webkit chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29617
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Added.
+
+2009-09-22  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compilation with WINSCW: no varargs macros
+
+        Disable variadic arguments for WINSCW just like we do
+        for MSVC7.
+
+        * wtf/Assertions.h:
+
+2009-09-22  Kent Hansen  <khansen@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Disable variadic macros on MSVC7.
+
+        This was originally added in r26589 but not extended
+        when LOG_DISABLED/ASSERT_DISABLED was introduced.
+
+        * wtf/Assertions.h:
+
+2009-09-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed build fix for Windows CE < 5
+
+        Define WINCEBASIC to disable the IsDebuggerPresent() code in
+        wtf/Assertions.cpp.
+
+        * JavaScriptCore.pri:
+
+2009-09-22  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix major memory leak in JavaScriptCore RegisterFile on Windows CE
+
+        https://bugs.webkit.org/show_bug.cgi?id=29367
+
+        On Widows CE we must decommit all committed pages before we release
+        them. See VirtualFree documentation.
+        Desktop Windows behaves much smoother in this situation.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+
+2009-09-21  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser & Sam Weinig.
+
+        Add ENABLE(ORIENTATION_EVENTS)
+        https://bugs.webkit.org/show_bug.cgi?id=29508
+
+        * wtf/Platform.h: Also sort PLATFORM(IPHONE) #defines.
+
+2009-09-21  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Fix] SourceCode's uninitialized member
+        
+        Potential source of crashes and bugs was fixed. Default constructor
+        didn't initialized m_provider member.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29364
+
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode):
+
+2009-09-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        REGRESSION (r48582): Crash in StructureStubInfo::initPutByIdTransition when reloading trac.webkit.org
+        https://bugs.webkit.org/show_bug.cgi?id=29599
+
+        It is unsafe to attempt to cache new property transitions on
+        dictionaries of any type.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+
+2009-09-21  Oliver Hunt  <oliver@apple.com>
+
+        RS=Maciej Stachowiak.
+
+        Re-land SNES fix with corrected assertion.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::removeDirect):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::fromDictionaryTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::isDictionary):
+        (JSC::Structure::isUncacheableDictionary):
+        (JSC::Structure::):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-09-21  Adam Roben  <aroben@apple.com>
+
+        Revert r48573, as it caused many assertion failures
+
+        * interpreter/Interpreter.cpp:
+        * jit/JITStubs.cpp:
+        * runtime/BatchedTransitionOptimizer.h:
+        * runtime/JSObject.cpp:
+        * runtime/Structure.cpp:
+        * runtime/Structure.h:
+        * runtime/StructureChain.cpp:
+
+2009-09-21  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix. Missing files.
+
+        * GNUmakefile.am:
+
+2009-09-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam 'Cabin Boy' Weinig.
+
+        Fix stack alignment with ARM THUMB2 JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=29526
+        
+        Stack is currently being decremented by 0x3c, bump this to 0x40 to make this a
+        multiple of 16 bytes.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+
+2009-09-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        SNES is too slow
+        https://bugs.webkit.org/show_bug.cgi?id=29534
+
+        The problem was that the emulator used multiple classes with
+        more properties than our dictionary cutoff allowed, this resulted
+        in more or less all critical logic inside the emulator requiring
+        uncached property access.
+
+        Rather than simply bumping the dictionary cutoff, this patch
+        recognises that there are two ways to create a "dictionary"
+        structure.  Either by adding a large number of properties, or
+        by removing a property.  In the case of adding properties we
+        know all the existing properties will maintain their existing
+        offsets, so we could cache access to those properties, if we
+        know they won't be removed.
+
+        To make this possible, this patch adds the logic required to
+        distinguish a dictionary created by addition from one created
+        by removal.  With this logic in place we can now cache access
+        to objects with large numbers of properties.
+
+        SNES performance improved by more than 6x.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::removeDirect):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::fromDictionaryTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::isDictionary):
+        (JSC::Structure::isUncacheableDictionary):
+        (JSC::Structure::):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement ES5 Object.create function
+        https://bugs.webkit.org/show_bug.cgi?id=29524
+
+        Implement Object.create.  Very simple patch, effectively Object.defineProperties
+        only creating the target object itself.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorCreate):
+
+2009-09-19  Dan Bernstein  <mitz@apple.com>
+
+        Fix clean debug builds.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-19  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by George Staikos.
+
+        QtWebKit Windows CE compile fix
+
+        https://bugs.webkit.org/show_bug.cgi?id=29379
+
+        There is no _aligned_alloc or _aligned_free on Windows CE.
+        We just use the Windows code that was there before and use VirtualAlloc.
+        But that also means that the BLOCK_SIZE must be 64K as this function
+        allocates on 64K boundaries.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        * runtime/Collector.h:
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implement ES5 Object.defineProperties function
+        https://bugs.webkit.org/show_bug.cgi?id=29522
+
+        Implement Object.defineProperties.  Fairly simple patch, simply makes use of
+        existing functionality used for defineProperty.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::defineProperties):
+        (JSC::objectConstructorDefineProperties):
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Windows build fix part2
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Windows build fix part 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Implement ES5 Object.defineProperty function
+        https://bugs.webkit.org/show_bug.cgi?id=29503
+
+        Implement Object.defineProperty.  This requires adding the API to
+        ObjectConstructor, along with a helper function that implements the
+        ES5 internal [[ToPropertyDescriptor]] function.  It then adds
+        JSObject::defineOwnProperty that implements the appropriate ES5 semantics.
+        Currently defineOwnProperty uses a delete followed by a put to redefine
+        attributes of a property, clearly this is less efficient than it could be
+        but we can improve this if it needs to be possible in future.
+
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::defineGetter):
+        (JSC::DebuggerActivation::defineSetter):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+          Update defineGetter/Setter calls
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::defineGetter):
+        (JSC::JSGlobalObject::defineSetter):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::toPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::writable):
+        (JSC::PropertyDescriptor::enumerable):
+        (JSC::PropertyDescriptor::configurable):
+        (JSC::PropertyDescriptor::isDataDescriptor):
+        (JSC::PropertyDescriptor::isGenericDescriptor):
+        (JSC::PropertyDescriptor::isAccessorDescriptor):
+        (JSC::PropertyDescriptor::getter):
+        (JSC::PropertyDescriptor::setter):
+        (JSC::PropertyDescriptor::setDescriptor):
+        (JSC::PropertyDescriptor::setAccessorDescriptor):
+        (JSC::PropertyDescriptor::setWritable):
+        (JSC::PropertyDescriptor::setEnumerable):
+        (JSC::PropertyDescriptor::setConfigurable):
+        (JSC::PropertyDescriptor::setSetter):
+        (JSC::PropertyDescriptor::setGetter):
+        (JSC::PropertyDescriptor::equalTo):
+        (JSC::PropertyDescriptor::attributesEqual):
+        (JSC::PropertyDescriptor::attributesWithOverride):
+        * runtime/PropertyDescriptor.h:
+        (JSC::PropertyDescriptor::PropertyDescriptor):
+        (JSC::PropertyDescriptor::value):
+        (JSC::PropertyDescriptor::setValue):
+        (JSC::PropertyDescriptor::isEmpty):
+        (JSC::PropertyDescriptor::writablePresent):
+        (JSC::PropertyDescriptor::enumerablePresent):
+        (JSC::PropertyDescriptor::configurablePresent):
+        (JSC::PropertyDescriptor::setterPresent):
+        (JSC::PropertyDescriptor::getterPresent):
+        (JSC::PropertyDescriptor::operator==):
+        (JSC::PropertyDescriptor::):
+
+2009-09-18  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Build fix to enable ARM_THUMB2 on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/JITStubs.cpp:
+        * wtf/Platform.h:
+
+2009-09-18  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Defines two pseudo-platforms for ARM and Thumb-2 instruction set.
+        https://bugs.webkit.org/show_bug.cgi?id=29122
+
+        Introduces WTF_PLATFORM_ARM_TRADITIONAL and WTF_PLATFORM_ARM_THUMB2
+        macros on ARM platforms. The PLATFORM(ARM_THUMB2) should be used
+        when Thumb-2 instruction set is the required target. The
+        PLATFORM(ARM_TRADITIONAL) is for generic ARM instruction set. In
+        case where the code is common the PLATFORM(ARM) have to be used.
+
+        * assembler/ARMAssembler.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.cpp:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        * jit/ExecutableAllocator.h:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::preserveReturnAddressAfterCall):
+        (JSC::JIT::restoreReturnAddressBeforeReturn):
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITOpcodes.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+
+2009-09-18  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt/Windows CE build.
+
+        * JavaScriptCore.pri: Build the ce_time.cpp functions from
+        within Qt externally.
+        * wtf/DateMath.cpp: Removed unnecessary Qt #ifdef, for the
+        Qt build these functions are no external, too.
+
 2009-09-17  Janne Koskinen  <janne.p.koskinen@digia.com>
 
         Reviewed by Simon Hausmann.
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
index bd80add..7a815e3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
@@ -50,10 +50,9 @@ win32-* {
     }
 }
 
-win32-msvc*: INCLUDEPATH += $$PWD/os-win32
 wince* {
-    INCLUDEPATH += $$PWD/os-win32
     SOURCES += $$QT_SOURCE_TREE/src/3rdparty/ce-compat/ce_time.cpp
+    DEFINES += WINCEBASIC
 }
 
 include(pcre/pcre.pri)
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
new file mode 100644
index 0000000..0cd2e1a
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
@@ -0,0 +1,69 @@
+# JavaScriptCore - qmake build info
+CONFIG += building-libs
+include($$PWD/../WebKit.pri)
+
+TEMPLATE = lib
+CONFIG += staticlib
+TARGET = JavaScriptCore
+
+CONFIG += depend_includepath
+
+contains(QT_CONFIG, embedded):CONFIG += embedded
+
+CONFIG(QTDIR_build) {
+    GENERATED_SOURCES_DIR = $$PWD/generated
+    OLDDESTDIR = $$DESTDIR
+    include($$QT_SOURCE_TREE/src/qbase.pri)
+    INSTALLS =
+    DESTDIR = $$OLDDESTDIR
+    PRECOMPILED_HEADER = $$PWD/../WebKit/qt/WebKit_pch.h
+    DEFINES *= NDEBUG
+}
+
+isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
+GENERATED_SOURCES_DIR_SLASH = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
+
+INCLUDEPATH += $$GENERATED_SOURCES_DIR
+
+!CONFIG(QTDIR_build) {
+    CONFIG(debug, debug|release) {
+        OBJECTS_DIR = obj/debug
+    } else { # Release
+        OBJECTS_DIR = obj/release
+    }
+}
+
+CONFIG(release):!CONFIG(QTDIR_build) {
+    contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
+    unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
+}
+
+linux-*: DEFINES += HAVE_STDINT_H
+freebsd-*: DEFINES += HAVE_PTHREAD_NP_H
+
+DEFINES += BUILD_WEBKIT
+
+win32-*: DEFINES += _HAS_TR1=0
+
+# Pick up 3rdparty libraries from INCLUDE/LIB just like with MSVC
+win32-g++ {
+    TMPPATH            = $$quote($$(INCLUDE))
+    QMAKE_INCDIR_POST += $$split(TMPPATH,";")
+    TMPPATH            = $$quote($$(LIB))
+    QMAKE_LIBDIR_POST += $$split(TMPPATH,";")
+}
+
+DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1
+
+DEFINES += WTF_CHANGES=1
+
+include(JavaScriptCore.pri)
+
+QMAKE_EXTRA_TARGETS += generated_files
+
+lessThan(QT_MINOR_VERSION, 4) {
+    DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
+}
+
+*-g++*:QMAKE_CXXFLAGS_RELEASE -= -O2
+*-g++*:QMAKE_CXXFLAGS_RELEASE += -O3
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp
index 77d7a53..1324586 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM)
+#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
 
 #include "ARMAssembler.h"
 
@@ -390,4 +390,4 @@ void* ARMAssembler::executableCopy(ExecutablePool* allocator)
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM)
+#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h
index 0b04bb4..9f9a450 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h
@@ -29,7 +29,7 @@
 
 #include <wtf/Platform.h>
 
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM)
+#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
 
 #include "AssemblerBufferWithConstantPool.h"
 #include <wtf/Assertions.h>
@@ -764,6 +764,6 @@ namespace JSC {
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM)
+#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
 
 #endif // ARMAssembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
index e920255..078de44 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -28,7 +28,7 @@
 
 #include <wtf/Platform.h>
 
-#if ENABLE(ASSEMBLER) && PLATFORM_ARM_ARCH(7)
+#if ENABLE(ASSEMBLER) && PLATFORM(ARM_THUMB2)
 
 #include "AssemblerBuffer.h"
 #include <wtf/Assertions.h>
@@ -1753,6 +1753,6 @@ private:
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM_ARM_ARCH(7)
+#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_THUMB2)
 
 #endif // ARMAssembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
index 9e1c5d3..2743ab4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
@@ -30,11 +30,11 @@
 
 #if ENABLE(ASSEMBLER)
 
-#if PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_THUMB2)
 #include "MacroAssemblerARMv7.h"
 namespace JSC { typedef MacroAssemblerARMv7 MacroAssemblerBase; };
 
-#elif PLATFORM(ARM)
+#elif PLATFORM(ARM_TRADITIONAL)
 #include "MacroAssemblerARM.h"
 namespace JSC { typedef MacroAssemblerARM MacroAssemblerBase; };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
index 33fac64..43648c4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
+#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
 
 #include "MacroAssemblerARM.h"
 
@@ -64,4 +64,4 @@ const bool MacroAssemblerARM::s_isVFPPresent = isVFPPresent();
 
 }
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
+#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
index 4a7c10a..0c696c9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -30,7 +30,7 @@
 
 #include <wtf/Platform.h>
 
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
+#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
 
 #include "ARMAssembler.h"
 #include "AbstractMacroAssembler.h"
@@ -797,6 +797,6 @@ private:
 
 }
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
+#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
 
 #endif // MacroAssemblerARM_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
index 341a7ff..568260a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -37,7 +37,7 @@
 
 // ASSERT_VALID_CODE_POINTER checks that ptr is a non-null pointer, and that it is a valid
 // instruction address on the platform (for example, check any alignment requirements).
-#if PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_THUMB2)
 // ARM/thumb instructions must be 16-bit aligned, but all code pointers to be loaded
 // into the processor are decorated with the bottom bit set, indicating that this is
 // thumb code (as oposed to 32-bit traditional ARM).  The first test checks for both
@@ -124,7 +124,7 @@ public:
     }
 
     explicit MacroAssemblerCodePtr(void* value)
-#if PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_THUMB2)
         // Decorate the pointer as a thumb code pointer.
         : m_value(reinterpret_cast<char*>(value) + 1)
 #else
@@ -141,7 +141,7 @@ public:
     }
 
     void* executableAddress() const { return m_value; }
-#if PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_THUMB2)
     // To use this pointer as a data address remove the decoration.
     void* dataLocation() const { ASSERT_VALID_CODE_POINTER(m_value); return reinterpret_cast<char*>(m_value) - 1; }
 #else
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
index 0e1fb1e..05834fc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
@@ -50,7 +50,7 @@ namespace JSC {
                 evalExecutable = m_cacheMap.get(evalSource.rep());
 
             if (!evalExecutable) {
-                evalExecutable = EvalExecutable::create(makeSource(evalSource));
+                evalExecutable = EvalExecutable::create(exec, makeSource(evalSource));
                 exceptionValue = evalExecutable->compile(exec, scopeChain);
                 if (exceptionValue)
                     return 0;
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
index 8d0faa1..865c919 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
@@ -157,7 +157,7 @@ void SamplingThread::stop()
 }
 
 
-void ScopeSampleRecord::sample(CodeBlock* codeBlock, Instruction* vPC)
+void ScriptSampleRecord::sample(CodeBlock* codeBlock, Instruction* vPC)
 {
     if (!m_samples) {
         m_size = codeBlock->instructions().size();
@@ -196,8 +196,8 @@ void SamplingTool::doRun()
 
 #if ENABLE(CODEBLOCK_SAMPLING)
     if (CodeBlock* codeBlock = sample.codeBlock()) {
-        MutexLocker locker(m_scopeSampleMapMutex);
-        ScopeSampleRecord* record = m_scopeSampleMap->get(codeBlock->ownerExecutable());
+        MutexLocker locker(m_scriptSampleMapMutex);
+        ScriptSampleRecord* record = m_scopeSampleMap->get(codeBlock->ownerExecutable());
         ASSERT(record);
         record->sample(codeBlock, sample.vPC());
     }
@@ -209,13 +209,13 @@ void SamplingTool::sample()
     s_samplingTool->doRun();
 }
 
-void SamplingTool::notifyOfScope(ScopeNode* scope)
+void SamplingTool::notifyOfScope(ScriptExecutable* script)
 {
 #if ENABLE(CODEBLOCK_SAMPLING)
-    MutexLocker locker(m_scopeSampleMapMutex);
-    m_scopeSampleMap->set(scope, new ScopeSampleRecord(scope));
+    MutexLocker locker(m_scriptSampleMapMutex);
+    m_scopeSampleMap->set(script, new ScriptSampleRecord(script));
 #else
-    UNUSED_PARAM(scope);
+    UNUSED_PARAM(script);
 #endif
 }
 
@@ -254,10 +254,10 @@ static int compareLineCountInfoSampling(const void* left, const void* right)
     return (leftLineCount->line > rightLineCount->line) ? 1 : (leftLineCount->line < rightLineCount->line) ? -1 : 0;
 }
 
-static int compareScopeSampleRecords(const void* left, const void* right)
+static int compareScriptSampleRecords(const void* left, const void* right)
 {
-    const ScopeSampleRecord* const leftValue = *static_cast<const ScopeSampleRecord* const *>(left);
-    const ScopeSampleRecord* const rightValue = *static_cast<const ScopeSampleRecord* const *>(right);
+    const ScriptSampleRecord* const leftValue = *static_cast<const ScriptSampleRecord* const *>(left);
+    const ScriptSampleRecord* const rightValue = *static_cast<const ScriptSampleRecord* const *>(right);
 
     return (leftValue->m_sampleCount < rightValue->m_sampleCount) ? 1 : (leftValue->m_sampleCount > rightValue->m_sampleCount) ? -1 : 0;
 }
@@ -318,26 +318,26 @@ void SamplingTool::dump(ExecState* exec)
     // (3) Build and sort 'codeBlockSamples' array.
 
     int scopeCount = m_scopeSampleMap->size();
-    Vector<ScopeSampleRecord*> codeBlockSamples(scopeCount);
-    ScopeSampleRecordMap::iterator iter = m_scopeSampleMap->begin();
+    Vector<ScriptSampleRecord*> codeBlockSamples(scopeCount);
+    ScriptSampleRecordMap::iterator iter = m_scopeSampleMap->begin();
     for (int i = 0; i < scopeCount; ++i, ++iter)
         codeBlockSamples[i] = iter->second;
 
-    qsort(codeBlockSamples.begin(), scopeCount, sizeof(ScopeSampleRecord*), compareScopeSampleRecords);
+    qsort(codeBlockSamples.begin(), scopeCount, sizeof(ScriptSampleRecord*), compareScriptSampleRecords);
 
     // (4) Print data from 'codeBlockSamples' array.
 
     printf("\nCodeBlock samples\n\n"); 
 
     for (int i = 0; i < scopeCount; ++i) {
-        ScopeSampleRecord* record = codeBlockSamples[i];
+        ScriptSampleRecord* record = codeBlockSamples[i];
         CodeBlock* codeBlock = record->m_codeBlock;
 
         double blockPercent = (record->m_sampleCount * 100.0) / m_sampleCount;
 
         if (blockPercent >= 1) {
             //Instruction* code = codeBlock->instructions().begin();
-            printf("#%d: %s:%d: %d / %lld (%.3f%%)\n", i + 1, record->m_scope->sourceURL().UTF8String().c_str(), codeBlock->lineNumberForBytecodeOffset(exec, 0), record->m_sampleCount, m_sampleCount, blockPercent);
+            printf("#%d: %s:%d: %d / %lld (%.3f%%)\n", i + 1, record->m_executable->sourceURL().UTF8String().c_str(), codeBlock->lineNumberForBytecodeOffset(exec, 0), record->m_sampleCount, m_sampleCount, blockPercent);
             if (i < 10) {
                 HashMap<unsigned,unsigned> lineCounts;
                 codeBlock->dump(exec);
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h
index 1a3f7cf..711b086 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h
@@ -38,6 +38,8 @@
 
 namespace JSC {
 
+    class ScriptExecutable;
+
     class SamplingFlags {
         friend class JIT;
     public:
@@ -92,9 +94,9 @@ namespace JSC {
     class ScopeNode;
     struct Instruction;
 
-    struct ScopeSampleRecord {
-        ScopeSampleRecord(ScopeNode* scope)
-            : m_scope(scope)
+    struct ScriptSampleRecord {
+        ScriptSampleRecord(ScriptExecutable* executable)
+            : m_executable(executable)
             , m_codeBlock(0)
             , m_sampleCount(0)
             , m_opcodeSampleCount(0)
@@ -103,7 +105,7 @@ namespace JSC {
         {
         }
         
-        ~ScopeSampleRecord()
+        ~ScriptSampleRecord()
         {
             if (m_samples)
                 free(m_samples);
@@ -111,7 +113,7 @@ namespace JSC {
         
         void sample(CodeBlock*, Instruction*);
 
-        RefPtr<ScopeNode> m_scope;
+        ScriptExecutable* m_executable;
         CodeBlock* m_codeBlock;
         int m_sampleCount;
         int m_opcodeSampleCount;
@@ -119,7 +121,7 @@ namespace JSC {
         unsigned m_size;
     };
 
-    typedef WTF::HashMap<ScopeNode*, ScopeSampleRecord*> ScopeSampleRecordMap;
+    typedef WTF::HashMap<ScriptExecutable*, ScriptSampleRecord*> ScriptSampleRecordMap;
 
     class SamplingThread {
     public:
@@ -193,7 +195,7 @@ namespace JSC {
             , m_sampleCount(0)
             , m_opcodeSampleCount(0)
 #if ENABLE(CODEBLOCK_SAMPLING)
-            , m_scopeSampleMap(new ScopeSampleRecordMap())
+            , m_scopeSampleMap(new ScriptSampleRecordMap())
 #endif
         {
             memset(m_opcodeSamples, 0, sizeof(m_opcodeSamples));
@@ -210,7 +212,7 @@ namespace JSC {
         void setup();
         void dump(ExecState*);
 
-        void notifyOfScope(ScopeNode* scope);
+        void notifyOfScope(ScriptExecutable* scope);
 
         void sample(CodeBlock* codeBlock, Instruction* vPC)
         {
@@ -266,8 +268,8 @@ namespace JSC {
         unsigned m_opcodeSamplesInCTIFunctions[numOpcodeIDs];
         
 #if ENABLE(CODEBLOCK_SAMPLING)
-        Mutex m_scopeSampleMapMutex;
-        OwnPtr<ScopeSampleRecordMap> m_scopeSampleMap;
+        Mutex m_scriptSampleMapMutex;
+        OwnPtr<ScriptSampleRecordMap> m_scopeSampleMap;
 #endif
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index af8f784..8951ce3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -273,7 +273,7 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* d
     } else {
         for (size_t i = 0; i < functionStack.size(); ++i) {
             FunctionBodyNode* function = functionStack[i];
-            globalObject->putWithAttributes(exec, function->ident(), new (exec) JSFunction(exec, makeFunction(function), scopeChain.node()), DontDelete);
+            globalObject->putWithAttributes(exec, function->ident(), new (exec) JSFunction(exec, makeFunction(exec, function), scopeChain.node()), DontDelete);
         }
         for (size_t i = 0; i < varStack.size(); ++i) {
             if (globalObject->hasProperty(exec, *varStack[i].first))
@@ -399,7 +399,7 @@ BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, const Debugger* debugge
 
     const DeclarationStacks::FunctionStack& functionStack = evalNode->functionStack();
     for (size_t i = 0; i < functionStack.size(); ++i)
-        m_codeBlock->addFunctionDecl(makeFunction(functionStack[i]));
+        m_codeBlock->addFunctionDecl(makeFunction(m_globalData, functionStack[i]));
 
     const DeclarationStacks::VarStack& varStack = evalNode->varStack();
     unsigned numVariables = varStack.size();
@@ -1316,7 +1316,7 @@ RegisterID* BytecodeGenerator::emitNewArray(RegisterID* dst, ElementNode* elemen
 
 RegisterID* BytecodeGenerator::emitNewFunction(RegisterID* dst, FunctionBodyNode* function)
 {
-    unsigned index = m_codeBlock->addFunctionDecl(makeFunction(function));
+    unsigned index = m_codeBlock->addFunctionDecl(makeFunction(m_globalData, function));
 
     emitOpcode(op_new_func);
     instructions().append(dst->index());
@@ -1336,7 +1336,7 @@ RegisterID* BytecodeGenerator::emitNewRegExp(RegisterID* dst, RegExp* regExp)
 RegisterID* BytecodeGenerator::emitNewFunctionExpression(RegisterID* r0, FuncExprNode* n)
 {
     FunctionBodyNode* function = n->body();
-    unsigned index = m_codeBlock->addFunctionExpr(makeFunction(function));
+    unsigned index = m_codeBlock->addFunctionExpr(makeFunction(m_globalData, function));
 
     emitOpcode(op_new_func_exp);
     instructions().append(r0->index());
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 650b362..1a83ce9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -417,9 +417,14 @@ namespace JSC {
         RegisterID* addConstantValue(JSValue);
         unsigned addRegExp(RegExp*);
 
-        PassRefPtr<FunctionExecutable> makeFunction(FunctionBodyNode* body)
+        PassRefPtr<FunctionExecutable> makeFunction(ExecState* exec, FunctionBodyNode* body)
         {
-            return FunctionExecutable::create(body->ident(), body->source(), body->usesArguments(), body->parameters(), body->lineNo(), body->lastLine());
+            return FunctionExecutable::create(exec, body->ident(), body->source(), body->usesArguments(), body->parameters(), body->lineNo(), body->lastLine());
+        }
+
+        PassRefPtr<FunctionExecutable> makeFunction(JSGlobalData* globalData, FunctionBodyNode* body)
+        {
+            return FunctionExecutable::create(globalData, body->ident(), body->source(), body->usesArguments(), body->parameters(), body->lineNo(), body->lastLine());
         }
 
         Vector<Instruction>& instructions() { return m_codeBlock->instructions(); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
index 61167d4..db02329 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
@@ -100,7 +100,7 @@ JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSG
 {
     CallFrame* globalCallFrame = globalObject->globalExec();
 
-    EvalExecutable eval(makeSource(script));
+    EvalExecutable eval(globalCallFrame, makeSource(script));
     JSObject* error = eval.compile(globalCallFrame, globalCallFrame->scopeChain());
     if (error)
         return error;
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
index 7a68d7d..5cc9a9f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
@@ -81,14 +81,14 @@ bool DebuggerActivation::getPropertyAttributes(JSC::ExecState* exec, const Ident
     return m_activation->getPropertyAttributes(exec, propertyName, attributes);
 }
 
-void DebuggerActivation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void DebuggerActivation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
-    m_activation->defineGetter(exec, propertyName, getterFunction);
+    m_activation->defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
-void DebuggerActivation::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+void DebuggerActivation::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
 {
-    m_activation->defineSetter(exec, propertyName, setterFunction);
+    m_activation->defineSetter(exec, propertyName, setterFunction, attributes);
 }
 
 JSValue DebuggerActivation::lookupGetter(ExecState* exec, const Identifier& propertyName)
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
index 06aea5a..dd34265 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
@@ -44,8 +44,8 @@ namespace JSC {
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
         virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
-        virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction);
-        virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction);
+        virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes);
+        virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes);
         virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
         virtual JSValue lookupSetter(ExecState*, const Identifier& propertyName);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index 9c8ca2a..88b14e6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -79,7 +79,7 @@ JSValue DebuggerCallFrame::evaluate(const UString& script, JSValue& exception) c
     if (!m_callFrame->codeBlock())
         return JSValue();
 
-    EvalExecutable eval(makeSource(script));
+    EvalExecutable eval(m_callFrame, makeSource(script));
     JSObject* error = eval.compile(m_callFrame, m_callFrame->scopeChain());
     if (error)
         return error;
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
index 4560db0..8a8fb3c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
@@ -169,7 +169,7 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
     PropertySlot slot(globalObject);
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isDictionary() && slot.slotBase() == globalObject) {
+        if (slot.isCacheable() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
             if (vPC[4].u.structure)
                 vPC[4].u.structure->deref();
             globalObject->structure()->ref();
@@ -953,7 +953,7 @@ NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock*
     JSCell* baseCell = asCell(baseValue);
     Structure* structure = baseCell->structure();
 
-    if (structure->isDictionary()) {
+    if (structure->isUncacheableDictionary()) {
         vPC[0] = getOpcode(op_put_by_id_generic);
         return;
     }
@@ -988,6 +988,10 @@ NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock*
 
     // Structure transition, cache transition info
     if (slot.type() == PutPropertySlot::NewProperty) {
+        if (structure->isDictionary()) {
+            vPC[0] = getOpcode(op_put_by_id_generic);
+            return;
+        }
         vPC[0] = getOpcode(op_put_by_id_transition);
         vPC[4] = structure->previousID();
         vPC[5] = structure;
@@ -1040,7 +1044,7 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
 
     Structure* structure = asCell(baseValue)->structure();
 
-    if (structure->isDictionary()) {
+    if (structure->isUncacheableDictionary()) {
         vPC[0] = getOpcode(op_get_by_id_generic);
         return;
     }
@@ -3731,7 +3735,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSObject* baseObj = asObject(callFrame->r(base).jsValue());
         Identifier& ident = callFrame->codeBlock()->identifier(property);
         ASSERT(callFrame->r(function).jsValue().isObject());
-        baseObj->defineSetter(callFrame, ident, asObject(callFrame->r(function).jsValue()));
+        baseObj->defineSetter(callFrame, ident, asObject(callFrame->r(function).jsValue()), 0);
 
         ++vPC;
         NEXT_INSTRUCTION();
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
index 06ddefc..5424199 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
@@ -36,6 +36,9 @@ RegisterFile::~RegisterFile()
 #if HAVE(MMAP)
     munmap(m_buffer, ((m_max - m_start) + m_maxGlobals) * sizeof(Register));
 #elif HAVE(VIRTUALALLOC)
+#if PLATFORM(WINCE)
+    VirtualFree(m_buffer, DWORD(m_commitEnd) - DWORD(m_buffer), MEM_DECOMMIT);
+#endif
     VirtualFree(m_buffer, 0, MEM_RELEASE);
 #else
     fastFree(m_buffer);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
index 51ada03..12e2a32 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
@@ -180,7 +180,7 @@ public:
     static void cacheFlush(void*, size_t)
     {
     }
-#elif PLATFORM_ARM_ARCH(7) && PLATFORM(IPHONE)
+#elif PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)
     static void cacheFlush(void* code, size_t size)
     {
         sys_dcache_flush(code, size);
@@ -191,24 +191,29 @@ public:
     {
         User::IMB_Range(code, static_cast<char*>(code) + size);
     }
-#elif PLATFORM(ARM)
+#elif PLATFORM(ARM) && COMPILER(GCC) && (GCC_VERSION >= 30406) && !defined(DISABLE_BUILTIN_CLEAR_CACHE)
     static void cacheFlush(void* code, size_t size)
     {
-    #if COMPILER(GCC) && (GCC_VERSION >= 30406)
         __clear_cache(reinterpret_cast<char*>(code), reinterpret_cast<char*>(code) + size);
-    #else
-        const int syscall = 0xf0002;
-        __asm __volatile (
-               "mov     r0, %0\n"
-               "mov     r1, %1\n"
-               "mov     r7, %2\n"
-               "mov     r2, #0x0\n"
-               "swi     0x00000000\n"
-           :
-           :   "r" (code), "r" (reinterpret_cast<char*>(code) + size), "r" (syscall)
-           :   "r0", "r1", "r7");
-    #endif // COMPILER(GCC) && (GCC_VERSION >= 30406)
     }
+#elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX)
+    static void cacheFlush(void* code, size_t size)
+    {
+        asm volatile (
+            "push    {r7}\n"
+            "mov     r0, %0\n"
+            "mov     r1, %1\n"
+            "mov     r7, #0xf0000\n"
+            "add     r7, r7, #0x2\n"
+            "mov     r2, #0x0\n"
+            "svc     0x0\n"
+            "pop     {r7}\n"
+            :
+            : "r" (code), "r" (reinterpret_cast<char*>(code) + size)
+            : "r0", "r1");
+    }
+#else
+    #error "The cacheFlush support is missing on this platform."
 #endif
 
 private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
index f7ac20e..5c58e9d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
@@ -226,7 +226,7 @@ namespace JSC {
         static const FPRegisterID fpRegT0 = X86Registers::xmm0;
         static const FPRegisterID fpRegT1 = X86Registers::xmm1;
         static const FPRegisterID fpRegT2 = X86Registers::xmm2;
-#elif PLATFORM_ARM_ARCH(7)
+#elif PLATFORM(ARM_THUMB2)
         static const RegisterID returnValueRegister = ARMRegisters::r0;
         static const RegisterID cachedResultRegister = ARMRegisters::r0;
         static const RegisterID firstArgumentRegister = ARMRegisters::r0;
@@ -242,7 +242,7 @@ namespace JSC {
         static const FPRegisterID fpRegT0 = ARMRegisters::d0;
         static const FPRegisterID fpRegT1 = ARMRegisters::d1;
         static const FPRegisterID fpRegT2 = ARMRegisters::d2;
-#elif PLATFORM(ARM)
+#elif PLATFORM(ARM_TRADITIONAL)
         static const RegisterID returnValueRegister = ARMRegisters::r0;
         static const RegisterID cachedResultRegister = ARMRegisters::r0;
         static const RegisterID firstArgumentRegister = ARMRegisters::r0;
@@ -571,7 +571,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 11;
         static const int patchOffsetMethodCheckProtoStruct = 18;
         static const int patchOffsetMethodCheckPutFunction = 29;
-#elif PLATFORM_ARM_ARCH(7)
+#elif PLATFORM(ARM_THUMB2)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
         static const int patchOffsetPutByIdExternalLoad = 20;
@@ -594,7 +594,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 18;
         static const int patchOffsetMethodCheckProtoStruct = 28;
         static const int patchOffsetMethodCheckPutFunction = 46;
-#elif PLATFORM(ARM)
+#elif PLATFORM(ARM_TRADITIONAL)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 4;
         static const int patchOffsetPutByIdExternalLoad = 16;
@@ -620,7 +620,7 @@ namespace JSC {
 #endif
 #endif // USE(JSVALUE32_64)
 
-#if PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_TRADITIONAL)
         // sequenceOpCall
         static const int sequenceOpCallInstructionSpace = 12;
         static const int sequenceOpCallConstantSpace = 2;
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
index 60c9658..e69e273 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
@@ -110,7 +110,7 @@ ALWAYS_INLINE JIT::Call JIT::emitNakedCall(CodePtr function)
 
 ALWAYS_INLINE void JIT::beginUninterruptedSequence(int insnSpace, int constSpace)
 {
-#if PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_TRADITIONAL)
 #ifndef NDEBUG
     // Ensure the label after the sequence can also fit
     insnSpace += sizeof(ARMWord);
@@ -139,38 +139,38 @@ ALWAYS_INLINE void JIT::endUninterruptedSequence(int insnSpace, int constSpace)
 
 #endif
 
-#if PLATFORM(X86) || PLATFORM(X86_64) || (PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7))
+#if PLATFORM(ARM_THUMB2)
 
 ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
 {
-    pop(reg);
+    move(linkRegister, reg);
 }
 
 ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(RegisterID reg)
 {
-    push(reg);
+    move(reg, linkRegister);
 }
 
 ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
 {
-    push(address);
+    loadPtr(address, linkRegister);
 }
 
-#elif PLATFORM_ARM_ARCH(7)
+#else // PLATFORM(X86) || PLATFORM(X86_64) || PLATFORM(ARM_TRADITIONAL)
 
 ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
 {
-    move(linkRegister, reg);
+    pop(reg);
 }
 
 ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(RegisterID reg)
 {
-    move(reg, linkRegister);
+    push(reg);
 }
 
 ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
 {
-    loadPtr(address, linkRegister);
+    push(address);
 }
 
 #endif
@@ -186,7 +186,7 @@ ALWAYS_INLINE void JIT::restoreArgumentReference()
 {
     move(stackPointerRegister, firstArgumentRegister);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
-#if PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_TRADITIONAL)
     move(ctiReturnRegister, ARMRegisters::lr);
 #endif
 }
@@ -195,7 +195,7 @@ ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
 #if PLATFORM(X86)
     // Within a trampoline the return address will be on the stack at this point.
     addPtr(Imm32(sizeof(void*)), stackPointerRegister, firstArgumentRegister);
-#elif PLATFORM_ARM_ARCH(7)
+#elif PLATFORM(ARM_THUMB2)
     move(stackPointerRegister, firstArgumentRegister);
 #endif
     // In the trampoline on x86-64, the first argument register is not overwritten.
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
index 1c9cd7e..28d630b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
@@ -1681,7 +1681,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // so pull them off now
     addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
 
-#elif PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
+#elif PLATFORM(ARM_TRADITIONAL)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
 
     // Allocate stack space for our arglist
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
index 4ab58d5..055a536 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
@@ -69,6 +69,12 @@ namespace JSC {
 #define SYMBOL_STRING(name) #name
 #endif
 
+#if PLATFORM(IPHONE)
+#define THUMB_FUNC_PARAM(name) SYMBOL_STRING(name)
+#else
+#define THUMB_FUNC_PARAM(name)
+#endif
+
 #if USE(JSVALUE32_64)
 
 #if COMPILER(GCC) && PLATFORM(X86)
@@ -193,7 +199,7 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
 
-#elif COMPILER(GCC) && PLATFORM_ARM_ARCH(7)
+#elif COMPILER(GCC) && PLATFORM(ARM_THUMB2)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on ARMv7."
@@ -204,7 +210,7 @@ asm volatile (
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
 ".thumb" "\n"
-".thumb_func " SYMBOL_STRING(ctiTrampoline) "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "sub sp, sp, #0x3c" "\n"
     "str lr, [sp, #0x20]" "\n"
@@ -230,7 +236,7 @@ asm volatile (
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
 ".thumb" "\n"
-".thumb_func " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "cpy r0, sp" "\n"
     "bl " SYMBOL_STRING(cti_vm_throw) "\n"
@@ -247,7 +253,7 @@ asm volatile (
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
 ".thumb" "\n"
-".thumb_func " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ldr r6, [sp, #0x2c]" "\n"
     "ldr r5, [sp, #0x28]" "\n"
@@ -452,7 +458,7 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
 
-#elif COMPILER(GCC) && PLATFORM_ARM_ARCH(7)
+#elif COMPILER(GCC) && PLATFORM(ARM_THUMB2)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on ARMv7."
@@ -463,9 +469,9 @@ asm volatile (
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
 ".thumb" "\n"
-".thumb_func " SYMBOL_STRING(ctiTrampoline) "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "sub sp, sp, #0x3c" "\n"
+    "sub sp, sp, #0x40" "\n"
     "str lr, [sp, #0x20]" "\n"
     "str r4, [sp, #0x24]" "\n"
     "str r5, [sp, #0x28]" "\n"
@@ -480,7 +486,7 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "ldr r5, [sp, #0x28]" "\n"
     "ldr r4, [sp, #0x24]" "\n"
     "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
+    "add sp, sp, #0x40" "\n"
     "bx lr" "\n"
 );
 
@@ -489,7 +495,7 @@ asm volatile (
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
 ".thumb" "\n"
-".thumb_func " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "cpy r0, sp" "\n"
     "bl " SYMBOL_STRING(cti_vm_throw) "\n"
@@ -497,7 +503,7 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "ldr r5, [sp, #0x28]" "\n"
     "ldr r4, [sp, #0x24]" "\n"
     "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
+    "add sp, sp, #0x40" "\n"
     "bx lr" "\n"
 );
 
@@ -506,7 +512,7 @@ asm volatile (
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
 ".thumb" "\n"
-".thumb_func " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ldr r6, [sp, #0x2c]" "\n"
     "ldr r5, [sp, #0x28]" "\n"
@@ -516,7 +522,7 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "bx lr" "\n"
 );
 
-#elif COMPILER(GCC) && PLATFORM(ARM)
+#elif COMPILER(GCC) && PLATFORM(ARM_TRADITIONAL)
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
@@ -636,7 +642,7 @@ JITThunks::JITThunks(JSGlobalData* globalData)
 {
     JIT::compileCTIMachineTrampolines(globalData, &m_executablePool, &m_ctiStringLengthTrampoline, &m_ctiVirtualCallLink, &m_ctiVirtualCall, &m_ctiNativeCallThunk);
 
-#if PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_THUMB2)
     // Unfortunate the arm compiler does not like the use of offsetof on JITStackFrame (since it contains non POD types),
     // and the OBJECT_OFFSETOF macro does not appear constantish enough for it to be happy with its use in COMPILE_ASSERT
     // macros.
@@ -649,7 +655,7 @@ JITThunks::JITThunks(JSGlobalData* globalData)
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, callFrame) == 0x34);
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, exception) == 0x38);
     // The fifth argument is the first item already on the stack.
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, enabledProfilerReference) == 0x3c);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, enabledProfilerReference) == 0x40);
 
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, thunkReturnAddress) == 0x1C);
 #endif
@@ -673,7 +679,7 @@ NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* co
     JSCell* baseCell = asCell(baseValue);
     Structure* structure = baseCell->structure();
 
-    if (structure->isDictionary()) {
+    if (structure->isUncacheableDictionary()) {
         ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_put_by_id_generic));
         return;
     }
@@ -689,7 +695,7 @@ NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* co
     // Structure transition, cache transition info
     if (slot.type() == PutPropertySlot::NewProperty) {
         StructureChain* prototypeChain = structure->prototypeChain(callFrame);
-        if (!prototypeChain->isCacheable()) {
+        if (!prototypeChain->isCacheable() || structure->isDictionary()) {
             ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_put_by_id_generic));
             return;
         }
@@ -737,7 +743,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
     JSCell* baseCell = asCell(baseValue);
     Structure* structure = baseCell->structure();
 
-    if (structure->isDictionary()) {
+    if (structure->isUncacheableDictionary()) {
         ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_generic));
         return;
     }
@@ -876,7 +882,7 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         } \
     } while (0)
 
-#if PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_THUMB2)
 
 #define DEFINE_STUB_FUNCTION(rtype, op) \
     extern "C" { \
@@ -887,7 +893,7 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         ".align 2" "\n" \
         ".globl " SYMBOL_STRING(cti_##op) "\n" \
         ".thumb" "\n" \
-        ".thumb_func " SYMBOL_STRING(cti_##op) "\n" \
+        ".thumb_func " THUMB_FUNC_PARAM(cti_##op) "\n" \
         SYMBOL_STRING(cti_##op) ":" "\n" \
         "str lr, [sp, #0x1c]" "\n" \
         "bl " SYMBOL_STRING(JITStubThunked_##op) "\n" \
@@ -1148,7 +1154,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
     JSObject* slotBaseObject;
     if (baseValue.isCell()
         && slot.isCacheable()
-        && !(structure = asCell(baseValue)->structure())->isDictionary()
+        && !(structure = asCell(baseValue)->structure())->isUncacheableDictionary()
         && (slotBaseObject = asObject(slot.slotBase()))->getPropertySpecificValue(callFrame, ident, specific)
         && specific
         ) {
@@ -1222,7 +1228,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
 
     if (baseValue.isCell()
         && slot.isCacheable()
-        && !asCell(baseValue)->structure()->isDictionary()
+        && !asCell(baseValue)->structure()->isUncacheableDictionary()
         && slot.slotBase() == baseValue) {
 
         CodeBlock* codeBlock = callFrame->codeBlock();
@@ -1293,7 +1299,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 
     CHECK_FOR_EXCEPTION();
 
-    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isDictionary()) {
+    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isUncacheableDictionary()) {
         ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
         return JSValue::encode(result);
     }
@@ -2182,7 +2188,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_global)
     PropertySlot slot(globalObject);
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isDictionary() && slot.slotBase() == globalObject) {
+        if (slot.isCacheable() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
             GlobalResolveInfo& globalResolveInfo = callFrame->codeBlock()->globalResolveInfo(globalResolveInfoIndex);
             if (globalResolveInfo.structure)
                 globalResolveInfo.structure->deref();
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
index 1dbdeaa..46973ee 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
@@ -129,7 +129,7 @@ namespace JSC {
 #if COMPILER(MSVC)
 #pragma pack(pop)
 #endif // COMPILER(MSVC)
-#elif PLATFORM_ARM_ARCH(7)
+#elif PLATFORM(ARM_THUMB2)
     struct JITStackFrame {
         void* reserved; // Unused
         JITStubArg args[6];
@@ -149,13 +149,15 @@ namespace JSC {
         CallFrame* callFrame;
         JSValue* exception;
 
+        void* padding2;
+
         // These arguments passed on the stack.
         Profiler** enabledProfilerReference;
         JSGlobalData* globalData;
         
         ReturnAddressPtr* returnAddressSlot() { return &thunkReturnAddress; }
     };
-#elif PLATFORM(ARM)
+#elif PLATFORM(ARM_TRADITIONAL)
     struct JITStackFrame {
         JITStubArg padding; // Unused
         JITStubArg args[7];
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
index 14a398a..3bd318a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
@@ -1886,10 +1886,6 @@ ScopeNode::ScopeNode(JSGlobalData* globalData)
     , ParserArenaRefCounted(globalData)
     , m_features(NoFeatures)
 {
-#if ENABLE(CODEBLOCK_SAMPLING)
-    if (SamplingTool* sampler = globalData->interpreter->sampler())
-        sampler->notifyOfScope(this);
-#endif
 }
 
 ScopeNode::ScopeNode(JSGlobalData* globalData, const SourceCode& source, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, CodeFeatures features, int numConstants)
@@ -1899,10 +1895,6 @@ ScopeNode::ScopeNode(JSGlobalData* globalData, const SourceCode& source, SourceE
     , m_features(features)
     , m_source(source)
 {
-#if ENABLE(CODEBLOCK_SAMPLING)
-    if (SamplingTool* sampler = globalData->interpreter->sampler())
-        sampler->notifyOfScope(this);
-#endif
 }
 
 inline void ScopeNode::emitStatementsBytecode(BytecodeGenerator& generator, RegisterID* dst)
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/SourceCode.h b/src/3rdparty/webkit/JavaScriptCore/parser/SourceCode.h
index 84360b8..9ba4da3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/SourceCode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/SourceCode.h
@@ -37,7 +37,8 @@ namespace JSC {
     class SourceCode {
     public:
         SourceCode()
-            : m_startChar(0)
+            : m_provider(0)
+            , m_startChar(0)
             , m_endChar(0)
             , m_firstLine(0)
         {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h b/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
index b9f738f..929a5e7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
@@ -38,7 +38,7 @@ namespace JSC {
             : m_object(object)
         {
             if (!m_object->structure()->isDictionary())
-                m_object->setStructure(Structure::toDictionaryTransition(m_object->structure()));
+                m_object->setStructure(Structure::toCacheableDictionaryTransition(m_object->structure()));
         }
 
         ~BatchedTransitionOptimizer()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
index 8493d73..abe5038 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
@@ -39,6 +39,9 @@
     macro(compile) \
     macro(configurable) \
     macro(constructor) \
+    macro(create) \
+    macro(defineProperty) \
+    macro(defineProperties) \
     macro(enumerable) \
     macro(eval) \
     macro(exec) \
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
index f36de54..ec3e000 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
@@ -37,7 +37,7 @@ Completion checkSyntax(ExecState* exec, const SourceCode& source)
 {
     JSLock lock(exec);
 
-    ProgramExecutable program(source);
+    ProgramExecutable program(exec, source);
     JSObject* error = program.checkSyntax(exec);
     if (error)
         return Completion(Throw, error);
@@ -49,7 +49,7 @@ Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& s
 {
     JSLock lock(exec);
 
-    ProgramExecutable program(source);
+    ProgramExecutable program(exec, source);
     JSObject* error = program.compile(exec, scopeChain.node());
     if (error)
         return Completion(Throw, error);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp
index 5e79794..7586746 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp
@@ -259,7 +259,7 @@ PassRefPtr<FunctionExecutable> FunctionExecutable::fromGlobalCode(const Identifi
 
     FunctionBodyNode* body = static_cast<FuncExprNode*>(funcExpr)->body();
     ASSERT(body);
-    return FunctionExecutable::create(functionName, body->source(), body->usesArguments(), body->parameters(), body->lineNo(), body->lastLine());
+    return FunctionExecutable::create(&exec->globalData(), functionName, body->source(), body->usesArguments(), body->parameters(), body->lineNo(), body->lastLine());
 }
 
 UString FunctionExecutable::paramString() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.h
index d437d46..9728775 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.h
@@ -27,7 +27,9 @@
 #define Executable_h
 
 #include "JSFunction.h"
+#include "Interpreter.h"
 #include "Nodes.h"
+#include "SamplingTool.h"
 
 namespace JSC {
 
@@ -102,11 +104,30 @@ namespace JSC {
 
     class ScriptExecutable : public ExecutableBase {
     public:
-        ScriptExecutable(const SourceCode& source)
+        ScriptExecutable(JSGlobalData* globalData, const SourceCode& source)
             : ExecutableBase(NUM_PARAMETERS_NOT_COMPILED)
             , m_source(source)
             , m_features(0)
         {
+#if ENABLE(CODEBLOCK_SAMPLING)
+            if (SamplingTool* sampler = globalData->interpreter->sampler())
+                sampler->notifyOfScope(this);
+#else
+            UNUSED_PARAM(globalData);
+#endif
+        }
+
+        ScriptExecutable(ExecState* exec, const SourceCode& source)
+            : ExecutableBase(NUM_PARAMETERS_NOT_COMPILED)
+            , m_source(source)
+            , m_features(0)
+        {
+#if ENABLE(CODEBLOCK_SAMPLING)
+            if (SamplingTool* sampler = exec->globalData().interpreter->sampler())
+                sampler->notifyOfScope(this);
+#else
+            UNUSED_PARAM(exec);
+#endif
         }
 
         const SourceCode& source() { return m_source; }
@@ -137,8 +158,8 @@ namespace JSC {
 
     class EvalExecutable : public ScriptExecutable {
     public:
-        EvalExecutable(const SourceCode& source)
-            : ScriptExecutable(source)
+        EvalExecutable(ExecState* exec, const SourceCode& source)
+            : ScriptExecutable(exec, source)
             , m_evalCodeBlock(0)
         {
         }
@@ -157,7 +178,7 @@ namespace JSC {
         JSObject* compile(ExecState*, ScopeChainNode*);
 
         ExceptionInfo* reparseExceptionInfo(JSGlobalData*, ScopeChainNode*, CodeBlock*);
-        static PassRefPtr<EvalExecutable> create(const SourceCode& source) { return adoptRef(new EvalExecutable(source)); }
+        static PassRefPtr<EvalExecutable> create(ExecState* exec, const SourceCode& source) { return adoptRef(new EvalExecutable(exec, source)); }
 
     private:
         EvalCodeBlock* m_evalCodeBlock;
@@ -178,8 +199,8 @@ namespace JSC {
 
     class ProgramExecutable : public ScriptExecutable {
     public:
-        ProgramExecutable(const SourceCode& source)
-            : ScriptExecutable(source)
+        ProgramExecutable(ExecState* exec, const SourceCode& source)
+            : ScriptExecutable(exec, source)
             , m_programCodeBlock(0)
         {
         }
@@ -221,9 +242,14 @@ namespace JSC {
     class FunctionExecutable : public ScriptExecutable {
         friend class JIT;
     public:
-        static PassRefPtr<FunctionExecutable> create(const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
+        static PassRefPtr<FunctionExecutable> create(ExecState* exec, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
+        {
+            return adoptRef(new FunctionExecutable(exec, name, source, forceUsesArguments, parameters, firstLine, lastLine));
+        }
+
+        static PassRefPtr<FunctionExecutable> create(JSGlobalData* globalData, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
         {
-            return adoptRef(new FunctionExecutable(name, source, forceUsesArguments, parameters, firstLine, lastLine));
+            return adoptRef(new FunctionExecutable(globalData, name, source, forceUsesArguments, parameters, firstLine, lastLine));
         }
 
         ~FunctionExecutable();
@@ -263,8 +289,20 @@ namespace JSC {
         static PassRefPtr<FunctionExecutable> fromGlobalCode(const Identifier&, ExecState*, Debugger*, const SourceCode&, int* errLine = 0, UString* errMsg = 0);
 
     private:
-        FunctionExecutable(const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
-            : ScriptExecutable(source)
+        FunctionExecutable(JSGlobalData* globalData, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
+            : ScriptExecutable(globalData, source)
+            , m_forceUsesArguments(forceUsesArguments)
+            , m_parameters(parameters)
+            , m_codeBlock(0)
+            , m_name(name)
+            , m_numVariables(0)
+        {
+            m_firstLine = firstLine;
+            m_lastLine = lastLine;
+        }
+
+        FunctionExecutable(ExecState* exec, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
+            : ScriptExecutable(exec, source)
             , m_forceUsesArguments(forceUsesArguments)
             , m_parameters(parameters)
             , m_codeBlock(0)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
index 1fcca81..101f543 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
@@ -223,7 +223,7 @@ bool JSArray::getOwnPropertySlot(ExecState* exec, unsigned i, PropertySlot& slot
         }
     }
 
-    return false;
+    return JSObject::getOwnPropertySlot(exec, Identifier::from(exec, i), slot);
 }
 
 bool JSArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
index 3a1909d..8d71ac3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -175,18 +175,18 @@ void JSGlobalObject::putWithAttributes(ExecState* exec, const Identifier& proper
     }
 }
 
-void JSGlobalObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunc)
+void JSGlobalObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunc, unsigned attributes)
 {
     PropertySlot slot;
     if (!symbolTableGet(propertyName, slot))
-        JSVariableObject::defineGetter(exec, propertyName, getterFunc);
+        JSVariableObject::defineGetter(exec, propertyName, getterFunc, attributes);
 }
 
-void JSGlobalObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunc)
+void JSGlobalObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunc, unsigned attributes)
 {
     PropertySlot slot;
     if (!symbolTableGet(propertyName, slot))
-        JSVariableObject::defineSetter(exec, propertyName, setterFunc);
+        JSVariableObject::defineSetter(exec, propertyName, setterFunc, attributes);
 }
 
 static inline JSObject* lastInPrototypeChain(JSObject* object)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
index d1150cc..5f7137f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
@@ -175,8 +175,8 @@ namespace JSC {
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
         virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes);
 
-        virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunc);
-        virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunc);
+        virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunc, unsigned attributes);
+        virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunc, unsigned attributes);
 
         // Linked list of all global objects that use the same JSGlobalData.
         JSGlobalObject*& head() { return d()->globalData->head; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index b11070f..5ded370 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -286,7 +286,7 @@ JSValue JSC_HOST_CALL globalFuncEval(ExecState* exec, JSObject* function, JSValu
     if (JSValue parsedObject = preparser.tryLiteralParse())
         return parsedObject;
 
-    EvalExecutable eval(makeSource(s));
+    EvalExecutable eval(exec, makeSource(s));
     JSObject* error = eval.compile(exec, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain().node());
     if (error)
         return throwError(exec, error);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
index f910603..74af4b1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
@@ -275,7 +275,7 @@ const HashEntry* JSObject::findPropertyHashEntry(ExecState* exec, const Identifi
     return 0;
 }
 
-void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     JSValue object = getDirect(propertyName);
     if (object && object.isGetterSetter()) {
@@ -286,7 +286,7 @@ void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSO
 
     PutPropertySlot slot;
     GetterSetter* getterSetter = new (exec) GetterSetter(exec);
-    putDirectInternal(exec->globalData(), propertyName, getterSetter, Getter, true, slot);
+    putDirectInternal(exec->globalData(), propertyName, getterSetter, attributes | Getter, true, slot);
 
     // putDirect will change our Structure if we add a new property. For
     // getters and setters, though, we also need to change our Structure
@@ -302,7 +302,7 @@ void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSO
     getterSetter->setGetter(getterFunction);
 }
 
-void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
 {
     JSValue object = getDirect(propertyName);
     if (object && object.isGetterSetter()) {
@@ -313,7 +313,7 @@ void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSO
 
     PutPropertySlot slot;
     GetterSetter* getterSetter = new (exec) GetterSetter(exec);
-    putDirectInternal(exec->globalData(), propertyName, getterSetter, Setter, true, slot);
+    putDirectInternal(exec->globalData(), propertyName, getterSetter, attributes | Setter, true, slot);
 
     // putDirect will change our Structure if we add a new property. For
     // getters and setters, though, we also need to change our Structure
@@ -471,7 +471,7 @@ JSObject* JSObject::unwrappedObject()
 void JSObject::removeDirect(const Identifier& propertyName)
 {
     size_t offset;
-    if (m_structure->isDictionary()) {
+    if (m_structure->isUncacheableDictionary()) {
         offset = m_structure->removePropertyWithoutTransition(propertyName);
         if (offset != WTF::notFound)
             putDirectOffset(offset, jsUndefined());
@@ -541,4 +541,131 @@ bool JSObject::getPropertyDescriptor(ExecState* exec, const Identifier& property
         object = asObject(prototype);
     }
 }
+
+static bool putDescriptor(ExecState* exec, JSObject* target, const Identifier& propertyName, PropertyDescriptor& descriptor, unsigned attributes, JSValue oldValue)
+{
+    if (descriptor.isGenericDescriptor() || descriptor.isDataDescriptor()) {
+        target->putWithAttributes(exec, propertyName, descriptor.value() ? descriptor.value() : oldValue, attributes & ~(Getter | Setter));
+        return true;
+    }
+    attributes &= ~ReadOnly;
+    if (descriptor.getter() && descriptor.getter().isObject())
+        target->defineGetter(exec, propertyName, asObject(descriptor.getter()), attributes);
+    if (exec->hadException())
+        return false;
+    if (descriptor.setter() && descriptor.setter().isObject())
+        target->defineSetter(exec, propertyName, asObject(descriptor.setter()), attributes);
+    return !exec->hadException();
+}
+
+bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool throwException)
+{
+    // If we have a new property we can just put it on normally
+    PropertyDescriptor current;
+    if (!getOwnPropertyDescriptor(exec, propertyName, current))
+        return putDescriptor(exec, this, propertyName, descriptor, descriptor.attributes(), jsUndefined());
+
+    if (descriptor.isEmpty())
+        return true;
+
+    if (current.equalTo(descriptor))
+        return true;
+
+    // Filter out invalid changes
+    if (!current.configurable()) {
+        if (descriptor.configurable()) {
+            if (throwException)
+                throwError(exec, TypeError, "Attempting to configurable attribute of unconfigurable property.");
+            return false;
+        }
+        if (descriptor.enumerablePresent() && descriptor.enumerable() != current.enumerable()) {
+            if (throwException)
+                throwError(exec, TypeError, "Attempting to change enumerable attribute of unconfigurable property.");
+            return false;
+        }
+    }
+
+    // A generic descriptor is simply changing the attributes of an existing property
+    if (descriptor.isGenericDescriptor()) {
+        if (!current.attributesEqual(descriptor)) {
+            deleteProperty(exec, propertyName);
+            putDescriptor(exec, this, propertyName, descriptor, current.attributesWithOverride(descriptor), current.value());
+        }
+        return true;
+    }
+
+    // Changing between a normal property or an accessor property
+    if (descriptor.isDataDescriptor() != current.isDataDescriptor()) {
+        if (!current.configurable()) {
+            if (throwException)
+                throwError(exec, TypeError, "Attempting to change access mechanism for an unconfigurable property.");
+            return false;
+        }
+        deleteProperty(exec, propertyName);
+        return putDescriptor(exec, this, propertyName, descriptor, current.attributesWithOverride(descriptor), current.value() ? current.value() : jsUndefined());
+    }
+
+    // Changing the value and attributes of an existing property
+    if (descriptor.isDataDescriptor()) {
+        if (!current.configurable()) {
+            if (!current.writable() && descriptor.writable()) {
+                if (throwException)
+                    throwError(exec, TypeError, "Attempting to change writable attribute of unconfigurable property.");
+                return false;
+            }
+            if (!current.writable()) {
+                if (descriptor.value() || !JSValue::strictEqual(current.value(), descriptor.value())) {
+                    if (throwException)
+                        throwError(exec, TypeError, "Attempting to change value of a readonly property.");
+                    return false;
+                }
+            }
+        } else if (current.attributesEqual(descriptor)) {
+            if (!descriptor.value())
+                return true;
+            PutPropertySlot slot;
+            put(exec, propertyName, descriptor.value(), slot);
+            if (exec->hadException())
+                return false;
+            return true;
+        }
+        deleteProperty(exec, propertyName);
+        return putDescriptor(exec, this, propertyName, descriptor, current.attributesWithOverride(descriptor), current.value());
+    }
+
+    // Changing the accessor functions of an existing accessor property
+    ASSERT(descriptor.isAccessorDescriptor());
+    if (!current.configurable()) {
+        if (descriptor.setterPresent() && !(current.setter() && JSValue::strictEqual(current.setter(), descriptor.setter()))) {
+            if (throwException)
+                throwError(exec, TypeError, "Attempting to change the setter of an unconfigurable property.");
+            return false;
+        }
+        if (descriptor.getterPresent() && !(current.getter() && JSValue::strictEqual(current.getter(), descriptor.getter()))) {
+            if (throwException)
+                throwError(exec, TypeError, "Attempting to change the getter of an unconfigurable property.");
+            return false;
+        }
+    }
+    JSValue accessor = getDirect(propertyName);
+    if (!accessor)
+        return false;
+    GetterSetter* getterSetter = asGetterSetter(accessor);
+    if (current.attributesEqual(descriptor)) {
+        if (descriptor.setter())
+            getterSetter->setSetter(asObject(descriptor.setter()));
+        if (descriptor.getter())
+            getterSetter->setGetter(asObject(descriptor.getter()));
+        return true;
+    }
+    deleteProperty(exec, propertyName);
+    unsigned attrs = current.attributesWithOverride(descriptor);
+    if (descriptor.setter())
+        attrs |= Setter;
+    if (descriptor.getter())
+        attrs |= Getter;
+    putDirect(propertyName, getterSetter, attrs);
+    return true;
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
index bdc949b..3fd1e3c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
@@ -186,10 +186,11 @@ namespace JSC {
 
         void fillGetterPropertySlot(PropertySlot&, JSValue* location);
 
-        virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction);
-        virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction);
+        virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes = 0);
+        virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes = 0);
         virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
         virtual JSValue lookupSetter(ExecState*, const Identifier& propertyName);
+        virtual bool defineOwnProperty(ExecState*, const Identifier& propertyName, PropertyDescriptor&, bool shouldThrow);
 
         virtual bool isGlobalObject() const { return false; }
         virtual bool isVariableObject() const { return false; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
index 8e78ff3..43f8b29 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
@@ -29,22 +29,44 @@
 #include "MarkStack.h"
 
 #include <unistd.h>
+#if defined (__SYMBIAN32__)
+#include "wtf/FastMalloc.h"
+#include <e32base.h>
+#include <e32std.h>
+#include <e32hal.h>
+#include <hal.h>
+#else
 #include <sys/mman.h>
+#endif
 
 namespace JSC {
 
 void MarkStack::initializePagesize()
 {
+#if defined (__SYMBIAN32__)
+    TInt page_size;
+    UserHal::PageSizeInBytes(page_size);
+    MarkStack::s_pageSize = page_size;
+#else
     MarkStack::s_pageSize = getpagesize();
+#endif
 }
 
 void* MarkStack::allocateStack(size_t size)
 {
+#if defined (__SYMBIAN32__)
+    return fastMalloc(size);
+#else
     return mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
+#endif
 }
 void MarkStack::releaseStack(void* addr, size_t size)
 {
+#if defined (__SYMBIAN32__)
+    fastFree(addr);
+#else
     munmap(addr, size);
+#endif
 }
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
index fd45c45..2992f1b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -37,6 +37,9 @@ ASSERT_CLASS_FITS_IN_CELL(ObjectConstructor);
 static JSValue JSC_HOST_CALL objectConstructorGetPrototypeOf(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL objectConstructorKeys(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectConstructorDefineProperty(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectConstructorDefineProperties(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectConstructorCreate(ExecState*, JSObject*, JSValue, const ArgList&);
 
 ObjectConstructor::ObjectConstructor(ExecState* exec, PassRefPtr<Structure> structure, ObjectPrototype* objectPrototype, Structure* prototypeFunctionStructure)
 : InternalFunction(&exec->globalData(), structure, Identifier(exec, "Object"))
@@ -50,6 +53,9 @@ ObjectConstructor::ObjectConstructor(ExecState* exec, PassRefPtr<Structure> stru
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().getPrototypeOf, objectConstructorGetPrototypeOf), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().getOwnPropertyDescriptor, objectConstructorGetOwnPropertyDescriptor), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().keys, objectConstructorKeys), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 3, exec->propertyNames().defineProperty, objectConstructorDefineProperty), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().defineProperties, objectConstructorDefineProperties), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().create, objectConstructorCreate), DontEnum);
 }
 
 // ECMA 15.2.2
@@ -103,15 +109,14 @@ JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState* exec,
         return jsUndefined();
     if (exec->hadException())
         return jsUndefined();
-    ASSERT(descriptor.isValid());
 
     JSObject* description = constructEmptyObject(exec);
-    if (!descriptor.hasAccessors()) {
-        description->putDirect(exec->propertyNames().value, descriptor.value(), 0);
+    if (!descriptor.isAccessorDescriptor()) {
+        description->putDirect(exec->propertyNames().value, descriptor.value() ? descriptor.value() : jsUndefined(), 0);
         description->putDirect(exec->propertyNames().writable, jsBoolean(descriptor.writable()), 0);
     } else {
-        description->putDirect(exec->propertyNames().get, descriptor.getter(), 0);
-        description->putDirect(exec->propertyNames().set, descriptor.setter(), 0);
+        description->putDirect(exec->propertyNames().get, descriptor.getter() ? descriptor.getter() : jsUndefined(), 0);
+        description->putDirect(exec->propertyNames().set, descriptor.setter() ? descriptor.setter() : jsUndefined(), 0);
     }
     
     description->putDirect(exec->propertyNames().enumerable, jsBoolean(descriptor.enumerable()), 0);
@@ -133,4 +138,163 @@ JSValue JSC_HOST_CALL objectConstructorKeys(ExecState* exec, JSObject*, JSValue,
     return keys;
 }
 
+// ES5 8.10.5 ToPropertyDescriptor
+static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor& desc)
+{
+    if (!in.isObject()) {
+        throwError(exec, TypeError, "Property description must be an object.");
+        return false;
+    }
+    JSObject* description = asObject(in);
+
+    PropertySlot enumerableSlot;
+    if (description->getPropertySlot(exec, exec->propertyNames().enumerable, enumerableSlot)) {
+        desc.setEnumerable(enumerableSlot.getValue(exec, exec->propertyNames().enumerable).toBoolean(exec));
+        if (exec->hadException())
+            return false;
+    }
+
+    PropertySlot configurableSlot;
+    if (description->getPropertySlot(exec, exec->propertyNames().configurable, configurableSlot)) {
+        desc.setConfigurable(configurableSlot.getValue(exec, exec->propertyNames().configurable).toBoolean(exec));
+        if (exec->hadException())
+            return false;
+    }
+
+    JSValue value;
+    PropertySlot valueSlot;
+    if (description->getPropertySlot(exec, exec->propertyNames().value, valueSlot)) {
+        desc.setValue(valueSlot.getValue(exec, exec->propertyNames().value));
+        if (exec->hadException())
+            return false;
+    }
+
+    PropertySlot writableSlot;
+    if (description->getPropertySlot(exec, exec->propertyNames().writable, writableSlot)) {
+        desc.setWritable(writableSlot.getValue(exec, exec->propertyNames().writable).toBoolean(exec));
+        if (exec->hadException())
+            return false;
+    }
+
+    PropertySlot getSlot;
+    if (description->getPropertySlot(exec, exec->propertyNames().get, getSlot)) {
+        JSValue get = getSlot.getValue(exec, exec->propertyNames().get);
+        if (exec->hadException())
+            return false;
+        if (!get.isUndefined()) {
+            CallData callData;
+            if (get.getCallData(callData) == CallTypeNone) {
+                throwError(exec, TypeError, "Getter must be a function.");
+                return false;
+            }
+        } else
+            get = JSValue();
+        desc.setGetter(get);
+    }
+
+    PropertySlot setSlot;
+    if (description->getPropertySlot(exec, exec->propertyNames().set, setSlot)) {
+        JSValue set = setSlot.getValue(exec, exec->propertyNames().set);
+        if (exec->hadException())
+            return false;
+        if (!set.isUndefined()) {
+            CallData callData;
+            if (set.getCallData(callData) == CallTypeNone) {
+                throwError(exec, TypeError, "Setter must be a function.");
+                return false;
+            }
+        } else
+            set = JSValue();
+
+        desc.setSetter(set);
+    }
+
+    if (!desc.isAccessorDescriptor())
+        return true;
+
+    if (desc.value()) {
+        throwError(exec, TypeError, "Invalid property.  'value' present on property with getter or setter.");
+        return false;
+    }
+
+    if (desc.writablePresent()) {
+        throwError(exec, TypeError, "Invalid property.  'writable' present on property with getter or setter.");
+        return false;
+    }
+    return true;
+}
+
+JSValue JSC_HOST_CALL objectConstructorDefineProperty(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError, "Properties can only be defined on Objects.");
+    JSObject* O = asObject(args.at(0));
+    UString propertyName = args.at(1).toString(exec);
+    if (exec->hadException())
+        return jsNull();
+    PropertyDescriptor descriptor;
+    if (!toPropertyDescriptor(exec, args.at(2), descriptor))
+        return jsNull();
+    ASSERT((descriptor.attributes() & (Getter | Setter)) || (!descriptor.isAccessorDescriptor()));
+    ASSERT(!exec->hadException());
+    O->defineOwnProperty(exec, Identifier(exec, propertyName), descriptor, true);
+    return O;
+}
+
+static JSValue defineProperties(ExecState* exec, JSObject* object, JSObject* properties)
+{
+    PropertyNameArray propertyNames(exec);
+    asObject(properties)->getOwnPropertyNames(exec, propertyNames);
+    size_t numProperties = propertyNames.size();
+    Vector<PropertyDescriptor> descriptors;
+    MarkedArgumentBuffer markBuffer;
+    for (size_t i = 0; i < numProperties; i++) {
+        PropertySlot slot;
+        JSValue prop = properties->get(exec, propertyNames[i]);
+        if (exec->hadException())
+            return jsNull();
+        PropertyDescriptor descriptor;
+        if (!toPropertyDescriptor(exec, prop, descriptor))
+            return jsNull();
+        descriptors.append(descriptor);
+        // Ensure we mark all the values that we're accumulating
+        if (descriptor.isDataDescriptor() && descriptor.value())
+            markBuffer.append(descriptor.value());
+        if (descriptor.isAccessorDescriptor()) {
+            if (descriptor.getter())
+                markBuffer.append(descriptor.getter());
+            if (descriptor.setter())
+                markBuffer.append(descriptor.setter());
+        }
+    }
+    for (size_t i = 0; i < numProperties; i++) {
+        object->defineOwnProperty(exec, propertyNames[i], descriptors[i], true);
+        if (exec->hadException())
+            return jsNull();
+    }
+    return object;
+}
+
+JSValue JSC_HOST_CALL objectConstructorDefineProperties(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError, "Properties can only be defined on Objects.");
+    if (!args.at(1).isObject())
+        return throwError(exec, TypeError, "Property descriptor list must be an Object.");
+    return defineProperties(exec, asObject(args.at(0)), asObject(args.at(1)));
+}
+
+JSValue JSC_HOST_CALL objectConstructorCreate(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (!args.at(0).isObject() && !args.at(0).isNull())
+        return throwError(exec, TypeError, "Object prototype may only be an Object or null.");
+    JSObject* newObject = constructEmptyObject(exec);
+    newObject->setPrototype(args.at(0));
+    if (args.at(1).isUndefined())
+        return newObject;
+    if (!args.at(1).isObject())
+        return throwError(exec, TypeError, "Property descriptor list must be an Object.");
+    return defineProperties(exec, newObject, asObject(args.at(1)));
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp
index d892e0a..4db814f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp
@@ -30,29 +30,40 @@
 
 #include "GetterSetter.h"
 #include "JSObject.h"
+#include "Operations.h"
 
 namespace JSC {
+unsigned PropertyDescriptor::defaultAttributes = (DontDelete << 1) - 1;
+
 bool PropertyDescriptor::writable() const
 {
-    ASSERT(!hasAccessors());
+    ASSERT(!isAccessorDescriptor());
     return !(m_attributes & ReadOnly);
 }
 
 bool PropertyDescriptor::enumerable() const
 {
-    ASSERT(isValid());
     return !(m_attributes & DontEnum);
 }
 
 bool PropertyDescriptor::configurable() const
 {
-    ASSERT(isValid());
     return !(m_attributes & DontDelete);
 }
 
-bool PropertyDescriptor::hasAccessors() const
+bool PropertyDescriptor::isDataDescriptor() const
 {
-    return !!(m_attributes & (Getter | Setter));
+    return m_value || (m_seenAttributes & WritablePresent);
+}
+
+bool PropertyDescriptor::isGenericDescriptor() const
+{
+    return !isAccessorDescriptor() && !isDataDescriptor();
+}
+
+bool PropertyDescriptor::isAccessorDescriptor() const
+{
+    return m_getter || m_setter;
 }
 
 void PropertyDescriptor::setUndefined()
@@ -63,32 +74,31 @@ void PropertyDescriptor::setUndefined()
 
 JSValue PropertyDescriptor::getter() const
 {
-    ASSERT(hasAccessors());
-    if (!m_getter)
-        return jsUndefined();
+    ASSERT(isAccessorDescriptor());
     return m_getter;
 }
 
 JSValue PropertyDescriptor::setter() const
 {
-    ASSERT(hasAccessors());
-    if (!m_setter)
-        return jsUndefined();
+    ASSERT(isAccessorDescriptor());
     return m_setter;
 }
 
 void PropertyDescriptor::setDescriptor(JSValue value, unsigned attributes)
 {
     ASSERT(value);
+    m_attributes = attributes;
     if (attributes & (Getter | Setter)) {
         GetterSetter* accessor = asGetterSetter(value);
         m_getter = accessor->getter();
         m_setter = accessor->setter();
         ASSERT(m_getter || m_setter);
+        m_seenAttributes = EnumerablePresent | ConfigurablePresent;
+        m_attributes &= ~ReadOnly;
     } else {
         m_value = value;
+        m_seenAttributes = EnumerablePresent | ConfigurablePresent | WritablePresent;
     }
-    m_attributes = attributes;
 }
 
 void PropertyDescriptor::setAccessorDescriptor(JSValue getter, JSValue setter, unsigned attributes)
@@ -98,6 +108,88 @@ void PropertyDescriptor::setAccessorDescriptor(JSValue getter, JSValue setter, u
     m_attributes = attributes;
     m_getter = getter;
     m_setter = setter;
+    m_attributes &= ~ReadOnly;
+    m_seenAttributes = EnumerablePresent | ConfigurablePresent;
+}
+
+void PropertyDescriptor::setWritable(bool writable)
+{
+    if (writable)
+        m_attributes &= ~ReadOnly;
+    else
+        m_attributes |= ReadOnly;
+    m_seenAttributes |= WritablePresent;
+}
+
+void PropertyDescriptor::setEnumerable(bool enumerable)
+{
+    if (enumerable)
+        m_attributes &= ~DontEnum;
+    else
+        m_attributes |= DontEnum;
+    m_seenAttributes |= EnumerablePresent;
+}
+
+void PropertyDescriptor::setConfigurable(bool configurable)
+{
+    if (configurable)
+        m_attributes &= ~DontDelete;
+    else
+        m_attributes |= DontDelete;
+    m_seenAttributes |= ConfigurablePresent;
+}
+
+void PropertyDescriptor::setSetter(JSValue setter)
+{
+    m_setter = setter;
+    m_attributes |= Setter;
+    m_attributes &= ~ReadOnly;
+}
+
+void PropertyDescriptor::setGetter(JSValue getter)
+{
+    m_getter = getter;
+    m_attributes |= Getter;
+    m_attributes &= ~ReadOnly;
+}
+
+bool PropertyDescriptor::equalTo(const PropertyDescriptor& other) const
+{
+    if (!other.m_value == m_value ||
+        !other.m_getter == m_getter ||
+        !other.m_setter == m_setter)
+        return false;
+    return (!m_value || JSValue::strictEqual(other.m_value, m_value)) && 
+           (!m_getter || JSValue::strictEqual(other.m_getter, m_getter)) && 
+           (!m_setter || JSValue::strictEqual(other.m_setter, m_setter)) &&
+           attributesEqual(other);
+}
+
+bool PropertyDescriptor::attributesEqual(const PropertyDescriptor& other) const
+{
+    unsigned mismatch = other.m_attributes ^ m_attributes;
+    unsigned sharedSeen = other.m_seenAttributes & m_seenAttributes;
+    if (sharedSeen & WritablePresent && mismatch & ReadOnly)
+        return false;
+    if (sharedSeen & ConfigurablePresent && mismatch & DontDelete)
+        return false;
+    if (sharedSeen & EnumerablePresent && mismatch & DontEnum)
+        return false;
+    return true;
+}
+
+unsigned PropertyDescriptor::attributesWithOverride(const PropertyDescriptor& other) const
+{
+    unsigned mismatch = other.m_attributes ^ m_attributes;
+    unsigned sharedSeen = other.m_seenAttributes & m_seenAttributes;
+    unsigned newAttributes = m_attributes & defaultAttributes;
+    if (sharedSeen & WritablePresent && mismatch & ReadOnly)
+        newAttributes ^= ReadOnly;
+    if (sharedSeen & ConfigurablePresent && mismatch & DontDelete)
+        newAttributes ^= DontDelete;
+    if (sharedSeen & EnumerablePresent && mismatch & DontEnum)
+        newAttributes ^= DontEnum;
+    return newAttributes;
 }
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h
index ad7c056..40bec86 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h
@@ -32,29 +32,48 @@ namespace JSC {
     class PropertyDescriptor {
     public:
         PropertyDescriptor()
-            : m_attributes(0)
+            : m_attributes(defaultAttributes)
+            , m_seenAttributes(0)
         {
         }
         bool writable() const;
         bool enumerable() const;
         bool configurable() const;
-        bool hasAccessors() const;
+        bool isDataDescriptor() const;
+        bool isGenericDescriptor() const;
+        bool isAccessorDescriptor() const;
         unsigned attributes() const { return m_attributes; }
-#ifndef NDEBUG
-        bool isValid() const { return m_value || ((m_getter || m_setter) && hasAccessors()); }
-#endif
-        JSValue value() const { ASSERT(m_value); return m_value; }
+        JSValue value() const { return m_value; }
         JSValue getter() const;
         JSValue setter() const;
         void setUndefined();
         void setDescriptor(JSValue value, unsigned attributes);
         void setAccessorDescriptor(JSValue getter, JSValue setter, unsigned attributes);
+        void setWritable(bool);
+        void setEnumerable(bool);
+        void setConfigurable(bool);
+        void setValue(JSValue value) { m_value = value; }
+        void setSetter(JSValue);
+        void setGetter(JSValue);
+        bool isEmpty() const { return !(m_value || m_getter || m_setter || m_seenAttributes); }
+        bool writablePresent() const { return m_seenAttributes & WritablePresent; }
+        bool enumerablePresent() const { return m_seenAttributes & EnumerablePresent; }
+        bool configurablePresent() const { return m_seenAttributes & ConfigurablePresent; }
+        bool setterPresent() const { return m_setter; }
+        bool getterPresent() const { return m_getter; }
+        bool equalTo(const PropertyDescriptor& other) const;
+        bool attributesEqual(const PropertyDescriptor& other) const;
+        unsigned attributesWithOverride(const PropertyDescriptor& other) const;
     private:
+        static unsigned defaultAttributes;
+        bool operator==(const PropertyDescriptor&){ return false; }
+        enum { WritablePresent = 1, EnumerablePresent = 2, ConfigurablePresent = 4};
         // May be a getter/setter
         JSValue m_value;
         JSValue m_getter;
         JSValue m_setter;
         unsigned m_attributes;
+        unsigned m_seenAttributes;
     };
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
index 34c27b7..7209b5f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
@@ -127,7 +127,7 @@ Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
     , m_propertyTable(0)
     , m_propertyStorageCapacity(JSObject::inlineStorageCapacity)
     , m_offset(noOffset)
-    , m_isDictionary(false)
+    , m_dictionaryKind(NoneDictionaryKind)
     , m_isPinnedPropertyTable(false)
     , m_hasGetterSetterProperties(false)
     , m_attributesInPrevious(0)
@@ -290,7 +290,7 @@ void Structure::getOwnEnumerablePropertyNames(ExecState* exec, PropertyNameArray
 
 void Structure::getEnumerablePropertyNames(ExecState* exec, PropertyNameArray& propertyNames, JSObject* baseObject)
 {
-    bool shouldCache = propertyNames.shouldCache() && !(propertyNames.size() || m_isDictionary);
+    bool shouldCache = propertyNames.shouldCache() && !(propertyNames.size() || isDictionary());
 
     if (shouldCache && m_cachedPropertyNameArrayData) {
         if (m_cachedPropertyNameArrayData->cachedPrototypeChain() == prototypeChain(exec)) {
@@ -349,7 +349,7 @@ void Structure::despecifyDictionaryFunction(const Identifier& propertyName)
 
     materializePropertyMapIfNecessary();
 
-    ASSERT(m_isDictionary);
+    ASSERT(isDictionary());
     ASSERT(m_propertyTable);
 
     unsigned i = rep->computedHash();
@@ -391,7 +391,7 @@ void Structure::despecifyDictionaryFunction(const Identifier& propertyName)
 
 PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
 {
-    ASSERT(!structure->m_isDictionary);
+    ASSERT(!structure->isDictionary());
     ASSERT(structure->typeInfo().type() == ObjectType);
 
     if (Structure* existingTransition = structure->table.get(make_pair(propertyName.ustring().rep(), attributes), specificValue)) {
@@ -405,12 +405,12 @@ PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Struct
 
 PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
 {
-    ASSERT(!structure->m_isDictionary);
+    ASSERT(!structure->isDictionary());
     ASSERT(structure->typeInfo().type() == ObjectType);
     ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, specificValue, offset));
 
     if (structure->transitionCount() > s_maxTransitionLength) {
-        RefPtr<Structure> transition = toDictionaryTransition(structure);
+        RefPtr<Structure> transition = toCacheableDictionaryTransition(structure);
         ASSERT(structure != transition);
         offset = transition->put(propertyName, attributes, specificValue);
         if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
@@ -454,9 +454,9 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
 
 PassRefPtr<Structure> Structure::removePropertyTransition(Structure* structure, const Identifier& propertyName, size_t& offset)
 {
-    ASSERT(!structure->m_isDictionary);
+    ASSERT(!structure->isUncacheableDictionary());
 
-    RefPtr<Structure> transition = toDictionaryTransition(structure);
+    RefPtr<Structure> transition = toUncacheableDictionaryTransition(structure);
 
     offset = transition->remove(propertyName);
 
@@ -554,25 +554,35 @@ PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
     return transition.release();
 }
 
-PassRefPtr<Structure> Structure::toDictionaryTransition(Structure* structure)
+PassRefPtr<Structure> Structure::toDictionaryTransition(Structure* structure, DictionaryKind kind)
 {
-    ASSERT(!structure->m_isDictionary);
-
+    ASSERT(!structure->isUncacheableDictionary());
+    
     RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
-    transition->m_isDictionary = true;
+    transition->m_dictionaryKind = kind;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
-
+    
     structure->materializePropertyMapIfNecessary();
     transition->m_propertyTable = structure->copyPropertyTable();
     transition->m_isPinnedPropertyTable = true;
-
+    
     return transition.release();
 }
 
+PassRefPtr<Structure> Structure::toCacheableDictionaryTransition(Structure* structure)
+{
+    return toDictionaryTransition(structure, CachedDictionaryKind);
+}
+
+PassRefPtr<Structure> Structure::toUncacheableDictionaryTransition(Structure* structure)
+{
+    return toDictionaryTransition(structure, UncachedDictionaryKind);
+}
+
 PassRefPtr<Structure> Structure::fromDictionaryTransition(Structure* structure)
 {
-    ASSERT(structure->m_isDictionary);
+    ASSERT(structure->isDictionary());
 
     // Since dictionary Structures are not shared, and no opcodes specialize
     // for them, we don't need to allocate a new Structure when transitioning
@@ -581,7 +591,7 @@ PassRefPtr<Structure> Structure::fromDictionaryTransition(Structure* structure)
     // FIMXE: We can make this more efficient by canonicalizing the Structure (draining the
     // deleted offsets vector) before transitioning from dictionary. 
     if (!structure->m_propertyTable || !structure->m_propertyTable->deletedOffsets || structure->m_propertyTable->deletedOffsets->isEmpty())
-        structure->m_isDictionary = false;
+        structure->m_dictionaryKind = NoneDictionaryKind;
 
     return structure;
 }
@@ -600,7 +610,7 @@ size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, u
 
 size_t Structure::removePropertyWithoutTransition(const Identifier& propertyName)
 {
-    ASSERT(m_isDictionary);
+    ASSERT(isUncacheableDictionary());
 
     materializePropertyMapIfNecessary();
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
index f7cb04b..ed9f6e5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
@@ -70,7 +70,8 @@ namespace JSC {
         static PassRefPtr<Structure> despecifyFunctionTransition(Structure*, const Identifier&);
         static PassRefPtr<Structure> addAnonymousSlotsTransition(Structure*, unsigned count);
         static PassRefPtr<Structure> getterSetterTransition(Structure*);
-        static PassRefPtr<Structure> toDictionaryTransition(Structure*);
+        static PassRefPtr<Structure> toCacheableDictionaryTransition(Structure*);
+        static PassRefPtr<Structure> toUncacheableDictionaryTransition(Structure*);
         static PassRefPtr<Structure> fromDictionaryTransition(Structure*);
 
         ~Structure();
@@ -81,8 +82,9 @@ namespace JSC {
         size_t addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t removePropertyWithoutTransition(const Identifier& propertyName);
         void setPrototypeWithoutTransition(JSValue prototype) { m_prototype = prototype; }
-
-        bool isDictionary() const { return m_isDictionary; }
+        
+        bool isDictionary() const { return m_dictionaryKind != NoneDictionaryKind; }
+        bool isUncacheableDictionary() const { return m_dictionaryKind == UncachedDictionaryKind; }
 
         const TypeInfo& typeInfo() const { return m_typeInfo; }
 
@@ -127,6 +129,13 @@ namespace JSC {
 
     private:
         Structure(JSValue prototype, const TypeInfo&);
+        
+        typedef enum { 
+            NoneDictionaryKind = 0,
+            CachedDictionaryKind = 1,
+            UncachedDictionaryKind = 2
+        } DictionaryKind;
+        static PassRefPtr<Structure> toDictionaryTransition(Structure*, DictionaryKind);
 
         size_t put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t remove(const Identifier& propertyName);
@@ -187,7 +196,7 @@ namespace JSC {
         size_t m_propertyStorageCapacity;
         signed char m_offset;
 
-        bool m_isDictionary : 1;
+        unsigned m_dictionaryKind : 2;
         bool m_isPinnedPropertyTable : 1;
         bool m_hasGetterSetterProperties : 1;
 #if COMPILER(WINSCW)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
index eb57a5ac..6e8a0ee 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
@@ -51,6 +51,7 @@ bool StructureChain::isCacheable() const
     uint32_t i = 0;
     
     while (m_vector[i]) {
+        // Both classes of dictionary structure may change arbitrarily so we can't cache them
         if (m_vector[i]->isDictionary())
             return false;
         if (!m_vector[i++]->typeInfo().hasDefaultGetPropertyNames())
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
index 59efd84..b68e70c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
@@ -144,7 +144,13 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 #if ASSERT_DISABLED
 
 #define ASSERT(assertion) ((void)0)
+#if COMPILER(MSVC7)
+#define ASSERT_WITH_MESSAGE(assertion) ((void)0)
+#elif PLATFORM(SYMBIAN)
+#define ASSERT_WITH_MESSAGE(assertion...) ((void)0)
+#else
 #define ASSERT_WITH_MESSAGE(assertion, ...) ((void)0)
+#endif /* COMPILER(MSVC7) */
 #define ASSERT_NOT_REACHED() ((void)0)
 #define ASSERT_UNUSED(variable, assertion) ((void)variable)
 
@@ -158,6 +164,8 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 while (0)
 #if COMPILER(MSVC7)
 #define ASSERT_WITH_MESSAGE(assertion) ((void)0)
+#elif PLATFORM(SYMBIAN)
+#define ASSERT_WITH_MESSAGE(assertion...) ((void)0)
 #else
 #define ASSERT_WITH_MESSAGE(assertion, ...) do \
     if (!(assertion)) { \
@@ -199,10 +207,12 @@ while (0)
 
 /* FATAL */
 
-#if FATAL_DISABLED
+#if FATAL_DISABLED && !COMPILER(MSVC7) && !PLATFORM(SYMBIAN)
 #define FATAL(...) ((void)0)
 #elif COMPILER(MSVC7)
 #define FATAL() ((void)0)
+#elif PLATFORM(SYMBIAN)
+#define FATAL(args...) ((void)0)
 #else
 #define FATAL(...) do { \
     WTFReportFatalError(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, __VA_ARGS__); \
@@ -212,20 +222,24 @@ while (0)
 
 /* LOG_ERROR */
 
-#if ERROR_DISABLED
+#if ERROR_DISABLED && !COMPILER(MSVC7) && !PLATFORM(SYMBIAN)
 #define LOG_ERROR(...) ((void)0)
 #elif COMPILER(MSVC7)
 #define LOG_ERROR() ((void)0)
+#elif PLATFORM(SYMBIAN)
+#define LOG_ERROR(args...) ((void)0)
 #else
 #define LOG_ERROR(...) WTFReportError(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, __VA_ARGS__)
 #endif
 
 /* LOG */
 
-#if LOG_DISABLED
+#if LOG_DISABLED && !COMPILER(MSVC7) && !PLATFORM(SYMBIAN)
 #define LOG(channel, ...) ((void)0)
 #elif COMPILER(MSVC7)
 #define LOG() ((void)0)
+#elif PLATFORM(SYMBIAN)
+#define LOG(channel, args...) ((void)0)
 #else
 #define LOG(channel, ...) WTFLog(&JOIN_LOG_CHANNEL_WITH_PREFIX(LOG_CHANNEL_PREFIX, channel), __VA_ARGS__)
 #define JOIN_LOG_CHANNEL_WITH_PREFIX(prefix, channel) JOIN_LOG_CHANNEL_WITH_PREFIX_LEVEL_2(prefix, channel)
@@ -234,10 +248,12 @@ while (0)
 
 /* LOG_VERBOSE */
 
-#if LOG_DISABLED
+#if LOG_DISABLED && !COMPILER(MSVC7) && !PLATFORM(SYMBIAN)
 #define LOG_VERBOSE(channel, ...) ((void)0)
 #elif COMPILER(MSVC7)
 #define LOG_VERBOSE(channel) ((void)0)
+#elif PLATFORM(SYMBIAN)
+#define LOG_VERBOSE(channel, args...) ((void)0)
 #else
 #define LOG_VERBOSE(channel, ...) WTFLogVerbose(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, &JOIN_LOG_CHANNEL_WITH_PREFIX(LOG_CHANNEL_PREFIX, channel), __VA_ARGS__)
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Forward.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Forward.h
index 67dc3be..448de7d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Forward.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Forward.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2006 Apple Computer, Inc.
+ *  Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -27,6 +27,7 @@ namespace WTF {
     template<typename T> class ListRefPtr;
     template<typename T> class OwnArrayPtr;
     template<typename T> class OwnPtr;
+    template<typename T> class PassOwnPtr;
     template<typename T> class PassRefPtr;
     template<typename T> class RefPtr;
     template<typename T, size_t inlineCapacity> class Vector;
@@ -35,9 +36,9 @@ namespace WTF {
 using WTF::ListRefPtr;
 using WTF::OwnArrayPtr;
 using WTF::OwnPtr;
+using WTF::PassOwnPtr;
 using WTF::PassRefPtr;
 using WTF::RefPtr;
 using WTF::Vector;
 
 #endif // WTF_Forward_h
-
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
index 1a422d8..1fda9c1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
@@ -64,8 +64,13 @@ namespace WTF {
         void remove(const ValueType& value);
         void remove(iterator it);
  
-       void clear();
-        
+        // removes the value, regardless of its count
+        void clear(iterator it);
+        void clear(const ValueType& value);
+
+        // clears the whole set
+        void clear();
+
     private:
         ImplType m_impl;
     };
@@ -166,6 +171,21 @@ namespace WTF {
     }
     
     template<typename Value, typename HashFunctions, typename Traits>
+    inline void HashCountedSet<Value, HashFunctions, Traits>::clear(const ValueType& value)
+    {
+        clear(find(value));
+    }
+    
+    template<typename Value, typename HashFunctions, typename Traits>
+    inline void HashCountedSet<Value, HashFunctions, Traits>::clear(iterator it)
+    {
+        if (it == end())
+            return;
+
+        m_impl.remove(it);
+    }
+    
+    template<typename Value, typename HashFunctions, typename Traits>
     inline void HashCountedSet<Value, HashFunctions, Traits>::clear()
     {
         m_impl.clear(); 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ListRefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ListRefPtr.h
index 9f9a354..d863226 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ListRefPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ListRefPtr.h
@@ -34,13 +34,8 @@ namespace WTF {
         ListRefPtr(const RefPtr<T>& o) : RefPtr<T>(o) {}
         // see comment in PassRefPtr.h for why this takes const reference
         template <typename U> ListRefPtr(const PassRefPtr<U>& o) : RefPtr<T>(o) {}
-
-        ~ListRefPtr()
-        {
-            RefPtr<T> reaper = this->release();
-            while (reaper && reaper->hasOneRef())
-                reaper = reaper->releaseNext(); // implicitly protects reaper->next, then derefs reaper
-        }
+        
+        ~ListRefPtr();
         
         ListRefPtr& operator=(T* optr) { RefPtr<T>::operator=(optr); return *this; }
         ListRefPtr& operator=(const RefPtr<T>& o) { RefPtr<T>::operator=(o); return *this; }
@@ -49,6 +44,17 @@ namespace WTF {
         template <typename U> ListRefPtr& operator=(const PassRefPtr<U>& o) { RefPtr<T>::operator=(o); return *this; }
     };
 
+    template <typename T> 
+#if !COMPILER(WINSCW)
+    inline
+#endif
+    ListRefPtr<T>::~ListRefPtr()
+    {
+        RefPtr<T> reaper = this->release();
+        while (reaper && reaper->hasOneRef())
+            reaper = reaper->releaseNext(); // implicitly protects reaper->next, then derefs reaper
+    }
+
     template <typename T> inline T* getPtr(const ListRefPtr<T>& p)
     {
         return p.get();
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
index 2abf3d2..e508f77 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
@@ -226,8 +226,11 @@
 #endif
 
 /* PLATFORM(ARM) */
+#define PLATFORM_ARM_ARCH(N) (PLATFORM(ARM) && ARM_ARCH_VERSION >= N)
+
 #if   defined(arm) \
-   || defined(__arm__)
+   || defined(__arm__) \
+   || defined(__MARM__)
 #define WTF_PLATFORM_ARM 1
 #if defined(__ARMEB__)
 #define WTF_PLATFORM_BIG_ENDIAN 1
@@ -241,22 +244,35 @@
 #endif
 #if defined(__ARM_ARCH_5__) || defined(__ARM_ARCH_5T__) \
         || defined(__ARM_ARCH_5E__) || defined(__ARM_ARCH_5TE__) \
-        || defined(__ARM_ARCH_5TEJ__)
+        || defined(__ARM_ARCH_5TEJ__) || defined(__MARM_ARMV5__)
 #undef ARM_ARCH_VERSION
 #define ARM_ARCH_VERSION 5
 #endif
 #if defined(__ARM_ARCH_6__) || defined(__ARM_ARCH_6J__) \
      || defined(__ARM_ARCH_6K__) || defined(__ARM_ARCH_6Z__) \
-     || defined(__ARM_ARCH_6ZK__)
+     || defined(__ARM_ARCH_6ZK__) || defined(__ARMV6__)
 #undef ARM_ARCH_VERSION
 #define ARM_ARCH_VERSION 6
 #endif
-#if defined(__ARM_ARCH_7A__)
+#if defined(__ARM_ARCH_7A__) || defined(__ARMV7__)
 #undef ARM_ARCH_VERSION
 #define ARM_ARCH_VERSION 7
 #endif
+/* Defines two pseudo-platforms for ARM and Thumb-2 instruction set. */
+#if !defined(WTF_PLATFORM_ARM_TRADITIONAL) && !defined(WTF_PLATFORM_ARM_THUMB2)
+#  if defined(thumb2) || defined(__thumb2__)
+#    define WTF_PLATFORM_ARM_TRADITIONAL 0
+#    define WTF_PLATFORM_ARM_THUMB2 1
+#  elif PLATFORM_ARM_ARCH(4) || PLATFORM_ARM_ARCH(5)
+#    define WTF_PLATFORM_ARM_TRADITIONAL 1
+#    define WTF_PLATFORM_ARM_THUMB2 0
+#  else
+#    error "Not supported ARM architecture"
+#  endif
+#elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(ARM_THUMB2) /* Sanity Check */
+#  error "Cannot use both of WTF_PLATFORM_ARM_TRADITIONAL and WTF_PLATFORM_ARM_THUMB2 platforms"
+#endif // !defined(ARM_TRADITIONAL) && !defined(ARM_THUMB2)
 #endif /* ARM */
-#define PLATFORM_ARM_ARCH(N) (PLATFORM(ARM) && ARM_ARCH_VERSION >= N)
 
 /* PLATFORM(X86) */
 #if   defined(__i386__) \
@@ -392,6 +408,9 @@
 #if PLATFORM(MAC) && !PLATFORM(IPHONE)
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER) && defined(__x86_64__)
+#define WTF_USE_PLUGIN_HOST_PROCESS 1
+#endif
 #if !defined(ENABLE_MAC_JAVA_BRIDGE)
 #define ENABLE_MAC_JAVA_BRIDGE 1
 #endif
@@ -400,7 +419,7 @@
 #endif
 #define HAVE_READLINE 1
 #define HAVE_RUNLOOP_TIMER 1
-#endif
+#endif // PLATFORM(MAC) && !PLATFORM(IPHONE)
 
 #if PLATFORM(CHROMIUM) && PLATFORM(DARWIN)
 #define WTF_PLATFORM_CF 1
@@ -408,18 +427,19 @@
 #endif
 
 #if PLATFORM(IPHONE)
-#define WTF_PLATFORM_CF 1
-#define WTF_USE_PTHREADS 1
 #define ENABLE_CONTEXT_MENUS 0
 #define ENABLE_DRAG_SUPPORT 0
 #define ENABLE_FTPDIR 1
+#define ENABLE_GEOLOCATION 1
+#define ENABLE_ICONDATABASE 0
 #define ENABLE_INSPECTOR 0
 #define ENABLE_MAC_JAVA_BRIDGE 0
-#define ENABLE_ICONDATABASE 0
-#define ENABLE_GEOLOCATION 1
 #define ENABLE_NETSCAPE_PLUGIN_API 0
-#define HAVE_READLINE 1
+#define ENABLE_ORIENTATION_EVENTS 1
 #define ENABLE_REPAINT_THROTTLING 1
+#define HAVE_READLINE 1
+#define WTF_PLATFORM_CF 1
+#define WTF_USE_PTHREADS 1
 #endif
 
 #if PLATFORM(WIN)
@@ -579,6 +599,14 @@
 #define ENABLE_NETSCAPE_PLUGIN_API 1
 #endif
 
+#if !defined(WTF_USE_PLUGIN_HOST_PROCESS)
+#define WTF_USE_PLUGIN_HOST_PROCESS 0
+#endif
+
+#if !defined(ENABLE_ORIENTATION_EVENTS)
+#define ENABLE_ORIENTATION_EVENTS 0
+#endif
+
 #if !defined(ENABLE_OPCODE_STATS)
 #define ENABLE_OPCODE_STATS 0
 #endif
@@ -637,7 +665,7 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #elif PLATFORM(X86) && PLATFORM(MAC)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-#elif PLATFORM_ARM_ARCH(7) && PLATFORM(IPHONE)
+#elif PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)
     /* Under development, temporarily disabled until 16Mb link range limit in assembler is fixed. */
     #define ENABLE_JIT 0
     #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
@@ -656,8 +684,11 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #elif PLATFORM(X86) && PLATFORM(LINUX) && GCC_VERSION >= 40100
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-#elif PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7) && PLATFORM(LINUX)
+#elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX)
     #define ENABLE_JIT 1
+    #if PLATFORM(ARM_THUMB2)
+        #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
+    #endif
 #endif
 #endif /* PLATFORM(QT) */
 
@@ -703,7 +734,7 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #if (PLATFORM(X86) && PLATFORM(MAC)) \
  || (PLATFORM(X86_64) && PLATFORM(MAC)) \
  /* Under development, temporarily disabled until 16Mb link range limit in assembler is fixed. */ \
- || (PLATFORM_ARM_ARCH(7) && PLATFORM(IPHONE) && 0) \
+ || (PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE) && 0) \
  || (PLATFORM(X86) && PLATFORM(WIN))
 #define ENABLE_YARR 1
 #define ENABLE_YARR_JIT 1
@@ -713,7 +744,7 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #if (PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100) \
  || (PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MSVC)) \
  || (PLATFORM(X86) && PLATFORM(LINUX) && GCC_VERSION >= 40100) \
- || (PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7) && PLATFORM(LINUX))
+ || (PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX))
 #define ENABLE_YARR 1
 #define ENABLE_YARR_JIT 1
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
index 77835ad..1a0b1fe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
@@ -50,7 +50,7 @@ namespace WTF {
 
         ~RefPtr() { T* ptr = m_ptr; derefIfNotNull(ptr); }
         
-        template <typename U> RefPtr(const RefPtr<U>& o) : m_ptr(o.get()) { if (T* ptr = m_ptr) ptr->ref(); }
+        template <typename U> RefPtr(const RefPtr<U>& o) : m_ptr(static_cast<T*>(o.get())) { if (T* ptr = static_cast<T*>(m_ptr)) ptr->ref(); }
         
         T* get() const { return m_ptr; }
         
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
index 7cba4e4..e1fc5b4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
@@ -63,6 +63,13 @@ namespace WTF {
     template <size_t size> struct AlignedBuffer<size, 32> { WTF_ALIGNED(AlignedBufferChar, buffer[size], 32); };
     template <size_t size> struct AlignedBuffer<size, 64> { WTF_ALIGNED(AlignedBufferChar, buffer[size], 64); };
 
+    template <size_t size, size_t alignment>
+    void swap(AlignedBuffer<size, alignment>& a, AlignedBuffer<size, alignment>& b)
+    {
+        for (size_t i = 0; i < size; ++i)
+            std::swap(a.buffer[i], b.buffer[i]);
+    }
+
     template <bool needsDestruction, typename T>
     class VectorDestructor;
 
@@ -404,6 +411,27 @@ namespace WTF {
             Base::deallocateBuffer(bufferToDeallocate);
         }
         
+        void swap(VectorBuffer<T, inlineCapacity>& other)
+        {
+            if (buffer() == inlineBuffer() && other.buffer() == other.inlineBuffer()) {
+                WTF::swap(m_inlineBuffer, other.m_inlineBuffer);
+                std::swap(m_capacity, other.m_capacity);
+            } else if (buffer() == inlineBuffer()) {
+                m_buffer = other.m_buffer;
+                other.m_buffer = other.inlineBuffer();
+                WTF::swap(m_inlineBuffer, other.m_inlineBuffer);
+                std::swap(m_capacity, other.m_capacity);
+            } else if (other.buffer() == other.inlineBuffer()) {
+                other.m_buffer = m_buffer;
+                m_buffer = inlineBuffer();
+                WTF::swap(m_inlineBuffer, other.m_inlineBuffer);
+                std::swap(m_capacity, other.m_capacity);
+            } else {
+                std::swap(m_buffer, other.m_buffer);
+                std::swap(m_capacity, other.m_capacity);
+            }
+        }
+
         void restoreInlineBufferIfNeeded()
         {
             if (m_buffer)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
index d59439d..7016a03 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
@@ -26,7 +26,11 @@
 #include <wtf/Assertions.h>
 
 #if USE(QT4_UNICODE)
+#if COMPILER(WINSCW) || COMPILER(RVCT)
+#include "wtf/unicode/qt4/UnicodeQt4.h"
+#else
 #include "qt4/UnicodeQt4.h"
+#endif
 #elif USE(ICU_UNICODE)
 #include <wtf/unicode/icu/UnicodeIcu.h>
 #elif USE(GLIB_UNICODE)
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
index 16b1ecc..4390b5b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
@@ -1309,7 +1309,7 @@ class RegexGenerator : private MacroAssembler {
         loadPtr(Address(X86Registers::ebp, 2 * sizeof(void*)), output);
     #endif
 #elif PLATFORM(ARM)
-#if !PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_TRADITIONAL)
         push(ARMRegisters::lr);
 #endif
         push(ARMRegisters::r4);
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 16d854d..e13219b 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,8 +4,8 @@ This is a snapshot of the Qt port of WebKit from
 
 The commit imported was from the
 
-        origin/qtwebkit-4.6-staging branch/tag
+        qtwebkit-4.6-snapshot-24092009 branch/tag
 
 and has the sha1 checksum
 
-        f572f72dce91be9a4525941c87d1b0a8c383ba39
+        75c44947a340d74a9e0098a3dfffabce0c9512ef
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 8a278ce..5d83c7b 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,3 +1,2660 @@
+2009-09-24  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QApp::translate() calls to provide the correct class name without
+        a trailing comma.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaTimeDescription):
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        More build fix: Removed JSSharedWorkerContextCustom.cpp from project
+        files, since it no longer exists in the repository.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Declare set/unsetPendingActivity public, so
+        SharedWorkerScriptLoader can call them.
+
+        * dom/ActiveDOMObject.h:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed a bit of the Windows build.
+
+        * workers/SharedWorker.idl: Declare a custom mark function. (I accidentally
+        removed this in my last patch.)
+        * WebCore.xcodeproj/project.pbxproj: Added JSSharedWorkerCustom.cpp back
+        to the build. (I accidentally removed this in my last patch.)
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        32-bit build fix: restore previous cast that I thought was unnecessary.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didSendData):
+        (WebCore::XMLHttpRequest::didReceiveData):
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bring a little sanity to this crazy EventTarget world of ours
+        https://bugs.webkit.org/show_bug.cgi?id=29701
+
+        Lots of EventTarget refactoring to achieve a single shared implementation
+        that fixes some of the performance and correctness bugs of the many individual
+        implementations, and makes reasoning about EventTargets and EventListeners
+        much easier.
+        
+        The basic design is this:
+            - EventTarget manages a set of EventListeners.
+            - onXXX EventListener attributes forward to standard EventTarget APIs.
+            - Since the onXXX code is repetitive, it is usually done with macros
+              of the form DEFINE_ATTRIBUTE_EVENT_LISTENER(attributeName).
+            - EventTarget provides a shared implementation of dispatchEvent,
+              which subclasses with special event dispatch rules, like Node, override.
+            - To support Node, which lazily instantiates its EventTarget data,
+              EventTarget has no data members, and instead makes a virtual call
+              to get its data from wherever its subclass chose to store it.
+              
+        Code that used to call dispatchEvent, passing an ExceptionCode paratmeter,
+        even though no exception could be thrown, has been changed not to do so,
+        to improve clarity and performance.
+        
+        Code that used to call a special dispatchXXXEvent function, which just
+        turned around and called dispatchEvent, has been changed to call
+        dispatchEvent, to improve clarity and performance.
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj: Another day in the life of a WebKit
+        engineer.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM): Updated for Node API change. Added
+        "is not in the document but is firing event listeners" as a condition
+        that makes a Node observable in the DOM, so that event listeners firing
+        on removed nodes are not destroyed midstream. (This was a long-standing
+        bug that was somewhat hidden by the old implementation's habit of
+        copying the RegisteredEventListener vector before firing events, which
+        would keep almost all the relevant objects from being destroyed.)
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent): Removed the isWindowEvent flag
+        because it was one of the most elaborately planned no-ops in the history
+        of software crime, and one of the reasons clients thought they needed more
+        than one dispatchEvent function even though they didn't.
+        * bindings/js/JSEventListener.h:
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::markChildren):
+        (WebCore::JSMessagePort::markChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        * bindings/js/JSEventSourceCustom.cpp:
+        * bindings/js/JSMessagePortCustom.cpp:
+        * bindings/js/JSSharedWorkerContextCustom.cpp: Removed.
+        * bindings/js/JSWebSocketCustom.cpp:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::markChildren):
+        * bindings/js/JSWorkerCustom.cpp:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren): EventListener marking is
+        now autogenerated. Classes that still have custom mark functions for other
+        reasons now call a shared EventTarget API to mark their EventListeners.
+
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent): Bye bye isWindowEvent.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Autogeneration support for
+        marking and invalidating event listeners.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::willRemoveChild):
+        (WebCore::ContainerNode::appendChild):
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListeners):
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::setFocusedNode):
+        (WebCore::Document::dispatchWindowEvent):
+        (WebCore::Document::dispatchWindowLoadEvent):
+        (WebCore::Document::finishedParsing):
+        * dom/Document.h: Use dispatchEvent directly.
+
+        * dom/Element.h: Moved a few event listener attributes down from Node,
+        since they don't apply to all Nodes, only Elements.
+
+        * dom/EventListener.h: Removed isWindowEvent parameter.
+
+        * dom/EventNames.h: Added the "display" event name, so it works correctly
+        with attribute macros, and for performance.
+
+        * dom/EventTarget.cpp:
+        (WebCore::forbidEventDispatch):
+        (WebCore::allowEventDispatch):
+        (WebCore::eventDispatchForbidden): Made this code (embarrasingly) thread
+        safe, since it's now called on multiple threads. (Currently, we only forbid
+        event dispatch on the main thread. If we ever want to forbid event dispatch
+        on secondary threads, we can improve it then.)
+
+        (WebCore::EventTarget::addEventListener):
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::setAttributeEventListener):
+        (WebCore::EventTarget::getAttributeEventListener):
+        (WebCore::EventTarget::clearAttributeEventListener):
+        (WebCore::EventTarget::dispatchEvent):
+        (WebCore::EventTarget::fireEventListeners):
+        (WebCore::EventTarget::getEventListeners):
+        (WebCore::EventTarget::removeAllEventListeners):
+        * dom/EventTarget.h:
+        (WebCore::FiringEventEndIterator::FiringEventEndIterator):
+        (WebCore::EventTarget::ref):
+        (WebCore::EventTarget::deref):
+        (WebCore::EventTarget::markEventListeners):
+        (WebCore::EventTarget::invalidateEventListeners):
+        (WebCore::EventTarget::isFiringEventListeners):
+        (WebCore::EventTarget::hasEventListeners): The ONE TRUE IMPLEMENTATION of
+        EventTarget APIs, crafted from an amalgam of all the different versions
+        we used to have. The most significant change here is that we no longer
+        make a copy of an EventListener vector before firing the events in the
+        vector -- instead, we use a reference to the original vector, along with
+        a notification mechanism for the unlikely case when an EventListener is
+        removed from the vector. This substantially reduces malloc, copying, and
+        refcount overhead, and complexity.
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create): Use dispatchEvent directly.
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::eventTargetData):
+        (WebCore::MessagePort::ensureEventTargetData):
+        * dom/MessagePort.h:
+        (WebCore::MessagePort::setOnmessage):
+        (WebCore::MessagePort::onmessage):
+        * dom/MessagePort.idl: Removed custom EventTarget implementation.
+
+        * dom/MutationEvent.h:
+        (WebCore::MutationEvent::create): Added some default values so callers
+        can construct MutationEvents more easily, without calling a custom dispatch
+        function.
+
+        * dom/Node.cpp:
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::eventTargetData):
+        (WebCore::Node::ensureEventTargetData):
+        (WebCore::Node::handleLocalEvents):
+        (WebCore::Node::dispatchEvent):
+        (WebCore::Node::dispatchGenericEvent):
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchUIEvent):
+        (WebCore::Node::dispatchKeyEvent):
+        (WebCore::Node::dispatchMouseEvent):
+        (WebCore::Node::dispatchWheelEvent):
+        (WebCore::Node::dispatchFocusEvent):
+        (WebCore::Node::dispatchBlurEvent):
+        * dom/Node.h:
+        (WebCore::Node::preDispatchEventHandler):
+        (WebCore::Node::postDispatchEventHandler):
+        * dom/Node.idl:
+        * dom/NodeRareData.h:
+        (WebCore::NodeRareData::eventTargetData):
+        (WebCore::NodeRareData::ensureEventTargetData): Use the shared EventTarget
+        interface, and call dispatchEvent directly instead of custom dispatchXXXEvent
+        functions that just forwarded to dispatchEvent.
+
+        * dom/RegisteredEventListener.cpp:
+        * dom/RegisteredEventListener.h:
+        (WebCore::RegisteredEventListener::RegisteredEventListener):
+        (WebCore::operator==): This is just a simple struct now, since we no longer
+        do a complicated copy / refCount / isRemoved dance just to honor the rule
+        that an EventListener can be removed during event dispatch.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Removed another custom dispatchEvent.
+
+        * html/HTMLBodyElement.cpp:
+        * html/HTMLBodyElement.h: Use the shared EventTarget API.
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent):
+        (WebCore::HTMLFormControlElement::checkValidity):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::handleLocalEvents):
+        (WebCore::HTMLFormElement::prepareSubmit):
+        (WebCore::HTMLFormElement::reset):
+        * html/HTMLFormElement.h: Use the standard dispatchEvent API.
+
+        * html/HTMLFrameSetElement.cpp:
+        * html/HTMLFrameSetElement.h: Use the shared EventTarget API.
+
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadInternal):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::dispatchLoadEvent):
+        (WebCore::HTMLScriptElement::dispatchErrorEvent):
+        * html/HTMLSourceElement.cpp:
+        (WebCore::HTMLSourceElement::errorEventTimerFired):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::notifyFinished): Use the standard dispatchEvent API.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::HashChangeEventTask::performTask):
+        (WebCore::FrameLoader::pageHidden): No more isWindowEvent.
+
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::CallCacheListenerTask::performTask):
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::notifyDOMApplicationCache):
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::eventTargetData):
+        (WebCore::DOMApplicationCache::ensureEventTargetData):
+        * loader/appcache/DOMApplicationCache.h:
+        * loader/appcache/DOMApplicationCache.idl: Switched to the standard
+        EventTarget API. As a part of this, I switched this class from using a
+        custom internal event name enumeration to using the standard EventNames.
+
+        * notifications/Notification.cpp:
+        (WebCore::Notification::eventTargetData):
+        (WebCore::Notification::ensureEventTargetData):
+        * notifications/Notification.h:
+        (WebCore::Notification::scriptExecutionContext):
+        * notifications/Notification.idl: Switched to the standard EventTarget API.
+
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::event):
+        (WebCore::windowsWithUnloadEventListeners):
+        (WebCore::windowsWithBeforeUnloadEventListeners):
+        (WebCore::allowsBeforeUnloadListeners):
+        (WebCore::DOMWindow::dispatchAllPendingBeforeUnloadEvents):
+        (WebCore::DOMWindow::pendingUnloadEventListeners):
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Changed the "pending"
+        unload / beforeunload listener tracker just to track which windows had
+        such listeners, instead of actually keeping a copy of the listeners. Now,
+        this code can use the standard EventTarget API.
+
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::postMessageTimerFired):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::dispatchLoadEvent):
+        (WebCore::DOMWindow::dispatchEvent):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        (WebCore::DOMWindow::captureEvents):
+        (WebCore::DOMWindow::releaseEvents):
+        (WebCore::DOMWindow::eventTargetData):
+        (WebCore::DOMWindow::ensureEventTargetData):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl: Use the standard EventTarget APIs.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::canMouseDownStartSelect):
+        (WebCore::EventHandler::canMouseDragExtendSelect):
+        (WebCore::EventHandler::sendResizeEvent):
+        (WebCore::EventHandler::sendScrollEvent): Use dispatchEvent directly.
+
+        * page/EventSource.cpp:
+        (WebCore::EventSource::endRequest):
+        (WebCore::EventSource::didReceiveResponse):
+        (WebCore::EventSource::parseEventStreamLine):
+        (WebCore::EventSource::stop):
+        (WebCore::EventSource::createMessageEvent):
+        (WebCore::EventSource::eventTargetData):
+        (WebCore::EventSource::ensureEventTargetData):
+        * page/EventSource.h:
+        * page/EventSource.idl: Use the standard EventTarget APIs.
+
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
+        (WebCore::FocusController::setFocusedFrame):
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldClose):
+        * page/Frame.h:
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::valueChanged):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::selectionChanged):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged): Use dispatchEvent.
+
+        * svg/SVGElement.cpp:
+        (WebCore::hasLoadListener): Rewritten for new EventTarget API.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::dummyEventTargetData):
+        (WebCore::SVGElementInstance::addEventListener):
+        (WebCore::SVGElementInstance::removeEventListener):
+        (WebCore::SVGElementInstance::removeAllEventListeners):
+        (WebCore::SVGElementInstance::dispatchEvent):
+        (WebCore::SVGElementInstance::eventTargetData):
+        (WebCore::SVGElementInstance::ensureEventTargetData): Use the EventTarget API.
+
+        * svg/SVGElementInstance.h:
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::dispatchLoadEvent):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchErrorEvent): Use dispatchEvent directly.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::transferEventListenersToShadowTree): Updated for
+        new EventTarget API.
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent): No more isWindowEvent.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::eventTargetData):
+        (WebCore::WebSocket::ensureEventTargetData):
+        * websockets/WebSocket.h:
+        * websockets/WebSocket.idl:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::eventTargetData):
+        (WebCore::AbstractWorker::ensureEventTargetData):
+        * workers/AbstractWorker.h:
+        * workers/AbstractWorker.idl:
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerConnectTask::performTask):
+        (WebCore::SharedWorkerScriptLoader::load):
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        * workers/SharedWorker.idl:
+        * workers/SharedWorkerContext.cpp:
+        (WebCore::createConnectEvent):
+        * workers/SharedWorkerContext.h:
+        * workers/SharedWorkerContext.idl:
+        * workers/Worker.cpp:
+        (WebCore::Worker::notifyFinished):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::eventTargetData):
+        (WebCore::WorkerContext::ensureEventTargetData):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerExceptionTask::performTask):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+        (WebCore::XMLHttpRequest::createRequest):
+        (WebCore::XMLHttpRequest::abort):
+        (WebCore::XMLHttpRequest::networkError):
+        (WebCore::XMLHttpRequest::abortError):
+        (WebCore::XMLHttpRequest::didSendData):
+        (WebCore::XMLHttpRequest::didReceiveData):
+        (WebCore::XMLHttpRequest::eventTargetData):
+        (WebCore::XMLHttpRequest::ensureEventTargetData):
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequest.idl:
+        * xml/XMLHttpRequestProgressEvent.h:
+        (WebCore::XMLHttpRequestProgressEvent::create):
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::eventTargetData):
+        (WebCore::XMLHttpRequestUpload::ensureEventTargetData):
+        * xml/XMLHttpRequestUpload.h:
+        * xml/XMLHttpRequestUpload.idl: Use new EventTarget API.
+
+2009-09-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        - Support for maxLength of <textarea>
+        - Move numGraphemeClusters() and numCharactersInGraphemeClusters() from InputElement to String.
+        https://bugs.webkit.org/show_bug.cgi?id=29292
+
+        Test: fast/forms/textarea-maxlength.html
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::sanitizeUserInputValue):
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::defaultEventHandler):
+        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
+        (WebCore::HTMLTextAreaElement::sanitizeUserInputValue):
+        (WebCore::HTMLTextAreaElement::maxLength):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::numGraphemeClusters):
+        (WebCore::String::numCharactersInGraphemeClusters):
+
+2009-09-23  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
+        https://bugs.webkit.org/show_bug.cgi?id=29654
+
+        Give GDK_Backspace key events the proper text properties.
+
+        Instead of adding new tests, this change removes existing tests
+        from Gtk's skipped list.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-09-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26989
+        Should allow navigation of top-level openers
+        <rdar://problem/7034025>
+
+        Allow navigation of cross-origin window.opener if it is top-level frame.
+
+        Test: http/tests/security/frameNavigation/cross-origin-opener.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::shouldAllowNavigation):
+
+2009-09-23  Marshall Culpepper  <mculpepper@appcelerator.com>
+
+        Reviewed by Eric Seidel.
+
+        Added $(WebKitLibrariesDir)/include/cairo so cairo.h is found by
+        default when the necessary dependencies are extracted into the
+        WebKitLibrariesDir.
+        https://bugs.webkit.org/show_bug.cgi?id=29661
+
+        * WebCore.vcproj/WebCoreCairo.vsprops:
+
+2009-09-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Crash when website does a history.back() followed by an alert()
+        https://bugs.webkit.org/show_bug.cgi?id=29686
+        rdar://problem/6984996
+
+        When loading is deferred, we need to defer timer-based loads
+        too, not just networking-driven loads. Otherwise we can get
+        syncronouse navigation while running a script, which leads to
+        crashes and other badness.
+
+        This patch includes a manual test; an automated test may be
+        possible some time in the future.
+
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv): Use scheduleLocationChange
+        instead of scheduleHTTPRedirection to implement the navigation
+        needed for x-frame-options.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader): Updated for data members with
+        new names and new data members.
+        (WebCore::FrameLoader::setDefersLoading): When turning deferral
+        off, call startRedirectionTimer and startCheckCompleteTimer, since
+        either of them might have been fired and ignored while defersLoading
+        was true.
+        (WebCore::FrameLoader::clear): Updated for replacement of the
+        m_checkCompletedTimer and m_checkLoadCompleteTimer timers.
+        (WebCore::FrameLoader::allAncestorsAreComplete): Added.
+        (WebCore::FrameLoader::checkCompleted): Added code to set
+        m_shouldCallCheckCompleted to false. Changed code that calls
+        startRedirectionTimer to call it unconditionally, since that
+        function now knows when to do work and doesn't expect callers
+        to handle that any more.
+        (WebCore::FrameLoader::checkTimerFired): Added. Replaces the old
+        timer fired callbacks. Calls checkCompleted and checkLoadComplete
+        as appropriate, but not when defersLoading is true.
+        (WebCore::FrameLoader::startCheckCompleteTimer): Added. Replaces
+        the two different calls to start timers before. Only starts the
+        timers if they are needed.
+        (WebCore::FrameLoader::scheduleCheckCompleted): Changed to call
+        startCheckCompleteTimer after setting boolean.
+        (WebCore::FrameLoader::scheduleCheckLoadComplete): Ditto.
+        (WebCore::FrameLoader::scheduleHistoryNavigation): Removed
+        canGoBackOrForward check. The logic works more naturally when
+        we don't do anything until the timer fires.
+        (WebCore::FrameLoader::redirectionTimerFired): Do nothing if
+        defersLoading is true. Also moved canGoBackOrForward check here.
+        (WebCore::FrameLoader::scheduleRedirection): Changed code that
+        calls startRedirectionTimer to do so unconditionally. That
+        function now handles the rules about when to start the timer
+        rather than expecting the caller to do so.
+        (WebCore::FrameLoader::startRedirectionTimer): Added code to
+        handle the case where there is no redirection scheduled,
+        where the timer is already active, or where this is a classic
+        redirection and there is an ancestor that has not yet completed
+        loading.
+        (WebCore::FrameLoader::completed): Call startRedirectionTimer
+        here directly instead of calling a cover named parentCompleted.
+        Hooray! One less function in the giant FrameLoader class!
+        (WebCore::FrameLoader::checkLoadComplete): Added code to set
+        m_shouldCallCheckLoadComplete to false.
+
+        * loader/FrameLoader.h: Replaced the two functions
+        checkCompletedTimerFired and checkLoadCompleteTimerFired with
+        one function, checkTimerFired. Removed the parentCompleted
+        function. Added the startCheckCompleteTimer and
+        allAncestorsAreComplete functions. Replaced the
+        m_checkCompletedTimer and m_checkLoadCompleteTimer data
+        members with m_checkTimer, m_shouldCallCheckCompleted, and
+        m_shouldCallCheckLoadComplete.
+
+        * manual-tests/go-back-after-alert.html: Added.
+        * manual-tests/resources/alert-and-go-back.html: Added.
+
+2009-09-23  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/29660> Move "Generate 64-bit Export File" build phase script into DerivedSources.make
+
+        Reviewed by Mark Rowe.
+
+        The "Generate 64-bit Export File" build phase script generated
+        the WebCore.LP64.exp export file used to link 64-bit WebCore.
+        Instead of having a separate build phase script, move its
+        generation into DerivedSources.make where WebCore.exp is
+        generated.
+
+        * DerivedSources.make: Added a rule to make WebCore.LP64.exp.
+        Added code to append WebCore.PluginHostProcess.exp to
+        $(WEBCORE_EXPORT_DEPENDENCIES) when WTF_USE_PLUGIN_HOST_PROCESS
+        is set to 1.
+        * WebCore.PluginHostProcess.exp: Renamed from WebCore/WebCore.LP64.exp.
+        * WebCore.xcodeproj/project.pbxproj: Removed the "Generate
+        64-bit Export File" build phase script. Renamed WebCore.LP64.exp
+        to WebCore.PluginHostProcess.exp.
+
+2009-09-23  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29694
+        [Chromium] Eliminate dependency on gfx::Rect from ImageSkia.
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::drawResampledBitmap):
+
+2009-09-22  Timothy Hatcher  <timothy@apple.com>
+
+        Prevent scrolling multiple elements during latched wheel events.
+
+        Reviewed by Anders Carlsson.
+
+        * page/EventHandler.cpp:
+        (WebCore::scrollAndAcceptEvent):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/EventHandler.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scroll):
+        * rendering/RenderBox.h:
+
+2009-09-23  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29523
+        
+        Fixes an issue where a JavaScript URL that was URL-encoded twice can bypass the
+        XSSAuditor.
+        
+        The method FrameLoader::executeIfJavaScriptURL decodes the URL escape 
+        sequences in a JavaScript URL before it is eventually passed to the XSSAuditor.
+        Because the XSSAuditor also decodes the URL escape sequences as part of its
+        canonicalization, the double decoding of a JavaScript URL would
+        not match the canonicalization of the input parameters.
+
+        Tests: http/tests/security/xssAuditor/iframe-javascript-url-url-encoded.html
+               http/tests/security/xssAuditor/javascript-link-url-encoded.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Moved call to 
+        XSSAuditor::canEvaluateJavaScriptURL into FrameLoader::executeIfJavaScriptURL.
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Ditto.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeIfJavaScriptURL): Modified to call 
+        XSSAuditor::canEvaluateJavaScriptURL on the JavaScript URL before it is
+        decoded.
+
+2009-09-22  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29657
+        Columns don't break properly in positioned elements with a fixed height.  Make sure that
+        a block is still considered to have columns even when the column count is 1 if the column
+        width is non-auto.
+    
+        Added fast/multicol/positioned-with-constrained-height.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::setDesiredColumnCountAndWidth):
+
+2009-09-23  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Add a null check for the Document*. In the mirror benchmarking
+        application a crash from a call from JavaScript was observed.
+
+        I was not able to come up with a test case for this issue.
+
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookieJar):
+
+2009-09-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the Qt/Windows build, after the introduction of
+        the page client.
+
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+
+2009-09-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] media tests failing after their rework
+        https://bugs.webkit.org/show_bug.cgi?id=29532
+
+        Correctly advertise the mime types used by the common formats used
+        in the tests.
+
+        Tests that regressed, and will pass again:
+
+           media/video-canvas-source.html
+           media/video-controls.html
+           media/video-currentTime-set2.html
+           media/video-dom-autoplay.html
+           media/video-dom-src.html
+           media/video-error-abort.html
+           media/video-load-networkState.html
+           media/video-load-readyState.html
+           media/video-muted.html
+           media/video-no-autoplay.html
+           media/video-pause-empty-events.html
+           media/video-play-empty-events.html
+           media/video-seekable.html
+           media/video-seeking.html
+           media/video-size.html
+           media/video-source-type-params.html
+           media/video-source-type.html
+           media/video-source.html
+           media/video-src-change.html
+           media/video-src-invalid-remove.html
+           media/video-src-remove.html
+           media/video-src-set.html
+           media/video-src-source.html
+           media/video-src.html
+           media/video-timeupdate-during-playback.html
+           media/video-volume.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-09-22  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Eric Seidel.
+
+        Fix the crash problem with absolte positioned children in foreignobject
+        htts://bugs.webkit.org/show_bug.cgi?id=26342
+
+        Test: svg/custom/foreignobject-crash-with-absolute-positioned-children.svg
+
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::isSVGForeignObject):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGForeignObject):
+
+2009-09-22  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers "name" attribute is now optional.
+        https://bugs.webkit.org/show_bug.cgi?id=28897
+
+        Test: fast/workers/shared-worker-name.html
+
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        (WebCore::constructSharedWorker):
+        Default 'name' attribute to empty string if it is not provided.
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Default 'name' attribute to empty string if it is not provided.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::matches):
+        Now matches URLs if names are empty strings.
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        Pass URL in to SharedWorkerProxy::matches().
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, another build fix.
+
+        [Chromium] Add another missing include.
+        https://bugs.webkit.org/show_bug.cgi?id=29536
+
+        * inspector/InspectorController.cpp: Added DOMWindow.h include.
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Add missing include.
+        https://bugs.webkit.org/show_bug.cgi?id=29536
+
+        * inspector/InspectorDOMStorageResource.cpp: Added DOMWindow.h include.
+
+2009-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Tighten up the ScheduledRedirection machinery to prepare for a bug fix
+        https://bugs.webkit.org/show_bug.cgi?id=29663
+
+        * loader/FrameLoader.cpp:
+        (WebCore::ScheduledRedirection::ScheduledRedirection): Added a boolean,
+        initialized to false, to keep track if the redirection has been
+        communicated to the client.
+        (WebCore::FrameLoader::stopLoading): Tweaked a comment.
+        (WebCore::FrameLoader::cancelRedirection): Removed code to clear
+        m_scheduledRedirection.clear since stopRedirectionTimer does that now.
+        (WebCore::FrameLoader::allChildrenAreComplete): Added.
+        (WebCore::FrameLoader::checkCompleted): Use allChildrenAreComplete
+        function for clarity.
+        (WebCore::FrameLoader::checkCallImplicitClose): Ditto.
+        (WebCore::FrameLoader::scheduleRedirection): Changed to take a PassOwnPtr.
+        (WebCore::FrameLoader::startRedirectionTimer): Added code to set the
+        toldClient flag and not call clientRedirected a second time if it is set.
+        (WebCore::FrameLoader::stopRedirectionTimer): Changed so this can be safely
+        called multiple times and it will call clientRedirectCancelledOrFinished
+        only once.
+
+        * loader/FrameLoader.h: Changed scheduleRedirection to be a PassOwnPtr.
+        Added allChildrenAreComplete function.
+
+2009-09-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate Databases tab to InjectedScript /
+        serialized interaction.
+
+        DOMStorage interaction is now serialized into JSON messages
+        and doesn't require quarantined objects.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28873
+
+        * dom/EventListener.h:
+        (WebCore::EventListener::):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::selectDOMStorage):
+        (WebCore::InspectorBackend::getDOMStorageEntries):
+        (WebCore::InspectorBackend::setDOMStorageItem):
+        (WebCore::InspectorBackend::removeDOMStorageItem):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::selectDOMStorage):
+        (WebCore::InspectorController::getDOMStorageEntries):
+        (WebCore::InspectorController::setDOMStorageItem):
+        (WebCore::InspectorController::removeDOMStorageItem):
+        (WebCore::InspectorController::getDOMStorageResourceForId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
+        (WebCore::InspectorDOMStorageResource::bind):
+        (WebCore::InspectorDOMStorageResource::unbind):
+        (WebCore::InspectorDOMStorageResource::startReportingChangesToFrontend):
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        (WebCore::InspectorDOMStorageResource::operator==):
+        * inspector/InspectorDOMStorageResource.h:
+        (WebCore::InspectorDOMStorageResource::cast):
+        (WebCore::InspectorDOMStorageResource::id):
+        (WebCore::InspectorDOMStorageResource::domStorage):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
+        (WebCore::InspectorFrontend::didSetDOMStorageItem):
+        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
+        (WebCore::InspectorFrontend::updateDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorage):
+        (WebInspector.DOMStorage.prototype.get id):
+        (WebInspector.DOMStorage.prototype.get domStorage):
+        (WebInspector.DOMStorage.prototype.get isLocalStorage):
+        (WebInspector.DOMStorage.prototype.getEntriesAsync):
+        (WebInspector.DOMStorage.prototype.setItemAsync):
+        (WebInspector.DOMStorage.prototype.removeItemAsync):
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.show):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.selectDOMStorage):
+        (WebInspector.StoragePanel.prototype.updateDOMStorage):
+        (WebInspector.StoragePanel.prototype._domStorageForId):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDOMStorage):
+        (WebInspector.updateDOMStorage):
+
+2009-09-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix for XMLHttpRequest.abort() should destroy the response text.
+        https://bugs.webkit.org/show_bug.cgi?id=29658
+        <rdar://problem/5301430>
+
+        Clearing the response text after calling XMLHttpRequest.abort() is necessary
+        per spec and matches Firefox. It is also a potential memory win.
+
+        Test: http/tests/xmlhttprequest/abort-should-destroy-responseText.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::abort): Clear the response text making sure to
+        keep the actual ResourceReponse around so that the response status and response
+        status text are kept around.
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r48639.
+        http://trac.webkit.org/changeset/48639
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+
+2009-09-22  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Changing the transaction coordinator to (re-)allow multiple read
+        transactions on the same database to run concurrently (without
+        risking a deadlock this time).
+
+        https://bugs.webkit.org/show_bug.cgi?id=29115
+
+        Tests: storage/read-and-write-transactions-dont-run-together.html
+               storage/read-transactions-running-concurrently.html
+
+        * storage/SQLTransaction.h:
+        (WebCore::SQLTransaction::isReadOnly): Returns the type of the
+        transaction.
+        * storage/SQLTransactionCoordinator.cpp:
+        (WebCore::SQLTransactionCoordinator::acquireLock): Changed to
+        allow multiple read transactions on the same DB to run
+        concurrently.
+        (WebCore::SQLTransactionCoordinator::releaseLock): Changed to
+        allow multiple read transactions on the same DB to run
+        concurrently.
+        (WebCore::SQLTransactionCoordinator::shutdown): Renamed the map.
+        * storage/SQLTransactionCoordinator.h:
+
+2009-09-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29652
+        Support true system colors for CSS system colors in Chromium/Win.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::cssValueIdToSysColorIndex):
+        (WebCore::RenderThemeChromiumWin::systemColor):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-09-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6925121> SAP: Wrong width calculation in 
+        table with fixed layout
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29501
+
+        New Tests:
+        * fast/table/fixed-table-with-percent-inside-percent-table.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-auto-table.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-div.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-extra-large-div.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-fixed-width-table.html: Added.
+        * fast/table/fixed-table-with-small-percent-width.html: Added.
+
+        This new quirk is very similar to an existing one that was 
+        implemented in revision 4316.
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcPrefWidths):
+
+2009-09-22  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        List HTTP status code with response headers in resources tab of Web Inspector.
+        http://webkit.org/b/19945
+
+        This patch adds a new top level list in the resources tab, HTTP Information, that 
+        for now, contains the Request Method (GET, POST, etc.) and the Status Code (200, 404, etc.).
+        Additionally, it adds a colored dot next to the requested URL to show the status 
+        (green for success, orange for redirect, red for error).
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ImageView.js:
+        (WebInspector.ImageView):
+        * inspector/front-end/Images/errorRedDot.png: Added.
+        * inspector/front-end/Images/successGreenDot.png: Added.
+        * inspector/front-end/Images/warningOrangeDot.png: Added.
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.StatusTextForCode):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._refreshURL):
+        (WebInspector.ResourceView.prototype._refreshHTTPInformation):
+        * inspector/front-end/inspector.css:
+
+2009-09-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Back list isn't properly updated for fragment changes after a redirect.
+        <rdar://problem/6142803> and https://bugs.webkit.org/show_bug.cgi?id=20355
+
+        Test: fast/loader/fragment-after-redirect-gets-back-entry.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL): Properly reset the policy FrameLoadType before
+          consulting the policy delegate for fragment scrolling.
+
+2009-09-22  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Drop down selects get stuck in the non-visible state and cannot be opened.
+        https://bugs.webkit.org/show_bug.cgi?id=29645
+
+        All paths that lead to hiding the popup menu must call popupDidHide on
+        the PopupMenuClient.  This change makes it so by moving all of the
+        hiding logic to PopupListBox::hidePopup.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupListBox::hidePopup):
+        * platform/chromium/PopupMenuChromium.h:
+
+2009-09-22  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector.log() function not protected if console not yet created
+        https://bugs.webkit.org/show_bug.cgi?id=29336
+        
+        No new tests.  Only affects Web Inspector developers adding logging
+        to their code during development.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.log.isLogAvailable):
+        (WebInspector.log.flushQueue):
+        (WebInspector.log.flushQueueIfAvailable):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2009-09-22  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+
+        Ported chromium.org's webcore.gyp for the webkit chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29617
+
+        * WebCore.gyp/WebCore.gyp: Added.
+
+2009-09-22  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Don't keep clean wrappers artificially alive        
+        We currently keep all DOM node wrappers alive, even when there are
+        no more references to them from JS, in case they have properties
+        that we need to keep around if new JS references are created.
+        This changes the policy to only keep wrappers artificially alive
+        if they have changed since they were created. Empty wrappers are
+        discarded and recreated as needed.
+        https://bugs.webkit.org/show_bug.cgi?id=29330
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+
+2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: console.count and console.timeEnd
+        crash when inspector is opened.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29632
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+
+2009-09-22  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Fix bogus build fix I did last night.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        NPAPI/Mac: Don't paint plugins if we don't have a CGContextRef
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reivewed by Simon Hausmann.
+
+        Fix the Qt/Mac build after r48604 (Implement new QWebPageClient class)
+
+        There's no QWidget::x11Info() on Mac, and setPlatformPluginWidget()
+        takes a QWidget*, not a QWebPageClient*
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+
+2009-09-21  Adam Barth  <abarth@webkit.org>
+
+        Attempted fix for the V8 build.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-09-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Don't re-enter JavaScript after performing access checks
+        https://bugs.webkit.org/show_bug.cgi?id=29531
+
+        Moved the access check slightly later in this functions to avoid
+        re-entering the JavaScript interpreter (typically via toString)
+        after performing the access check.
+
+        I can't really think of a meaningful test for this change.  It's more
+        security hygiene.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::assign):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::if):
+        (CALLBACK_FUNC_DECL):
+        (V8Custom::WindowSetLocation):
+        (V8Custom::ClearTimeoutImpl):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-21  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make all write transaction start with a BEGIN IMMEDIATE command
+        instead of BEGIN.
+
+        We cannot test this change in a layout test, because in order to
+        test it we need to spawn two database threads and execute
+        transaction steps on these two threads in a very specific order,
+        which seems impossible to do when they share the same main thread
+        (as they would in a layout test). The SQLite docs and the case
+        described in the bug though should be enough proof that we do have
+        a problem here and that this patch will fix it.
+
+        Relevant SQLite documentation:
+        http://www.sqlite.org/lang_transaction.html
+        http://www.sqlite.org/lockingv3.html#locking
+
+        https://bugs.webkit.org/show_bug.cgi?id=29218
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::SQLiteTransaction): Added a readOnly
+        parameter.
+        (WebCore::SQLiteTransaction::begin): Changed to BEGIN IMMEDIATE
+        for write transactions.
+        * platform/sql/SQLiteTransaction.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::openTransactionAndPreflight): Passing
+        the read-only flag to the SQLiteTransaction instance.
+
+2009-09-21  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Mark Rowe.
+
+        * DerivedSources.make: Fix the Xcode build on SnowLeopard.
+
+2009-09-15  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Prevent sleeps in unload handlers.
+        https://bugs.webkit.org/show_bug.cgi?id=29193
+
+        Test: fast/dom/Window/slow_unload_handler.html
+
+        * WebCore.gypi:
+        * bindings/v8/DateExtension.cpp: Added.
+        (WebCore::DateExtension::DateExtension):
+        (WebCore::DateExtension::get):
+        (WebCore::DateExtension::setAllowSleep):
+        (WebCore::DateExtension::GetNativeFunction):
+        (WebCore::DateExtension::weakCallback):
+        (WebCore::DateExtension::GiveEnableSleepDetectionFunction):
+        (WebCore::DateExtension::OnSleepDetected):
+        * bindings/v8/DateExtension.h: Added.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::registerExtensionWithV8):
+        (WebCore::V8Proxy::registeredExtensionWithV8):
+        * bindings/v8/V8Proxy.h:
+
+2009-09-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Run-time exception in onmessage handler is not forwarded to the
+        worker object.
+        https://bugs.webkit.org/show_bug.cgi?id=28980
+
+        The previous fix was partially reverted due to a reliability build break
+        in chromium. The break happens when an exception is thrown without
+        setting a message. We need to check for this scenario and handle it.
+
+        Tested by worker-close.html.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-09-21  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser & Sam Weinig.
+
+        Add ENABLE(ORIENTATION_EVENTS)
+        https://bugs.webkit.org/show_bug.cgi?id=29508
+        
+        See documentation here:
+        http://developer.apple.com/safari/library/documentation/AppleApplications/Reference/SafariWebContent/HandlingEvents/HandlingEvents.html#//apple_ref/doc/uid/TP40006511-SW16
+
+        * DerivedSources.make: Use new WebCore.OrientationEvents.exp file if ENABLE_ORIENTATION_EVENTS.
+        Add ENABLE_ORIENTATION_EVENTS to the new ADDITIONAL_IDL_DEFINES variable that is passed to the IDL
+        code generator. This is because ENABLE_ORIENTATION_EVENTS is not in FEATURE_DEFINES.
+        * WebCore.OrientationEvents.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.OrientationEvents.exp.
+        * dom/EventNames.h: Add onorientationchange.
+        * html/HTMLAttributeNames.in: Ditto.
+        * html/HTMLBodyElement.cpp: Handle onorientationchange properly.
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        (WebCore::HTMLBodyElement::onorientationchange):
+        (WebCore::HTMLBodyElement::setOnorientationchange):
+        * html/HTMLBodyElement.h: Ditto.
+        * html/HTMLBodyElement.idl: Ditto.
+        * html/HTMLFrameSetElement.cpp: Ditto.
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        (WebCore::HTMLFrameSetElement::onorientationchange):
+        (WebCore::HTMLFrameSetElement::setOnorientationchange):
+        * html/HTMLFrameSetElement.h: Ditto.
+        * html/HTMLFrameSetElement.idl: Ditto.
+        * page/DOMWindow.cpp: Ditto.
+        (WebCore::DOMWindow::orientation): Calls up the to the Frame for the orientation value.
+        (WebCore::DOMWindow::onorientationchange):
+        (WebCore::DOMWindow::setOnorientationchange):
+        * page/DOMWindow.h: Handle onorientationchange properly.
+        * page/DOMWindow.idl: Ditto.
+        * page/Frame.cpp: Ditto.
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::sendOrientationChangeEvent):
+        * page/Frame.h: Ditto.
+        (WebCore::Frame::orientation):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Try fixing the build again.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: completions are always evaluated against
+        window (discarding call frames).
+
+        https://bugs.webkit.org/show_bug.cgi?id=29616
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.selectedCallFrameId):
+
+2009-09-21  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows (Cairo) target.
+
+        Add stubs for SocketStream classes added in @r47788, which
+        broke the WinCairo build.
+
+        No new tests. (Build failure).
+
+        * WebCore.vcproj/WebCore.vcproj:  Add references to new files
+          to Cairo build, exclude from standard Apple build.
+        * platform/network/curl/SocketStreamError.h: Added.
+        * platform/network/curl/SocketStreamHandle.h: Added.
+        * platform/network/curl/SocketStreamHandleCurl.cpp: Added.
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Expose InspectorResource fields.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29537
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::sourceString):
+        (WebCore::InspectorResource::resourceData):
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::requestHeaderFields):
+        (WebCore::InspectorResource::responseHeaderFields):
+        (WebCore::InspectorResource::responseStatusCode):
+        (WebCore::InspectorResource::requestMethod):
+        (WebCore::InspectorResource::requestFormData):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: JS error drilling down childless node.
+        No need to dispatch double click twice - it is already handled
+        in TreeElement.treeElementDoubleClicked.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22144
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline):
+
+2009-09-21  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Implement new QWebPageClient class and let our classes
+        QWebViewPrivate and QWebGraphicsItemPrivate inherit from it.
+
+        For Qt, platformPageClient() will now return a class derived from
+        the QWebPageClient, so the patch adapts our Qt hooks to go though
+        this class and not depend on the QWebView.
+
+        * WebCore.pro:
+        * platform/Widget.h:
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QWebPageClient.h: Added.
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Evaluating on call frame always returns "undefined".
+
+        https://bugs.webkit.org/show_bug.cgi?id=29613
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.evaluateInCallFrame):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Exception formatting is broken in console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29608
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleCommandResult):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript.createProxyObject):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Console object formatting is broken.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29607
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._format):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy.wrapPrimitiveValue):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Crash When Logging an Element Before Opening Inspector
+
+        https://bugs.webkit.org/show_bug.cgi?id=29514
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+
+2009-09-21  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Incorrect clipping with accelerated compositing content, and position:fixed
+        https://bugs.webkit.org/show_bug.cgi?id=29347
+        
+        Fix the compositing clipping logic to behave correctly when position:fixed
+        elements clip, by using the new backgroundClipRect() method to determine
+        when we need to clip, and to compute the clipping layer position.
+
+        Test: compositing/overflow/fixed-position-ancestor-clip.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::clippedByAncestor):
+
+2009-09-21  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add back in a special case for window.top in the V8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29605
+
+        Fixes LayoutTests/fast/dom/Window/window-property-shadowing.html in the Chromium port.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Ensure window.top is not marked as read only, as this breaks the shadowing disabling.
+
+2009-09-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        HTMLMediaElement: media file should not reload when page comes out of page cache
+        https://bugs.webkit.org/show_bug.cgi?id=29604
+
+        Test: media/restore-from-page-cache.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::userCancelledLoad): Do nothing unless the element
+        is still loading. Only fire an 'emptied' event if the readyState is HAVE_NOTHING,
+        otherwise set the network state to NETWORK_IDLE.
+
+2009-09-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Sean/Shawn/Shaun" Garen.
+
+        Clarify two FIXMEs.
+
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+
+2009-09-21  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Drop down selects fail to close when a value is selected
+        https://bugs.webkit.org/show_bug.cgi?id=29582
+
+        Implement PopupListBox::hidePopup, which was previously
+        declared but unimplemented.  Removes the declaration of
+        showPopup since that method is not implemented.
+
+        PopupListBox::hidePopup takes care of hiding the popup,
+        by invoking hidePopup on its parent PopupContainer, and
+        then informs the PopupMenuClient that popupDidHide.
+        This mimics the old behavior prior to r48370.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::hidePopup):
+
+2009-09-21  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] Windows build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=29535
+
+        * platform/network/qt/DnsPrefetchHelper.cpp: Missing #include "config.h"  added.
+
+2009-09-21  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix. Missing files.
+
+        * GNUmakefile.am:
+
+2009-09-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Crash when clicking link in unload handler
+        https://bugs.webkit.org/show_bug.cgi?id=29525
+
+        Test that the first navigation always wins when the page tries to start
+        a new navigation in an unload handler.
+
+        Tests: fast/loader/unload-form-about-blank.html
+               fast/loader/unload-form-post-about-blank.html
+               fast/loader/unload-form-post.html
+               fast/loader/unload-form.html
+               fast/loader/unload-hyperlink.html
+               fast/loader/unload-javascript-url.html
+               fast/loader/unload-reload.html
+               fast/loader/unload-window-location.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+
+2009-09-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Sometimes crashes when a page is destroyed/loads another URL while playing video
+        https://bugs.webkit.org/show_bug.cgi?id=29496
+
+        Protect the video sink object, and destroy it in an idle callback
+        to hopefully avoid a race condition that leads to a crash.
+
+        This is already tested by media/video-seekable.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::idleUnref):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+
+2009-09-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix for GTK+ and a blind one for Qt after r48566.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-09-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29519
+        Remove JSNameNodeCollection and just use StaticNodeList
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        * bindings/js/JSNamedNodesCollection.cpp: Removed.
+        * bindings/js/JSNamedNodesCollection.h: Removed.
+
+2009-09-19  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29511
+        
+        Fixes an issue where script code that contains non-ASCII characters may bypass the 
+        XSSAuditor.
+        
+        Before performing a comparison between the script source code and input parameters, we
+        remove all non-ASCII characters, including non-printable ASCII characters from the
+        script source code and input parameters.
+
+        Tests: http/tests/security/xssAuditor/img-onerror-non-ASCII-char.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char-default-encoding.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2-default-encoding.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isNonCanonicalCharacter): Modified to remove all non-ASCII characters,
+        including non-printable ASCII characters.
+
+2009-09-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Incorrect animation with scale(0) transform (singular matrix)
+        https://bugs.webkit.org/show_bug.cgi?id=29465
+        
+        Make accelerated scale() and translate() animations go through the component animation
+        path (rather than just matrix animation) to avoid problems with singular scale matrices,
+        and be slightly more efficient.
+
+        Test: compositing/transitions/singular-scale-transition.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getTransformFunctionValue):
+        (WebCore::getValueFunctionNameForTransformOperation):
+
+2009-09-19  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Adds CSS styling and basic DOM element support for MathML
+
+        * DerivedSources.make:
+          Added user stylesheet and tag factory generation
+
+        * WebCore.xcodeproj/project.pbxproj:
+          Added new DOM element code
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAttr):
+          Added check for document since stylesheet can be added before there is a document
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForElement):
+          Added check to add MathML user agent stylesheet
+
+        * css/mathml.css: Added.
+          MathML user agent stylesheet
+
+        * dom/Document.cpp:
+        (WebCore::Document::createElement):
+          Added support for creation of MathML DOM objects
+
+        * dom/Node.h:
+        (WebCore::Node::isMathMLElement):
+          Added check method for whether the node is a MathML node
+
+        * mathml: Added.
+        * mathml/MathMLElement.cpp: Added.
+        (WebCore::MathMLElement::MathMLElement):
+        (WebCore::MathMLElement::create):
+        (WebCore::MathMLElement::createRenderer):
+        * mathml/MathMLElement.h: Added.
+        (WebCore::MathMLElement::isMathMLElement):
+          MathML DOM base class
+
+
+        * mathml/MathMLInlineContainerElement.cpp: Added.
+        (WebCore::MathMLInlineContainerElement::MathMLInlineContainerElement):
+        (WebCore::MathMLInlineContainerElement::create):
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/MathMLInlineContainerElement.h: Added.
+          Base class for non-text containers
+
+        * mathml/MathMLMathElement.cpp: Added.
+        (WebCore::MathMLMathElement::MathMLMathElement):
+        (WebCore::MathMLMathElement::create):
+        * mathml/MathMLMathElement.h: Added.
+          Root Math element
+
+        * mathml/mathtags.in: Added.
+          Element list mappings
+
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+          Added MathML name initialization
+2009-09-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Canvas drawn with data URL image raises SECURITY_ERR when toDataUrl() called.
+        https://bugs.webkit.org/show_bug.cgi?id=29305
+
+        We need to special-case data URLs when tainting a canvas because we
+        treat data URLs has having no security origin, unlike other
+        browsers.  The reason we do this is to help sites avoid XSS via data
+        URLs, but that consideration doesn't apply to canvas taint.
+
+        Also, we were previously incorrectly taking document.domain state
+        into account when tainting canvas.
+
+        Tests: http/tests/security/canvas-remote-read-data-url-image.html
+               http/tests/security/canvas-remote-read-data-url-svg-image.html
+               http/tests/security/canvas-remote-read-remote-image-document-domain.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::checkOrigin):
+        (WebCore::CanvasRenderingContext2D::createPattern):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::taintsCanvas):
+        * page/SecurityOrigin.h:
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix stylistic issue raised in code review for previous commit.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::hasNonZeroTransformOrigin):
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Element is misplaced during opacity transition with certain configuration of transform-origin and clipping
+        https://bugs.webkit.org/show_bug.cgi?id=29495
+        
+        If an element has zero size, but has a transform origin with absolute values,
+        then the transform origin would not be applied because it is implemented via
+        anchorPoint, which is expressed as a fraction of the layer size.
+        
+        Work around this by artificially inflating the size of the backing store when we need to.
+
+        Test: compositing/geometry/transfrom-origin-on-zero-size-layer.html
+
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        Init m_artificiallyInflatedBounds to false.
+        
+        (WebCore::hasNonZeroTransformOrigin):
+        Utility function that describes whether the transform-origin contains non-percentage
+        x or y offsets.
+        
+        (WebCore::RenderLayerBacking::updateCompositedBounds):
+        New wrapper method around setCompositedBounds() that applies the size inflation
+        when necessary, setting the m_artificiallyInflatedBounds as appropriate.
+        
+        (WebCore::RenderLayerBacking::updateAfterLayout): Call updateCompositedBounds().
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Ditto
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Ditto
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry): Ditto
+
+2009-09-18  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29512
+        Don't recalculate style when restoring from the page cache
+
+        FrameLoaderClient::forceLayout() also forces style recalc. Instead call FrameView::forceLayout() 
+        directly to update the scrollbars while keeping the existing style.
+        
+        Makes back/forward really fast on complex pages (in cases where page cache works).
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad):
+
+2009-09-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Implement ES5 Object.defineProperty function
+        https://bugs.webkit.org/show_bug.cgi?id=29503
+
+        Override defineOwnProperty on JSDOMWindowShell to forward appropriately,
+        and then override defineOwnProperty on JSDOMWindow to disallow cross origin
+        defineOwnProperty usage.  We also override defineOwnProperty on QuarantinedObjectWrapper
+        to ensure correct wrapping semantics of quarantined objects.
+
+        One major caveat in this patch is that it currently disallows the use
+        of Object.defineProperty on DOMObjects other than the window due to
+        the significant work involved in correctly propagating attributes and
+        ensuring correct semantics on dom objects.
+
+        Tests: fast/js/Object-defineProperty.html
+               http/tests/security/xss-DENIED-defineProperty.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMObject::defineOwnProperty):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::defineGetter):
+        (WebCore::JSDOMWindow::defineSetter):
+        (WebCore::JSDOMWindow::defineOwnProperty):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::defineOwnProperty):
+        (WebCore::JSDOMWindowShell::defineGetter):
+        (WebCore::JSDOMWindowShell::defineSetter):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::defineGetter):
+        (WebCore::JSLocationPrototype::defineGetter):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
+        (WebCore::JSQuarantinedObjectWrapper::defineOwnProperty):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-09-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29510
+        Active DOM objects should be suspended while a modal dialog is displayed
+
+        * manual-tests/js-timers-beneath-modal-dialog.html: Added a test for JS timers.
+
+        * page/PageGroupLoadDeferrer.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+        Match other platforms, and make Mac also suspend active DOM objects. Since a page that
+        currently displays a modal dialog cannot go into page cache, there is no danger of suspending
+        an object twice.        
+
+2009-09-18  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Buildfix caused by http://trac.webkit.org/changeset/48513
+        https://bugs.webkit.org/show_bug.cgi?id=29351
+
+        * bridge/qt/qt_instance.h: createRuntimeObject method renamed to newRuntimeObject.
+        * bridge/runtime.h: Visibility of newRuntimeObject method modified to protected.
+
+2009-09-18  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix parameter substitutions in console.log().
+
+        https://bugs.webkit.org/show_bug.cgi?id=29366
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._format):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getPrototypes):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+        * inspector/front-end/utilities.js:
+        ():
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen and Brady Eidson.
+
+        Temporarily remove an assertion that was getting hit when going
+        back to a page in the page cache while a banner in Safari was visible.
+        We should re-enable this once that is fixed. See <rdar://problem/7218118>
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scheduleRelayout):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Try fixing the build again.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Fix windows build.
+        
+        * platform/win/PopupMenuWin.cpp:
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin 'BearClaw' Barraclough.
+
+        Convert another callback type object to store the global object
+        instead of the frame.
+
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::create):
+        (WebCore::JSCustomXPathNSResolver::JSCustomXPathNSResolver):
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSCustomXPathNSResolver.h:
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29332
+        <rdar://problem/7231652> 
+        REGRESSION (r48446): While a <select> popup menu is open, the
+        rest of the WebView doesn't respond to mouse move events.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::translatePoint):
+        New helper function that translates a point between HWND coordinates.
+        
+        (WebCore::PopupMenu::show):
+        Protect the PopupMenu if someone removes the <select> in response to a mouse
+        event. Handle WM_HOST_WINDOW_MOUSEMOVE events.
+        
+        (WebCore::PopupMenu::wndProc):
+        in the WM_MOUSEMOVE handler, if the mouse is not over the popup, post a 
+        WM_HOST_WINDOW_MOUSEMOVE event so that the host window (the WebView) gets the
+        mouse move event.
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Compositing layers are incorrectly positioned after scrolling with position:fixed
+        https://bugs.webkit.org/show_bug.cgi?id=29262
+        
+        When scrolling a page with compositing layers inside a position:fixed element,
+        we need to update the compositing layer positions when the scroll position changes.
+
+        Test: compositing/geometry/fixed-position.html
+
+        * WebCore.base.exp:
+        Export FrameView::scrollPositionChanged()
+        
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollPositionChanged):
+        New method that sends the scroll event, and updates compositing layers positions if necessary.
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Transformed elements inside position:fixed container are clipped incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=29346
+        
+        Fix clipping and hit testing on transformed elements inside a position:fixed element.
+        Previously, the code used the overflowClipRect of the parent clip rects, but
+        this is not correct for fixed postion elements. Instead, share code that is
+        already present in calculateRects() to get the correct rect.
+
+        Test: fast/overflow/position-fixed-transform-clipping.html
+
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        Call the new backgroundClipRect() to get the correct clipRect.
+        
+        (WebCore::RenderLayer::backgroundClipRect):
+        New method, factored out of calculateRects(), that computes the clip rect,
+        doing the right thing for fixed position elements.
+        
+        (WebCore::RenderLayer::calculateRects):
+        Call the new backgroundClipRect() method.
+        
+2009-09-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <rdar://problem/7050773> REGRESSION (r40098) Crash at
+        WebCore::RenderBlock::layoutBlock()
+        https://bugs.webkit.org/show_bug.cgi?id=29498
+
+        Test: accessibility/nested-layout-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::updateBackingStore): Changed to
+            call Document::updateLayoutIgnorePendingStylesheets() instead of
+            calling RenderObject::layoutIfNeeded(). The latter requires that
+            there be no pending style recalc, which allows methods that call
+            Document::updateLayout() to be called during layout without risking
+            re-entry into layout.
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityActionNames]): Null-check
+            m_object after calling updateBackingStore(), since style recalc may
+            destroy the renderer, which destroys the accessibility object and
+            detaches it from the wrapper.
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityFocusedUIElement]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityHitTest:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIsIgnored]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+             Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformAction:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+            Ditto.
+
+2009-09-18  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Simon Hausmann.
+
+        Update Qt build system for Web Socket.
+        https://bugs.webkit.org/show_bug.cgi?id=29270
+
+        * WebCore.pro:
+        * platform/network/qt/SocketStreamError.h: Added.
+        * platform/network/qt/SocketStreamHandle.h: Added.
+        * platform/network/qt/SocketStreamHandleSoup.cpp: Added.
+
+2009-09-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        NULL check HTMLMediaElement::m_playedTimeRanges.
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29494
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::addPlayedRange): New. Create m_playedTimeRanges if
+        necessary, add range specified.
+        (WebCore::HTMLMediaElement::seek): Use addPlayedRange. 
+        (WebCore::HTMLMediaElement::played): Use addPlayedRange. Change time comparison 
+        to be more readable.
+        (WebCore::HTMLMediaElement::updatePlayState): Ditto.
+        * html/HTMLMediaElement.h:
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Follow up fix for https://bugs.webkit.org/show_bug.cgi?id=29276
+        REGRESSION(r48334): WebKit crashes on file select by drag
+
+        Don't use Document.elementFromPoint since it returns null if the point
+        is outside the viewport.  Instead, just hit test ourselves.
+
+        Test: fast/events/drag-file-crash.html
+
+        * page/DragController.cpp:
+        (WebCore::elementUnderMouse):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+
+2009-09-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Each wrapped Objective-C object should use a single RuntimeObjectImp
+        https://bugs.webkit.org/show_bug.cgi?id=29351
+        rdar://problem/7142294
+
+        * WebCore.base.exp: Added a newly-needed exported symbol.
+
+        * bindings/objc/DOMInternal.h: Eliminated unused
+        createWrapperCacheWithIntegerKeys; it has not been needed since the
+        RGBColor wrappers were reworked.
+        * bindings/objc/DOMInternal.mm: Ditto.
+
+        * bridge/objc/objc_instance.h: Made the create function non-inline.
+        * bridge/objc/objc_instance.mm:
+        (createInstanceWrapperCache): Added. Creates an appropriate map table.
+        (ObjcInstance::create): Moved here from header. Uses NSMapGet and
+        NSMapInsert to cache the instance in a map table.
+        (ObjcInstance::~ObjcInstance): Added a call to NSMapRemove to remove
+        the instance from the map table.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance): Remove unneeded code to remove
+        the instance from cachedObjects, which no longer exists.
+        (JSC::Bindings::QtInstance::newRuntimeObject): Renamed to overload new
+        bottleneck. Caching is now handled by the base class.
+
+        * bridge/runtime.cpp:
+        (JSC::Bindings::Instance::Instance): Initialize m_runtimeObject to 0.
+        (JSC::Bindings::Instance::~Instance): Assert m_runtimeObject is 0.
+        (JSC::Bindings::Instance::createRuntimeObject): Use m_runtimeObject
+        if it's already set. Set m_runtimeObject and call addRuntimeObject
+        if it's not.
+        (JSC::Bindings::Instance::newRuntimeObject): Added. Virtual function,
+        used only by createRuntimeObject.
+        (JSC::Bindings::Instance::willDestroyRuntimeObject): Added.
+        Calls removeRuntimeObject and then clears m_runtimeObject.
+        (JSC::Bindings::Instance::willInvalidateRuntimeObject): Added.
+        Clears m_runtimeObject.
+
+        * bridge/runtime.h: Made createRuntimeObject non-virtual. Added
+        willDestroyRuntimeObject, willInvalidateRuntimeObject,
+        newRuntimeObject, and m_runtimeObject.
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp): Removed addRuntimeObject
+        call, now handled by caller.
+        (JSC::RuntimeObjectImp::~RuntimeObjectImp): Replaced removeRuntimeObject
+        call with willDestroyRuntimeObject call; the latter nows calls
+        removeRuntimeObject.
+        (JSC::RuntimeObjectImp::invalidate): Added willInvalidateRuntimeObject
+        call.
+
+        * bridge/runtime_object.h: Made invalidate non-virtual.
+
+2009-09-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make PlatformWindow return something else than PlatformWidget
+        https://bugs.webkit.org/show_bug.cgi?id=29085
+
+        Make platformWindow return a PlatformPageClient
+        (for now typedef'ed to PlatformWidget)
+
+        Also, change the name of platformWindow to platformPageClient()
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::platformPageClient):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::platformPageClient):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::wheelEvent):
+        (WebCore::EventHandler::currentPlatformMouseEvent):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::eventMayStartDrag):
+        * platform/HostWindow.h:
+        * platform/Widget.h:
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+        (WebCore::ScrollView::visibleContentRect):
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setCursor):
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::monitorInfoForWidget):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::calculatePositionAndSize):
+        (WebCore::PopupMenu::wndProc):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::nativeWindowForRenderObject):
+        * platform/wx/ScrollbarThemeWx.cpp:
+        (WebCore::ScrollbarThemeWx::paint):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+
+2009-09-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Web inspector UI adjustments specific to the Qt platform:
+        - Hide the close button
+        - Hide the dock button
+        - Disable the draggable toolbar
+
+        https://bugs.webkit.org/show_bug.cgi?id=29384
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.toolbarDragStart):
+
+2009-09-18  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        QtWebKit Windows CE compile fixes
+
+        Exclude certain pure-WINCE specific code paths from the Qt build.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/FontCache.h:
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop): Guard this code block with NETSCAPE_PLUGIN_API as
+        the corresponding PluginViewWndProc has the same guard in the header file.
+
+2009-09-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Geolocation does not correctly handle Infinity for PositionOptions properties.
+        https://bugs.webkit.org/show_bug.cgi?id=29099
+
+        * bindings/js/JSGeolocationCustom.cpp: Modified.
+        (WebCore::createPositionOptions): Modified. If timeout or maximumAge is positive infinity, applies these values as a special case.
+        * page/PositionOptions.h: Modified.
+        (WebCore::PositionOptions::hasMaximumAge): Added. Determines whether the object has a maximum age.
+        (WebCore::PositionOptions::maximumAge): Modified. Asserts that the object has a maximum age.
+        (WebCore::PositionOptions::clearMaximumAge): Added. Clears the maximum age.
+        (WebCore::PositionOptions::setMaximumAge): Modified. Registers that the maximum age has been set.
+        (WebCore::PositionOptions::PositionOptions): Modified. Registers that the maximum age has been set.
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29276
+        REGRESSION(r48334): WebKit crashes on file select by drag
+
+        Document.elementFromPoint now takes point in client space, not page space.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+
+2009-09-17  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        Reimplement default media UI for Mac Chromium to match the style
+        of the Windows and Linux versions.  Also breaks the dependency
+        on the internal wk* functions that were previously used to
+        render the media controller widgets.
+        https://bugs.webkit.org/show_bug.cgi?id=29161
+
+        No media layout tests are currently enabled in Mac Chromium, so
+        nothing needs rebaselineing, etc.
+
+        This is a recommit of r48438 with a compile fix and merges of
+        recent changes to the file.
+
+        * css/mediaControlsChromium.css:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::mediaElementParent):
+        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
+        (WebCore::mediaSliderThumbImage):
+        (WebCore::mediaVolumeSliderThumbImage):
+        (WebCore::RenderThemeChromiumMac::paintSliderTrack):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
+        (WebCore::RenderThemeChromiumMac::paintMediaButtonInternal):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize):
+
+2009-09-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        The Console scope bar should have a divider between All and the other possible
+        values (Errors, Warnings, Logs). It will look something like:
+        
+        All | Errors Warnings Logs.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createDividerElement):
+        (WebInspector.ConsoleView):
+        * inspector/front-end/inspector.css:
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove additional references to JSVoidCallback which no longer exists.
+
+        * DerivedSources.cpp:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Remove commented out onhashchange attribute now that it is implemented.
+
+        * page/DOMWindow.idl:
+
+2009-09-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7007541> 
+        CrashTracer: 4800+ crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
+        
+        Make RuntimeObjectImp more robust against m_instance being a null (which can happen if an OOP plug-in
+        crashes while we're calling into it).
+        
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp):
+        (JSC::RuntimeObjectImp::~RuntimeObjectImp):
+        (JSC::RuntimeObjectImp::invalidate):
+        (JSC::RuntimeObjectImp::fallbackObjectGetter):
+        (JSC::RuntimeObjectImp::fieldGetter):
+        (JSC::RuntimeObjectImp::methodGetter):
+        (JSC::RuntimeObjectImp::getOwnPropertySlot):
+        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
+        (JSC::RuntimeObjectImp::put):
+        (JSC::RuntimeObjectImp::defaultValue):
+        (JSC::RuntimeObjectImp::getCallData):
+        (JSC::RuntimeObjectImp::getConstructData):
+        (JSC::RuntimeObjectImp::getPropertyNames):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::getInternalInstance):
+
+2009-09-17  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Wrap primitive values (as objects) in InspectorController::wrap.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28983
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::wrapObject): objects of any type will be wrapped into proxies,
+         only object proxies will have objectId.
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions): there is InjectedScript.getCompletionsi
+         that accepts an expression and returns possible completions. This way we don't need to wrap
+         and unwrap the completions result into a proxy object.
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.createProxyObject):
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-09-17  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Wrap PageTransitionEvents properly for V8's use.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29340
+
+        Fixes Chromium's failures for LayoutTests/fast/events/pageshow-pagehide.html.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object): Wrap PageTransitionEvents properly.
+
+2009-09-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Hardware-accelerated opacity transition on inline asserts
+        https://bugs.webkit.org/show_bug.cgi?id=29342
+        
+        Remove an erroneous toRenderBox() that could be called on a RenderInline; we can just
+        pass an empty size, because the box size is only required for transform animations.
+
+        Test: compositing/transitions/opacity-on-inline.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startTransition):
+
+2009-09-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] OwnHandle might get a weak callback after destruction
+        https://bugs.webkit.org/show_bug.cgi?id=29172
+
+        Be sure to clear out weak reference so we don't get a weak callback
+        after we've destructed ourselves.  Also, removed some tricky methods
+        that had no clients.
+
+        * bindings/v8/OwnHandle.h:
+        (WebCore::OwnHandle::clear):
+
+2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Partial roll out of http://trac.webkit.org/changeset/48455 to
+        fix crashes that started happening in V8Proxy::getEnteredContext().
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+
+2009-09-17  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: labels of checkboxes should, when hit-tested, return the checkbox
+        https://bugs.webkit.org/show_bug.cgi?id=29335
+
+        When an accessibility hit test is done and it hits the label of a control element,
+        the control element should be returned instead of nothing, since the label
+        itself is usually ignored.
+
+        Test: accessibility/label-for-control-hittest.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::correspondingControlForLabelElement):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        (WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-09-17  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Dimitri Glazkov, build fix.
+
+        Change to make RenderThemeChromiumMac compile inside of non PLATFORM(MAC).
+        https://bugs.webkit.org/show_bug.cgi?id=29243
+
+        Covered by existing tests.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+
+2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Accessing properties/methods of an object, created with document.implementation.createDocumentType
+        creates nodes that have no document (ScriptExecutionContext), which in turn produces NULL-ref crashes.
+        https://bugs.webkit.org/show_bug.cgi?id=26402
+
+        Test: fast/dom/DOMImplementation/detached-doctype.html
+              fast/dom/doctype-event-listener-crash.html
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener): Added an extra NULL-check.
+
+2009-09-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        FontDescription.h includes RenderStyleConstants.h, which violates layering
+        https://bugs.webkit.org/show_bug.cgi?id=29327
+
+        * GNUmakefile.am: Added FontSmoothingMode.h.
+        * WebCore.gypi: Added FontSmoothingMode.h.
+        * WebCore.vcproj/WebCore.vcproj: Added FontSmoothingMode.h.
+        * WebCore.xcodeproj/project.pbxproj: Added FontSmoothingMode.h and made
+            it a private header.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Get the
+            font smoothing mode via the font description.
+        * css/CSSPrimitiveValueMappings.h: Include FontSmoothingMode.h
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Updated for the rename
+            of FontSmoothing to FontSmoothingMode.
+        (WebCore::CSSPrimitiveValue::operator FontSmoothingMode): Ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Get the font smoothing mode
+            via the font description.
+        * platform/graphics/FontDescription.h: Do not include
+            RenderStyleConstants.h.
+        (WebCore::FontDescription::fontSmoothing): Updated for the rename of
+            FontSmoothing to FontSmoothingMode.
+        (WebCore::FontDescription::setFontSmoothing): Ditto.
+        * platform/graphics/FontSmoothingMode.h: Added.
+        (WebCore::FontSmoothingMode): Moved the FontSmoothing enum from
+            RenderStyleConstants here and renamed it to this.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::fontSmoothing): Removed this getter, since
+            this can be accessed via the font description.
+        * rendering/style/RenderStyleConstants.h: Moved the FontSmoothing enum
+            from here to FontSmoothingMode.h.
+
+2009-09-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx 2.9 build fix.
+
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxGetGdkWindowForDC):
+
+2009-09-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Elements appear behind <video> when they should be in front sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=29314
+        
+        r45598 added logic that tests for overlap with <video> to determine when to throw
+        a layer into compositing mode. That logic was incorrect in some cases, and this patch
+        fixes it. When testing overlap, the layer needs to be composited iff some previous layer
+        is composited (which adds a rect to the overlay map), and there is overlap.
+
+        Test: compositing/geometry/video-opacity-overlay.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::CompositingState::CompositingState):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-09-17  Avi Drissman  <avi@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Update the Chromium Mac theming files (RenderTheme and Theme) to be
+        up-to-date.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29243
+        http://crbug.com/19604
+
+        Covered by existing tests.
+
+        * WebCore.gypi:
+        * platform/chromium/ThemeChromiumMac.h: Added.
+        (WebCore::ThemeChromiumMac::ThemeChromiumMac):
+        (WebCore::ThemeChromiumMac::~ThemeChromiumMac):
+        (WebCore::ThemeChromiumMac::controlRequiresPreWhiteSpace):
+        * platform/chromium/ThemeChromiumMac.mm: Added.
+        (WebCore::):
+        (WebCore::platformTheme):
+        (WebCore::controlSizeForFont):
+        (WebCore::sizeFromFont):
+        (WebCore::setControlSize):
+        (WebCore::updateStates):
+        (WebCore::inflateRect):
+        (WebCore::checkboxSizes):
+        (WebCore::checkboxMargins):
+        (WebCore::checkboxSize):
+        (WebCore::checkbox):
+        (WebCore::paintCheckbox):
+        (WebCore::radioSizes):
+        (WebCore::radioMargins):
+        (WebCore::radioSize):
+        (WebCore::radio):
+        (WebCore::paintRadio):
+        (WebCore::buttonSizes):
+        (WebCore::buttonMargins):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeChromiumMac::baselinePositionAdjustment):
+        (WebCore::ThemeChromiumMac::controlFont):
+        (WebCore::ThemeChromiumMac::controlSize):
+        (WebCore::ThemeChromiumMac::minimumControlSize):
+        (WebCore::ThemeChromiumMac::controlBorder):
+        (WebCore::ThemeChromiumMac::controlPadding):
+        (WebCore::ThemeChromiumMac::inflateControlPaintRect):
+        (WebCore::ThemeChromiumMac::paint):
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/IntRect.h:
+        * rendering/RenderThemeChromiumMac.h:
+        (WebCore::RenderThemeChromiumMac::supportsControlTints):
+        (WebCore::RenderThemeChromiumMac::scrollbarControlSizeForPart):
+        (WebCore::RenderThemeChromiumMac::supportsSelectionForegroundColors):
+        * rendering/RenderThemeChromiumMac.mm:
+        (-[WebCoreRenderThemeNotificationObserver systemColorsDidChange:]):
+        (-[RTCMFlippedView isFlipped]):
+        (-[RTCMFlippedView currentEditor]):
+        (WebCore::):
+        (WebCore::FlippedView):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeChromiumMac::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumMac::systemFont):
+        (WebCore::convertNSColorToColor):
+        (WebCore::menuBackgroundColor):
+        (WebCore::RenderThemeChromiumMac::systemColor):
+        (WebCore::RenderThemeChromiumMac::isControlStyled):
+        (WebCore::RenderThemeChromiumMac::adjustRepaintRect):
+        (WebCore::RenderThemeChromiumMac::inflateRect):
+        (WebCore::RenderThemeChromiumMac::convertToPaintingRect):
+        (WebCore::RenderThemeChromiumMac::setFontFromControlSize):
+        (WebCore::RenderThemeChromiumMac::paintTextField):
+        (WebCore::RenderThemeChromiumMac::paintCapsLockIndicator):
+        (WebCore::RenderThemeChromiumMac::paintTextArea):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::TopGradientInterpolate):
+        (WebCore::BottomGradientInterpolate):
+        (WebCore::MainGradientInterpolate):
+        (WebCore::TrackGradientInterpolate):
+        (WebCore::RenderThemeChromiumMac::paintMenuListButtonGradients):
+        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingRight):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingTop):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumMac::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSliderTrackStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbStyle):
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintSearchField):
+        (WebCore::RenderThemeChromiumMac::setSearchCellState):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldDecoration):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+        (WebCore::mediaControllerTheme):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
+        (WebCore::getMediaUIPartStateFlags):
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaRewindButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaReturnToRealtimeButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
+        (WebCore::RenderThemeChromiumMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeChromiumMac::paintMediaTimeRemaining):
+        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
+
 2009-09-16  Daniel Bates  <dbates@webkit.org>
 
         Reviewed by Darin Adler.
diff --git a/src/3rdparty/webkit/WebCore/DerivedSources.cpp b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
index 408daba..2131793 100644
--- a/src/3rdparty/webkit/WebCore/DerivedSources.cpp
+++ b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
@@ -333,7 +333,6 @@
 #include "JSTreeWalker.cpp"
 #include "JSUIEvent.cpp"
 #include "JSValidityState.cpp"
-#include "JSVoidCallback.cpp"
 #include "JSWebKitAnimationEvent.cpp"
 #include "JSWebKitCSSKeyframeRule.cpp"
 #include "JSWebKitCSSKeyframesRule.cpp"
diff --git a/src/3rdparty/webkit/WebCore/WebCore.LP64.exp b/src/3rdparty/webkit/WebCore/WebCore.LP64.exp
deleted file mode 100644
index cc04718..0000000
--- a/src/3rdparty/webkit/WebCore/WebCore.LP64.exp
+++ /dev/null
@@ -1,15 +0,0 @@
-# This file gets appended to WebCore.exp, only for 64-bit architectures.
-
-__ZN3JSC16RuntimeObjectImp6s_infoE
-__ZN3JSC8Bindings10RootObjectD1Ev
-__ZN3JSC8Bindings8Instance19createRuntimeObjectEPNS_9ExecStateE
-__ZN3JSC8Bindings8InstanceC2EN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZN3JSC8Bindings8InstanceD2Ev
-__ZN7WebCore13IdentifierRep3getEi
-__ZN7WebCore13IdentifierRep3getEPKc
-__ZN7WebCore13IdentifierRep7isValidEPS0_
-__ZN7WebCore16ScriptController16createRootObjectEPv
-__ZN7WebCore16ScriptController24jsObjectForPluginElementEPNS_17HTMLPlugInElementE
-__ZN7WebCore16ScriptController9isEnabledEv
-__ZN7WebCore6String26fromUTF8WithLatin1FallbackEPKcm
-__ZN7WebCore6String8fromUTF8EPKcm
diff --git a/src/3rdparty/webkit/WebCore/WebCore.gypi b/src/3rdparty/webkit/WebCore/WebCore.gypi
index 3a5c73c..758d99d 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.gypi
+++ b/src/3rdparty/webkit/WebCore/WebCore.gypi
@@ -532,7 +532,6 @@
             'bindings/js/JSRGBColor.h',
             'bindings/js/JSSharedWorkerConstructor.cpp',
             'bindings/js/JSSharedWorkerConstructor.h',
-            'bindings/js/JSSharedWorkerContextCustom.cpp',
             'bindings/js/JSSharedWorkerCustom.cpp',
             'bindings/js/JSSQLResultSetRowListCustom.cpp',
             'bindings/js/JSSQLTransactionCustom.cpp',
@@ -690,6 +689,8 @@
             'bindings/v8/custom/V8XMLSerializerConstructor.cpp',
             'bindings/v8/custom/V8XPathEvaluatorConstructor.cpp',
             'bindings/v8/custom/V8XSLTProcessorCustom.cpp',
+            'bindings/v8/DateExtension.cpp',
+            'bindings/v8/DateExtension.h',
             'bindings/v8/DOMData.cpp',
             'bindings/v8/DOMData.h',
             'bindings/v8/DOMDataStore.cpp',
@@ -1771,6 +1772,8 @@
             'platform/chromium/SuddenTerminationChromium.cpp',
             'platform/chromium/SystemTimeChromium.cpp',
             'platform/chromium/TemporaryLinkStubs.cpp',
+            'platform/chromium/ThemeChromiumMac.h',
+            'platform/chromium/ThemeChromiumMac.mm',
             'platform/chromium/WidgetChromium.cpp',
             'platform/chromium/WindowsVersion.cpp',
             'platform/chromium/WindowsVersion.h',
@@ -2064,6 +2067,7 @@
             'platform/graphics/FontFastPath.cpp',
             'platform/graphics/FontRenderingMode.h',
             'platform/graphics/FontSelector.h',
+            'platform/graphics/FontSmoothingMode.h',
             'platform/graphics/FontTraitsMask.h',
             'platform/graphics/GeneratedImage.cpp',
             'platform/graphics/GeneratedImage.h',
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index e614ffb..de3717d 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -169,8 +169,7 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 }
 
 # Web Socket support.
-# FIXME: Enable once platform code is landed.
-# !contains(DEFINES, ENABLE_WEB_SOCKETS=.): DEFINES += ENABLE_WEB_SOCKETS=1
+!contains(DEFINES, ENABLE_WEB_SOCKETS=.): DEFINES += ENABLE_WEB_SOCKETS=1
 
 DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1 WTF_CHANGES=1
 
@@ -714,7 +713,6 @@ SOURCES += \
     bindings/js/JSInspectorCallbackWrapper.cpp \
     bindings/js/JSLocationCustom.cpp \
     bindings/js/JSNamedNodeMapCustom.cpp \
-    bindings/js/JSNamedNodesCollection.cpp  \
     bindings/js/JSNavigatorCustom.cpp  \
     bindings/js/JSNodeCustom.cpp \
     bindings/js/JSNodeFilterCondition.cpp \
@@ -1392,7 +1390,6 @@ HEADERS += \
     bindings/js/JSLazyEventListener.h \
     bindings/js/JSLocationCustom.h \
     bindings/js/JSMessageChannelConstructor.h \
-    bindings/js/JSNamedNodesCollection.h \
     bindings/js/JSNodeFilterCondition.h \
     bindings/js/JSOptionConstructor.h \
     bindings/js/JSPluginElementFunctions.h \
@@ -1904,6 +1901,7 @@ HEADERS += \
     platform/network/ResourceRequestBase.h \
     platform/network/ResourceResponseBase.h \
     platform/qt/ClipboardQt.h \
+    platform/qt/QWebPageClient.h \
     platform/qt/QWebPopup.h \
     platform/qt/RenderThemeQt.h \
     platform/qt/ScrollbarThemeQt.h \
@@ -2637,7 +2635,6 @@ contains(DEFINES, ENABLE_SHARED_WORKERS=1) {
 
     SOURCES += \
         bindings/js/JSSharedWorkerConstructor.cpp \
-        bindings/js/JSSharedWorkerContextCustom.cpp \
         bindings/js/JSSharedWorkerCustom.cpp \
         workers/DefaultSharedWorkerRepository.cpp \
         workers/SharedWorker.cpp \
@@ -3105,6 +3102,20 @@ SOURCES += \
     bindings/js/JSDOMApplicationCacheCustom.cpp
 }
 
+contains(DEFINES, ENABLE_WEB_SOCKETS=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WEB_SOCKETS=1
+
+SOURCES += \
+    websockets/WebSocket.cpp \
+    websockets/WebSocketChannel.cpp \
+    websockets/WebSocketHandshake.cpp \
+    platform/network/SocketStreamErrorBase.cpp \
+    platform/network/SocketStreamHandleBase.cpp \
+    platform/network/qt/SocketStreamHandleSoup.cpp \
+    bindings/js/JSWebSocketCustom.cpp \
+    bindings/js/JSWebSocketConstructor.cpp
+}
+
 # GENERATOR 1: IDL compiler
 idl.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JS${QMAKE_FILE_BASE}.cpp
 idl.variable_out = GENERATED_SOURCES
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
index 8762fd8..c5ba1ed 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
@@ -316,6 +316,7 @@ public:
     virtual void linkedUIElements(AccessibilityChildrenVector&) const { }
     virtual AccessibilityObject* titleUIElement() const { return 0; }
     virtual bool exposesTitleUIElement() const { return true; }
+    virtual AccessibilityObject* correspondingControlForLabelElement() const { return 0; }
 
     virtual AccessibilityRole ariaRoleAttribute() const { return UnknownRole; }
     virtual bool isPresentationalChildOfAriaRole() const { return false; }
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
index b7dd601..834e931 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -1276,15 +1276,9 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     
     // find out if this element is inside of a label element.
     // if so, it may be ignored because it's the label for a checkbox or radio button
-    HTMLLabelElement* labelElement = labelElementContainer();
-    if (labelElement) {
-        HTMLElement* correspondingControl = labelElement->correspondingControl();
-        if (correspondingControl && correspondingControl->renderer()) {
-            AccessibilityObject* controlObject = axObjectCache()->getOrCreate(correspondingControl->renderer());
-            if (!controlObject->exposesTitleUIElement())
-                return true;
-        }
-    }
+    AccessibilityObject* controlObject = correspondingControlForLabelElement();
+    if (controlObject && !controlObject->exposesTitleUIElement())
+        return true;
         
     AccessibilityRole ariaRole = ariaRoleAttribute();
     if (ariaRole == TextAreaRole || ariaRole == StaticTextRole) {
@@ -2119,8 +2113,14 @@ AccessibilityObject* AccessibilityRenderObject::doAccessibilityHitTest(const Int
     if (obj->isListBox())
         return static_cast<AccessibilityListBox*>(result)->doAccessibilityHitTest(point);
         
-    if (result->accessibilityIsIgnored())
+    if (result->accessibilityIsIgnored()) {
+        // If this element is the label of a control, a hit test should return the control.
+        AccessibilityObject* controlObject = result->correspondingControlForLabelElement();
+        if (controlObject && !controlObject->exposesTitleUIElement())
+            return controlObject;
+
         result = result->parentObjectUnignored();
+    }
 
     return result;
 }
@@ -2199,6 +2199,18 @@ void AccessibilityRenderObject::handleActiveDescendantChanged()
         doc->axObjectCache()->postNotification(activedescendant->renderer(), AXObjectCache::AXFocusedUIElementChanged, true);
 }
 
+AccessibilityObject* AccessibilityRenderObject::correspondingControlForLabelElement() const
+{
+    HTMLLabelElement* labelElement = labelElementContainer();
+    if (!labelElement)
+        return 0;
+    
+    HTMLElement* correspondingControl = labelElement->correspondingControl();
+    if (!correspondingControl)
+        return 0;
+    
+    return axObjectCache()->getOrCreate(correspondingControl->renderer());     
+}
 
 AccessibilityObject* AccessibilityRenderObject::observableObject() const
 {
@@ -2664,7 +2676,9 @@ void AccessibilityRenderObject::updateBackingStore()
 {
     if (!m_renderer)
         return;
-    m_renderer->view()->layoutIfNeeded();
-}    
-    
+
+    // Updating layout may delete m_renderer and this object.
+    m_renderer->document()->updateLayoutIgnorePendingStylesheets();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
index e600b61..d82ca71 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
@@ -133,6 +133,8 @@ public:
     virtual void linkedUIElements(AccessibilityChildrenVector&) const;
     virtual bool exposesTitleUIElement() const;
     virtual AccessibilityObject* titleUIElement() const;
+    virtual AccessibilityObject* correspondingControlForLabelElement() const;
+
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
     virtual bool ariaRoleHasPresentationalChildren() const;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
index 475b374..aac1c63 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
@@ -44,21 +44,6 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSAbstractWorker::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
-
-    markIfNotNull(markStack, m_impl->onerror());
-
-    typedef AbstractWorker::EventListenersMap EventListenersMap;
-    typedef AbstractWorker::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
-}
-
 JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index 4476be5..da4a53a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -49,13 +49,13 @@ PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(JSC::ExecSta
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
     }
-    
-    return adoptRef(new JSCustomXPathNSResolver(resolverObject, asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame()));
+
+    return adoptRef(new JSCustomXPathNSResolver(resolverObject, asJSDOMWindow(exec->dynamicGlobalObject())));
 }
 
-JSCustomXPathNSResolver::JSCustomXPathNSResolver(JSObject* customResolver, Frame* frame)
+JSCustomXPathNSResolver::JSCustomXPathNSResolver(JSObject* customResolver, JSDOMWindow* globalObject)
     : m_customResolver(customResolver)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
 
@@ -67,15 +67,9 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
 {
     ASSERT(m_customResolver);
 
-    if (!m_frame)
-        return String();
-    if (!m_frame->script()->isEnabled())
-        return String();
-
     JSLock lock(SilenceAssertionsOnly);
 
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ExecState* exec = m_globalObject->globalExec();
         
     JSValue function = m_customResolver->get(exec, Identifier(exec, "lookupNamespaceURI"));
     CallData callData;
@@ -84,7 +78,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
         callType = m_customResolver->getCallData(callData);
         if (callType == CallTypeNone) {
             // FIXME: Pass actual line number and source URL.
-            m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "XPathNSResolver does not have a lookupNamespaceURI method.", 0, String());
+            m_globalObject->impl()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "XPathNSResolver does not have a lookupNamespaceURI method.", 0, String());
             return String();
         }
         function = m_customResolver;
@@ -95,9 +89,9 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     MarkedArgumentBuffer args;
     args.append(jsString(exec, prefix));
 
-    globalObject->globalData()->timeoutChecker.start();
+    m_globalObject->globalData()->timeoutChecker.start();
     JSValue retval = call(exec, function, callType, callData, m_customResolver, args);
-    globalObject->globalData()->timeoutChecker.stop();
+    m_globalObject->globalData()->timeoutChecker.stop();
 
     String result;
     if (exec->hadException())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h
index 44c44f9..7d66494 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h
@@ -41,6 +41,7 @@ namespace JSC {
 namespace WebCore {
 
     class Frame;
+    class JSDOMWindow;
 
     class JSCustomXPathNSResolver : public XPathNSResolver {
     public:
@@ -51,10 +52,11 @@ namespace WebCore {
         virtual String lookupNamespaceURI(const String& prefix);
 
     private:
-        JSCustomXPathNSResolver(JSC::JSObject*, Frame*);
+        JSCustomXPathNSResolver(JSC::JSObject*, JSDOMWindow*);
 
-        JSC::JSObject* m_customResolver; // JSCustomXPathNSResolvers are always temporary, thus no need to GC protect the object.
-        RefPtr<Frame> m_frame;
+        // JSCustomXPathNSResolvers are always temporary, thus no need to GC protect the objects.
+        JSC::JSObject* m_customResolver;
+        JSDOMWindow* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index b833e71..5855026 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -42,28 +42,6 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSDOMApplicationCache::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
-
-    markIfNotNull(markStack, m_impl->onchecking());
-    markIfNotNull(markStack, m_impl->onerror());
-    markIfNotNull(markStack, m_impl->onnoupdate());
-    markIfNotNull(markStack, m_impl->ondownloading());
-    markIfNotNull(markStack, m_impl->onprogress());
-    markIfNotNull(markStack, m_impl->onupdateready());
-    markIfNotNull(markStack, m_impl->oncached());
-    markIfNotNull(markStack, m_impl->onobsolete());
-
-    typedef DOMApplicationCache::EventListenersMap EventListenersMap;
-    typedef DOMApplicationCache::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
-}
-
 #if ENABLE(APPLICATION_CACHE_DYNAMIC_ENTRIES)
 
 JSValue JSDOMApplicationCache::hasItem(ExecState* exec, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index df384ea..1899797 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -275,7 +275,7 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
 
         // If a node is in the document, and has event listeners, its wrapper is
         // observable because its wrapper is responsible for marking those event listeners.
-        if (node->eventListeners().size())
+        if (node->hasEventListeners())
             return true; // Technically, we may overzealously mark a wrapper for a node that has only non-JS event listeners. Oh well.
 
         // If a node owns another object with a wrapper with custom properties,
@@ -323,6 +323,11 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
 #endif
     }
 
+    // If a node is firing event listeners, its wrapper is observable because
+    // its wrapper is responsible for marking those event listeners.
+    if (node->isFiringEventListeners())
+        return true;
+
     return false;
 }
 
@@ -648,4 +653,10 @@ JSC::JSObject* toJSSequence(ExecState* exec, JSValue value, unsigned& length)
     return object;
 }
 
+bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDescriptor&, bool)
+{
+    throwError(exec, TypeError, "defineProperty is not supported on DOM Objects");
+    return false;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
index c3ab266..c46513c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
@@ -55,6 +55,8 @@ namespace WebCore {
         {
         }
 
+        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, bool);
+
 #ifndef NDEBUG
         virtual ~DOMObject();
 #endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 27e95fe..08c7144 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -94,7 +94,7 @@ void JSDOMWindow::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    markEventListeners(markStack, impl()->eventListeners());
+    impl()->markEventListeners(markStack);
 
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
@@ -488,7 +488,7 @@ bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& prope
     return Base::getPropertyAttributes(exec, propertyName, attributes);
 }
 
-void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     // Only allow defining getters by frames in the same origin.
     if (!allowsAccessFrom(exec))
@@ -498,15 +498,23 @@ void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName,
     if (propertyName == "location")
         return;
 
-    Base::defineGetter(exec, propertyName, getterFunction);
+    Base::defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
-void JSDOMWindow::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+void JSDOMWindow::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
 {
     // Only allow defining setters by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
-    Base::defineSetter(exec, propertyName, setterFunction);
+    Base::defineSetter(exec, propertyName, setterFunction, attributes);
+}
+
+bool JSDOMWindow::defineOwnProperty(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    // Only allow defining properties in this way by frames in the same origin, as it allows setters to be introduced.
+    if (!allowsAccessFrom(exec))
+        return false;
+    return Base::defineOwnProperty(exec, propertyName, descriptor, shouldThrow);
 }
 
 JSValue JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& propertyName)
@@ -572,13 +580,13 @@ void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
-    if (!shouldAllowNavigation(exec, frame))
-        return;
-
     KURL url = completeURL(exec, value.toString(exec));
     if (url.isNull())
         return;
 
+    if (!shouldAllowNavigation(exec, frame))
+        return;
+
     if (!protocolIsJavaScript(url) || allowsAccessFrom(exec)) {
         // We want a new history item if this JS was called via a user gesture
         frame->loader()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture(exec));
@@ -773,6 +781,10 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
 
 JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 {
+    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    AtomicString frameName = args.at(1).isUndefinedOrNull() ? "_blank" : AtomicString(args.at(1).toString(exec));
+    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(2)));
+
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
@@ -785,9 +797,6 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 
     Page* page = frame->page();
 
-    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
-    AtomicString frameName = args.at(1).isUndefinedOrNull() ? "_blank" : AtomicString(args.at(1).toString(exec));
-
     // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
     // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
     if (!DOMWindow::allowPopUp(dynamicFrame) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
@@ -805,13 +814,13 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
         topOrParent = true;
     }
     if (topOrParent) {
-        if (!shouldAllowNavigation(exec, frame))
-            return jsUndefined();
-
         String completedURL;
         if (!urlString.isEmpty())
             completedURL = completeURL(exec, urlString).string();
 
+        if (!shouldAllowNavigation(exec, frame))
+            return jsUndefined();
+
         const JSDOMWindow* targetedWindow = toJSDOMWindow(frame);
         if (!completedURL.isEmpty() && (!protocolIsJavaScript(completedURL) || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
             bool userGesture = processingUserGesture(exec);
@@ -827,7 +836,6 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
     }
 
     // In the case of a named frame or a new window, we'll use the createWindow() helper
-    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(2)));
     FloatRect windowRect(windowFeatures.xSet ? windowFeatures.x : 0, windowFeatures.ySet ? windowFeatures.y : 0,
                          windowFeatures.widthSet ? windowFeatures.width : 0, windowFeatures.heightSet ? windowFeatures.height : 0);
     DOMWindow::adjustWindowRect(screenAvailableRect(page ? page->mainFrame()->view() : 0), windowRect, windowRect);
@@ -847,6 +855,10 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 
 JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
 {
+    String url = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    JSValue dialogArgs = args.at(1);
+    String featureArgs = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
@@ -860,10 +872,6 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
     if (!DOMWindow::canShowModalDialogNow(frame) || !DOMWindow::allowPopUp(dynamicFrame))
         return jsUndefined();
 
-    String url = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
-    JSValue dialogArgs = args.at(1);
-    String featureArgs = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
-
     HashMap<String, String> features;
     DOMWindow::parseModalDialogFeatures(featureArgs, features);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
index f969dc1..3c3ff4c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -103,6 +103,11 @@ void JSDOMWindowShell::putWithAttributes(ExecState* exec, const Identifier& prop
     m_window->putWithAttributes(exec, propertyName, value, attributes);
 }
 
+bool JSDOMWindowShell::defineOwnProperty(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    return m_window->defineOwnProperty(exec, propertyName, descriptor, shouldThrow);
+}
+
 bool JSDOMWindowShell::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     return m_window->deleteProperty(exec, propertyName);
@@ -123,14 +128,14 @@ bool JSDOMWindowShell::getPropertyAttributes(JSC::ExecState* exec, const Identif
     return m_window->getPropertyAttributes(exec, propertyName, attributes);
 }
 
-void JSDOMWindowShell::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSDOMWindowShell::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
-    m_window->defineGetter(exec, propertyName, getterFunction);
+    m_window->defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
-void JSDOMWindowShell::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+void JSDOMWindowShell::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
 {
-    m_window->defineSetter(exec, propertyName, setterFunction);
+    m_window->defineSetter(exec, propertyName, setterFunction, attributes);
 }
 
 JSValue JSDOMWindowShell::lookupGetter(ExecState* exec, const Identifier& propertyName)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
index a7c2c56..23af340 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
@@ -74,8 +74,9 @@ namespace WebCore {
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
         virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
         virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
-        virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
-        virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);
+        virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
+        virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction, unsigned attributes);
+        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
         virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual JSC::JSObject* unwrappedObject();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
index a633a42..fbee5ef 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
@@ -42,13 +42,6 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSDedicatedWorkerContext::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
-
-    markIfNotNull(markStack, impl()->onmessage());
-}
-
 JSC::JSValue JSDedicatedWorkerContext::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
 {
     return handlePostMessage(exec, args, impl());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
index d391073..48ae014 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
@@ -56,7 +56,7 @@ void JSEventListener::markJSFunction(MarkStack& markStack)
     markStack.append(m_globalObject);
 }
 
-void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
+void JSEventListener::handleEvent(Event* event)
 {
     JSLock lock(SilenceAssertionsOnly);
 
@@ -106,19 +106,10 @@ void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
         JSGlobalData* globalData = globalObject->globalData();
         DynamicGlobalObjectScope globalObjectScope(exec, globalData->dynamicGlobalObject ? globalData->dynamicGlobalObject : globalObject);
 
-        JSValue retval;
-        if (handleEventFunction) {
-            globalData->timeoutChecker.start();
-            retval = call(exec, handleEventFunction, callType, callData, jsFunction, args);
-        } else {
-            JSValue thisValue;
-            if (isWindowEvent)
-                thisValue = globalObject->toThisObject(exec);
-            else
-                thisValue = toJS(exec, globalObject, event->currentTarget());
-            globalData->timeoutChecker.start();
-            retval = call(exec, jsFunction, callType, callData, thisValue, args);
-        }
+        globalData->timeoutChecker.start();
+        JSValue retval = handleEventFunction
+            ? call(exec, handleEventFunction, callType, callData, jsFunction, args)
+            : call(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args);
         globalData->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
index 92f0c41..91ceff7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
@@ -53,7 +53,7 @@ namespace WebCore {
 
     private:
         virtual void markJSFunction(JSC::MarkStack&);
-        virtual void handleEvent(Event*, bool isWindowEvent);
+        virtual void handleEvent(Event*);
         virtual bool reportError(const String& message, const String& url, int lineNumber);
         virtual bool virtualisAttribute() const;
         void clearJSFunctionInline();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
index deebcb9..d757ef6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
@@ -43,23 +43,6 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSEventSource::markChildren(MarkStack& markStack)
-{
-    DOMObject::markChildren(markStack);
-
-    markIfNotNull(markStack, m_impl->onopen());
-    markIfNotNull(markStack, m_impl->onmessage());
-    markIfNotNull(markStack, m_impl->onerror());
-
-    typedef EventSource::EventListenersMap EventListenersMap;
-    typedef EventSource::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
-}
-
 JSValue JSEventSource::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
index 10f8bd5..530b89b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
@@ -100,20 +100,34 @@ static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValu
     if (exec->hadException())
         return 0;
     if (!timeoutValue.isUndefined()) {
-        // Wrap to int32 and force non-negative to match behavior of window.setTimeout.
-        options->setTimeout(max(0, timeoutValue.toInt32(exec)));
+        double timeoutNumber = timeoutValue.toNumber(exec);
         if (exec->hadException())
             return 0;
+        // If the value is positive infinity, there's nothing to do.
+        if (!(isinf(timeoutNumber) && (timeoutNumber > 0))) {
+            // Wrap to int32 and force non-negative to match behavior of window.setTimeout.
+            options->setTimeout(max(0, timeoutValue.toInt32(exec)));
+            if (exec->hadException())
+                return 0;
+        }
     }
 
     JSValue maximumAgeValue = object->get(exec, Identifier(exec, "maximumAge"));
     if (exec->hadException())
         return 0;
     if (!maximumAgeValue.isUndefined()) {
-        // Wrap to int32 and force non-negative to match behavior of window.setTimeout.
-        options->setMaximumAge(max(0, maximumAgeValue.toInt32(exec)));
+        double maximumAgeNumber = maximumAgeValue.toNumber(exec);
         if (exec->hadException())
             return 0;
+        if (isinf(maximumAgeNumber) && (maximumAgeNumber > 0)) {
+            // If the value is positive infinity, clear maximumAge.
+            options->clearMaximumAge();
+        } else {
+            // Wrap to int32 and force non-negative to match behavior of window.setTimeout.
+            options->setMaximumAge(max(0, maximumAgeValue.toInt32(exec)));
+            if (exec->hadException())
+                return 0;
+        }
     }
 
     return options.release();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index dd9af74..8ffddf7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -23,12 +23,13 @@
 #include "AtomicString.h"
 #include "HTMLCollection.h"
 #include "HTMLOptionsCollection.h"
+#include "JSDOMBinding.h"
 #include "JSHTMLAllCollection.h"
 #include "JSHTMLOptionsCollection.h"
-#include "JSNamedNodesCollection.h"
 #include "JSNode.h"
+#include "JSNodeList.h"
 #include "Node.h"
-#include "JSDOMBinding.h"
+#include "StaticNodeList.h"
 #include <wtf/Vector.h>
 
 using namespace JSC;
@@ -42,11 +43,13 @@ static JSValue getNamedItems(ExecState* exec, JSHTMLCollection* collection, cons
 
     if (namedItems.isEmpty())
         return jsUndefined();
-
     if (namedItems.size() == 1)
         return toJS(exec, collection->globalObject(), namedItems[0].get());
 
-    return new (exec) JSNamedNodesCollection(exec, collection->globalObject(), namedItems);
+    // FIXME: HTML5 specifies that this should be a DynamicNodeList.
+    // FIXME: HTML5 specifies that non-HTMLOptionsCollection collections should return
+    // the first matching item instead of a NodeList.
+    return toJS(exec, collection->globalObject(), StaticNodeList::adopt(namedItems).get());
 }
 
 // HTMLCollections are strange objects, they support both get and call,
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
index ffa2d57..de9ec4a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
@@ -30,7 +30,8 @@
 #include "HTMLCollection.h"
 #include "HTMLFormElement.h"
 #include "JSDOMWindowCustom.h"
-#include "JSNamedNodesCollection.h"
+#include "JSNodeList.h"
+#include "StaticNodeList.h"
 
 using namespace JSC;
 
@@ -47,15 +48,17 @@ JSValue JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propert
 {
     JSHTMLElement* jsForm = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
     HTMLFormElement* form = static_cast<HTMLFormElement*>(jsForm->impl());
-    
+
     Vector<RefPtr<Node> > namedItems;
     form->getNamedElements(propertyName, namedItems);
     
+    if (namedItems.isEmpty())
+        return jsUndefined();
     if (namedItems.size() == 1)
         return toJS(exec, namedItems[0].get());
-    if (namedItems.size() > 1) 
-        return new (exec) JSNamedNodesCollection(exec, jsForm->globalObject(), namedItems);
-    return jsUndefined();
+
+    // FIXME: HTML5 specifies that this should be a RadioNodeList.
+    return toJS(exec, jsForm->globalObject(), StaticNodeList::adopt(namedItems).get());
 }
 
 JSValue JSHTMLFormElement::submit(ExecState* exec, const ArgList&)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
index ef58349..aecec5e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
@@ -182,11 +182,11 @@ void JSLocation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propert
     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
-void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
         return;
-    Base::defineGetter(exec, propertyName, getterFunction);
+    Base::defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
 static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bool lockHistory, bool lockBackForwardList)
@@ -204,13 +204,13 @@ void JSLocation::setHref(ExecState* exec, JSValue value)
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
-    if (!shouldAllowNavigation(exec, frame))
-        return;
-
     KURL url = completeURL(exec, value.toString(exec));
     if (url.isNull())
         return;
 
+    if (!shouldAllowNavigation(exec, frame))
+        return;
+
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
@@ -308,13 +308,13 @@ JSValue JSLocation::replace(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (!shouldAllowNavigation(exec, frame))
-        return jsUndefined();
-
     KURL url = completeURL(exec, args.at(0).toString(exec));
     if (url.isNull())
         return jsUndefined();
 
+    if (!shouldAllowNavigation(exec, frame))
+        return jsUndefined();
+
     navigateIfAllowed(exec, frame, url, true, true);
     return jsUndefined();
 }
@@ -336,13 +336,13 @@ JSValue JSLocation::assign(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (!shouldAllowNavigation(exec, frame))
-        return jsUndefined();
-
     KURL url = completeURL(exec, args.at(0).toString(exec));
     if (url.isNull())
         return jsUndefined();
 
+    if (!shouldAllowNavigation(exec, frame))
+        return jsUndefined();
+
     // We want a new history item if this JS was called via a user gesture
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
     return jsUndefined();
@@ -362,11 +362,11 @@ bool JSLocationPrototype::putDelegate(ExecState* exec, const Identifier& propert
     return (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf);
 }
 
-void JSLocationPrototype::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSLocationPrototype::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
         return;
-    Base::defineGetter(exec, propertyName, getterFunction);
+    Base::defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
index 8202d1a..2084905 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -45,8 +45,6 @@ void JSMessagePort::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    markIfNotNull(markStack, m_impl->onmessage());
-
     // If we have a locally entangled port, we can directly mark it as reachable. Ports that are remotely entangled are marked in-use by markActiveObjectsForContext().
     if (MessagePort* entangledPort = m_impl->locallyEntangledPort()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), entangledPort);
@@ -54,13 +52,7 @@ void JSMessagePort::markChildren(MarkStack& markStack)
             markStack.append(wrapper);
     }
 
-    typedef MessagePort::EventListenersMap EventListenersMap;
-    typedef MessagePort::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) 
-            (*vecIter)->markJSFunction(markStack);
-    }
+    m_impl->markEventListeners(markStack);
 }
 
 JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
deleted file mode 100644
index a1cb202..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "JSNamedNodesCollection.h"
-
-#include "AtomicString.h"
-#include "Element.h"
-#include "JSNode.h"
-#include "NamedNodeMap.h"
-
-namespace WebCore {
-
-using namespace JSC;
-
-ASSERT_CLASS_FITS_IN_CELL(JSNamedNodesCollection);
-
-const ClassInfo JSNamedNodesCollection::s_info = { "Collection", 0, 0, 0 };
-
-// Such a collection is usually very short-lived, it only exists
-// for constructs like document.forms.<name>[1],
-// so it shouldn't be a problem that it's storing all the nodes (with the same name). (David)
-JSNamedNodesCollection::JSNamedNodesCollection(ExecState* exec, JSDOMGlobalObject* globalObject, const Vector<RefPtr<Node> >& nodes)
-    : DOMObjectWithGlobalPointer(getDOMStructure<JSNamedNodesCollection>(exec, globalObject), globalObject)
-    , m_nodes(new Vector<RefPtr<Node> >(nodes))
-{
-}
-
-JSValue JSNamedNodesCollection::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSNamedNodesCollection* thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
-    return jsNumber(exec, thisObj->m_nodes->size());
-}
-
-JSValue JSNamedNodesCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSNamedNodesCollection *thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
-    return toJS(exec, (*thisObj->m_nodes)[slot.index()].get());
-}
-
-bool JSNamedNodesCollection::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    if (propertyName == exec->propertyNames().length) {
-        slot.setCustom(this, lengthGetter);
-        return true;
-    }
-
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok);
-    if (ok && index < m_nodes->size()) {
-        slot.setCustomIndex(this, index, indexGetter);
-        return true;
-    }
-
-    // For IE compatibility, we need to be able to look up elements in a
-    // document.formName.name result by id as well as be index.
-
-    AtomicString atomicPropertyName = propertyName;
-    for (unsigned i = 0; i < m_nodes->size(); i++) {
-        Node* node = (*m_nodes)[i].get();
-        if (node->hasAttributes() && node->attributes()->id() == atomicPropertyName) {
-            slot.setCustomIndex(this, i, indexGetter);
-            return true;
-        }
-    }
-
-    return DOMObjectWithGlobalPointer::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-bool JSNamedNodesCollection::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    if (propertyName == exec->propertyNames().length) {
-        descriptor.setDescriptor(jsNumber(exec, m_nodes->size()), ReadOnly | DontDelete | DontEnum);
-        return true;
-    }
-    
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok);
-    if (ok && index < m_nodes->size()) {
-        PropertySlot slot;
-        slot.setCustomIndex(this, index, indexGetter);
-        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete);
-        return true;
-    }
-    
-    // For IE compatibility, we need to be able to look up elements in a
-    // document.formName.name result by id as well as be index.
-    
-    AtomicString atomicPropertyName = propertyName;
-    for (unsigned i = 0; i < m_nodes->size(); i++) {
-        Node* node = (*m_nodes)[i].get();
-        if (node->hasAttributes() && node->attributes()->id() == atomicPropertyName) {
-            PropertySlot slot;
-            slot.setCustomIndex(this, i, indexGetter);
-            descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete);
-            return true;
-        }
-    }
-    
-    return DOMObjectWithGlobalPointer::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
deleted file mode 100644
index fc629d8..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSNamedNodesCollection_h
-#define JSNamedNodesCollection_h
-
-#include "JSDOMBinding.h"
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-    class Node;
-
-    // Internal class, used for the collection return by e.g. document.forms.myinput
-    // when multiple nodes have the same name.
-    class JSNamedNodesCollection : public DOMObjectWithGlobalPointer {
-    public:
-        JSNamedNodesCollection(JSC::ExecState*, JSDOMGlobalObject*, const Vector<RefPtr<Node> >&);
-
-        virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
-
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-        static const JSC::ClassInfo s_info;
-
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState*, JSC::JSGlobalObject* globalObject)
-        {
-            return globalObject->objectPrototype();
-        }
-
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-        {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
-        }
-
-    private:
-        static JSC::JSValue lengthGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-        OwnPtr<Vector<RefPtr<Node> > > m_nodes;
-    };
-
-} // namespace WebCore
-
-#endif // JSNamedNodesCollection_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
index e88a9ec..025a8fa 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
@@ -150,10 +150,10 @@ void JSNode::pushEventHandlerScope(ExecState*, ScopeChain&) const
 
 void JSNode::markChildren(MarkStack& markStack)
 {
-    Node* node = m_impl.get();
-
     Base::markChildren(markStack);
-    markEventListeners(markStack, node->eventListeners());
+
+    Node* node = m_impl.get();
+    node->markEventListeners(markStack);
 
     // Nodes in the document are kept alive by JSDocument::mark, so, if we're in
     // the document, we need to mark the document, but we don't need to explicitly
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
index a071a4e..30acf9b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
@@ -148,7 +148,7 @@ bool JSQuarantinedObjectWrapper::getOwnPropertyDescriptor(ExecState* exec, const
     PropertyDescriptor unwrappedDescriptor;
     bool result = m_unwrappedObject->getOwnPropertyDescriptor(unwrappedExecState(), identifier, unwrappedDescriptor);
 
-    if (unwrappedDescriptor.hasAccessors()) {
+    if (unwrappedDescriptor.isAccessorDescriptor()) {
         descriptor.setAccessorDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.getter()),
                                          wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.setter()),
                                          unwrappedDescriptor.attributes());
@@ -178,6 +178,33 @@ void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSVal
     transferExceptionToExecState(exec);
 }
 
+bool JSQuarantinedObjectWrapper::defineOwnProperty(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    if (!allowsSetProperty())
+        return false;
+
+    PropertyDescriptor wrappedDescriptor;
+    if (descriptor.isDataDescriptor()) {
+        wrappedDescriptor.setValue(prepareIncomingValue(exec, descriptor.value()));
+        if (wrappedDescriptor.writablePresent())
+            wrappedDescriptor.setWritable(descriptor.writable());
+    } else if (descriptor.isAccessorDescriptor()) {
+        if (descriptor.getter())
+            wrappedDescriptor.setGetter(prepareIncomingValue(exec, descriptor.getter()));
+        if (descriptor.setter())
+            wrappedDescriptor.setSetter(prepareIncomingValue(exec, descriptor.setter()));
+    }
+    if (wrappedDescriptor.enumerablePresent())
+        wrappedDescriptor.setEnumerable(descriptor.enumerable());
+    if (wrappedDescriptor.configurablePresent())
+        wrappedDescriptor.setConfigurable(descriptor.configurable());
+    
+    bool result = m_unwrappedObject->defineOwnProperty(unwrappedExecState(), propertyName, wrappedDescriptor, shouldThrow);
+    
+    transferExceptionToExecState(exec);
+    return result;
+}
+
 bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, const Identifier& identifier)
 {
     if (!allowsDeleteProperty())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
index 37f2518..2bc6633 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
@@ -62,6 +62,7 @@ namespace WebCore {
 
         virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void put(JSC::ExecState*, unsigned, JSC::JSValue);
+        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
 
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
         virtual bool deleteProperty(JSC::ExecState*, unsigned);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
index 651805c..c05b3d2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
@@ -57,11 +57,14 @@ static JSObject* constructSharedWorker(ExecState* exec, JSObject* constructor, c
 {
     JSSharedWorkerConstructor* jsConstructor = static_cast<JSSharedWorkerConstructor*>(constructor);
 
-    if (args.size() < 2)
+    if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
     UString scriptURL = args.at(0).toString(exec);
-    UString name = args.at(1).toString(exec);
+    UString name;
+    if (args.size() > 1)
+        name = args.at(1).toString(exec);
+
     if (exec->hadException())
         return 0;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
index 401b33d..d305502 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -44,14 +44,6 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSWebSocket::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
-    if (m_impl->readyState() != WebSocket::CLOSED)
-        markIfNotNull(markStack, m_impl->onmessage());
-    // FIXME: mark if EventListeners is registered.
-}
-
 // Custom functions
 JSValue JSWebSocket::send(ExecState* exec, const ArgList& args)
 {
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
index 9e54fa0..1b78264 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -62,15 +62,7 @@ void JSWorkerContext::markChildren(MarkStack& markStack)
     markDOMObjectWrapper(markStack, globalData, impl()->optionalLocation());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalNavigator());
 
-    markIfNotNull(markStack, impl()->onerror());
-
-    typedef WorkerContext::EventListenersMap EventListenersMap;
-    typedef WorkerContext::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = impl()->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
+    impl()->markEventListeners(markStack);
 }
 
 bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
index a42a043..09b881a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
@@ -37,13 +37,6 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSWorker::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
-
-    markIfNotNull(markStack, static_cast<Worker*>(impl())->onmessage());
-}
-
 JSC::JSValue JSWorker::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
 {
     return handlePostMessage(exec, args, impl());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index c69f727..6d0ce57 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -59,20 +59,7 @@ void JSXMLHttpRequest::markChildren(MarkStack& markStack)
             markStack.append(wrapper);
     }
 
-    markIfNotNull(markStack, m_impl->onreadystatechange());
-    markIfNotNull(markStack, m_impl->onabort());
-    markIfNotNull(markStack, m_impl->onerror());
-    markIfNotNull(markStack, m_impl->onload());
-    markIfNotNull(markStack, m_impl->onloadstart());
-    markIfNotNull(markStack, m_impl->onprogress());
-    
-    typedef XMLHttpRequest::EventListenersMap EventListenersMap;
-    typedef XMLHttpRequest::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
+    m_impl->markEventListeners(markStack);
 }
 
 // Custom functions
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index 2f17542..c0f0c39 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -51,19 +51,7 @@ void JSXMLHttpRequestUpload::markChildren(MarkStack& markStack)
             markStack.append(wrapper);
     }
 
-    markIfNotNull(markStack, m_impl->onabort());
-    markIfNotNull(markStack, m_impl->onerror());
-    markIfNotNull(markStack, m_impl->onload());
-    markIfNotNull(markStack, m_impl->onloadstart());
-    markIfNotNull(markStack, m_impl->onprogress());
-    
-    typedef XMLHttpRequestUpload::EventListenersMap EventListenersMap;
-    typedef XMLHttpRequestUpload::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
+    m_impl->markEventListeners(markStack);
 }
 
 JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
index 4b33069..dfa1602 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
@@ -85,12 +85,7 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     const SourceCode& jsSourceCode = sourceCode.jsSourceCode();
     String sourceURL = jsSourceCode.provider()->url();
     
-    if (sourceURL.isNull() && !m_XSSAuditor->canEvaluateJavaScriptURL(sourceCode.source())) {
-        // This JavaScript URL is not safe to be evaluated.
-        return JSValue();
-    }
-    
-    if (!sourceURL.isNull() && !m_XSSAuditor->canEvaluate(sourceCode.source())) {
+    if (!m_XSSAuditor->canEvaluate(sourceCode.source())) {
         // This script is not safe to be evaluated.
         return JSValue();
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 88f67f0..3523b43 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -476,7 +476,9 @@ sub GenerateHeader
     my $parentClassName = GetParentClassName($dataNode);
     my $conditional = $dataNode->extendedAttributes->{"Conditional"};
     my $needsSVGContext = IsSVGTypeNeedingContextParameter($interfaceName);
-
+    my $eventTarget = $dataNode->extendedAttributes->{"EventTarget"};
+    my $needsMarkChildren = $dataNode->extendedAttributes->{"CustomMarkFunction"} || $dataNode->extendedAttributes->{"EventTarget"};
+    
     # - Add default header template
     @headerContentHeader = split("\r", $headerTemplate);
 
@@ -548,7 +550,7 @@ sub GenerateHeader
     }
 
     # Destructor
-    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $interfaceName eq "Document" or $interfaceName eq "DOMWindow");
+    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $eventTarget or $interfaceName eq "Document" or $interfaceName eq "DOMWindow");
 
     # Prototype
     push(@headerContent, "    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);\n") unless ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"});
@@ -613,8 +615,8 @@ sub GenerateHeader
             "    }\n\n");
     }
 
-    # Custom mark function
-    push(@headerContent, "    virtual void markChildren(JSC::MarkStack&);\n\n") if $dataNode->extendedAttributes->{"CustomMarkFunction"};
+    # markChildren function
+    push(@headerContent, "    virtual void markChildren(JSC::MarkStack&);\n\n") if $needsMarkChildren;
 
     # Custom pushEventHandlerScope function
     push(@headerContent, "    virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;\n\n") if $dataNode->extendedAttributes->{"CustomPushEventHandlerScope"};
@@ -627,6 +629,10 @@ sub GenerateHeader
 
     # Custom getPropertyNames function exists on DOMWindow
     push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if $interfaceName eq "DOMWindow";
+
+    # Custom defineProperty function exists on DOMWindow
+    push(@headerContent, "    virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);\n") if $interfaceName eq "DOMWindow";
+
     # Custom getOwnPropertyNames function
     push(@headerContent, "    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"});    
 
@@ -634,10 +640,10 @@ sub GenerateHeader
     push(@headerContent, "    virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;\n") if $dataNode->extendedAttributes->{"CustomGetPropertyAttributes"};
 
     # Custom defineGetter function
-    push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);\n") if $dataNode->extendedAttributes->{"CustomDefineGetter"};
+    push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);\n") if $dataNode->extendedAttributes->{"CustomDefineGetter"};
 
     # Custom defineSetter function
-    push(@headerContent, "    virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);\n") if $dataNode->extendedAttributes->{"CustomDefineSetter"};
+    push(@headerContent, "    virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction, unsigned attributes);\n") if $dataNode->extendedAttributes->{"CustomDefineSetter"};
 
     # Custom lookupGetter function
     push(@headerContent, "    virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupGetter"};
@@ -785,7 +791,7 @@ sub GenerateHeader
         push(@headerContent,
             "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
             "    {\n" .
-            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType" . ($dataNode->extendedAttributes->{"CustomMarkFunction"} ? "" : ", JSC::HasDefaultMark") . "));\n" .
+            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType" . ($needsMarkChildren ? "" : ", JSC::HasDefaultMark") . "));\n" .
             "    }\n");
     } elsif ($dataNode->extendedAttributes->{"CustomMarkFunction"}) {
         push(@headerContent,
@@ -800,7 +806,7 @@ sub GenerateHeader
     }
 
     # Custom defineGetter function
-    push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);\n") if $dataNode->extendedAttributes->{"CustomPrototypeDefineGetter"};
+    push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);\n") if $dataNode->extendedAttributes->{"CustomPrototypeDefineGetter"};
 
     push(@headerContent, "    ${className}Prototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }\n");
 
@@ -864,6 +870,8 @@ sub GenerateImplementation
     my $parentClassName = GetParentClassName($dataNode);
     my $conditional = $dataNode->extendedAttributes->{"Conditional"};
     my $visibleClassName = GetVisibleClassName($interfaceName);
+    my $eventTarget = $dataNode->extendedAttributes->{"EventTarget"};
+    my $needsMarkChildren = $dataNode->extendedAttributes->{"CustomMarkFunction"} || $dataNode->extendedAttributes->{"EventTarget"};
 
     # - Add default header template
     @implContentHeader = split("\r", $headerTemplate);
@@ -1149,17 +1157,17 @@ sub GenerateImplementation
     push(@implContent, "}\n\n");
 
     # Destructor
-    if (!$hasParent || $interfaceName eq "DOMWindow") {
+    if (!$hasParent || $eventTarget) {
         push(@implContent, "${className}::~$className()\n");
         push(@implContent, "{\n");
 
+        if ($eventTarget) {
+            $implIncludes{"RegisteredEventListener.h"} = 1;
+            push(@implContent, "    impl()->invalidateEventListeners();\n");
+        }
+
         if ($interfaceName eq "Node") {
-             $implIncludes{"RegisteredEventListener.h"} = 1;
-             push(@implContent, "    invalidateEventListeners(m_impl->eventListeners());\n");
-             push(@implContent, "    forgetDOMNode(m_impl->document(), m_impl.get());\n");
-        } elsif ($interfaceName eq "DOMWindow") {
-             $implIncludes{"RegisteredEventListener.h"} = 1;
-             push(@implContent, "    invalidateEventListeners(impl()->eventListeners());\n");
+             push(@implContent, "    forgetDOMNode(impl()->document(), impl());\n");
         } else {
             if ($podType) {
                 my $animatedType = $implClassName;
@@ -1170,7 +1178,7 @@ sub GenerateImplementation
                     push(@implContent, "    JSSVGDynamicPODTypeWrapperCache<$podType, $animatedType>::forgetWrapper(m_impl.get());\n");
                 }
             }
-            push(@implContent, "    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());\n");
+            push(@implContent, "    forgetDOMObject(*Heap::heap(this)->globalData(), impl());\n");
         }
 
         push(@implContent, "}\n\n");
@@ -1183,6 +1191,14 @@ sub GenerateImplementation
         push(@implContent, "{\n    forgetDOMObject(*Heap::heap(this)->globalData(), static_cast<${implClassName}*>(impl()));\n}\n\n");
     }
 
+    if ($needsMarkChildren && !$dataNode->extendedAttributes->{"CustomMarkFunction"}) {
+        push(@implContent, "void ${className}::markChildren(MarkStack& markStack)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    Base::markChildren(markStack);\n");
+        push(@implContent, "    impl()->markEventListeners(markStack);\n");
+        push(@implContent, "}\n\n");
+    }
+
     if (!$dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
         push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
index b3307cd..a18de49 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -1003,7 +1003,12 @@ sub GenerateBatchedAttributeData
         # Replaceable
         if ($attrExt->{"Replaceable"} && !$hasCustomSetter) {
             $setter = "0";
-            $propAttr .= "|v8::ReadOnly";
+            # Handle the special case of window.top being marked as Replaceable.
+            # FIXME: Investigate whether we could treat window.top as replaceable 
+            # and allow shadowing without it being a security hole.
+            if (!($interfaceName eq "DOMWindow" and $attrName eq "top")) { 
+                $propAttr .= "|v8::ReadOnly";
+            }
         }
 
         # Read only attributes
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
index 58280e3..0546014 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
@@ -43,16 +43,10 @@ namespace Bindings {
 typedef QMultiHash<void*, QtInstance*> QObjectInstanceMap;
 static QObjectInstanceMap cachedInstances;
 
-// Cache JSObjects
-typedef QHash<QtInstance*, JSObject*> InstanceJSObjectMap;
-static InstanceJSObjectMap cachedObjects;
-
 // Derived RuntimeObject
 class QtRuntimeObjectImp : public RuntimeObjectImp {
 public:
     QtRuntimeObjectImp(ExecState*, PassRefPtr<Instance>);
-    ~QtRuntimeObjectImp();
-    virtual void invalidate();
 
     static const ClassInfo s_info;
 
@@ -64,9 +58,6 @@ public:
             instance->markAggregate(markStack);
     }
 
-protected:
-    void removeFromCache();
-        
 private:
     virtual const ClassInfo* classInfo() const { return &s_info; }
 };
@@ -78,25 +69,6 @@ QtRuntimeObjectImp::QtRuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> ins
 {
 }
 
-QtRuntimeObjectImp::~QtRuntimeObjectImp()
-{
-    removeFromCache();
-}
-
-void QtRuntimeObjectImp::invalidate()
-{
-    removeFromCache();
-    RuntimeObjectImp::invalidate();
-}
-
-void QtRuntimeObjectImp::removeFromCache()
-{
-    JSLock lock(SilenceAssertionsOnly);
-    QtInstance* key = cachedObjects.key(this);
-    if (key)
-        cachedObjects.remove(key);
-}
-
 // QtInstance
 QtInstance::QtInstance(QObject* o, PassRefPtr<RootObject> rootObject, QScriptEngine::ValueOwnership ownership)
     : Instance(rootObject)
@@ -112,7 +84,6 @@ QtInstance::~QtInstance()
 {
     JSLock lock(SilenceAssertionsOnly);
 
-    cachedObjects.remove(this);
     cachedInstances.remove(m_hashkey);
 
     // clean up (unprotect from gc) the JSValues we've created
@@ -190,16 +161,10 @@ Class* QtInstance::getClass() const
     return m_class;
 }
 
-RuntimeObjectImp* QtInstance::createRuntimeObject(ExecState* exec)
+RuntimeObjectImp* QtInstance::newRuntimeObject(ExecState* exec)
 {
     JSLock lock(SilenceAssertionsOnly);
-    RuntimeObjectImp* ret = static_cast<RuntimeObjectImp*>(cachedObjects.value(this));
-    if (!ret) {
-        ret = new (exec) QtRuntimeObjectImp(exec, this);
-        cachedObjects.insert(this, ret);
-        ret = static_cast<RuntimeObjectImp*>(cachedObjects.value(this));
-    }
-    return ret;
+    return new (exec) QtRuntimeObjectImp(exec, this);
 }
 
 void QtInstance::markAggregate(MarkStack& markStack)
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
index c276b29..00aaa5b 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
@@ -40,7 +40,7 @@ public:
     ~QtInstance();
 
     virtual Class* getClass() const;
-    virtual RuntimeObjectImp* createRuntimeObject(ExecState*);
+    virtual RuntimeObjectImp* newRuntimeObject(ExecState*);
 
     virtual void begin();
     virtual void end();
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime.cpp
index 6934406..eac8586 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime.cpp
@@ -48,12 +48,14 @@ Array::~Array()
 
 Instance::Instance(PassRefPtr<RootObject> rootObject)
     : _rootObject(rootObject)
+    , m_runtimeObject(0)
 {
     ASSERT(_rootObject);
 }
 
 Instance::~Instance()
 {
+    ASSERT(!m_runtimeObject);
 }
 
 static KJSDidExecuteFunctionPtr s_didExecuteFunction;
@@ -80,11 +82,37 @@ void Instance::end()
 
 RuntimeObjectImp* Instance::createRuntimeObject(ExecState* exec)
 {
+    ASSERT(_rootObject);
+    ASSERT(_rootObject->isValid());
+    if (m_runtimeObject)
+        return m_runtimeObject;
+    JSLock lock(SilenceAssertionsOnly);
+    m_runtimeObject = newRuntimeObject(exec);
+    _rootObject->addRuntimeObject(m_runtimeObject);
+    return m_runtimeObject;
+}
+
+RuntimeObjectImp* Instance::newRuntimeObject(ExecState* exec)
+{
     JSLock lock(SilenceAssertionsOnly);
-    
     return new (exec) RuntimeObjectImp(exec, this);
 }
 
+void Instance::willDestroyRuntimeObject()
+{
+    ASSERT(_rootObject);
+    ASSERT(_rootObject->isValid());
+    ASSERT(m_runtimeObject);
+    _rootObject->removeRuntimeObject(m_runtimeObject);
+    m_runtimeObject = 0;
+}
+
+void Instance::willInvalidateRuntimeObject()
+{
+    ASSERT(m_runtimeObject);
+    m_runtimeObject = 0;
+}
+
 RootObject* Instance::rootObject() const 
 { 
     return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime.h b/src/3rdparty/webkit/WebCore/bridge/runtime.h
index e028020..6682a97 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -86,8 +86,10 @@ public:
     void begin();
     void end();
     
-    virtual Class *getClass() const = 0;
-    virtual RuntimeObjectImp* createRuntimeObject(ExecState*);
+    virtual Class* getClass() const = 0;
+    RuntimeObjectImp* createRuntimeObject(ExecState*);
+    void willInvalidateRuntimeObject();
+    void willDestroyRuntimeObject();
     
     // Returns false if the value was not set successfully.
     virtual bool setValueOfUndefinedField(ExecState*, const Identifier&, JSValue) { return false; }
@@ -117,8 +119,12 @@ public:
 protected:
     virtual void virtualBegin() { }
     virtual void virtualEnd() { }
+    virtual RuntimeObjectImp* newRuntimeObject(ExecState*);
 
     RefPtr<RootObject> _rootObject;
+
+private:
+    RuntimeObjectImp* m_runtimeObject;
 };
 
 class Array : public Noncopyable {
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
index 0282411..3fd8024 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,7 +28,6 @@
 
 #include "JSDOMBinding.h"
 #include "runtime_method.h"
-#include "runtime_root.h"
 #include <runtime/Error.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -40,38 +39,38 @@ using namespace Bindings;
 
 const ClassInfo RuntimeObjectImp::s_info = { "RuntimeObject", 0, 0, 0 };
 
-RuntimeObjectImp::RuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> i)
+RuntimeObjectImp::RuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> instance)
     // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
     // We need to pass in the right global object for "i".
     : JSObject(deprecatedGetDOMStructure<RuntimeObjectImp>(exec))
-    , instance(i)
+    , m_instance(instance)
 {
-    instance->rootObject()->addRuntimeObject(this);
 }
-    
-RuntimeObjectImp::RuntimeObjectImp(ExecState*, PassRefPtr<Structure> structure, PassRefPtr<Instance> i)
+
+RuntimeObjectImp::RuntimeObjectImp(ExecState*, PassRefPtr<Structure> structure, PassRefPtr<Instance> instance)
     : JSObject(structure)
-    , instance(i)
+    , m_instance(instance)
 {
-    instance->rootObject()->addRuntimeObject(this);
 }
 
 RuntimeObjectImp::~RuntimeObjectImp()
 {
-    if (instance)
-        instance->rootObject()->removeRuntimeObject(this);
+    if (m_instance)
+        m_instance->willDestroyRuntimeObject();
 }
 
 void RuntimeObjectImp::invalidate()
 {
-    ASSERT(instance);
-    instance = 0;
+    ASSERT(m_instance);
+    if (m_instance)
+        m_instance->willInvalidateRuntimeObject();
+    m_instance = 0;
 }
 
 JSValue RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
-    RefPtr<Instance> instance = thisObj->instance;
+    RefPtr<Instance> instance = thisObj->m_instance;
 
     if (!instance)
         return throwInvalidAccessError(exec);
@@ -89,7 +88,7 @@ JSValue RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier
 JSValue RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {    
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
-    RefPtr<Instance> instance = thisObj->instance;
+    RefPtr<Instance> instance = thisObj->m_instance;
 
     if (!instance)
         return throwInvalidAccessError(exec);
@@ -108,7 +107,7 @@ JSValue RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propert
 JSValue RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
-    RefPtr<Instance> instance = thisObj->instance;
+    RefPtr<Instance> instance = thisObj->m_instance;
 
     if (!instance)
         return throwInvalidAccessError(exec);
@@ -126,11 +125,13 @@ JSValue RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& proper
 
 bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (!instance) {
+    if (!m_instance) {
         throwInvalidAccessError(exec);
         return false;
     }
     
+    RefPtr<Instance> instance = m_instance;
+
     instance->begin();
     
     Class *aClass = instance->getClass();
@@ -169,11 +170,12 @@ bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& pro
 
 bool RuntimeObjectImp::getOwnPropertyDescriptor(ExecState *exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    if (!instance) {
+    if (!m_instance) {
         throwInvalidAccessError(exec);
         return false;
     }
     
+    RefPtr<Instance> instance = m_instance;
     instance->begin();
     
     Class *aClass = instance->getClass();
@@ -217,12 +219,12 @@ bool RuntimeObjectImp::getOwnPropertyDescriptor(ExecState *exec, const Identifie
 
 void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    if (!instance) {
+    if (!m_instance) {
         throwInvalidAccessError(exec);
         return;
     }
     
-    RefPtr<Instance> protector(instance);
+    RefPtr<Instance> instance = m_instance;
     instance->begin();
 
     // Set the value of the property.
@@ -243,10 +245,11 @@ bool RuntimeObjectImp::deleteProperty(ExecState*, const Identifier&)
 
 JSValue RuntimeObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
-    if (!instance)
+    if (!m_instance)
         return throwInvalidAccessError(exec);
     
-    RefPtr<Instance> protector(instance);
+    RefPtr<Instance> instance = m_instance;
+
     instance->begin();
     JSValue result = instance->defaultValue(exec, hint);
     instance->end();
@@ -264,8 +267,13 @@ static JSValue JSC_HOST_CALL callRuntimeObject(ExecState* exec, JSObject* functi
 
 CallType RuntimeObjectImp::getCallData(CallData& callData)
 {
-    if (!instance || !instance->supportsInvokeDefaultMethod())
+    if (!m_instance)
+        return CallTypeNone;
+    
+    RefPtr<Instance> instance = m_instance;
+    if (!instance->supportsInvokeDefaultMethod())
         return CallTypeNone;
+    
     callData.native.function = callRuntimeObject;
     return CallTypeHost;
 }
@@ -283,19 +291,26 @@ static JSObject* callRuntimeConstructor(ExecState* exec, JSObject* constructor,
 
 ConstructType RuntimeObjectImp::getConstructData(ConstructData& constructData)
 {
-    if (!instance || !instance->supportsConstruct())
+    if (!m_instance)
+        return ConstructTypeNone;
+    
+    RefPtr<Instance> instance = m_instance;
+    if (!instance->supportsConstruct())
         return ConstructTypeNone;
+    
     constructData.native.function = callRuntimeConstructor;
     return ConstructTypeHost;
 }
 
 void RuntimeObjectImp::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    if (!instance) {
+    if (!m_instance) {
         throwInvalidAccessError(exec);
         return;
     }
 
+    RefPtr<Instance> instance = m_instance;
+    
     instance->begin();
     instance->getPropertyNames(exec, propertyNames);
     instance->end();
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
index 5e8f57e..5aa02ea 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,13 +34,12 @@ namespace JSC {
 class RuntimeObjectImp : public JSObject {
 public:
     RuntimeObjectImp(ExecState*, PassRefPtr<Bindings::Instance>);
-
     virtual ~RuntimeObjectImp();
 
     virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
     virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor&);
     virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-    virtual bool deleteProperty(ExecState* , const Identifier& propertyName);
+    virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
     virtual CallType getCallData(CallData&);
     virtual ConstructType getConstructData(ConstructData&);
@@ -48,8 +47,9 @@ public:
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
     virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
 
-    virtual void invalidate();
-    Bindings::Instance* getInternalInstance() const { return instance.get(); }
+    void invalidate();
+
+    Bindings::Instance* getInternalInstance() const { return m_instance.get(); }
 
     static JSObject* throwInvalidAccessError(ExecState*);
 
@@ -75,7 +75,7 @@ private:
     static JSValue fieldGetter(ExecState*, const Identifier&, const PropertySlot&);
     static JSValue methodGetter(ExecState*, const Identifier&, const PropertySlot&);
 
-    RefPtr<Bindings::Instance> instance;
+    RefPtr<Bindings::Instance> m_instance;
 };
     
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
index debd396..2935c31 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -1122,7 +1122,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyResize:
             return CSSPrimitiveValue::create(style->resize());
         case CSSPropertyWebkitFontSmoothing:
-            return CSSPrimitiveValue::create(style->fontSmoothing());
+            return CSSPrimitiveValue::create(style->fontDescription().fontSmoothing());
         case CSSPropertyZIndex:
             if (style->hasAutoZIndex())
                 return CSSPrimitiveValue::createIdentifier(CSSValueAuto);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
index aa2be59..c46bf36 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
@@ -2150,7 +2150,7 @@ PassRefPtr<CSSValue> CSSParser::parseAttr(CSSParserValueList* args)
     if (attrName[0] == '-')
         return 0;
 
-    if (document()->isHTMLDocument())
+    if (document() && document()->isHTMLDocument())
         attrName = attrName.lower();
     
     return CSSPrimitiveValue::create(attrName, CSSPrimitiveValue::CSS_ATTR);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
index 70b21c4..b46322d 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
@@ -30,6 +30,7 @@
 
 #include "CSSPrimitiveValue.h"
 #include "CSSValueKeywords.h"
+#include "FontSmoothingMode.h"
 #include "GraphicsTypes.h"
 #include "Path.h"
 #include "RenderStyleConstants.h"
@@ -1798,7 +1799,7 @@ template<> inline CSSPrimitiveValue::operator EPointerEvents() const
     }
 }
 
-template<> inline CSSPrimitiveValue::CSSPrimitiveValue(FontSmoothing smoothing)
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(FontSmoothingMode smoothing)
     : m_type(CSS_IDENT)
 {
     switch (smoothing) {
@@ -1820,7 +1821,7 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(FontSmoothing smoothing)
     m_value.ident = CSSValueAuto;
 }
 
-template<> inline CSSPrimitiveValue::operator FontSmoothing() const
+template<> inline CSSPrimitiveValue::operator FontSmoothingMode() const
 {
     switch (m_value.ident) {
     case CSSValueAuto:
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
index d6bcd39..dc9f2e5 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
@@ -1139,6 +1139,17 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
     }
 #endif
 
+#if ENABLE(MATHML)
+    static bool loadedMathMLUserAgentSheet;
+    if (e->isMathMLElement() && !loadedMathMLUserAgentSheet) {
+        // MathML rules.
+        loadedMathMLUserAgentSheet = true;
+        CSSStyleSheet* mathMLSheet = parseUASheet(mathmlUserAgentStyleSheet, sizeof(mathmlUserAgentStyleSheet));
+        defaultStyle->addRulesFromSheet(mathMLSheet, screenEval());
+        defaultPrintStyle->addRulesFromSheet(mathMLSheet, printEval());
+    }
+#endif
+
 #if ENABLE(WML)
     static bool loadedWMLUserAgentSheet;
     if (e->isWMLElement() && !loadedWMLUserAgentSheet) {
@@ -3498,14 +3509,14 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitFontSmoothing: {
         FontDescription fontDescription = m_style->fontDescription();
         if (isInherit) 
-            fontDescription.setFontSmoothing(m_parentStyle->fontSmoothing());
+            fontDescription.setFontSmoothing(m_parentStyle->fontDescription().fontSmoothing());
         else if (isInitial)
             fontDescription.setFontSmoothing(AutoSmoothing);
         else {
             if (!primitiveValue)
                 return;
             int id = primitiveValue->getIdent();
-            FontSmoothing smoothing;
+            FontSmoothingMode smoothing;
             switch (id) {
                 case CSSValueAuto:
                     smoothing = AutoSmoothing;
diff --git a/src/3rdparty/webkit/WebCore/css/mathml.css b/src/3rdparty/webkit/WebCore/css/mathml.css
new file mode 100644
index 0000000..e725d8c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/mathml.css
@@ -0,0 +1,170 @@
+@namespace "http://www.w3.org/1998/Math/MathML";
+
+/* approved */
+math {
+    font-family: Symbol, STIXGeneral, "Times New Roman";
+    display: inline-block;
+    padding: 0px;
+    margin: 0px;
+    text-indent: 0;
+    font-size: 1.1em;
+    vertical-align: baseline;
+}
+math[display="block"] {
+    font-family: "New Times Roman"
+    display: block;
+    text-align: center;
+    page-break-inside: avoid;
+}
+
+mfrac {
+    vertical-align: middle;
+}
+
+msub, msup {
+   display: inline-block;
+}
+
+msub > * + * {
+   vertical-align: sub;
+   font-size: 0.75em;
+   line-height: 0.75em;
+}
+
+msup > * + * {
+   vertical-align: super;
+   font-size: 0.75em;
+   line-height: 0.75em;
+}
+
+msubsup > * {
+    margin: 0px;
+    padding: 0px;
+    vertical-align: middle;
+}
+
+msubsup > * + * {
+   font-size: 0.75em;
+   line-height: 0.75em;
+}
+
+munderover {
+    vertical-align: middle;
+}
+
+munderover > * + *, mover > * + *, munder > * + * {
+   font-size: 0.75em;
+   line-height: 0.5625em;
+}
+
+mrow {
+    line-height: 1em;
+    white-space: nowrap;
+    vertical-align: middle;
+}
+
+mfenced > * {
+    vertical-align: middle;
+}
+
+mo, mn, mi {
+   line-height: 0.75em;
+   padding: 0px;
+   margin: 0px;
+}
+
+mo[mathsize="small"], mn[mathsize="small"], mi[mathsize="small"] {
+   font-size: 0.75em;
+   line-height: 0.5625em;
+}
+
+mo[mathsize="normal"],mn[mathsize="normal"],mi[mathsize="normal"] {
+   font-size: 1em;
+   line-height: 0.75em;
+}
+
+mo[mathsize="big"], mn[mathsize="big"], mi[mathsize="big"] {
+   line-height: 1.2em;
+   font-size: 1.5em;
+}
+ 
+annotation, annotation-xml {
+    display:none;
+}
+
+mphantom {
+    visibility: hidden;
+}
+merror {
+    outline: solid thin red;
+}
+
+msqrt {
+    padding-top: 0.2em;
+    padding-left: 0.75em;
+}
+
+mroot {
+    padding-top: 0.2em;
+    padding-left: 0.2em;
+}
+
+mroot > * + * {
+    font-size: 0.75em;
+    line-height: 0.75em;
+    vertical-align: top;
+    padding-right: 0.3em;
+}
+
+mtable {
+    display: inline-table;
+    line-height: 1.5em;
+    text-align: center;
+    vertical-align: middle;
+}
+mtr {
+    display: table-row;
+}
+mtd {
+    display: table-cell;
+    padding: 0 0.5ex;
+}
+
+mtable[columnalign="left"], mtr[columnalign="left"], mtd[columnalign="left"] {
+    text-align: left;
+}
+
+mtable[columnalign="right"], mtr[columnalign="right"], mtd[columnalign="right"] {
+    text-align: right;
+}
+mtable[rowalign="top"] mtd, mtable mtr[rowalign="top"] mtd, mtable mtr mtd[rowalign="top"] {
+    vertical-align: top;
+}
+mtable[rowalign="bottom"] mtd, mtable mtr[rowalign="bottom"] mtd, mtable mtr mtd[rowalign="bottom"] {
+    vertical-align: bottom;
+}
+mtable[rowalign="center"] mtd, mtable mtr[rowalign="center"] mtd, mtable mtr mtd[rowalign="center"] {
+    vertical-align: middle;
+}
+mtable[frame="solid"] {
+    border: solid thin;
+}
+mtable[frame="dashed"] {
+    border: dashed thin;
+}
+mtable[rowlines="solid"], mtable[rowlines="dashed"], mtable[columnlines="solid"], mtable[columnlines="dashed"] {
+    border-collapse: collapse;
+}
+mtable[rowlines="solid"] > mtr + mtr {
+    border-top: solid thin;
+}
+mtable[rowlines="dashed"] > mtr + mtr {
+    border-top: dashed thin;
+}
+mtable[columnlines="solid"] > mtr > mtd + mtd {
+    border-left: solid thin;
+}
+mtable[columnlines="dashed"] > mtr > mtd + mtd {
+    border-left: dashed thin;
+}
+
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css b/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
index 0c01da2..16ff0e4 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
@@ -147,6 +147,7 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     height: 16px;
 
     border-color: rgba(255, 255, 255, 0.2);
+    border-style: solid;
     border-width: 1px;
     border-radius: 2px;
     background-color: rgba(255, 255, 255, 0.08);
diff --git a/src/3rdparty/webkit/WebCore/dom/ActiveDOMObject.h b/src/3rdparty/webkit/WebCore/dom/ActiveDOMObject.h
index e58d3f9..73b52d5 100644
--- a/src/3rdparty/webkit/WebCore/dom/ActiveDOMObject.h
+++ b/src/3rdparty/webkit/WebCore/dom/ActiveDOMObject.h
@@ -53,9 +53,6 @@ namespace WebCore {
         virtual void resume();
         virtual void stop();
 
-    protected:
-        virtual ~ActiveDOMObject();
-
         template<class T> void setPendingActivity(T* thisObject)
         {
             ASSERT(thisObject == this);
@@ -70,6 +67,9 @@ namespace WebCore {
             thisObject->deref();
         }
 
+    protected:
+        virtual ~ActiveDOMObject();
+
     private:
         ScriptExecutionContext* m_scriptExecutionContext;
         unsigned m_pendingActivityCount;
diff --git a/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp b/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp
index 902b7ff..3c3dc37 100644
--- a/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp
@@ -187,10 +187,8 @@ void CharacterData::dispatchModifiedEvent(StringImpl* prevValue)
 {
     if (parentNode())
         parentNode()->childrenChanged();
-    if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER)) {
-        ExceptionCode ec;
-        dispatchMutationEvent(eventNames().DOMCharacterDataModifiedEvent, true, 0, prevValue, m_data, ec); 
-    }
+    if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER))
+        dispatchEvent(MutationEvent::create(eventNames().DOMCharacterDataModifiedEvent, true, 0, prevValue, m_data));
     dispatchSubtreeModifiedEvent();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
index 1ec4eb3..7274b5d 100644
--- a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
@@ -41,8 +41,8 @@
 
 namespace WebCore {
 
-static void dispatchChildInsertionEvents(Node*, ExceptionCode&);
-static void dispatchChildRemovalEvents(Node*, ExceptionCode&);
+static void dispatchChildInsertionEvents(Node*);
+static void dispatchChildRemovalEvents(Node*);
 
 typedef Vector<std::pair<NodeCallback, RefPtr<Node> > > NodeCallbackQueue;
 static NodeCallbackQueue* s_postAttachCallbackQueue;
@@ -144,7 +144,7 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
 
         // Dispatch the mutation events.
         childrenChanged(false, refChildPreviousSibling.get(), next.get(), 1);
-        dispatchChildInsertionEvents(child.get(), ec);
+        dispatchChildInsertionEvents(child.get());
                 
         // Add child to the rendering tree.
         if (attached() && !child->attached() && child->parent() == this) {
@@ -255,7 +255,7 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
         allowEventDispatch();
 
         // Dispatch the mutation events
-        dispatchChildInsertionEvents(child.get(), ec);
+        dispatchChildInsertionEvents(child.get());
                 
         // Add child to the rendering tree
         if (attached() && !child->attached() && child->parent() == this) {
@@ -287,7 +287,7 @@ static ExceptionCode willRemoveChild(Node *child)
     ExceptionCode ec = 0;
 
     // fire removed from document mutation events.
-    dispatchChildRemovalEvents(child, ec);
+    dispatchChildRemovalEvents(child);
     if (ec)
         return ec;
 
@@ -480,7 +480,7 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
 
         // Dispatch the mutation events
         childrenChanged(false, prev.get(), 0, 1);
-        dispatchChildInsertionEvents(child.get(), ec);
+        dispatchChildInsertionEvents(child.get());
 
         // Add child to the rendering tree
         if (attached() && !child->attached() && child->parent() == this) {
@@ -864,7 +864,7 @@ Node *ContainerNode::childNode(unsigned index) const
     return n;
 }
 
-static void dispatchChildInsertionEvents(Node* child, ExceptionCode& ec)
+static void dispatchChildInsertionEvents(Node* child)
 {
     ASSERT(!eventDispatchForbidden());
 
@@ -878,25 +878,17 @@ static void dispatchChildInsertionEvents(Node* child, ExceptionCode& ec)
 
     document->incDOMTreeVersion();
 
-    if (c->parentNode() && document->hasListenerType(Document::DOMNODEINSERTED_LISTENER)) {
-        ec = 0;
-        c->dispatchMutationEvent(eventNames().DOMNodeInsertedEvent, true, c->parentNode(), String(), String(), ec); 
-        if (ec)
-            return;
-    }
+    if (c->parentNode() && document->hasListenerType(Document::DOMNODEINSERTED_LISTENER))
+        c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeInsertedEvent, true, c->parentNode()));
 
     // dispatch the DOMNodeInsertedIntoDocument event to all descendants
     if (c->inDocument() && document->hasListenerType(Document::DOMNODEINSERTEDINTODOCUMENT_LISTENER)) {
-        for (; c; c = c->traverseNextNode(child)) {
-            ec = 0;
-            c->dispatchMutationEvent(eventNames().DOMNodeInsertedIntoDocumentEvent, false, 0, String(), String(), ec); 
-            if (ec)
-                return;
-        }
+        for (; c; c = c->traverseNextNode(child))
+            c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeInsertedIntoDocumentEvent, false));
     }
 }
 
-static void dispatchChildRemovalEvents(Node* child, ExceptionCode& ec)
+static void dispatchChildRemovalEvents(Node* child)
 {
     RefPtr<Node> c = child;
     RefPtr<Document> document = child->document();
@@ -907,21 +899,14 @@ static void dispatchChildRemovalEvents(Node* child, ExceptionCode& ec)
     document->incDOMTreeVersion();
 
     // dispatch pre-removal mutation events
-    if (c->parentNode() && document->hasListenerType(Document::DOMNODEREMOVED_LISTENER)) {
-        ec = 0;
-        c->dispatchMutationEvent(eventNames().DOMNodeRemovedEvent, true, c->parentNode(), String(), String(), ec); 
-        if (ec)
-            return;
-    }
+    if (c->parentNode() && document->hasListenerType(Document::DOMNODEREMOVED_LISTENER))
+        c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeRemovedEvent, true, c->parentNode()));
 
     // dispatch the DOMNodeRemovedFromDocument event to all descendants
-    if (c->inDocument() && document->hasListenerType(Document::DOMNODEREMOVEDFROMDOCUMENT_LISTENER))
-        for (; c; c = c->traverseNextNode(child)) {
-            ec = 0;
-            c->dispatchMutationEvent(eventNames().DOMNodeRemovedFromDocumentEvent, false, 0, String(), String(), ec); 
-            if (ec)
-                return;
-        }
+    if (c->inDocument() && document->hasListenerType(Document::DOMNODEREMOVEDFROMDOCUMENT_LISTENER)) {
+        for (; c; c = c->traverseNextNode(child))
+            c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeRemovedFromDocumentEvent, false));
+    }
 }
 
-}
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index 1b8afe7..5422bf0 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -174,6 +174,12 @@
 #include "WMLNames.h"
 #endif
 
+#if ENABLE(MATHML)
+#include "MathMLElement.h"
+#include "MathMLElementFactory.h"
+#include "MathMLNames.h"
+#endif
+
 #if ENABLE(XHTMLMP)
 #include "HTMLNoScriptElement.h"
 #endif
@@ -803,6 +809,10 @@ PassRefPtr<Element> Document::createElement(const QualifiedName& qName, bool cre
     else if (isWMLDocument())
         e = WMLElementFactory::createWMLElement(QualifiedName(nullAtom, qName.localName(), WMLNames::wmlNamespaceURI), this, createdByParser);
 #endif
+#if ENABLE(MATHML)
+    else if (qName.namespaceURI() == MathMLNames::mathmlNamespaceURI)
+        e = MathMLElementFactory::createMathMLElement(qName, this, createdByParser);
+#endif
     
     if (!e)
         e = Element::create(qName, document());
@@ -1460,9 +1470,11 @@ void Document::detach()
 
 void Document::removeAllEventListeners()
 {
+    EventTarget::removeAllEventListeners();
+
     if (DOMWindow* domWindow = this->domWindow())
         domWindow->removeAllEventListeners();
-    for (Node* node = this; node; node = node->traverseNextNode())
+    for (Node* node = firstChild(); node; node = node->traverseNextNode())
         node->removeAllEventListeners();
 }
 
@@ -1705,8 +1717,8 @@ void Document::implicitClose()
         f->animation()->resumeAnimations(this);
 
     ImageLoader::dispatchPendingLoadEvents();
-    dispatchLoadEvent();
-    dispatchPageTransitionEvent(EventNames().pageshowEvent, false);
+    dispatchWindowLoadEvent();
+    dispatchWindowEvent(PageTransitionEvent::create(eventNames().pageshowEvent, false), this);
     if (f)
         f->loader()->handledOnloadEvents();
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
@@ -2163,7 +2175,7 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
         FrameLoader* frameLoader = frame->loader();
         if (frameLoader->shouldInterruptLoadForXFrameOptions(content, url())) {
             frameLoader->stopAllLoaders();
-            frameLoader->scheduleHTTPRedirection(0, blankURL());
+            frameLoader->scheduleLocationChange(blankURL(), String());
         }
     }
 }
@@ -2636,7 +2648,7 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         // Dispatch a change event for text fields or textareas that have been edited
         RenderObject* r = oldFocusedNode->renderer();
         if (r && r->isTextControl() && toRenderTextControl(r)->isEdited()) {
-            oldFocusedNode->dispatchEvent(eventNames().changeEvent, true, false);
+            oldFocusedNode->dispatchEvent(Event::create(eventNames().changeEvent, true, false));
             r = oldFocusedNode->renderer();
             if (r && r->isTextControl())
                 toRenderTextControl(r)->setEdited(false);
@@ -2863,26 +2875,16 @@ EventListener* Document::getWindowAttributeEventListener(const AtomicString& eve
     return domWindow->getAttributeEventListener(eventType);
 }
 
-void Document::dispatchWindowEvent(PassRefPtr<Event> event)
-{
-    ASSERT(!eventDispatchForbidden());
-    DOMWindow* domWindow = this->domWindow();
-    if (!domWindow)
-        return;
-    ExceptionCode ec;
-    domWindow->dispatchEvent(event, ec);
-}
-
-void Document::dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
+void Document::dispatchWindowEvent(PassRefPtr<Event> event,  PassRefPtr<EventTarget> target)
 {
     ASSERT(!eventDispatchForbidden());
     DOMWindow* domWindow = this->domWindow();
     if (!domWindow)
         return;
-    domWindow->dispatchEvent(eventType, canBubbleArg, cancelableArg);
+    domWindow->dispatchEvent(event, target);
 }
 
-void Document::dispatchLoadEvent()
+void Document::dispatchWindowLoadEvent()
 {
     ASSERT(!eventDispatchForbidden());
     DOMWindow* domWindow = this->domWindow();
@@ -2891,15 +2893,6 @@ void Document::dispatchLoadEvent()
     domWindow->dispatchLoadEvent();
 }
 
-void Document::dispatchPageTransitionEvent(const AtomicString& eventType, bool persisted)
-{
-    ASSERT(!eventDispatchForbidden());
-    DOMWindow* domWindow = this->domWindow();
-    if (!domWindow)
-        return;
-    domWindow->dispatchPageTransitionEvent(eventType, persisted);
-}
-
 PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode& ec)
 {
     if (eventType == "Event" || eventType == "Events" || eventType == "HTMLEvents")
@@ -4019,10 +4012,7 @@ CollectionCache* Document::nameCollectionInfo(CollectionType type, const AtomicS
 void Document::finishedParsing()
 {
     setParsing(false);
-
-    ExceptionCode ec = 0;
-    dispatchEvent(Event::create(eventNames().DOMContentLoadedEvent, true, false), ec);
-
+    dispatchEvent(Event::create(eventNames().DOMContentLoadedEvent, true, false));
     if (Frame* f = frame())
         f->loader()->finishedParsing();
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.h b/src/3rdparty/webkit/WebCore/dom/Document.h
index bb247f3..454304b 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.h
+++ b/src/3rdparty/webkit/WebCore/dom/Document.h
@@ -200,6 +200,49 @@ public:
 
     // DOM methods & attributes for Document
 
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(change);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(click);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dblclick);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragenter);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragover);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragleave);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(drop);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragstart);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(drag);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragend);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keydown);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keypress);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keyup);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousedown);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousemove);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseout);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseover);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseup);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousewheel);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(scroll);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(select);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(submit);
+
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(blur);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(focus);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(load);
+
+    // WebKit extensions
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforecut);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(cut);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforecopy);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(copy);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforepaste);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(paste);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(selectstart);
+
     DocumentType* doctype() const { return m_docType.get(); }
 
     DOMImplementation* implementation() const;
@@ -547,10 +590,8 @@ public:
     // Helper functions for forwarding DOMWindow event related tasks to the DOMWindow if it exists.
     void setWindowAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
     EventListener* getWindowAttributeEventListener(const AtomicString& eventType);
-    void dispatchWindowEvent(PassRefPtr<Event>);
-    void dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg);
-    void dispatchLoadEvent();
-    void dispatchPageTransitionEvent(const AtomicString& eventType, bool persisted);
+    void dispatchWindowEvent(PassRefPtr<Event>, PassRefPtr<EventTarget> = 0);
+    void dispatchWindowLoadEvent();
 
     PassRefPtr<Event> createEvent(const String& eventType, ExceptionCode&);
 
@@ -812,7 +853,7 @@ public:
     void setDashboardRegions(const Vector<DashboardRegionValue>&);
 #endif
 
-    void removeAllEventListeners();
+    virtual void removeAllEventListeners();
 
     CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
     
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.h b/src/3rdparty/webkit/WebCore/dom/Element.h
index e7a910c..4ecf932 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.h
+++ b/src/3rdparty/webkit/WebCore/dom/Element.h
@@ -44,6 +44,51 @@ public:
     static PassRefPtr<Element> create(const QualifiedName&, Document*);
     virtual ~Element();
 
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(change);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(click);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dblclick);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragenter);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragover);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragleave);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(drop);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragstart);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(drag);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragend);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keydown);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keypress);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keyup);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousedown);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousemove);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseout);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseover);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseup);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousewheel);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(scroll);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(select);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(submit);
+
+    // These 4 attribute event handler attributes are overrided by HTMLBodyElement
+    // and HTMLFrameSetElement to forward to the DOMWindow.
+    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(blur);
+    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(error);
+    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(focus);
+    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(load);
+
+    // WebKit extensions
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforecut);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(cut);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforecopy);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(copy);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforepaste);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(paste);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(selectstart);
+
     const AtomicString& getIDAttribute() const;
     bool hasAttribute(const QualifiedName&) const;
     const AtomicString& getAttribute(const QualifiedName&) const;
diff --git a/src/3rdparty/webkit/WebCore/dom/EventListener.h b/src/3rdparty/webkit/WebCore/dom/EventListener.h
index 501c61d..6862f06 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventListener.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventListener.h
@@ -37,13 +37,14 @@ namespace WebCore {
     public:
         enum Type { JSEventListenerType, 
                     ImageEventListenerType, 
-                    InspectorDOMAgentType, 
+                    InspectorDOMAgentType,
+                    InspectorDOMStorageResourceType,
                     ObjCEventListenerType, 
                     ConditionEventListenerType };
                     
         virtual ~EventListener() { }
         virtual bool operator==(const EventListener&) = 0;
-        virtual void handleEvent(Event*, bool isWindowEvent = false) = 0;
+        virtual void handleEvent(Event*) = 0;
         // Return true to indicate that the error is handled.
         virtual bool reportError(const String& /*message*/, const String& /*url*/, int /*lineNumber*/) { return false; }
         virtual bool wasCreatedFromMarkup() const { return false; }
@@ -68,10 +69,6 @@ namespace WebCore {
         Type m_type;
     };
 
-#if USE(JSC)
-    inline void markIfNotNull(JSC::MarkStack& markStack, EventListener* listener) { if (listener) listener->markJSFunction(markStack); }
-#endif
-
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/EventNames.h b/src/3rdparty/webkit/WebCore/dom/EventNames.h
index 382bbf7..0eb98ec 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventNames.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventNames.h
@@ -45,6 +45,7 @@ namespace WebCore {
     macro(copy) \
     macro(cut) \
     macro(dblclick) \
+    macro(display) \
     macro(downloading) \
     macro(drag) \
     macro(dragend) \
@@ -136,6 +137,8 @@ namespace WebCore {
     \
     macro(webkitTransitionEnd) \
     \
+    macro(orientationchange) \
+    \
 // end of DOM_EVENT_NAMES_FOR_EACH
 
     class EventNames {
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
index 652644f..d3b3f55 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
@@ -34,11 +34,39 @@
 #include "config.h"
 #include "EventTarget.h"
 
+#include "Event.h"
+#include "EventException.h"
+#include <wtf/StdLibExtras.h>
+
+using namespace WTF;
+
 namespace WebCore {
 
 #ifndef NDEBUG
 static int gEventDispatchForbidden = 0;
-#endif
+
+void forbidEventDispatch()
+{
+    if (!isMainThread())
+        return;
+    ++gEventDispatchForbidden;
+}
+
+void allowEventDispatch()
+{
+    if (!isMainThread())
+        return;
+    if (gEventDispatchForbidden > 0)
+        --gEventDispatchForbidden;
+}
+
+bool eventDispatchForbidden()
+{
+    if (!isMainThread())
+        return false;
+    return gEventDispatchForbidden > 0;
+}
+#endif // NDEBUG
 
 EventTarget::~EventTarget()
 {
@@ -125,22 +153,153 @@ Notification* EventTarget::toNotification()
 }
 #endif
 
-#ifndef NDEBUG
-void forbidEventDispatch()
+bool EventTarget::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
-    ++gEventDispatchForbidden;
+    EventTargetData* d = ensureEventTargetData();
+
+    pair<EventListenerMap::iterator, bool> result = d->eventListenerMap.add(eventType, EventListenerVector());
+    EventListenerVector& entry = result.first->second;
+
+    RegisteredEventListener registeredListener(listener, useCapture);
+    if (!result.second) { // pre-existing entry
+        if (entry.find(registeredListener) != notFound) // duplicate listener
+            return false;
+    }
+
+    entry.append(registeredListener);
+    return true;
 }
 
-void allowEventDispatch()
+bool EventTarget::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    if (gEventDispatchForbidden > 0)
-        --gEventDispatchForbidden;
+    EventTargetData* d = eventTargetData();
+    if (!d)
+        return false;
+
+    EventListenerMap::iterator result = d->eventListenerMap.find(eventType);
+    if (result == d->eventListenerMap.end())
+        return false;
+    EventListenerVector& entry = result->second;
+
+    RegisteredEventListener registeredListener(listener, useCapture);
+    size_t index = entry.find(registeredListener);
+    if (index == notFound)
+        return false;
+
+    entry.remove(index);
+    if (!entry.size())
+        d->eventListenerMap.remove(result);
+
+    // Notify firing events planning to invoke the listener at 'index' that
+    // they have one less listener to invoke.
+    for (size_t i = 0; i < d->firingEventEndIterators.size(); ++i) {
+        if (eventType == *d->firingEventEndIterators[i].eventType && index < *d->firingEventEndIterators[i].value)
+            --*d->firingEventEndIterators[i].value;
+    }
+
+    return true;
 }
 
-bool eventDispatchForbidden()
+bool EventTarget::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
 {
-    return gEventDispatchForbidden > 0;
+    clearAttributeEventListener(eventType);
+    if (!listener)
+        return false;
+    return addEventListener(eventType, listener, false);
+}
+
+EventListener* EventTarget::getAttributeEventListener(const AtomicString& eventType)
+{
+    const EventListenerVector& entry = getEventListeners(eventType);
+    for (size_t i = 0; i < entry.size(); ++i) {
+        if (entry[i].listener->isAttribute())
+            return entry[i].listener.get();
+    }
+    return 0;
+}
+
+bool EventTarget::clearAttributeEventListener(const AtomicString& eventType)
+{
+    EventListener* listener = getAttributeEventListener(eventType);
+    if (!listener)
+        return false;
+    return removeEventListener(eventType, listener, false);
+}
+
+bool EventTarget::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
+{
+    if (!event || event->type().isEmpty()) {
+        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
+        return false;
+    }
+    return dispatchEvent(event);
+}
+
+bool EventTarget::dispatchEvent(PassRefPtr<Event> event)
+{
+    event->setTarget(this);
+    event->setCurrentTarget(this);
+    event->setEventPhase(Event::AT_TARGET);
+    return fireEventListeners(event.get());
+}
+
+bool EventTarget::fireEventListeners(Event* event)
+{
+    ASSERT(!eventDispatchForbidden());
+    ASSERT(event && !event->type().isEmpty());
+
+    EventTargetData* d = eventTargetData();
+    if (!d)
+        return true;
+
+    EventListenerMap::iterator result = d->eventListenerMap.find(event->type());
+    if (result == d->eventListenerMap.end())
+        return false;
+    EventListenerVector& entry = result->second;
+
+    RefPtr<EventTarget> protect = this;
+
+    size_t end = entry.size();
+    d->firingEventEndIterators.append(FiringEventEndIterator(&event->type(), &end));
+    for (size_t i = 0; i < end; ++i) {
+        RegisteredEventListener& registeredListener = entry[i];
+        if (event->eventPhase() == Event::CAPTURING_PHASE && !registeredListener.useCapture)
+            continue;
+        if (event->eventPhase() == Event::BUBBLING_PHASE && registeredListener.useCapture)
+            continue;
+        // To match Mozilla, the AT_TARGET phase fires both capturing and bubbling
+        // event listeners, even though that violates some versions of the DOM spec.
+        registeredListener.listener->handleEvent(event);
+    }
+    d->firingEventEndIterators.removeLast();
+
+    return !event->defaultPrevented();
+}
+
+const EventListenerVector& EventTarget::getEventListeners(const AtomicString& eventType)
+{
+    DEFINE_STATIC_LOCAL(EventListenerVector, emptyVector, ());
+
+    EventTargetData* d = eventTargetData();
+    if (!d)
+        return emptyVector;
+    EventListenerMap::iterator it = d->eventListenerMap.find(eventType);
+    if (it == d->eventListenerMap.end())
+        return emptyVector;
+    return it->second;
+}
+
+void EventTarget::removeAllEventListeners()
+{
+    EventTargetData* d = eventTargetData();
+    if (!d)
+        return;
+    d->eventListenerMap.clear();
+
+    // Notify firing events planning to invoke the listener at 'index' that
+    // they have one less listener to invoke.
+    for (size_t i = 0; i < d->firingEventEndIterators.size(); ++i)
+        *d->firingEventEndIterators[i].value = 0;
 }
-#endif // NDEBUG
 
-} // end namespace
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.h b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
index 6bcc3fb..4499328 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
@@ -32,6 +32,9 @@
 #ifndef EventTarget_h
 #define EventTarget_h
 
+#include "AtomicStringHash.h"
+#include "EventNames.h"
+#include "RegisteredEventListener.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
@@ -58,8 +61,31 @@ namespace WebCore {
 
     typedef int ExceptionCode;
 
+    struct FiringEventEndIterator {
+        FiringEventEndIterator(const AtomicString* eventType, size_t* value)
+            : eventType(eventType)
+            , value(value)
+        {
+        }
+        
+        const AtomicString* eventType;
+        size_t* value;
+    };
+    typedef Vector<FiringEventEndIterator, 1> FiringEventEndIteratorVector;
+
+    typedef Vector<RegisteredEventListener, 1> EventListenerVector;
+    typedef HashMap<AtomicString, EventListenerVector> EventListenerMap;
+
+    struct EventTargetData {
+        EventListenerMap eventListenerMap;
+        FiringEventEndIteratorVector firingEventEndIterators;
+    };
+
     class EventTarget {
     public:
+        void ref() { refEventTarget(); }
+        void deref() { derefEventTarget(); }
+
         virtual EventSource* toEventSource();
         virtual MessagePort* toMessagePort();
         virtual Node* toNode();
@@ -90,36 +116,119 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture) = 0;
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture) = 0;
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&) = 0;
+        virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+        virtual bool removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+        virtual void removeAllEventListeners();
+        virtual bool dispatchEvent(PassRefPtr<Event>);
+        bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&); // DOM API
 
-        void ref() { refEventTarget(); }
-        void deref() { derefEventTarget(); }
+        // Used for legacy "onEvent" attribute APIs.
+        bool setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
+        bool clearAttributeEventListener(const AtomicString& eventType);
+        EventListener* getAttributeEventListener(const AtomicString& eventType);
+
+        bool hasEventListeners();
+        bool hasEventListeners(const AtomicString& eventType);
+        const EventListenerVector& getEventListeners(const AtomicString& eventType);
 
-        // Handlers to do/undo actions on the target node before an event is dispatched to it and after the event
-        // has been dispatched.  The data pointer is handed back by the preDispatch and passed to postDispatch.
-        virtual void* preDispatchEventHandler(Event*) { return 0; }
-        virtual void postDispatchEventHandler(Event*, void* /*dataFromPreDispatch*/) { }
+        bool fireEventListeners(Event*);
+        bool isFiringEventListeners();
+
+#if USE(JSC)
+        void markEventListeners(JSC::MarkStack&);
+        void invalidateEventListeners();
+#endif
 
     protected:
         virtual ~EventTarget();
+        
+        virtual EventTargetData* eventTargetData() = 0;
+        virtual EventTargetData* ensureEventTargetData() = 0;
 
     private:
         virtual void refEventTarget() = 0;
         virtual void derefEventTarget() = 0;
     };
 
-    void forbidEventDispatch();
-    void allowEventDispatch();
+    #define DEFINE_ATTRIBUTE_EVENT_LISTENER(attribute) \
+        EventListener* on##attribute() { return getAttributeEventListener(eventNames().attribute##Event); } \
+        void setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().attribute##Event, listener); } \
+
+    #define DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(attribute) \
+        virtual EventListener* on##attribute() { return getAttributeEventListener(eventNames().attribute##Event); } \
+        virtual void setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().attribute##Event, listener); } \
+
+    #define DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(attribute) \
+        EventListener* on##attribute() { return document()->getWindowAttributeEventListener(eventNames().attribute##Event); } \
+        void setOn##attribute(PassRefPtr<EventListener> listener) { document()->setWindowAttributeEventListener(eventNames().attribute##Event, listener); } \
+
+    #define DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(attribute, eventName) \
+        EventListener* on##attribute() { return getAttributeEventListener(eventNames().eventName##Event); } \
+        void setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().eventName##Event, listener); } \
+
+    #define DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(recipient, attribute) \
+        EventListener* on##attribute() { return recipient ? recipient->getAttributeEventListener(eventNames().attribute##Event) : 0; } \
+        void setOn##attribute(PassRefPtr<EventListener> listener) { if (recipient) recipient->setAttributeEventListener(eventNames().attribute##Event, listener); } \
 
 #ifndef NDEBUG
+    void forbidEventDispatch();
+    void allowEventDispatch();
     bool eventDispatchForbidden();
 #else
     inline void forbidEventDispatch() { }
     inline void allowEventDispatch() { }
 #endif
 
-}
+#if USE(JSC)
+    inline void EventTarget::markEventListeners(JSC::MarkStack& markStack)
+    {
+        EventTargetData* d = eventTargetData();
+        if (!d)
+            return;
+
+        EventListenerMap::iterator end = d->eventListenerMap.end();
+        for (EventListenerMap::iterator it = d->eventListenerMap.begin(); it != end; ++it) {
+            EventListenerVector& entry = it->second;
+            for (size_t i = 0; i < entry.size(); ++i)
+                entry[i].listener->markJSFunction(markStack);
+        }
+    }
+
+    inline void EventTarget::invalidateEventListeners()
+    {
+        EventTargetData* d = eventTargetData();
+        if (!d)
+            return;
+
+        d->eventListenerMap.clear();
+    }
+
+    inline bool EventTarget::isFiringEventListeners()
+    {
+        EventTargetData* d = eventTargetData();
+        if (!d)
+            return false;
+        return d->firingEventEndIterators.size() != 0;
+    }
+
+    inline bool EventTarget::hasEventListeners()
+    {
+        EventTargetData* d = eventTargetData();
+        if (!d)
+            return false;
+        return !d->eventListenerMap.isEmpty();
+    }
+
+    inline bool EventTarget::hasEventListeners(const AtomicString& eventType)
+    {
+        EventTargetData* d = eventTargetData();
+        if (!d)
+            return false;
+        return d->eventListenerMap.contains(eventType);
+    }
 
 #endif
+
+} // namespace WebCore
+
+#endif // EventTarget_h
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
index 97793e2..96e31f4 100644
--- a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
@@ -34,7 +34,6 @@
 #include "RenderTextControlSingleLine.h"
 #include "SelectionController.h"
 #include "TextIterator.h"
-#include "TextBreakIterator.h"
 
 #if ENABLE(WML)
 #include "WMLInputElement.h"
@@ -154,28 +153,10 @@ void InputElement::setValueFromRenderer(InputElementData& data, InputElement* in
 
     element->setFormControlValueMatchesRenderer(true);
 
-    // Fire the "input" DOM event
-    element->dispatchEvent(eventNames().inputEvent, true, false);
+    element->dispatchEvent(Event::create(eventNames().inputEvent, true, false));
     notifyFormStateChanged(element);
 }
 
-static int numCharactersInGraphemeClusters(StringImpl* s, int numGraphemeClusters)
-{
-    if (!s)
-        return 0;
-
-    TextBreakIterator* it = characterBreakIterator(s->characters(), s->length());
-    if (!it)
-        return 0;
-
-    for (int i = 0; i < numGraphemeClusters; ++i) {
-        if (textBreakNext(it) == TextBreakDone)
-            return s->length();
-    }
-
-    return textBreakCurrent(it);
-}
-
 String InputElement::sanitizeValue(const InputElement* inputElement, const String& proposedValue)
 {
     return InputElement::sanitizeUserInputValue(inputElement, proposedValue, s_maximumLength);
@@ -191,36 +172,15 @@ String InputElement::sanitizeUserInputValue(const InputElement* inputElement, co
     string.replace('\r', ' ');
     string.replace('\n', ' ');
 
-    StringImpl* s = string.impl();
-    int newLength = numCharactersInGraphemeClusters(s, maxLength);
-    for (int i = 0; i < newLength; ++i) {
-        const UChar& current = (*s)[i];
+    unsigned newLength = string.numCharactersInGraphemeClusters(maxLength);
+    for (unsigned i = 0; i < newLength; ++i) {
+        const UChar current = string[i];
         if (current < ' ' && current != '\t') {
             newLength = i;
             break;
         }
     }
-
-    if (newLength < static_cast<int>(string.length()))
-        return string.left(newLength);
-
-    return string;
-}
-
-static int numGraphemeClusters(StringImpl* s)
-{
-    if (!s)
-        return 0;
-
-    TextBreakIterator* it = characterBreakIterator(s->characters(), s->length());
-    if (!it)
-        return 0;
-
-    int num = 0;
-    while (textBreakNext(it) != TextBreakDone)
-        ++num;
-
-    return num;
+    return string.left(newLength);
 }
 
 void InputElement::handleBeforeTextInsertedEvent(InputElementData& data, InputElement* inputElement, Element* element, Event* event)
@@ -231,15 +191,16 @@ void InputElement::handleBeforeTextInsertedEvent(InputElementData& data, InputEl
     // We use RenderTextControlSingleLine::text() instead of InputElement::value()
     // because they can be mismatched by sanitizeValue() in
     // RenderTextControlSingleLine::subtreeHasChanged() in some cases.
-    int oldLength = numGraphemeClusters(toRenderTextControlSingleLine(element->renderer())->text().impl());
+    unsigned oldLength = toRenderTextControlSingleLine(element->renderer())->text().numGraphemeClusters();
 
     // selection() may be a pre-edit text.
-    int selectionLength = numGraphemeClusters(plainText(element->document()->frame()->selection()->selection().toNormalizedRange().get()).impl());
+    unsigned selectionLength = plainText(element->document()->frame()->selection()->selection().toNormalizedRange().get()).numGraphemeClusters();
     ASSERT(oldLength >= selectionLength);
 
     // Selected characters will be removed by the next text event.
-    int baseLength = oldLength - selectionLength;
-    int appendableLength = data.maxLength() - baseLength;
+    unsigned baseLength = oldLength - selectionLength;
+    unsigned maxLength = static_cast<unsigned>(data.maxLength()); // maxLength() can never be negative.
+    unsigned appendableLength = maxLength > baseLength ? maxLength - baseLength : 0;
 
     // Truncate the inserted text to avoid violating the maxLength and other constraints.
     BeforeTextInsertedEvent* textEvent = static_cast<BeforeTextInsertedEvent*>(event);
diff --git a/src/3rdparty/webkit/WebCore/dom/MessageEvent.h b/src/3rdparty/webkit/WebCore/dom/MessageEvent.h
index 7d94689..555ed47 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessageEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessageEvent.h
@@ -42,7 +42,7 @@ namespace WebCore {
         {
             return adoptRef(new MessageEvent);
         }
-        static PassRefPtr<MessageEvent> create(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray> ports)
+        static PassRefPtr<MessageEvent> create(PassOwnPtr<MessagePortArray> ports, const String& data = "", const String& origin = "", const String& lastEventId = "", PassRefPtr<DOMWindow> source = 0)
         {
             return adoptRef(new MessageEvent(data, origin, lastEventId, source, ports));
         }
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
index bfd7932..50a0106 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
@@ -169,13 +169,7 @@ void MessagePort::dispatchMessages()
     OwnPtr<MessagePortChannel::EventData> eventData;
     while (m_entangledChannel && m_entangledChannel->tryGetMessageFromRemote(eventData)) {
         OwnPtr<MessagePortArray> ports = MessagePort::entanglePorts(*m_scriptExecutionContext, eventData->channels());
-        RefPtr<Event> evt = MessageEvent::create(eventData->message(), "", "", 0, ports.release());
-
-        if (m_onMessageListener) {
-            evt->setTarget(this);
-            evt->setCurrentTarget(this);
-            m_onMessageListener->handleEvent(evt.get(), false);
-        }
+        RefPtr<Event> evt = MessageEvent::create(ports.release(), eventData->message());
 
         ExceptionCode ec = 0;
         dispatchEvent(evt.release(), ec);
@@ -183,63 +177,6 @@ void MessagePort::dispatchMessages()
     }
 }
 
-void MessagePort::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end()) {
-        ListenerVector listeners;
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    } else {
-        ListenerVector& listeners = iter->second;
-        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (**listenerIter == *eventListener)
-                return;
-        }
-        
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    }    
-}
-
-void MessagePort::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end())
-        return;
-    
-    ListenerVector& listeners = iter->second;
-    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (**listenerIter == *eventListener) {
-            listeners.remove(listenerIter - listeners.begin());
-            return;
-        }
-    }
-}
-
-bool MessagePort::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
-{
-    if (!event || event->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
-    }
-    
-    ListenerVector listenersCopy = m_eventListeners.get(event->type());
-    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        listenerIter->get()->handleEvent(event.get(), false);
-    }
-    
-    return !event->defaultPrevented();
-}
-
-void MessagePort::setOnmessage(PassRefPtr<EventListener> eventListener)
-{
-    m_onMessageListener = eventListener;
-    start();
-}
-
 bool MessagePort::hasPendingActivity()
 {
     // The spec says that entangled message ports should always be treated as if they have a strong reference.
@@ -294,4 +231,14 @@ PassOwnPtr<MessagePortArray> MessagePort::entanglePorts(ScriptExecutionContext&
     return portArray;
 }
 
+EventTargetData* MessagePort::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* MessagePort::ensureEventTargetData()
+{
+    return &m_eventTargetData;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.h b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
index d042bc1..e649d5d 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
@@ -29,9 +29,9 @@
 
 #include "AtomicStringHash.h"
 #include "EventListener.h"
+#include "EventNames.h"
 #include "EventTarget.h"
 #include "MessagePortChannel.h"
-
 #include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
@@ -87,21 +87,17 @@ namespace WebCore {
 
         void dispatchMessages();
 
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-
-        typedef Vector<RefPtr<EventListener> > ListenerVector;
-        typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
-        EventListenersMap& eventListeners() { return m_eventListeners; }
-
         using RefCounted<MessagePort>::ref;
         using RefCounted<MessagePort>::deref;
 
         bool hasPendingActivity();
 
-        void setOnmessage(PassRefPtr<EventListener>);
-        EventListener* onmessage() const { return m_onMessageListener.get(); }
+        void setOnmessage(PassRefPtr<EventListener> listener)
+        {
+            setAttributeEventListener(eventNames().messageEvent, listener);
+            start();
+        }
+        EventListener* onmessage() { return getAttributeEventListener(eventNames().messageEvent); }
 
         // Returns null if there is no entangled port, or if the entangled port is run by a different thread.
         // Returns null otherwise.
@@ -114,16 +110,15 @@ namespace WebCore {
 
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
 
         OwnPtr<MessagePortChannel> m_entangledChannel;
 
         bool m_started;
 
         ScriptExecutionContext* m_scriptExecutionContext;
-
-        RefPtr<EventListener> m_onMessageListener;
-
-        EventListenersMap m_eventListeners;
+        EventTargetData m_eventTargetData;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.idl b/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
index 11ab757..a9149ec 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
@@ -28,6 +28,7 @@ module events {
 
     interface [
         CustomMarkFunction,
+        EventTarget,
         GenerateConstructor,
         NoStaticTables
     ] MessagePort {
diff --git a/src/3rdparty/webkit/WebCore/dom/MutationEvent.h b/src/3rdparty/webkit/WebCore/dom/MutationEvent.h
index c5f2d1d..29b978c 100644
--- a/src/3rdparty/webkit/WebCore/dom/MutationEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/MutationEvent.h
@@ -41,10 +41,11 @@ namespace WebCore {
         {
             return adoptRef(new MutationEvent);
         }
-        static PassRefPtr<MutationEvent> create(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<Node> relatedNode,
-            const String& prevValue, const String& newValue, const String& attrName, unsigned short attrChange)
+
+        static PassRefPtr<MutationEvent> create(const AtomicString& type, bool canBubble, PassRefPtr<Node> relatedNode = 0,
+            const String& prevValue = String(), const String& newValue = String(), const String& attrName = String(), unsigned short attrChange = 0)
         {
-            return adoptRef(new MutationEvent(type, canBubble, cancelable, relatedNode, prevValue, newValue, attrName, attrChange));
+            return adoptRef(new MutationEvent(type, canBubble, false, relatedNode, prevValue, newValue, attrName, attrChange));
         }
 
         void initMutationEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<Node> relatedNode,
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.cpp b/src/3rdparty/webkit/WebCore/dom/Node.cpp
index a26dd04..2240dd8 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Node.cpp
@@ -2342,16 +2342,6 @@ ScriptExecutionContext* Node::scriptExecutionContext() const
     return document();
 }
 
-const RegisteredEventListenerVector& Node::eventListeners() const
-{
-    if (hasRareData()) {
-        if (RegisteredEventListenerVector* listeners = rareData()->listeners())
-            return *listeners;
-    }
-    static const RegisteredEventListenerVector* emptyListenersVector = new RegisteredEventListenerVector;
-    return *emptyListenersVector;
-}
-
 void Node::insertedIntoDocument()
 {
     setInDocument(true);
@@ -2399,69 +2389,45 @@ static inline void updateSVGElementInstancesAfterEventListenerChange(Node* refer
 #endif
 }
 
-void Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+bool Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
+    if (!EventTarget::addEventListener(eventType, listener, useCapture))
+        return false;
+
     if (Document* document = this->document())
         document->addListenerTypeIfNeeded(eventType);
-
-    RegisteredEventListenerVector& listeners = ensureRareData()->ensureListeners();
-
-    // Remove existing identical listener set with identical arguments.
-    // The DOM2 spec says that "duplicate instances are discarded" in this case.
-    removeEventListener(eventType, listener.get(), useCapture);
-
-    listeners.append(RegisteredEventListener::create(eventType, listener, useCapture));
     updateSVGElementInstancesAfterEventListenerChange(this);
+    return true;
 }
 
-void Node::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
+bool Node::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    if (!hasRareData())
-        return;
-
-    RegisteredEventListenerVector* listeners = rareData()->listeners();
-    if (!listeners)
-        return;
-
-    size_t size = listeners->size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listeners->at(i);
-        if (r.eventType() == eventType && r.useCapture() == useCapture && *r.listener() == *listener) {
-            r.setRemoved(true);
-            listeners->remove(i);
+    if (!EventTarget::removeEventListener(eventType, listener, useCapture))
+        return false;
 
-            updateSVGElementInstancesAfterEventListenerChange(this);
-            return;
-        }
-    }
+    updateSVGElementInstancesAfterEventListenerChange(this);
+    return true;
 }
 
-void Node::removeAllEventListenersSlowCase()
+EventTargetData* Node::eventTargetData()
 {
-    ASSERT(hasRareData());
-
-    RegisteredEventListenerVector* listeners = rareData()->listeners();
-    if (!listeners)
-        return;
+    return hasRareData() ? rareData()->eventTargetData() : 0;
+}
 
-    size_t size = listeners->size();
-    for (size_t i = 0; i < size; ++i)
-        listeners->at(i)->setRemoved(true);
-    listeners->clear();
+EventTargetData* Node::ensureEventTargetData()
+{
+    return ensureRareData()->ensureEventTargetData();
 }
 
-void Node::handleLocalEvents(Event* event, bool useCapture)
+void Node::handleLocalEvents(Event* event)
 {
+    if (!hasRareData() || !rareData()->eventTargetData())
+        return;
+
     if (disabled() && event->isMouseEvent())
         return;
 
-    RegisteredEventListenerVector listenersCopy = eventListeners();
-    size_t size = listenersCopy.size();
-    for (size_t i = 0; i < size; ++i) {
-        const RegisteredEventListener& r = *listenersCopy[i];
-        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
-            r.listener()->handleEvent(event, false);
-    }
+    fireEventListeners(event);
 }
 
 #if ENABLE(SVG)
@@ -2502,19 +2468,15 @@ static inline EventTarget* eventTargetRespectingSVGTargetRules(Node* referenceNo
     return referenceNode;
 }
 
-bool Node::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
+bool Node::dispatchEvent(PassRefPtr<Event> prpEvent)
 {
-    RefPtr<Event> evt(e);
-    ASSERT(!eventDispatchForbidden());
-    if (!evt || evt->type().isEmpty()) { 
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return false;
-    }
+    RefPtr<EventTarget> protect = this;
+    RefPtr<Event> event = prpEvent;
 
-    evt->setTarget(eventTargetRespectingSVGTargetRules(this));
+    event->setTarget(eventTargetRespectingSVGTargetRules(this));
 
     RefPtr<FrameView> view = document()->view();
-    return dispatchGenericEvent(evt.release());
+    return dispatchGenericEvent(event.release());
 }
 
 bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
@@ -2567,27 +2529,22 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
 
     if (targetForWindowEvents) {
         event->setCurrentTarget(targetForWindowEvents);
-        targetForWindowEvents->handleEvent(event.get(), true);
+        targetForWindowEvents->fireEventListeners(event.get());
         if (event->propagationStopped())
             goto doneDispatching;
     }
     for (size_t i = ancestors.size(); i; --i) {
         ContainerNode* ancestor = ancestors[i - 1].get();
         event->setCurrentTarget(eventTargetRespectingSVGTargetRules(ancestor));
-        ancestor->handleLocalEvents(event.get(), true);
+        ancestor->handleLocalEvents(event.get());
         if (event->propagationStopped())
             goto doneDispatching;
     }
 
     event->setEventPhase(Event::AT_TARGET);
 
-    // We do want capturing event listeners to be invoked here, even though
-    // that violates some versions of the DOM specification; Mozilla does it.
     event->setCurrentTarget(eventTargetRespectingSVGTargetRules(this));
-    handleLocalEvents(event.get(), true);
-    if (event->propagationStopped())
-        goto doneDispatching;
-    handleLocalEvents(event.get(), false);
+    handleLocalEvents(event.get());
     if (event->propagationStopped())
         goto doneDispatching;
 
@@ -2599,13 +2556,13 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
         for (size_t i = 0; i < size; ++i) {
             ContainerNode* ancestor = ancestors[i].get();
             event->setCurrentTarget(eventTargetRespectingSVGTargetRules(ancestor));
-            ancestor->handleLocalEvents(event.get(), false);
+            ancestor->handleLocalEvents(event.get());
             if (event->propagationStopped() || event->cancelBubble())
                 goto doneDispatching;
         }
         if (targetForWindowEvents) {
             event->setCurrentTarget(targetForWindowEvents);
-            targetForWindowEvents->handleEvent(event.get(), false);
+            targetForWindowEvents->fireEventListeners(event.get());
             if (event->propagationStopped() || event->cancelBubble())
                 goto doneDispatching;
         }
@@ -2663,8 +2620,7 @@ void Node::dispatchSubtreeModifiedEvent()
     if (!document()->hasListenerType(Document::DOMSUBTREEMODIFIED_LISTENER))
         return;
 
-    ExceptionCode ec = 0;
-    dispatchMutationEvent(eventNames().DOMSubtreeModifiedEvent, true, 0, String(), String(), ec); 
+    dispatchEvent(MutationEvent::create(eventNames().DOMSubtreeModifiedEvent, true));
 }
 
 void Node::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent)
@@ -2674,18 +2630,15 @@ void Node::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr
     
     bool cancelable = eventType == eventNames().DOMActivateEvent;
     
-    ExceptionCode ec = 0;
-    RefPtr<UIEvent> evt = UIEvent::create(eventType, true, cancelable, document()->defaultView(), detail);
-    evt->setUnderlyingEvent(underlyingEvent);
-    dispatchEvent(evt.release(), ec);
+    RefPtr<UIEvent> event = UIEvent::create(eventType, true, cancelable, document()->defaultView(), detail);
+    event->setUnderlyingEvent(underlyingEvent);
+    dispatchEvent(event.release());
 }
 
 bool Node::dispatchKeyEvent(const PlatformKeyboardEvent& key)
 {
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
     RefPtr<KeyboardEvent> keyboardEvent = KeyboardEvent::create(key, document()->defaultView());
-    bool r = dispatchEvent(keyboardEvent, ec);
+    bool r = dispatchEvent(keyboardEvent);
     
     // we want to return false if default is prevented (already taken care of)
     // or if the element is default-handled by the DOM. Otherwise we let it just
@@ -2779,8 +2732,6 @@ bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int det
     
     bool cancelable = eventType != eventNames().mousemoveEvent;
     
-    ExceptionCode ec = 0;
-    
     bool swallowEvent = false;
     
     // Attempting to dispatch with a non-EventTarget relatedTarget causes the relatedTarget to be silently ignored.
@@ -2805,7 +2756,7 @@ bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int det
     mouseEvent->setUnderlyingEvent(underlyingEvent.get());
     mouseEvent->setAbsoluteLocation(IntPoint(pageX, pageY));
     
-    dispatchEvent(mouseEvent, ec);
+    dispatchEvent(mouseEvent);
     bool defaultHandled = mouseEvent->defaultHandled();
     bool defaultPrevented = mouseEvent->defaultPrevented();
     if (defaultHandled || defaultPrevented)
@@ -2823,7 +2774,7 @@ bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int det
         doubleClickEvent->setUnderlyingEvent(underlyingEvent.get());
         if (defaultHandled)
             doubleClickEvent->setDefaultHandled();
-        dispatchEvent(doubleClickEvent, ec);
+        dispatchEvent(doubleClickEvent);
         if (doubleClickEvent->defaultHandled() || doubleClickEvent->defaultPrevented())
             swallowEvent = true;
     }
@@ -2860,98 +2811,18 @@ void Node::dispatchWheelEvent(PlatformWheelEvent& e)
 
     we->setAbsoluteLocation(IntPoint(pos.x(), pos.y()));
 
-    ExceptionCode ec = 0;
-    if (!dispatchEvent(we.release(), ec))
+    if (!dispatchEvent(we.release()))
         e.accept();
 }
 
-void Node::dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime)
-{
-    ASSERT(!eventDispatchForbidden());
-    
-    ExceptionCode ec = 0;
-    dispatchEvent(WebKitAnimationEvent::create(eventType, animationName, elapsedTime), ec);
-}
-
-void Node::dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime)
-{
-    ASSERT(!eventDispatchForbidden());
-    
-    ExceptionCode ec = 0;
-    dispatchEvent(WebKitTransitionEvent::create(eventType, propertyName, elapsedTime), ec);
-}
-
-void Node::dispatchMutationEvent(const AtomicString& eventType, bool canBubble, PassRefPtr<Node> relatedNode, const String& prevValue, const String& newValue, ExceptionCode& ec)
-{
-    ASSERT(!eventDispatchForbidden());
-
-    dispatchEvent(MutationEvent::create(eventType, canBubble, false, relatedNode, prevValue, newValue, String(), 0), ec);
-}
-
 void Node::dispatchFocusEvent()
 {
-    dispatchEvent(eventNames().focusEvent, false, false);
+    dispatchEvent(Event::create(eventNames().focusEvent, false, false));
 }
 
 void Node::dispatchBlurEvent()
 {
-    dispatchEvent(eventNames().blurEvent, false, false);
-}
-
-bool Node::dispatchEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
-{
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    return dispatchEvent(Event::create(eventType, canBubbleArg, cancelableArg), ec);
-}
-
-void Node::dispatchProgressEvent(const AtomicString &eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg)
-{
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    dispatchEvent(ProgressEvent::create(eventType, lengthComputableArg, loadedArg, totalArg), ec);
-}
-
-void Node::clearAttributeEventListener(const AtomicString& eventType)
-{
-    if (!hasRareData())
-        return;
-
-    RegisteredEventListenerVector* listeners = rareData()->listeners();
-    if (!listeners)
-        return;
-
-    size_t size = listeners->size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listeners->at(i);
-        if (r.eventType() != eventType || !r.listener()->isAttribute())
-            continue;
-
-        r.setRemoved(true);
-        listeners->remove(i);
-
-        updateSVGElementInstancesAfterEventListenerChange(this);
-        return;
-    }
-}
-
-void Node::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
-{
-    clearAttributeEventListener(eventType);
-    if (listener)
-        addEventListener(eventType, listener, false);
-}
-
-EventListener* Node::getAttributeEventListener(const AtomicString& eventType) const
-{
-    const RegisteredEventListenerVector& listeners = eventListeners();
-    size_t size = listeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        const RegisteredEventListener& r = *listeners[i];
-        if (r.eventType() == eventType && r.listener()->isAttribute())
-            return r.listener();
-    }
-    return 0;
+    dispatchEvent(Event::create(eventNames().blurEvent, false, false));
 }
 
 bool Node::disabled() const
@@ -2984,396 +2855,6 @@ void Node::defaultEventHandler(Event* event)
     }
 }
 
-EventListener* Node::onabort() const
-{
-    return getAttributeEventListener(eventNames().abortEvent);
-}
-
-void Node::setOnabort(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().abortEvent, eventListener);
-}
-
-EventListener* Node::onblur() const
-{
-    return getAttributeEventListener(eventNames().blurEvent);
-}
-
-void Node::setOnblur(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().blurEvent, eventListener);
-}
-
-EventListener* Node::onchange() const
-{
-    return getAttributeEventListener(eventNames().changeEvent);
-}
-
-void Node::setOnchange(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().changeEvent, eventListener);
-}
-
-EventListener* Node::onclick() const
-{
-    return getAttributeEventListener(eventNames().clickEvent);
-}
-
-void Node::setOnclick(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().clickEvent, eventListener);
-}
-
-EventListener* Node::oncontextmenu() const
-{
-    return getAttributeEventListener(eventNames().contextmenuEvent);
-}
-
-void Node::setOncontextmenu(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().contextmenuEvent, eventListener);
-}
-
-EventListener* Node::ondblclick() const
-{
-    return getAttributeEventListener(eventNames().dblclickEvent);
-}
-
-void Node::setOndblclick(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dblclickEvent, eventListener);
-}
-
-EventListener* Node::onerror() const
-{
-    return getAttributeEventListener(eventNames().errorEvent);
-}
-
-void Node::setOnerror(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().errorEvent, eventListener);
-}
-
-EventListener* Node::onfocus() const
-{
-    return getAttributeEventListener(eventNames().focusEvent);
-}
-
-void Node::setOnfocus(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().focusEvent, eventListener);
-}
-
-EventListener* Node::oninput() const
-{
-    return getAttributeEventListener(eventNames().inputEvent);
-}
-
-void Node::setOninput(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().inputEvent, eventListener);
-}
-
-EventListener* Node::oninvalid() const
-{
-    return getAttributeEventListener(eventNames().invalidEvent);
-}
-
-void Node::setOninvalid(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().invalidEvent, eventListener);
-}
-
-EventListener* Node::onkeydown() const
-{
-    return getAttributeEventListener(eventNames().keydownEvent);
-}
-
-void Node::setOnkeydown(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().keydownEvent, eventListener);
-}
-
-EventListener* Node::onkeypress() const
-{
-    return getAttributeEventListener(eventNames().keypressEvent);
-}
-
-void Node::setOnkeypress(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().keypressEvent, eventListener);
-}
-
-EventListener* Node::onkeyup() const
-{
-    return getAttributeEventListener(eventNames().keyupEvent);
-}
-
-void Node::setOnkeyup(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().keyupEvent, eventListener);
-}
-
-EventListener* Node::onload() const
-{
-    return getAttributeEventListener(eventNames().loadEvent);
-}
-
-void Node::setOnload(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().loadEvent, eventListener);
-}
-
-EventListener* Node::onmousedown() const
-{
-    return getAttributeEventListener(eventNames().mousedownEvent);
-}
-
-void Node::setOnmousedown(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mousedownEvent, eventListener);
-}
-
-EventListener* Node::onmousemove() const
-{
-    return getAttributeEventListener(eventNames().mousemoveEvent);
-}
-
-void Node::setOnmousemove(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mousemoveEvent, eventListener);
-}
-
-EventListener* Node::onmouseout() const
-{
-    return getAttributeEventListener(eventNames().mouseoutEvent);
-}
-
-void Node::setOnmouseout(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mouseoutEvent, eventListener);
-}
-
-EventListener* Node::onmouseover() const
-{
-    return getAttributeEventListener(eventNames().mouseoverEvent);
-}
-
-void Node::setOnmouseover(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mouseoverEvent, eventListener);
-}
-
-EventListener* Node::onmouseup() const
-{
-    return getAttributeEventListener(eventNames().mouseupEvent);
-}
-
-void Node::setOnmouseup(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mouseupEvent, eventListener);
-}
-
-EventListener* Node::onmousewheel() const
-{
-    return getAttributeEventListener(eventNames().mousewheelEvent);
-}
-
-void Node::setOnmousewheel(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mousewheelEvent, eventListener);
-}
-
-EventListener* Node::ondragenter() const
-{
-    return getAttributeEventListener(eventNames().dragenterEvent);
-}
-
-void Node::setOndragenter(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragenterEvent, eventListener);
-}
-
-EventListener* Node::ondragover() const
-{
-    return getAttributeEventListener(eventNames().dragoverEvent);
-}
-
-void Node::setOndragover(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragoverEvent, eventListener);
-}
-
-EventListener* Node::ondragleave() const
-{
-    return getAttributeEventListener(eventNames().dragleaveEvent);
-}
-
-void Node::setOndragleave(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragleaveEvent, eventListener);
-}
-
-EventListener* Node::ondrop() const
-{
-    return getAttributeEventListener(eventNames().dropEvent);
-}
-
-void Node::setOndrop(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dropEvent, eventListener);
-}
-
-EventListener* Node::ondragstart() const
-{
-    return getAttributeEventListener(eventNames().dragstartEvent);
-}
-
-void Node::setOndragstart(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragstartEvent, eventListener);
-}
-
-EventListener* Node::ondrag() const
-{
-    return getAttributeEventListener(eventNames().dragEvent);
-}
-
-void Node::setOndrag(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragEvent, eventListener);
-}
-
-EventListener* Node::ondragend() const
-{
-    return getAttributeEventListener(eventNames().dragendEvent);
-}
-
-void Node::setOndragend(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragendEvent, eventListener);
-}
-
-EventListener* Node::onscroll() const
-{
-    return getAttributeEventListener(eventNames().scrollEvent);
-}
-
-void Node::setOnscroll(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().scrollEvent, eventListener);
-}
-
-EventListener* Node::onselect() const
-{
-    return getAttributeEventListener(eventNames().selectEvent);
-}
-
-void Node::setOnselect(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().selectEvent, eventListener);
-}
-
-EventListener* Node::onsubmit() const
-{
-    return getAttributeEventListener(eventNames().submitEvent);
-}
-
-void Node::setOnsubmit(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().submitEvent, eventListener);
-}
-
-EventListener* Node::onbeforecut() const
-{
-    return getAttributeEventListener(eventNames().beforecutEvent);
-}
-
-void Node::setOnbeforecut(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().beforecutEvent, eventListener);
-}
-
-EventListener* Node::oncut() const
-{
-    return getAttributeEventListener(eventNames().cutEvent);
-}
-
-void Node::setOncut(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().cutEvent, eventListener);
-}
-
-EventListener* Node::onbeforecopy() const
-{
-    return getAttributeEventListener(eventNames().beforecopyEvent);
-}
-
-void Node::setOnbeforecopy(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().beforecopyEvent, eventListener);
-}
-
-EventListener* Node::oncopy() const
-{
-    return getAttributeEventListener(eventNames().copyEvent);
-}
-
-void Node::setOncopy(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().copyEvent, eventListener);
-}
-
-EventListener* Node::onbeforepaste() const
-{
-    return getAttributeEventListener(eventNames().beforepasteEvent);
-}
-
-void Node::setOnbeforepaste(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().beforepasteEvent, eventListener);
-}
-
-EventListener* Node::onpaste() const
-{
-    return getAttributeEventListener(eventNames().pasteEvent);
-}
-
-void Node::setOnpaste(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().pasteEvent, eventListener);
-}
-
-EventListener* Node::onreset() const
-{
-    return getAttributeEventListener(eventNames().resetEvent);
-}
-
-void Node::setOnreset(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().resetEvent, eventListener);
-}
-
-EventListener* Node::onsearch() const
-{
-    return getAttributeEventListener(eventNames().searchEvent);
-}
-
-void Node::setOnsearch(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().searchEvent, eventListener);
-}
-
-EventListener* Node::onselectstart() const
-{
-    return getAttributeEventListener(eventNames().selectstartEvent);
-}
-
-void Node::setOnselectstart(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().selectstartEvent, eventListener);
-}
-
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.h b/src/3rdparty/webkit/WebCore/dom/Node.h
index af1e73b..f3bebc6 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.h
+++ b/src/3rdparty/webkit/WebCore/dom/Node.h
@@ -183,6 +183,13 @@ public:
     static bool isWMLElement() { return false; }
 #endif
 
+#if ENABLE(MATHML)
+    virtual bool isMathMLElement() const { return false; }
+#else
+    static bool isMathMLElement() { return false; }
+#endif
+
+
     virtual bool isMediaControlElement() const { return false; }
     virtual bool isStyledElement() const { return false; }
     virtual bool isFrameOwnerElement() const { return false; }
@@ -505,19 +512,19 @@ public:
 
     virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-    // Used for standard DOM addEventListener / removeEventListener APIs.
-    virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-    virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+    virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+    virtual bool removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
 
-    // Used for legacy "onEvent" property APIs.
-    void setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
-    void clearAttributeEventListener(const AtomicString& eventType);
-    EventListener* getAttributeEventListener(const AtomicString& eventType) const;
+    // Handlers to do/undo actions on the target node before an event is dispatched to it and after the event
+    // has been dispatched.  The data pointer is handed back by the preDispatch and passed to postDispatch.
+    virtual void* preDispatchEventHandler(Event*) { return 0; }
+    virtual void postDispatchEventHandler(Event*, void* /*dataFromPreDispatch*/) { }
 
-    virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-    bool dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable);
+    using EventTarget::dispatchEvent;
+    virtual bool dispatchEvent(PassRefPtr<Event>);
 
-    void removeAllEventListeners() { if (hasRareData()) removeAllEventListenersSlowCase(); }
+    bool dispatchGenericEvent(PassRefPtr<Event>);
+    virtual void handleLocalEvents(Event*);
 
     void dispatchSubtreeModifiedEvent();
     void dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent);
@@ -531,14 +538,6 @@ public:
         bool isSimulated, Node* relatedTarget, PassRefPtr<Event> underlyingEvent);
     void dispatchSimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<Event> underlyingEvent);
     void dispatchSimulatedClick(PassRefPtr<Event> underlyingEvent, bool sendMouseEvents = false, bool showPressedLook = true);
-    void dispatchProgressEvent(const AtomicString& eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg);
-    void dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime);
-    void dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime);
-    void dispatchMutationEvent(const AtomicString& type, bool canBubble, PassRefPtr<Node> relatedNode, const String& prevValue, const String& newValue, ExceptionCode&);
-
-    bool dispatchGenericEvent(PassRefPtr<Event>);
-
-    virtual void handleLocalEvents(Event*, bool useCapture);
 
     virtual void dispatchFocusEvent();
     virtual void dispatchBlurEvent();
@@ -554,95 +553,12 @@ public:
      */
     virtual bool disabled() const;
 
-    const RegisteredEventListenerVector& eventListeners() const;
-
-    // These 4 attribute event handler attributes are overrided by HTMLBodyElement
-    // and HTMLFrameSetElement to forward to the DOMWindow.
-    virtual EventListener* onblur() const;
-    virtual void setOnblur(PassRefPtr<EventListener>);
-    virtual EventListener* onerror() const;
-    virtual void setOnerror(PassRefPtr<EventListener>);
-    virtual EventListener* onfocus() const;
-    virtual void setOnfocus(PassRefPtr<EventListener>);
-    virtual EventListener* onload() const;
-    virtual void setOnload(PassRefPtr<EventListener>);
-
-    EventListener* onabort() const;
-    void setOnabort(PassRefPtr<EventListener>);
-    EventListener* onchange() const;
-    void setOnchange(PassRefPtr<EventListener>);
-    EventListener* onclick() const;
-    void setOnclick(PassRefPtr<EventListener>);
-    EventListener* oncontextmenu() const;
-    void setOncontextmenu(PassRefPtr<EventListener>);
-    EventListener* ondblclick() const;
-    void setOndblclick(PassRefPtr<EventListener>);
-    EventListener* ondragenter() const;
-    void setOndragenter(PassRefPtr<EventListener>);
-    EventListener* ondragover() const;
-    void setOndragover(PassRefPtr<EventListener>);
-    EventListener* ondragleave() const;
-    void setOndragleave(PassRefPtr<EventListener>);
-    EventListener* ondrop() const;
-    void setOndrop(PassRefPtr<EventListener>);
-    EventListener* ondragstart() const;
-    void setOndragstart(PassRefPtr<EventListener>);
-    EventListener* ondrag() const;
-    void setOndrag(PassRefPtr<EventListener>);
-    EventListener* ondragend() const;
-    void setOndragend(PassRefPtr<EventListener>);
-    EventListener* oninput() const;
-    void setOninput(PassRefPtr<EventListener>);
-    EventListener* oninvalid() const;
-    void setOninvalid(PassRefPtr<EventListener>);
-    EventListener* onkeydown() const;
-    void setOnkeydown(PassRefPtr<EventListener>);
-    EventListener* onkeypress() const;
-    void setOnkeypress(PassRefPtr<EventListener>);
-    EventListener* onkeyup() const;
-    void setOnkeyup(PassRefPtr<EventListener>);
-    EventListener* onmousedown() const;
-    void setOnmousedown(PassRefPtr<EventListener>);
-    EventListener* onmousemove() const;
-    void setOnmousemove(PassRefPtr<EventListener>);
-    EventListener* onmouseout() const;
-    void setOnmouseout(PassRefPtr<EventListener>);
-    EventListener* onmouseover() const;
-    void setOnmouseover(PassRefPtr<EventListener>);
-    EventListener* onmouseup() const;
-    void setOnmouseup(PassRefPtr<EventListener>);
-    EventListener* onmousewheel() const;
-    void setOnmousewheel(PassRefPtr<EventListener>);
-    EventListener* onscroll() const;
-    void setOnscroll(PassRefPtr<EventListener>);
-    EventListener* onselect() const;
-    void setOnselect(PassRefPtr<EventListener>);
-    EventListener* onsubmit() const;
-    void setOnsubmit(PassRefPtr<EventListener>);
-
-    // WebKit extensions
-    EventListener* onbeforecut() const;
-    void setOnbeforecut(PassRefPtr<EventListener>);
-    EventListener* oncut() const;
-    void setOncut(PassRefPtr<EventListener>);
-    EventListener* onbeforecopy() const;
-    void setOnbeforecopy(PassRefPtr<EventListener>);
-    EventListener* oncopy() const;
-    void setOncopy(PassRefPtr<EventListener>);
-    EventListener* onbeforepaste() const;
-    void setOnbeforepaste(PassRefPtr<EventListener>);
-    EventListener* onpaste() const;
-    void setOnpaste(PassRefPtr<EventListener>);
-    EventListener* onreset() const;
-    void setOnreset(PassRefPtr<EventListener>);
-    EventListener* onsearch() const;
-    void setOnsearch(PassRefPtr<EventListener>);
-    EventListener* onselectstart() const;
-    void setOnselectstart(PassRefPtr<EventListener>);
-
     using TreeShared<Node>::ref;
     using TreeShared<Node>::deref;
 
+    virtual EventTargetData* eventTargetData();
+    virtual EventTargetData* ensureEventTargetData();
+
 protected:
     // CreateElementZeroRefCount is deprecated and can be removed once we convert all element
     // classes to start with a reference count of 1.
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.idl b/src/3rdparty/webkit/WebCore/dom/Node.idl
index 1e31aea..45ea132 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Node.idl
@@ -24,6 +24,7 @@ module core {
         CustomMarkFunction,
         CustomPushEventHandlerScope,
         CustomToJS,
+        EventTarget,
         GenerateConstructor,
         GenerateNativeConverter,
         InlineGetOwnPropertySlot,
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeRareData.h b/src/3rdparty/webkit/WebCore/dom/NodeRareData.h
index 7740344..8b9e1bf 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeRareData.h
+++ b/src/3rdparty/webkit/WebCore/dom/NodeRareData.h
@@ -93,12 +93,12 @@ public:
     void setTabIndexExplicitly(short index) { m_tabIndex = index; m_tabIndexWasSetExplicitly = true; }
     bool tabIndexSetExplicitly() const { return m_tabIndexWasSetExplicitly; }
 
-    RegisteredEventListenerVector* listeners() { return m_eventListeners.get(); }
-    RegisteredEventListenerVector& ensureListeners()
+    EventTargetData* eventTargetData() { return m_eventTargetData.get(); }
+    EventTargetData* ensureEventTargetData()
     {
-        if (!m_eventListeners)
-            m_eventListeners.set(new RegisteredEventListenerVector);
-        return *m_eventListeners;
+        if (!m_eventTargetData)
+            m_eventTargetData.set(new EventTargetData);
+        return m_eventTargetData.get();
     }
 
     bool isFocused() const { return m_isFocused; }
@@ -111,7 +111,7 @@ protected:
 
 private:
     OwnPtr<NodeListsNodeData> m_nodeLists;
-    OwnPtr<RegisteredEventListenerVector > m_eventListeners;
+    OwnPtr<EventTargetData> m_eventTargetData;
     short m_tabIndex;
     bool m_tabIndexWasSetExplicitly : 1;
     bool m_isFocused : 1;
diff --git a/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.cpp b/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.cpp
index f257e56..e8bc594 100644
--- a/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.cpp
@@ -27,12 +27,4 @@
 
 namespace WebCore {
 
-RegisteredEventListener::RegisteredEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
-    : m_eventType(eventType)
-    , m_listener(listener)
-    , m_useCapture(useCapture)
-    , m_removed(false)
-{
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h b/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
index 034f6c3..88d2279 100644
--- a/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
+++ b/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
@@ -29,47 +29,21 @@
 
 namespace WebCore {
 
-    class RegisteredEventListener : public RefCounted<RegisteredEventListener> {
-    public:
-        static PassRefPtr<RegisteredEventListener> create(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+    struct RegisteredEventListener {
+        RegisteredEventListener(PassRefPtr<EventListener> listener, bool useCapture)
+            : listener(listener)
+            , useCapture(useCapture)
         {
-            return adoptRef(new RegisteredEventListener(eventType, listener, useCapture));
         }
 
-        const AtomicString& eventType() const { return m_eventType; }
-        EventListener* listener() const { return m_listener.get(); }
-        bool useCapture() const { return m_useCapture; }
-        
-        bool removed() const { return m_removed; }
-        void setRemoved(bool removed) { m_removed = removed; }
-    
-    private:
-        RegisteredEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-
-        AtomicString m_eventType;
-        RefPtr<EventListener> m_listener;
-        bool m_useCapture;
-        bool m_removed;
+        RefPtr<EventListener> listener;
+        bool useCapture;
     };
-
-    typedef Vector<RefPtr<RegisteredEventListener> > RegisteredEventListenerVector;
-
-#if USE(JSC)
-    inline void markEventListeners(JSC::MarkStack& markStack, const RegisteredEventListenerVector& listeners)
-    {
-        for (size_t i = 0; i < listeners.size(); ++i)
-            listeners[i]->listener()->markJSFunction(markStack);
-    }
-
-    inline void invalidateEventListeners(const RegisteredEventListenerVector& listeners)
+    
+    inline bool operator==(const RegisteredEventListener& a, const RegisteredEventListener& b)
     {
-        // For efficiency's sake, we just set the "removed" bit, instead of
-        // actually removing the event listener. The node that owns these
-        // listeners is about to be deleted, anyway.
-        for (size_t i = 0; i < listeners.size(); ++i)
-            listeners[i]->setRemoved(true);
+        return *a.listener == *b.listener && a.useCapture == b.useCapture;
     }
-#endif
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
index d259fc2..4e51f54 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
@@ -451,6 +451,7 @@ DEFINE_GLOBAL(QualifiedName, onmouseupAttr, nullAtom, "onmouseup", xhtmlNamespac
 DEFINE_GLOBAL(QualifiedName, onmousewheelAttr, nullAtom, "onmousewheel", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onofflineAttr, nullAtom, "onoffline", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, ononlineAttr, nullAtom, "ononline", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onorientationchangeAttr, nullAtom, "onorientationchange", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onpagehideAttr, nullAtom, "onpagehide", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onpageshowAttr, nullAtom, "onpageshow", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onpasteAttr, nullAtom, "onpaste", xhtmlNamespaceURI);
@@ -702,6 +703,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onmousewheelAttr,
         (WebCore::QualifiedName*)&onofflineAttr,
         (WebCore::QualifiedName*)&ononlineAttr,
+        (WebCore::QualifiedName*)&onorientationchangeAttr,
         (WebCore::QualifiedName*)&onpagehideAttr,
         (WebCore::QualifiedName*)&onpageshowAttr,
         (WebCore::QualifiedName*)&onpasteAttr,
@@ -786,7 +788,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&widthAttr,
         (WebCore::QualifiedName*)&wrapAttr,
     };
-    *size = 246;
+    *size = 247;
     return HTMLAttr;
 }
 
@@ -1206,6 +1208,7 @@ void init()
     const char *onmousewheelAttrString = "onmousewheel";
     const char *onofflineAttrString = "onoffline";
     const char *ononlineAttrString = "ononline";
+    const char *onorientationchangeAttrString = "onorientationchange";
     const char *onpagehideAttrString = "onpagehide";
     const char *onpageshowAttrString = "onpageshow";
     const char *onpasteAttrString = "onpaste";
@@ -1452,6 +1455,7 @@ void init()
     new ((void*)&onmousewheelAttr) QualifiedName(nullAtom, onmousewheelAttrString, nullAtom);
     new ((void*)&onofflineAttr) QualifiedName(nullAtom, onofflineAttrString, nullAtom);
     new ((void*)&ononlineAttr) QualifiedName(nullAtom, ononlineAttrString, nullAtom);
+    new ((void*)&onorientationchangeAttr) QualifiedName(nullAtom, onorientationchangeAttrString, nullAtom);
     new ((void*)&onpagehideAttr) QualifiedName(nullAtom, onpagehideAttrString, nullAtom);
     new ((void*)&onpageshowAttr) QualifiedName(nullAtom, onpageshowAttrString, nullAtom);
     new ((void*)&onpasteAttr) QualifiedName(nullAtom, onpasteAttrString, nullAtom);
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
index a7fb532..d7d327f 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
@@ -322,6 +322,7 @@ extern const WebCore::QualifiedName onmouseupAttr;
 extern const WebCore::QualifiedName onmousewheelAttr;
 extern const WebCore::QualifiedName onofflineAttr;
 extern const WebCore::QualifiedName ononlineAttr;
+extern const WebCore::QualifiedName onorientationchangeAttr;
 extern const WebCore::QualifiedName onpagehideAttr;
 extern const WebCore::QualifiedName onpageshowAttr;
 extern const WebCore::QualifiedName onpasteAttr;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
index 7c6452d..28e127d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
@@ -31,6 +31,7 @@
 #include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
+#include "RegisteredEventListener.h"
 #include <runtime/Error.h>
 #include <wtf/GetPtr.h>
 
@@ -144,7 +145,14 @@ JSAbstractWorker::JSAbstractWorker(PassRefPtr<Structure> structure, JSDOMGlobalO
 
 JSAbstractWorker::~JSAbstractWorker()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    impl()->invalidateEventListeners();
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+}
+
+void JSAbstractWorker::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+    impl()->markEventListeners(markStack);
 }
 
 JSObject* JSAbstractWorker::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
index a01207f..6ebd59c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
@@ -76,7 +76,7 @@ JSBarInfo::JSBarInfo(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalO
 
 JSBarInfo::~JSBarInfo()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSBarInfo::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
index 329c7d6..fe8476b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
@@ -159,7 +159,7 @@ JSCSSRule::JSCSSRule(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalO
 
 JSCSSRule::~JSCSSRule()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSCSSRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
index 3a71cc3..7e62e27 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
@@ -137,7 +137,7 @@ JSCSSRuleList::JSCSSRuleList(PassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSCSSRuleList::~JSCSSRuleList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSCSSRuleList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
index d0ccb9b..1a6eeb9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
@@ -151,7 +151,7 @@ JSCSSStyleDeclaration::JSCSSStyleDeclaration(PassRefPtr<Structure> structure, JS
 
 JSCSSStyleDeclaration::~JSCSSStyleDeclaration()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSCSSStyleDeclaration::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
index 58c0990..b5152cb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
@@ -142,7 +142,7 @@ JSCSSValue::JSCSSValue(PassRefPtr<Structure> structure, JSDOMGlobalObject* globa
 
 JSCSSValue::~JSCSSValue()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSCSSValue::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
index 419ba7d..8e2ef47 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
@@ -144,7 +144,7 @@ JSCSSVariablesDeclaration::JSCSSVariablesDeclaration(PassRefPtr<Structure> struc
 
 JSCSSVariablesDeclaration::~JSCSSVariablesDeclaration()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSCSSVariablesDeclaration::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
index 685bd6d..2331bba 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
@@ -93,7 +93,7 @@ JSCanvasArray::JSCanvasArray(PassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSCanvasArray::~JSCanvasArray()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSCanvasArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp
index 644e3ed..b8a9406 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp
@@ -80,7 +80,7 @@ JSCanvasArrayBuffer::JSCanvasArrayBuffer(PassRefPtr<Structure> structure, JSDOMG
 
 JSCanvasArrayBuffer::~JSCanvasArrayBuffer()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSCanvasArrayBuffer::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
index 70f71bc..aec7049 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
@@ -74,7 +74,7 @@ JSCanvasGradient::JSCanvasGradient(PassRefPtr<Structure> structure, JSDOMGlobalO
 
 JSCanvasGradient::~JSCanvasGradient()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSCanvasGradient::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp
index c806e5d..27db344 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp
@@ -61,7 +61,7 @@ JSCanvasPattern::JSCanvasPattern(PassRefPtr<Structure> structure, JSDOMGlobalObj
 
 JSCanvasPattern::~JSCanvasPattern()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSCanvasPattern::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
index aedc360..9bbdff5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
@@ -123,7 +123,7 @@ JSCanvasRenderingContext::JSCanvasRenderingContext(PassRefPtr<Structure> structu
 
 JSCanvasRenderingContext::~JSCanvasRenderingContext()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSCanvasRenderingContext::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
index ea5d079..a7f4de1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
@@ -127,7 +127,7 @@ JSClientRect::JSClientRect(PassRefPtr<Structure> structure, JSDOMGlobalObject* g
 
 JSClientRect::~JSClientRect()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSClientRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
index e840f61..1373327 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
@@ -138,7 +138,7 @@ JSClientRectList::JSClientRectList(PassRefPtr<Structure> structure, JSDOMGlobalO
 
 JSClientRectList::~JSClientRectList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSClientRectList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
index 708c546..08b4630 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
@@ -142,7 +142,7 @@ JSClipboard::JSClipboard(PassRefPtr<Structure> structure, JSDOMGlobalObject* glo
 
 JSClipboard::~JSClipboard()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSClipboard::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp b/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
index 1f8c6d8..897401d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
@@ -104,7 +104,7 @@ JSConsole::JSConsole(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalO
 
 JSConsole::~JSConsole()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSConsole::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
index 21efdc8..68636b7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
@@ -83,7 +83,7 @@ JSCoordinates::JSCoordinates(PassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSCoordinates::~JSCoordinates()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSCoordinates::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
index d7bc5f1..edd7ead 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
@@ -125,7 +125,7 @@ JSCounter::JSCounter(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalO
 
 JSCounter::~JSCounter()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSCounter::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
index e28b6ec..d2b052b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
@@ -31,6 +31,7 @@
 #include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
+#include "RegisteredEventListener.h"
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <wtf/GetPtr.h>
@@ -116,7 +117,14 @@ JSDOMApplicationCache::JSDOMApplicationCache(PassRefPtr<Structure> structure, JS
 
 JSDOMApplicationCache::~JSDOMApplicationCache()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    impl()->invalidateEventListeners();
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+}
+
+void JSDOMApplicationCache::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+    impl()->markEventListeners(markStack);
 }
 
 JSObject* JSDOMApplicationCache::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
index 94df8dd..fbca8b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
@@ -182,7 +182,7 @@ JSDOMCoreException::JSDOMCoreException(PassRefPtr<Structure> structure, JSDOMGlo
 
 JSDOMCoreException::~JSDOMCoreException()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSDOMCoreException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
index 27eb530..2e678bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
@@ -145,7 +145,7 @@ JSDOMImplementation::JSDOMImplementation(PassRefPtr<Structure> structure, JSDOMG
 
 JSDOMImplementation::~JSDOMImplementation()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSDOMImplementation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
index 8ff4a03..1880607 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
@@ -144,7 +144,7 @@ JSDOMParser::JSDOMParser(PassRefPtr<Structure> structure, JSDOMGlobalObject* glo
 
 JSDOMParser::~JSDOMParser()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSDOMParser::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
index daf65df..88ddfc1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
@@ -119,7 +119,7 @@ JSDOMSelection::JSDOMSelection(PassRefPtr<Structure> structure, JSDOMGlobalObjec
 
 JSDOMSelection::~JSDOMSelection()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSDOMSelection::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
index 414a1bb..8e85b60 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
@@ -214,6 +214,7 @@
 #include "JSWebKitCSSTransformValue.h"
 #include "JSWebKitPoint.h"
 #include "JSWebKitTransitionEvent.h"
+#include "JSWebSocket.h"
 #include "JSWheelEvent.h"
 #include "JSWorker.h"
 #include "JSXMLHttpRequest.h"
@@ -243,7 +244,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindow);
 
 /* Hash table */
 
-static const HashTableValue JSDOMWindowTableValues[293] =
+static const HashTableValue JSDOMWindowTableValues[294] =
 {
     { "screen", DontDelete|ReadOnly, (intptr_t)jsDOMWindowScreen, (intptr_t)0 },
     { "history", DontDelete|ReadOnly, (intptr_t)jsDOMWindowHistory, (intptr_t)0 },
@@ -531,6 +532,7 @@ static const HashTableValue JSDOMWindowTableValues[293] =
     { "MessageChannel", DontDelete, (intptr_t)jsDOMWindowMessageChannelConstructor, (intptr_t)setJSDOMWindowMessageChannelConstructor },
     { "Worker", DontDelete, (intptr_t)jsDOMWindowWorkerConstructor, (intptr_t)setJSDOMWindowWorkerConstructor },
     { "SharedWorker", DontDelete, (intptr_t)jsDOMWindowSharedWorkerConstructor, (intptr_t)setJSDOMWindowSharedWorkerConstructor },
+    { "WebSocket", DontDelete, (intptr_t)jsDOMWindowWebSocketConstructor, (intptr_t)setJSDOMWindowWebSocketConstructor },
     { "Plugin", DontDelete, (intptr_t)jsDOMWindowPluginConstructor, (intptr_t)setJSDOMWindowPluginConstructor },
     { "PluginArray", DontDelete, (intptr_t)jsDOMWindowPluginArrayConstructor, (intptr_t)setJSDOMWindowPluginArrayConstructor },
     { "MimeType", DontDelete, (intptr_t)jsDOMWindowMimeTypeConstructor, (intptr_t)setJSDOMWindowMimeTypeConstructor },
@@ -578,7 +580,7 @@ static JSC_CONST_HASHTABLE HashTable JSDOMWindowTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 65535, JSDOMWindowTableValues, 0 };
 #else
-    { 1067, 1023, JSDOMWindowTableValues, 0 };
+    { 1068, 1023, JSDOMWindowTableValues, 0 };
 #endif
 
 /* Hash table for prototype */
@@ -657,7 +659,8 @@ JSDOMWindow::JSDOMWindow(PassRefPtr<Structure> structure, PassRefPtr<DOMWindow>
 
 JSDOMWindow::~JSDOMWindow()
 {
-    invalidateEventListeners(impl()->eventListeners());
+    impl()->invalidateEventListeners();
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSValue jsDOMWindowScreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -3239,6 +3242,14 @@ JSValue jsDOMWindowSharedWorkerConstructor(ExecState* exec, const Identifier&, c
     return castedThis->sharedWorker(exec);
 }
 
+JSValue jsDOMWindowWebSocketConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThis->webSocket(exec);
+}
+
 JSValue jsDOMWindowPluginConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
@@ -5610,6 +5621,14 @@ void setJSDOMWindowSharedWorkerConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SharedWorker"), value);
 }
 
+void setJSDOMWindowWebSocketConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebSocket"), value);
+}
+
 void setJSDOMWindowPluginConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
index 5b1b58e..5c723f1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
@@ -50,10 +50,11 @@ public:
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;
-    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
-    virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);
+    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
+    virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction, unsigned attributes);
     virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
     virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
 
@@ -80,6 +81,7 @@ public:
     JSC::JSValue messageChannel(JSC::ExecState*) const;
     JSC::JSValue worker(JSC::ExecState*) const;
     JSC::JSValue sharedWorker(JSC::ExecState*) const;
+    JSC::JSValue webSocket(JSC::ExecState*) const;
     JSC::JSValue audio(JSC::ExecState*) const;
 
     // Custom functions
@@ -666,6 +668,8 @@ JSC::JSValue jsDOMWindowWorkerConstructor(JSC::ExecState*, const JSC::Identifier
 void setJSDOMWindowWorkerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowSharedWorkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowSharedWorkerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebSocketConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWebSocketConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowPluginConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowPluginConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowPluginArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
index 59eafb1..c0187fb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
@@ -154,7 +154,7 @@ JSDataGridColumn::JSDataGridColumn(PassRefPtr<Structure> structure, JSDOMGlobalO
 
 JSDataGridColumn::~JSDataGridColumn()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSDataGridColumn::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
index 2ec302a..10c8813 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
@@ -148,7 +148,7 @@ JSDataGridColumnList::JSDataGridColumnList(PassRefPtr<Structure> structure, JSDO
 
 JSDataGridColumnList::~JSDataGridColumnList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSDataGridColumnList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp b/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
index 16b0888..cb2dc3f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
@@ -95,7 +95,7 @@ JSDatabase::JSDatabase(PassRefPtr<Structure> structure, JSDOMGlobalObject* globa
 
 JSDatabase::~JSDatabase()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSDatabase::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
index d6caa8d..d513c8f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
@@ -45,8 +45,6 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void markChildren(JSC::MarkStack&);
-
 
     // Custom functions
     JSC::JSValue postMessage(JSC::ExecState*, const JSC::ArgList&);
@@ -68,7 +66,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSDedicatedWorkerContextPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
index 9d9b7f2..833b5a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
@@ -196,7 +196,7 @@ JSEvent::JSEvent(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObjec
 
 JSEvent::~JSEvent()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
index df2cebc..9044090 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
@@ -148,7 +148,7 @@ JSEventException::JSEventException(PassRefPtr<Structure> structure, JSDOMGlobalO
 
 JSEventException::~JSEventException()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSEventException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp
index 8fe292b..69471ee 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp
@@ -32,6 +32,7 @@
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "KURL.h"
+#include "RegisteredEventListener.h"
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
@@ -118,7 +119,14 @@ JSEventSource::JSEventSource(PassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSEventSource::~JSEventSource()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    impl()->invalidateEventListeners();
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+}
+
+void JSEventSource::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+    impl()->markEventListeners(markStack);
 }
 
 JSObject* JSEventSource::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
index 5fa637e..a426abf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
@@ -125,7 +125,7 @@ JSFile::JSFile(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject,
 
 JSFile::~JSFile()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSFile::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
index 5fb8b0c..da2ed09 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
@@ -138,7 +138,7 @@ JSFileList::JSFileList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globa
 
 JSFileList::~JSFileList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSFileList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
index 7a1e5f0..e5d4526 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
@@ -92,7 +92,7 @@ JSGeolocation::JSGeolocation(PassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSGeolocation::~JSGeolocation()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSGeolocation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
index 400e0d4..8219fb2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
@@ -80,7 +80,7 @@ JSGeoposition::JSGeoposition(PassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSGeoposition::~JSGeoposition()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSGeoposition::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
index b93fb61..30defc0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
@@ -143,7 +143,7 @@ JSHTMLCollection::JSHTMLCollection(PassRefPtr<Structure> structure, JSDOMGlobalO
 
 JSHTMLCollection::~JSHTMLCollection()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSHTMLCollection::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
index ffe9716..be123db 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
@@ -41,7 +41,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLTextAreaElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLTextAreaElementTableValues[20] =
+static const HashTableValue JSHTMLTextAreaElementTableValues[21] =
 {
     { "defaultValue", DontDelete, (intptr_t)jsHTMLTextAreaElementDefaultValue, (intptr_t)setJSHTMLTextAreaElementDefaultValue },
     { "form", DontDelete|ReadOnly, (intptr_t)jsHTMLTextAreaElementForm, (intptr_t)0 },
@@ -50,6 +50,7 @@ static const HashTableValue JSHTMLTextAreaElementTableValues[20] =
     { "cols", DontDelete, (intptr_t)jsHTMLTextAreaElementCols, (intptr_t)setJSHTMLTextAreaElementCols },
     { "disabled", DontDelete, (intptr_t)jsHTMLTextAreaElementDisabled, (intptr_t)setJSHTMLTextAreaElementDisabled },
     { "autofocus", DontDelete, (intptr_t)jsHTMLTextAreaElementAutofocus, (intptr_t)setJSHTMLTextAreaElementAutofocus },
+    { "maxLength", DontDelete, (intptr_t)jsHTMLTextAreaElementMaxLength, (intptr_t)setJSHTMLTextAreaElementMaxLength },
     { "name", DontDelete, (intptr_t)jsHTMLTextAreaElementName, (intptr_t)setJSHTMLTextAreaElementName },
     { "placeholder", DontDelete, (intptr_t)jsHTMLTextAreaElementPlaceholder, (intptr_t)setJSHTMLTextAreaElementPlaceholder },
     { "readOnly", DontDelete, (intptr_t)jsHTMLTextAreaElementReadOnly, (intptr_t)setJSHTMLTextAreaElementReadOnly },
@@ -229,6 +230,14 @@ JSValue jsHTMLTextAreaElementAutofocus(ExecState* exec, const Identifier&, const
     return jsBoolean(imp->autofocus());
 }
 
+JSValue jsHTMLTextAreaElementMaxLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
+    return jsNumber(exec, imp->maxLength());
+}
+
 JSValue jsHTMLTextAreaElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
@@ -357,6 +366,12 @@ void setJSHTMLTextAreaElementAutofocus(ExecState* exec, JSObject* thisObject, JS
     imp->setAutofocus(value.toBoolean(exec));
 }
 
+void setJSHTMLTextAreaElementMaxLength(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    imp->setMaxLength(value.toInt32(exec));
+}
+
 void setJSHTMLTextAreaElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
index 313af9f..0df320e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
@@ -82,6 +82,8 @@ JSC::JSValue jsHTMLTextAreaElementDisabled(JSC::ExecState*, const JSC::Identifie
 void setJSHTMLTextAreaElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLTextAreaElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLTextAreaElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementMaxLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementMaxLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLTextAreaElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLTextAreaElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLTextAreaElementPlaceholder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp b/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
index d7c2b04..2d6e7d4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
@@ -92,7 +92,7 @@ JSHistory::JSHistory(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalO
 
 JSHistory::~JSHistory()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSHistory::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
index b918220..796c592 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
@@ -123,7 +123,7 @@ JSImageData::JSImageData(PassRefPtr<Structure> structure, JSDOMGlobalObject* glo
 
 JSImageData::~JSImageData()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSImageData::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
index c77185c..77b4b7c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
@@ -96,7 +96,7 @@ bool JSInspectorBackendConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 /* Hash table for prototype */
 
-static const HashTableValue JSInspectorBackendPrototypeTableValues[66] =
+static const HashTableValue JSInspectorBackendPrototypeTableValues[69] =
 {
     { "hideDOMNodeHighlight", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHideDOMNodeHighlight, (intptr_t)0 },
     { "highlightDOMNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHighlightDOMNode, (intptr_t)1 },
@@ -163,6 +163,9 @@ static const HashTableValue JSInspectorBackendPrototypeTableValues[66] =
     { "addNodesToSearchResult", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAddNodesToSearchResult, (intptr_t)1 },
     { "selectDatabase", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSelectDatabase, (intptr_t)1 },
     { "selectDOMStorage", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSelectDOMStorage, (intptr_t)1 },
+    { "getDOMStorageEntries", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetDOMStorageEntries, (intptr_t)2 },
+    { "setDOMStorageItem", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetDOMStorageItem, (intptr_t)4 },
+    { "removeDOMStorageItem", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionRemoveDOMStorageItem, (intptr_t)3 },
     { 0, 0, 0, 0 }
 };
 
@@ -200,7 +203,7 @@ JSInspectorBackend::JSInspectorBackend(PassRefPtr<Structure> structure, JSDOMGlo
 
 JSInspectorBackend::~JSInspectorBackend()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSInspectorBackend::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -1019,6 +1022,51 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDOMStorage(ExecSt
     return castedThisObj->selectDOMStorage(exec, args);
 }
 
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetDOMStorageEntries(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int storageId = args.at(1).toInt32(exec);
+
+    imp->getDOMStorageEntries(callId, storageId);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetDOMStorageItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int storageId = args.at(1).toInt32(exec);
+    const UString& key = args.at(2).toString(exec);
+    const UString& value = args.at(3).toString(exec);
+
+    imp->setDOMStorageItem(callId, storageId, key, value);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveDOMStorageItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int storageId = args.at(1).toInt32(exec);
+    const UString& key = args.at(2).toString(exec);
+
+    imp->removeDOMStorageItem(callId, storageId, key);
+    return jsUndefined();
+}
+
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, InspectorBackend* object)
 {
     return getDOMObjectWrapper<JSInspectorBackend>(exec, globalObject, object);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
index 102a5b4..fec9031 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
@@ -155,6 +155,9 @@ JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPushNodePathToFron
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddNodesToSearchResult(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDatabase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDOMStorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetDOMStorageEntries(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetDOMStorageItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveDOMStorageItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
 JSC::JSValue jsInspectorBackendConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
index 9ec80b0..212ed59 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
@@ -101,7 +101,7 @@ JSJavaScriptCallFrame::JSJavaScriptCallFrame(PassRefPtr<Structure> structure, JS
 
 JSJavaScriptCallFrame::~JSJavaScriptCallFrame()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSJavaScriptCallFrame::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
index 9df3a4d..0889e16 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
@@ -108,7 +108,7 @@ JSLocation::JSLocation(PassRefPtr<Structure> structure, JSDOMGlobalObject* globa
 
 JSLocation::~JSLocation()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSLocation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSLocation.h b/src/3rdparty/webkit/WebCore/generated/JSLocation.h
index 54b41ce..8db2969 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSLocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSLocation.h
@@ -52,7 +52,7 @@ public:
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
+    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
 
     // Custom attributes
     void setHref(JSC::ExecState*, JSC::JSValue);
@@ -92,7 +92,7 @@ public:
     }
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
-    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
+    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
     JSLocationPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp b/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
index 26dffa8..8106ab4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
@@ -135,7 +135,7 @@ JSMedia::JSMedia(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObjec
 
 JSMedia::~JSMedia()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSMedia::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
index 5a906ae..43640f3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
@@ -143,7 +143,7 @@ JSMediaError::JSMediaError(PassRefPtr<Structure> structure, JSDOMGlobalObject* g
 
 JSMediaError::~JSMediaError()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSMediaError::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
index 8c5e097..04d30bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
@@ -139,7 +139,7 @@ JSMediaList::JSMediaList(PassRefPtr<Structure> structure, JSDOMGlobalObject* glo
 
 JSMediaList::~JSMediaList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSMediaList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
index accf6e3..d851688 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
@@ -87,7 +87,7 @@ JSMessageChannel::JSMessageChannel(PassRefPtr<Structure> structure, JSDOMGlobalO
 
 JSMessageChannel::~JSMessageChannel()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSMessageChannel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
index 7cbcc88..a532d51 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
@@ -29,6 +29,7 @@
 #include "JSEventListener.h"
 #include "MessagePort.h"
 #include "PlatformString.h"
+#include "RegisteredEventListener.h"
 #include <runtime/Error.h>
 #include <wtf/GetPtr.h>
 
@@ -153,7 +154,8 @@ JSMessagePort::JSMessagePort(PassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSMessagePort::~JSMessagePort()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    impl()->invalidateEventListeners();
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSMessagePort::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
index 0857400..458d7d7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
@@ -128,7 +128,7 @@ JSMimeType::JSMimeType(PassRefPtr<Structure> structure, JSDOMGlobalObject* globa
 
 JSMimeType::~JSMimeType()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSMimeType::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
index 5cc3fd4..79f7bce 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
@@ -139,7 +139,7 @@ JSMimeTypeArray::JSMimeTypeArray(PassRefPtr<Structure> structure, JSDOMGlobalObj
 
 JSMimeTypeArray::~JSMimeTypeArray()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSMimeTypeArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
index 71d3cef..a9b9e44 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
@@ -144,7 +144,7 @@ JSNamedNodeMap::JSNamedNodeMap(PassRefPtr<Structure> structure, JSDOMGlobalObjec
 
 JSNamedNodeMap::~JSNamedNodeMap()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSNamedNodeMap::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp b/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
index bf18b74..cdb2d38 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
@@ -108,7 +108,7 @@ JSNavigator::JSNavigator(PassRefPtr<Structure> structure, JSDOMGlobalObject* glo
 
 JSNavigator::~JSNavigator()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSNavigator::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
index 59f6004..beb059e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
@@ -217,8 +217,8 @@ JSNode::JSNode(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject,
 
 JSNode::~JSNode()
 {
-    invalidateEventListeners(m_impl->eventListeners());
-    forgetDOMNode(m_impl->document(), m_impl.get());
+    impl()->invalidateEventListeners();
+    forgetDOMNode(impl()->document(), impl());
 }
 
 JSObject* JSNode::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
index e4c50ba..37c4367 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
@@ -164,7 +164,7 @@ JSNodeFilter::JSNodeFilter(PassRefPtr<Structure> structure, JSDOMGlobalObject* g
 
 JSNodeFilter::~JSNodeFilter()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSNodeFilter::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
index 0f4167d..324be0f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
@@ -145,7 +145,7 @@ JSNodeIterator::JSNodeIterator(PassRefPtr<Structure> structure, JSDOMGlobalObjec
 
 JSNodeIterator::~JSNodeIterator()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSNodeIterator::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
index 892ba5b..fe6f6ca 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
@@ -139,7 +139,7 @@ JSNodeList::JSNodeList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globa
 
 JSNodeList::~JSNodeList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSNodeList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
index e23dc5a..1416a74 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
@@ -144,7 +144,7 @@ JSPlugin::JSPlugin(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObj
 
 JSPlugin::~JSPlugin()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSPlugin::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
index 9f46e08..436b924 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
@@ -140,7 +140,7 @@ JSPluginArray::JSPluginArray(PassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSPluginArray::~JSPluginArray()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSPluginArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
index 03c0ba3..234481f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
@@ -143,7 +143,7 @@ JSPositionError::JSPositionError(PassRefPtr<Structure> structure, JSDOMGlobalObj
 
 JSPositionError::~JSPositionError()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSPositionError::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
index f3b1a35..b0bf6b4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
@@ -125,7 +125,7 @@ JSRGBColor::JSRGBColor(PassRefPtr<Structure> structure, JSDOMGlobalObject* globa
 
 JSRGBColor::~JSRGBColor()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSRGBColor::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
index dffeb8a..9968a29 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
@@ -185,7 +185,7 @@ JSRange::JSRange(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObjec
 
 JSRange::~JSRange()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSRange::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
index 1ef3ced..29db9c0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
@@ -142,7 +142,7 @@ JSRangeException::JSRangeException(PassRefPtr<Structure> structure, JSDOMGlobalO
 
 JSRangeException::~JSRangeException()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSRangeException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
index b717102..df9089d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
@@ -126,7 +126,7 @@ JSRect::JSRect(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject,
 
 JSRect::~JSRect()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
index a004498..acab07d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
@@ -83,7 +83,7 @@ JSSQLError::JSSQLError(PassRefPtr<Structure> structure, JSDOMGlobalObject* globa
 
 JSSQLError::~JSSQLError()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSSQLError::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
index 7218490..d12399a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
@@ -84,7 +84,7 @@ JSSQLResultSet::JSSQLResultSet(PassRefPtr<Structure> structure, JSDOMGlobalObjec
 
 JSSQLResultSet::~JSSQLResultSet()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSObject* JSSQLResultSet::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp