657 files changed, 2509 insertions, 2109 deletions

diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 3321570..d55356f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,3 +1,32 @@
+2009-02-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 23676: Speed up uses of reserveCapacity on new vectors by adding a new reserveInitialCapacity
+        https://bugs.webkit.org/show_bug.cgi?id=23676
+
+        * API/JSObjectRef.cpp:
+        (JSObjectCopyPropertyNames): Use reserveInitialCapacity.
+        * parser/Lexer.cpp:
+        (JSC::Lexer::Lexer): Ditto.
+        (JSC::Lexer::clear): Ditto.
+
+        * wtf/Vector.h: Added reserveInitialCapacity, a more efficient version of
+        reserveCapacity for use when the vector is brand new (still size 0 with no
+        capacity other than the inline capacity).
+
+2009-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed <rdar://problem/6033712> -- a little bit of hardening in the Collector.
+        
+        SunSpider reports no change. I also verified in the disassembly that
+        we end up with a single compare to constant.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::heapAllocate):
+
 2009-01-22  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Geoff Garen.
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
index 69cb05e..7d3e27f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
@@ -365,6 +365,9 @@ collect:
         // didn't find a block, and GC didn't reclaim anything, need to allocate a new block
         size_t numBlocks = heap.numBlocks;
         if (usedBlocks == numBlocks) {
+            static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR;
+            if (numBlocks > maxNumBlocks)
+                CRASH();
             numBlocks = max(MIN_ARRAY_SIZE, numBlocks * GROWTH_FACTOR);
             heap.numBlocks = numBlocks;
             heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, numBlocks * sizeof(CollectorBlock*)));
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
index 880b45d..1483129 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
@@ -503,6 +503,7 @@ namespace WTF {
         void grow(size_t size);
         void resize(size_t size);
         void reserveCapacity(size_t newCapacity);
+        void reserveInitialCapacity(size_t initialCapacity);
         void shrinkCapacity(size_t newCapacity);
         void shrinkToFit() { shrinkCapacity(size()); }
 
@@ -733,6 +734,15 @@ namespace WTF {
     }
     
     template<typename T, size_t inlineCapacity>
+    inline void Vector<T, inlineCapacity>::reserveInitialCapacity(size_t initialCapacity)
+    {
+        ASSERT(!m_size);
+        ASSERT(capacity() == inlineCapacity);
+        if (initialCapacity > inlineCapacity)
+            m_buffer.allocateBuffer(initialCapacity);
+    }
+    
+    template<typename T, size_t inlineCapacity>
     void Vector<T, inlineCapacity>::shrinkCapacity(size_t newCapacity)
     {
         if (newCapacity >= capacity())
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 2be6d53..f7bd730 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -8,4 +8,4 @@ The commit imported was from the
 
 and has the sha1 checksum
 
-        44bbcef18007e00c6cfee294640c5cfc9e464aa4
+        bd7262be70c02564d655e4f2aaf79cd8302a937f
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index fb31572..304b55d 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,3 +1,233 @@
+2009-05-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Test for <rdar://problem/6910832> | https://bugs.webkit.org/show_bug.cgi?id=25907
+        Incorrect URL returned to the DOM while the user drags a file
+
+        * page/DragController.cpp:
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::tryDHTMLDrag): Don't base our decision on KURL,
+        since that only looks at the text of the document's URL. Do base our
+        decision on the securityOrigin(), which knows more about the document's
+        actual origin.
+
+2009-04-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+        
+        Fix <rdar://problem/6755724> <audio> and <video> elements can reference local 
+        file:/// URLs from remote in Safari
+
+        Tests: http/tests/security/local-video-poster-from-remote.html
+               http/tests/security/local-video-source-from-remote.html
+               http/tests/security/local-video-src-from-remote.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): Don't pass url to media engine unless loader->canLoad()
+        says it is OK.
+
+2009-04-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Part of <rdar://problem/6150868>
+        Fix incorrect handling of content that needs to go into the head element
+        once the head element has been removed.
+
+        Test: fast/parser/head-content-after-head-removal.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::HTMLParser): Remove unneeded initializer of m_head.
+        (WebCore::HTMLParser::handleError): Update since m_head is now a RefPtr.
+        (WebCore::HTMLParser::createHead): Ditto.
+        * html/HTMLParser.h: Make m_head a RefPtr.
+
+2009-04-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Big Boy" Garen.
+
+        Fix for <rdar://problem/5745677> Possible to stop load during an unload event
+        Also fixes https://bugs.webkit.org/show_bug.cgi?id=20605
+
+        Tests: fast/events/stop-load-in-unload-handler-using-document-write.html
+               fast/events/stop-load-in-unload-handler-using-window-stop.html
+
+        Don't allow calling methods that would stop the new load inside the unload
+        event.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::stopAllLoaders):
+        * loader/FrameLoader.h:
+
+2009-04-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/6226200> Implement Microsoft's X-FRAME-OPTIONS anti-framing defense
+
+        Tests: http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html
+               http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow.html
+               http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html
+               http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html
+               http/tests/security/XFrameOptions/x-frame-options-deny.html
+               http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-allow.html
+               http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-deny.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv): Stop the current load and redirect to about:blank
+        if an X-FRAME-OPTIONS <meta> tag http-equiq dictates we should.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::shouldInterruptLoadForXFrameOptions): Add logic to parse
+        the X-FRAME-OPTIONS parameter.
+        * loader/FrameLoader.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse): Stop the current load if framed and
+        a X-FRAME-OPTIONS header and its parameter dictate that we should.
+
+2009-04-05  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build.
+
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createPrototype): Take the JSGlobalObject
+        as second argument.
+
+2009-04-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6330929>
+        https://bugs.webkit.org/show_bug.cgi?id=21456
+
+        Don't update the document pointer for all inactive windows on navigations.
+        This change causes us to differ slightly from Firefox when accessing the
+        document from within a closure tied to a navigated context, but as all
+        browsers differ on this edge case, I don't foresee compatibility issues.
+
+        Test: http/tests/security/cross-frame-access-document-direct.html
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::~JSDOMWindowBase):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/js/ScriptController.h:
+
+2009-04-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/6476356>
+        https://bugs.webkit.org/show_bug.cgi?id=23148
+
+        - Use the window object the Location and History objects are directly associated with
+          instead of the lexical global object to pick the object prototype to serve as the
+          base of the their respective prototype chains.
+        - Re-factor as necessary to allow passing the correct global object to the createPrototype
+          functions.
+
+        Tests: http/tests/security/cross-frame-access-history-prototype.html
+               http/tests/security/cross-frame-access-location-prototype.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::getCachedDOMStructure):
+        (WebCore::cacheDOMStructure):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::getDOMStructure):
+        (WebCore::getDOMPrototype):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::history):
+        (WebCore::JSDOMWindow::location):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        * bindings/js/JSNamedNodesCollection.h:
+        (WebCore::JSNamedNodesCollection::createPrototype):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSRGBColor.h:
+        (WebCore::JSRGBColor::createPrototype):
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createPrototype):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createPrototype):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createPrototype):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createPrototype):
+        * page/DOMWindow.idl:
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6015407> attr parsing should allow only identifiers
+
+        Test: fast/css/attr-parsing.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseContent): Allow only CSS_IDENT, and filter out
+        identifiers that start with "-".
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText): Added a case for CSS_ATTR so the test
+        case works. This has the pleasant side effect of fixing a bug too.
+
+2009-03-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/6320555>
+        Add an upper limit for setting HTMLSelectElement.length.
+
+        Test: fast/forms/select-max-length.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setOption):
+        (WebCore::HTMLSelectElement::setLength):
+
+2009-03-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for <rdar://problem/6166844>
+        https://bugs.webkit.org/show_bug.cgi?id=24495
+
+        Use same rule for loading java applets as we do for images.
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::createRenderer):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem):
+
+2009-02-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23500
+        KURL::parse() incorrectly compares its result to original string
+
+        * platform/KURL.cpp: (WebCore::KURL::parse): Take string length into account.
+
 2009-05-15  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Oliver Hunt.
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index 4cf083a..fca03d9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -509,19 +509,29 @@ ScriptState* scriptStateFromNode(Node* node)
     return frame->script()->globalObject()->globalExec();
 }
 
-Structure* getCachedDOMStructure(ExecState* exec, const ClassInfo* classInfo)
+Structure* getCachedDOMStructure(JSDOMGlobalObject* globalObject, const ClassInfo* classInfo)
 {
-    JSDOMStructureMap& structures = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->structures();
+    JSDOMStructureMap& structures = globalObject->structures();
     return structures.get(classInfo).get();
 }
 
-Structure* cacheDOMStructure(ExecState* exec, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+Structure* cacheDOMStructure(JSDOMGlobalObject* globalObject, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
 {
-    JSDOMStructureMap& structures = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->structures();
+    JSDOMStructureMap& structures = globalObject->structures();
     ASSERT(!structures.contains(classInfo));
     return structures.set(classInfo, structure).first->second.get();
 }
 
+Structure* getCachedDOMStructure(ExecState* exec, const ClassInfo* classInfo)
+{
+    return getCachedDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), classInfo);
+}
+
+Structure* cacheDOMStructure(ExecState* exec, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+{
+    return cacheDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), structure, classInfo);
+}
+
 JSObject* getCachedDOMConstructor(ExecState* exec, const ClassInfo* classInfo)
 {
     JSDOMConstructorMap& constructors = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->constructors();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
index 71da21b..5870ecc 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
@@ -73,21 +73,27 @@ namespace WebCore {
     void markActiveObjectsForContext(JSC::JSGlobalData&, ScriptExecutionContext*);
     void markDOMObjectWrapper(JSC::JSGlobalData& globalData, void* object);
 
+    JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
+    JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
     JSC::Structure* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSC::ExecState*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
 
     JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
     void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
 
-    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec)
+    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec, JSDOMGlobalObject* globalObject)
     {
-        if (JSC::Structure* structure = getCachedDOMStructure(exec, &WrapperClass::s_info))
+        if (JSC::Structure* structure = getCachedDOMStructure(globalObject, &WrapperClass::s_info))
             return structure;
-        return cacheDOMStructure(exec, WrapperClass::createStructure(WrapperClass::createPrototype(exec)), &WrapperClass::s_info);
+        return cacheDOMStructure(globalObject, WrapperClass::createStructure(WrapperClass::createPrototype(exec, globalObject)), &WrapperClass::s_info);
+    }
+    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec)
+    {
+        return getDOMStructure<WrapperClass>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()));
     }
-    template<class WrapperClass> inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec)
+    template<class WrapperClass> inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject)
     {
-        return static_cast<JSC::JSObject*>(asObject(getDOMStructure<WrapperClass>(exec)->storedPrototype()));
+        return static_cast<JSC::JSObject*>(asObject(getDOMStructure<WrapperClass>(exec, static_cast<JSDOMGlobalObject*>(globalObject))->storedPrototype()));
     }
     #define CREATE_DOM_OBJECT_WRAPPER(exec, className, object) createDOMObjectWrapper<JS##className>(exec, static_cast<className*>(object))
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
index 10fc022..fa22c9b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -153,8 +153,6 @@ void JSDOMWindowBase::updateDocument()
 
 JSDOMWindowBase::~JSDOMWindowBase()
 {
-    if (d()->impl->frame())
-        d()->impl->frame()->script()->clearFormerWindow(asJSDOMWindow(this));
 }
 
 ScriptExecutionContext* JSDOMWindowBase::scriptExecutionContext() const
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 2c5f882..74b290d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -28,9 +28,13 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameTree.h"
+#include "History.h"
 #include "JSDOMWindowShell.h"
 #include "JSEventListener.h"
+#include "JSHistory.h"
+#include "JSLocation.h"
 #include "JSMessagePort.h"
+#include "Location.h"
 #include "MessagePort.h"
 #include "ScriptController.h"
 #include "Settings.h"
@@ -124,6 +128,28 @@ JSValuePtr JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& property
     return Base::lookupSetter(exec, propertyName);
 }
 
+JSValuePtr JSDOMWindow::history(ExecState* exec) const
+{
+    History* history = impl()->history();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), history))
+        return wrapper;
+
+    JSHistory* jsHistory = new (exec) JSHistory(getDOMStructure<JSHistory>(exec, const_cast<JSDOMWindow*>(this)), history);
+    cacheDOMObjectWrapper(exec->globalData(), history, jsHistory);
+    return jsHistory;
+}
+
+JSValuePtr JSDOMWindow::location(ExecState* exec) const
+{
+    Location* location = impl()->location();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+        return wrapper;
+
+    JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, const_cast<JSDOMWindow*>(this)), location);
+    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    return jsLocation;
+}
+
 void JSDOMWindow::setLocation(ExecState* exec, JSValuePtr value)
 {
     Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
index f292b38..316252a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -55,7 +55,14 @@ JSValuePtr JSDocument::location(ExecState* exec) const
     if (!frame)
         return jsNull();
 
-    return toJS(exec, frame->domWindow()->location());
+    Location* location = frame->domWindow()->location();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+        return wrapper;
+
+    JSDOMWindow* window = static_cast<JSDOMWindow*>(exec->lexicalGlobalObject());
+    JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, window), location);
+    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    return jsLocation;
 }
 
 void JSDocument::setLocation(ExecState* exec, JSValuePtr value)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
index 2237c7a..c33653f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
@@ -21,6 +21,7 @@
 #include "JSImageConstructor.h"
 
 #include "HTMLImageElement.h"
+#include "JSHTMLImageElement.h"
 #include "HTMLNames.h"
 #include "JSNode.h"
 #include "ScriptExecutionContext.h"
@@ -38,6 +39,8 @@ JSImageConstructor::JSImageConstructor(ExecState* exec, ScriptExecutionContext*
 {
     ASSERT(context->isDocument());
     m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+
+    putDirect(exec->propertyNames().prototype, JSHTMLImageElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 static JSObject* constructImage(ExecState* exec, JSObject* constructor, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
index 6c11bea..98411fa 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
@@ -51,7 +51,7 @@ JSMessageChannelConstructor::JSMessageChannelConstructor(ExecState* exec, Script
     else
         ASSERT_NOT_REACHED();
 
-    putDirect(exec->propertyNames().prototype, JSMessageChannelPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSMessageChannelPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 JSMessageChannelConstructor::~JSMessageChannelConstructor()
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
index 19f194b..fff4d6c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
@@ -44,9 +44,9 @@ namespace WebCore {
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
 
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState* exec)
+        static JSC::ObjectPrototype* createPrototype(JSC::ExecState*, JSC::JSGlobalObject* globalObject)
         {
-            return exec->lexicalGlobalObject()->objectPrototype();
+            return globalObject->objectPrototype();
         }
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h
index d5acff3..2f51407 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h
@@ -38,9 +38,9 @@ namespace WebCore {
 
         unsigned impl() const { return m_color; }
 
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState* exec)
+        static JSC::ObjectPrototype* createPrototype(JSC::ExecState*, JSC::JSGlobalObject* globalObject)
         {
-            return exec->lexicalGlobalObject()->objectPrototype();
+            return globalObject->objectPrototype();
         }
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
index d7f54de..5269208 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
@@ -37,8 +37,7 @@ JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor(ExecState* exec, Script
 {
     ASSERT(context->isDocument());
     m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
-
-    putDirect(exec->propertyNames().prototype, JSXMLHttpRequestPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSXMLHttpRequestPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 static JSObject* constructXMLHttpRequest(ExecState* exec, JSObject* constructor, const ArgList&)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
index ed456e1..efa74c9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
@@ -44,7 +44,7 @@ const ClassInfo JSXSLTProcessorConstructor::s_info = { "XSLTProcessorConsructor"
 JSXSLTProcessorConstructor::JSXSLTProcessorConstructor(ExecState* exec)
     : DOMObject(JSXSLTProcessorConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
 {
-    putDirect(exec->propertyNames().prototype, JSXSLTProcessorPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSXSLTProcessorPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 static JSObject* constructXSLTProcessor(ExecState* exec, JSObject*, const ArgList&)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
index ebed71d..c5696ed 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
@@ -133,7 +133,6 @@ void ScriptController::clearWindowShell()
 
     JSLock lock(false);
     m_windowShell->window()->clear();
-    m_liveFormerWindows.add(m_windowShell->window());
     m_windowShell->setWindow(m_frame->domWindow());
     if (Page* page = m_frame->page()) {
         attachDebugger(page->debugger());
@@ -168,7 +167,7 @@ void ScriptController::initScript()
     JSLock lock(false);
 
     m_windowShell = new JSDOMWindowShell(m_frame->domWindow());
-    updateDocument();
+    m_windowShell->window()->updateDocument();
 
     if (Page* page = m_frame->page()) {
         attachDebugger(page->debugger());
@@ -231,9 +230,6 @@ void ScriptController::updateDocument()
     JSLock lock(false);
     if (m_windowShell)
         m_windowShell->window()->updateDocument();
-    HashSet<JSDOMWindow*>::iterator end = m_liveFormerWindows.end();
-    for (HashSet<JSDOMWindow*>::iterator it = m_liveFormerWindows.begin(); it != end; ++it)
-        (*it)->updateDocument();
 }
 
 void ScriptController::updateSecurityOrigin()
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
index c952cc2..20f57a4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
@@ -100,7 +100,6 @@ public:
     const String* sourceURL() const { return m_sourceURL; } // 0 if we are not evaluating any script
 
     void clearWindowShell();
-    void clearFormerWindow(JSDOMWindow* window) { m_liveFormerWindows.remove(window); }
     void updateDocument();
 
     // Notifies the ScriptController that the securityOrigin of the current
@@ -142,7 +141,6 @@ private:
     void disconnectPlatformScriptObjects();
 
     JSC::ProtectedPtr<JSDOMWindowShell> m_windowShell;
-    HashSet<JSDOMWindow*> m_liveFormerWindows;
     Frame* m_frame;
     int m_handlerLineno;
     const String* m_sourceURL;
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
index f1061df..b2990f2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -438,7 +438,7 @@ sub GenerateHeader
     push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $interfaceName eq "Document");
 
     # Prototype
-    push(@headerContent, "    static JSC::JSObject* createPrototype(JSC::ExecState*);\n") unless ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"});
+    push(@headerContent, "    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);\n") unless ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"});
 
     $implIncludes{"${className}Custom.h"} = 1 if $dataNode->extendedAttributes->{"CustomHeader"} || $dataNode->extendedAttributes->{"CustomPutFunction"};
 
@@ -664,7 +664,7 @@ sub GenerateHeader
     } elsif ($interfaceName eq "WorkerContext") {
         push(@headerContent, "    void* operator new(size_t, JSC::JSGlobalData*);\n");
     } else {
-        push(@headerContent, "    static JSC::JSObject* self(JSC::ExecState*);\n");
+        push(@headerContent, "    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);\n");
     }
     push(@headerContent, "    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }\n");
     push(@headerContent, "    static const JSC::ClassInfo s_info;\n");
@@ -913,9 +913,9 @@ sub GenerateImplementation
         push(@implContent, "    return globalData->heap.allocate(size);\n");
         push(@implContent, "}\n\n");
     } else {
-        push(@implContent, "JSObject* ${className}Prototype::self(ExecState* exec)\n");
+        push(@implContent, "JSObject* ${className}Prototype::self(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
-        push(@implContent, "    return getDOMPrototype<${className}>(exec);\n");
+        push(@implContent, "    return getDOMPrototype<${className}>(exec, globalObject);\n");
         push(@implContent, "}\n\n");
     }
     if ($numConstants > 0 || $numFunctions > 0) {
@@ -1013,12 +1013,12 @@ sub GenerateImplementation
     }
 
     if (!$dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
-        push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec)\n");
+        push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
         if ($hasParent && $parentClassName ne "JSC::DOMNodeFilter") {
-            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(${parentClassName}Prototype::self(exec)));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(${parentClassName}Prototype::self(exec, globalObject)));\n");
         } else {
-            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(globalObject->objectPrototype()));\n");
         }
         push(@implContent, "}\n\n");
     }
@@ -1998,7 +1998,7 @@ public:
     ${className}Constructor(ExecState* exec)
         : DOMObject(${className}Constructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec), None);
+        putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
index 7912a2b9..45be51a 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
@@ -144,9 +144,9 @@ public:
 
     static const ClassInfo s_info;
 
-    static FunctionPrototype* createPrototype(ExecState* exec)
+    static FunctionPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->functionPrototype();
+        return globalObject->functionPrototype();
     }
 
     static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
index 1ea47a4..488c3f5 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
@@ -51,9 +51,9 @@ public:
 
     static const ClassInfo s_info;
 
-    static ArrayPrototype* createPrototype(ExecState* exec)
+    static ArrayPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->arrayPrototype();
+        return globalObject->arrayPrototype();
     }
 
     static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
index bb983f9..fe1178a 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
@@ -40,9 +40,9 @@ public:
 
     static const ClassInfo s_info;
 
-    static FunctionPrototype* createPrototype(ExecState* exec)
+    static FunctionPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->functionPrototype();
+        return globalObject->functionPrototype();
     }
 
     static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
index 0e8ea77..4d843c6 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
@@ -51,9 +51,9 @@ public:
 
     static const ClassInfo s_info;
 
-    static ObjectPrototype* createPrototype(ExecState* exec)
+    static ObjectPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->objectPrototype();
+        return globalObject->objectPrototype();
     }
 
     static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
index 36b86a4..4a9412e 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
@@ -621,7 +621,6 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyContent:              // [ <string> | <uri> | <counter> | attr(X) | open-quote |
         // close-quote | no-open-quote | no-close-quote ]+ | inherit
         return parseContent(propId, important);
-        break;
 
     case CSSPropertyWhiteSpace:          // normal | pre | nowrap | inherit
         if (id == CSSValueNormal ||
@@ -1979,13 +1978,21 @@ bool CSSParser::parseContent(int propId, bool important)
                 if (args->size() != 1)
                     return false;
                 CSSParserValue* a = args->current();
+                if (a->unit != CSSPrimitiveValue::CSS_IDENT)
+                    return false;
                 String attrName = a->string;
+                // CSS allows identifiers with "-" at the start, like "-webkit-mask-image".
+                // But HTML attribute names can't have those characters, and we should not
+                // even parse them inside attr().
+                if (attrName[0] == '-')
+                    return false;
                 if (document()->isHTMLDocument())
                     attrName = attrName.lower();
                 parsedValue = CSSPrimitiveValue::create(attrName, CSSPrimitiveValue::CSS_ATTR);
             } else if (equalIgnoringCase(val->function->name, "counter(")) {
                 parsedValue = parseCounterContent(args, false);
-                if (!parsedValue) return false;
+                if (!parsedValue)
+                    return false;
             } else if (equalIgnoringCase(val->function->name, "counters(")) {
                 parsedValue = parseCounterContent(args, true);
                 if (!parsedValue)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
index a160454..5c5c679 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
@@ -754,9 +754,18 @@ String CSSPrimitiveValue::cssText() const
         case CSS_IDENT:
             text = valueOrPropertyName(m_value.ident);
             break;
-        case CSS_ATTR:
-            // FIXME
-            break;
+        case CSS_ATTR: {
+            DEFINE_STATIC_LOCAL(const String, attrParen, ("attr("));
+
+            Vector<UChar> result;
+            result.reserveInitialCapacity(6 + m_value.string->length());
+
+            append(result, attrParen);
+            append(result, m_value.string);
+            result.uncheckedAppend(')');
+
+            return String::adopt(result);
+        }
         case CSS_COUNTER:
             text = "counter(";
             text += String::number(m_value.num);
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index a51d1ab..34418a9 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -26,8 +26,8 @@
 #include "config.h"
 #include "Document.h"
 
-#include "AnimationController.h"
 #include "AXObjectCache.h"
+#include "AnimationController.h"
 #include "CDATASection.h"
 #include "CSSHelper.h"
 #include "CSSStyleSelector.h"
@@ -77,6 +77,8 @@
 #include "HitTestRequest.h"
 #include "HitTestResult.h"
 #include "ImageLoader.h"
+#include "InspectorController.h"
+#include "JSDOMBinding.h"
 #include "KeyboardEvent.h"
 #include "Logging.h"
 #include "MessageEvent.h"
@@ -98,6 +100,7 @@
 #include "RenderView.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
+#include "ScriptController.h"
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "SelectionController.h"
@@ -107,8 +110,8 @@
 #include "TextEvent.h"
 #include "TextIterator.h"
 #include "TextResourceDecoder.h"
-#include "TreeWalker.h"
 #include "Timer.h"
+#include "TreeWalker.h"
 #include "UIEvent.h"
 #include "WebKitAnimationEvent.h"
 #include "WebKitTransitionEvent.h"
@@ -120,8 +123,8 @@
 #include "ScriptController.h"
 #include <wtf/HashFunctions.h>
 #include <wtf/MainThread.h>
-#include <wtf/StdLibExtras.h>
 #include <wtf/PassRefPtr.h>
+#include <wtf/StdLibExtras.h>
 
 #if ENABLE(DATABASE)
 #include "Database.h"
@@ -1953,11 +1956,11 @@ Node *Document::nodeWithAbsIndex(int absIndex)
     return n;
 }
 
-void Document::processHttpEquiv(const String &equiv, const String &content)
+void Document::processHttpEquiv(const String& equiv, const String& content)
 {
     ASSERT(!equiv.isNull() && !content.isNull());
 
-    Frame *frame = this->frame();
+    Frame* frame = this->frame();
 
     if (equalIgnoringCase(equiv, "default-style")) {
         // The preferred style set has been overridden as per section 
@@ -1987,6 +1990,13 @@ void Document::processHttpEquiv(const String &equiv, const String &content)
         setContentLanguage(content);
     else if (equalIgnoringCase(equiv, "x-dns-prefetch-control"))
         parseDNSPrefetchControlHeader(content);
+    else if (equalIgnoringCase(equiv, "x-frame-options")) {
+        FrameLoader* frameLoader = frame->loader();
+        if (frameLoader->shouldInterruptLoadForXFrameOptions(content, url())) {
+            frameLoader->stopAllLoaders();
+            frameLoader->scheduleHTTPRedirection(0, blankURL());
+        }
+    }
 }
 
 MouseEventWithHitTestResults Document::prepareMouseEvent(const HitTestRequest& request, const IntPoint& documentPoint, const PlatformMouseEvent& event)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
index f7b7de3..d330bca 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
@@ -79,7 +79,7 @@ public:
     JSAttrConstructor(ExecState* exec)
         : DOMObject(JSAttrConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSAttrPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSAttrPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
@@ -114,9 +114,9 @@ static const HashTable JSAttrPrototypeTable =
 
 const ClassInfo JSAttrPrototype::s_info = { "AttrPrototype", 0, &JSAttrPrototypeTable, 0 };
 
-JSObject* JSAttrPrototype::self(ExecState* exec)
+JSObject* JSAttrPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSAttr>(exec);
+    return getDOMPrototype<JSAttr>(exec, globalObject);
 }
 
 const ClassInfo JSAttr::s_info = { "Attr", &JSEventTargetNode::s_info, &JSAttrTable, 0 };
@@ -126,9 +126,9 @@ JSAttr::JSAttr(PassRefPtr<Structure> structure, PassRefPtr<Attr> impl)
 {
 }
 
-JSObject* JSAttr::createPrototype(ExecState* exec)
+JSObject* JSAttr::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSAttrPrototype(JSAttrPrototype::createStructure(JSEventTargetNodePrototype::self(exec)));
+    return new (exec) JSAttrPrototype(JSAttrPrototype::createStructure(JSEventTargetNodePrototype::self(exec, globalObject)));
 }
 
 bool JSAttr::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.h b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
index 40b861e..db1d3e6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
@@ -31,7 +31,7 @@ class JSAttr : public JSEventTargetNode {
     typedef JSEventTargetNode Base;
 public:
     JSAttr(PassRefPtr<JSC::Structure>, PassRefPtr<Attr>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
@@ -56,7 +56,7 @@ Attr* toAttr(JSC::JSValuePtr);
 
 class JSAttrPrototype : public JSC::JSObject {
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSAttrPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
index 566468f..389f3e2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
@@ -64,9 +64,9 @@ static const HashTable JSBarInfoPrototypeTable =
 
 const ClassInfo JSBarInfoPrototype::s_info = { "BarInfoPrototype", 0, &JSBarInfoPrototypeTable, 0 };
 
-JSObject* JSBarInfoPrototype::self(ExecState* exec)
+JSObject* JSBarInfoPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSBarInfo>(exec);
+    return getDOMPrototype<JSBarInfo>(exec, globalObject);
 }
 
 const ClassInfo JSBarInfo::s_info = { "BarInfo", 0, &JSBarInfoTable, 0 };
@@ -83,9 +83,9 @@ JSBarInfo::~JSBarInfo()
 
 }
 
-JSObject* JSBarInfo::createPrototype(ExecState* exec)
+JSObject* JSBarInfo::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSBarInfoPrototype(JSBarInfoPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSBarInfoPrototype(JSBarInfoPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSBarInfo::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
index f13a62c..e61f234 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
@@ -34,7 +34,7 @@ class JSBarInfo : public DOMObject {
 public:
     JSBarInfo(PassRefPtr<JSC::Structure>, PassRefPtr<BarInfo>);
     virtual ~JSBarInfo();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,7 +55,7 @@ BarInfo* toBarInfo(JSC::JSValuePtr);
 
 class JSBarInfoPrototype : public JSC::JSObject {
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSBarInfoPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
index 0374edd..8010040 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
@@ -68,7 +68,7 @@ public:
     JSCDATASectionConstructor(ExecState* exec)
         : DOMObject(JSCDATASectionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCDATASectionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCDATASectionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
@@ -103,9 +103,9 @@ static const HashTable JSCDATASectionPrototypeTable =
 
 const ClassInfo JSCDATASectionPrototype::s_info = { "CDATASectionPrototype", 0, &JSCDATASectionPrototypeTable, 0 };
 
-JSObject* JSCDATASectionPrototype::self(ExecState* exec)
+JSObject* JSCDATASectionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCDATASection>(exec);
+    return getDOMPrototype<JSCDATASection>(exec, globalObject);
 }
 
 const ClassInfo JSCDATASection::s_info = { "CDATASection", &JSText::s_info, &JSCDATASectionTable, 0 };
@@ -115,9 +115,9 @@ JSCDATASection::JSCDATASection(PassRefPtr<Structure> structure, PassRefPtr<CDATA
 {
 }
 
-JSObject* JSCDATASection::createPrototype(ExecState* exec)
+JSObject* JSCDATASection::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCDATASectionPrototype(JSCDATASectionPrototype::createStructure(JSTextPrototype::self(exec)));
+    return new (exec) JSCDATASectionPrototype(JSCDATASectionPrototype::createStructure(JSTextPrototype::self(exec, globalObject)));
 }
 
 bool JSCDATASection::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
index b92e3ac..cd5bf36 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
@@ -31,7 +31,7 @@ class JSCDATASection : public JSText {
     typedef JSText Base;
 public:
     JSCDATASection(PassRefPtr<JSC::Structure>, PassRefPtr<CDATASection>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -47,7 +47,7 @@ public:
 
 class JSCDATASectionPrototype : public JSC::JSObject {
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCDATASectionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
index 8dfe3c3..827deb3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
@@ -70,7 +70,7 @@ public:
     JSCSSCharsetRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSCharsetRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSCharsetRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSCharsetRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
@@ -105,9 +105,9 @@ static const HashTable JSCSSCharsetRulePrototypeTable =
 
 const ClassInfo JSCSSCharsetRulePrototype::s_info = { "CSSCharsetRulePrototype", 0, &JSCSSCharsetRulePrototypeTable, 0 };
 
-JSObject* JSCSSCharsetRulePrototype::self(ExecState* exec)
+JSObject* JSCSSCharsetRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSCharsetRule>(exec);
+    return getDOMPrototype<JSCSSCharsetRule>(exec, globalObject);
 }
 
 const ClassInfo JSCSSCharsetRule::s_info = { "CSSCharsetRule", &JSCSSRule::s_info, &JSCSSCharsetRuleTable, 0 };
@@ -117,9 +117,9 @@ JSCSSCharsetRule::JSCSSCharsetRule(PassRefPtr<Structure> structure, PassRefPtr<C
 {
 }
 
-JSObject* JSCSSCharsetRule::createPrototype(ExecState* exec)
+JSObject* JSCSSCharsetRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSCharsetRulePrototype(JSCSSCharsetRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSCharsetRulePrototype(JSCSSCharsetRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSCharsetRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
index 9877f1a..3c71326 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
@@ -31,7 +31,7 @@ class JSCSSCharsetRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSCharsetRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSCharsetRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
@@ -48,7 +48,7 @@ public:
 
 class JSCSSCharsetRulePrototype : public JSC::JSObject {
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCSSCharsetRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
index 4109ea8..48f66e3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
@@ -72,7 +72,7 @@ public:
     JSCSSFontFaceRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSFontFaceRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSFontFaceRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSFontFaceRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
@@ -107,9 +107,9 @@ static const HashTable JSCSSFontFaceRulePrototypeTable =
 
 const ClassInfo JSCSSFontFaceRulePrototype::s_info = { "CSSFontFaceRulePrototype", 0, &JSCSSFontFaceRulePrototypeTable, 0 };
 
-JSObject* JSCSSFontFaceRulePrototype::self(ExecState* exec)
+JSObject* JSCSSFontFaceRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSFontFaceRule>(exec);
+    return getDOMPrototype<JSCSSFontFaceRule>(exec, globalObject);
 }
 
 const ClassInfo JSCSSFontFaceRule::s_info = { "CSSFontFaceRule", &JSCSSRule::s_info, &JSCSSFontFaceRuleTable, 0 };
@@ -119,9 +119,9 @@ JSCSSFontFaceRule::JSCSSFontFaceRule(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSCSSFontFaceRule::createPrototype(ExecState* exec)
+JSObject* JSCSSFontFaceRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSFontFaceRulePrototype(JSCSSFontFaceRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSFontFaceRulePrototype(JSCSSFontFaceRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSFontFaceRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
index 1567718..f7e043c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
@@ -31,7 +31,7 @@ class JSCSSFontFaceRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSFontFaceRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSFontFaceRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -47,7 +47,7 @@ public:
 
 class JSCSSFontFaceRulePrototype : public JSC::JSObject {
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCSSFontFaceRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
index bc2dad5..0a9472e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
@@ -76,7 +76,7 @@ public:
     JSCSSImportRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSImportRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSImportRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSImportRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
@@ -111,9 +111,9 @@ static const HashTable JSCSSImportRulePrototypeTable =
 
 const ClassInfo JSCSSImportRulePrototype::s_info = { "CSSImportRulePrototype", 0, &JSCSSImportRulePrototypeTable, 0 };
 
-JSObject* JSCSSImportRulePrototype::self(ExecState* exec)
+JSObject* JSCSSImportRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSImportRule>(exec);
+    return getDOMPrototype<JSCSSImportRule>(exec, globalObject);
 }
 
 const ClassInfo JSCSSImportRule::s_info = { "CSSImportRule", &JSCSSRule::s_info, &JSCSSImportRuleTable, 0 };
@@ -123,9 +123,9 @@ JSCSSImportRule::JSCSSImportRule(PassRefPtr<Structure> structure, PassRefPtr<CSS
 {
 }
 
-JSObject* JSCSSImportRule::createPrototype(ExecState* exec)
+JSObject* JSCSSImportRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSImportRulePrototype(JSCSSImportRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSImportRulePrototype(JSCSSImportRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSImportRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h