Updated WebKit from /home/joce/dev/qtwebkit3/ to qtwebkit-4.6-snapshot-24092009 ( 75c44947a340d74a9e0098a3dfffabce0c9512ef )

Changes in WebKit/qt since the last update:

++ b/WebKit/qt/ChangeLog
2009-09-24  Martin Smith  <msmith@trolltech.com>

        Reviewed by Simon Hausmann.

        qdoc: Added \brief texts to all the since 4.6 functions.

        * Api/qwebhistory.cpp:

2009-09-23  J-P Nurmi  <jpnurmi@gmail.com>

        Reviewed by Simon Hausmann.

        Prevent QWebPage::setView() from changing the viewport size on the fly
        in case the view doesn't actually change. QWebPage::setView() is
        called upon every QWebGraphicsItem::hoverMoveEvent(), which forced
        the viewport size to be equal to the size of the whole graphics view.

        https://bugs.webkit.org/show_bug.cgi?id=29676

        * Api/qwebpage.cpp:
        (QWebPage::setView):

2009-09-23  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        [Qt] Crash fix in QWebHistory back and forward methods.

        QWebHistory::back() and QWebHistory::forward() were crashing on
        ASSERT in WebCore::BackForwardList. The methods should check
        canGoBack() and canGoForward() at the beginning.

        https://bugs.webkit.org/show_bug.cgi?id=29675

        * Api/qwebhistory.cpp:
        (QWebHistory::back):
        (QWebHistory::forward):

2009-09-23  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        [Qt] Bug fix. QWebHistory should call QWebPage::updateNavigationActions

        In QWebHistory's methods that change item count or current item call
        to QWebPage::updateNavigationActions should be executed.
        QWebHistory::clear() and QWebHistory::restorState() were changed.
        New helper method, QWebPagePrivate accesor, were created in
        QWebHistoryPrivate class.
        Two autotest were developed.

        https://bugs.webkit.org/show_bug.cgi?id=29246

        * Api/qwebhistory.cpp:
        (QWebHistory::clear):
        (QWebHistory::restoreState):
        (QWebHistoryPrivate::page):
        * Api/qwebhistory_p.h:
        * tests/qwebhistory/tst_qwebhistory.cpp:
        (tst_QWebHistory::saveAndRestore_1):
        (tst_QWebHistory::clear):

2009-09-23  Norbert Leser  <norbert.leser@nokia.com>

        Reviewed by Tor Arne Vestbø.

        Need to guard QX11Info include with Q_WS_X11.
        That class may not be available (in QT 4.5 for Symbian, for instance).
        Completes fixes in r48627 and r48604.

        * Api/qwebgraphicsitem.cpp:
        * Api/qwebview.cpp:

2009-09-22  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>

        Reviewed by Simon Hausmann.

        [Qt] Add default timeout while waiting for signals in QWebPage auto
        tests.
        https://bugs.webkit.org/show_bug.cgi?id=29637

        * tests/qwebpage/tst_qwebpage.cpp:
        (waitForSignal):

2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>

        Reivewed by Simon Hausmann.

        Fix the Qt/Mac build after r48604 (Implement new QWebPageClient class)

        There's no QWidget::x11Info() on Mac, and setPlatformPluginWidget()
        takes a QWidget*, not a QWebPageClient*

        * Api/qwebgraphicsitem.cpp:
        (QWebGraphicsItemPrivate::screenNumber):
        * Api/qwebview.cpp:
        (QWebViewPrivate::screenNumber):

2009-09-21  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Simon Hausmann.

        For Qt, platformPageClient() will now return a class derived from
        the QWebPageClient, so the patch adapts our Qt hooks to go though
        this class and not depend on the QWebView.

        * Api/qwebgraphicsitem.cpp:
        (QWebGraphicsItemPrivate::scroll):
        (QWebGraphicsItemPrivate::update):
        (QWebGraphicsItemPrivate::cursor):
        (QWebGraphicsItemPrivate::updateCursor):
        (QWebGraphicsItemPrivate::screenNumber):
        (QWebGraphicsItemPrivate::winId):
        (QWebGraphicsItem::event):
        (QWebGraphicsItem::setPage):
        * Api/qwebgraphicsitem.h:
        * Api/qwebpage.cpp:
        (QWebPagePrivate::QWebPagePrivate):
        * Api/qwebpage_p.h:
        * Api/qwebview.cpp:
        (QWebViewPrivate::scroll):
        (QWebViewPrivate::update):
        (QWebViewPrivate::cursor):
        (QWebViewPrivate::updateCursor):
        (QWebViewPrivate::screenNumber):
        (QWebViewPrivate::winId):
        (QWebView::setPage):
        (QWebView::event):
        * WebCoreSupport/ChromeClientQt.cpp:
        (WebCore::ChromeClientQt::repaint):
        (WebCore::ChromeClientQt::scroll):
        (WebCore::ChromeClientQt::platformPageClient):

2009-09-21  Yael Aharon  <yael.aharon@nokia.com>

        Reviewed by Simon Hausmann.

        https://bugs.webkit.org/show_bug.cgi?id=29609
        Build fix for windows when using Qt 4.5.0.

        * Api/qwebpage.cpp:
        (QWebPage::userAgentForUrl):

2009-09-19  Benjamin Poulain  <benjamin.poulain@nokia.com>

        Reviewed by Simon Hausmann.

        https://bugs.webkit.org/show_bug.cgi?id=29345
        The tests of QWebFrame did not use QTRY_VERIFY for
        tests involving the event loop.

        * tests/qwebframe/tst_qwebframe.cpp:
        * tests/util.h: Added. Copy of tests/shared/util.h of Qt

2009-09-19  Jakub Wieczorek  <faw217@gmail.com>

        Reviewed by Simon Hausmann.

        [Qt] Add an autotest stub for QWebGraphicsItem.

        It just calls all the functions and makes sure they don't crash.

        * tests/qwebgraphicsitem/qwebgraphicsitem.pro: Added.
        * tests/qwebgraphicsitem/tst_qwebgraphicsitem.cpp: Added.
        (tst_QWebGraphicsItem::qwebgraphicsitem):
        * tests/tests.pro:

2009-09-18  Norbert Leser  <norbert.leser@nokia.com>

        Reviewed by Eric Seidel.

        Corrected the Symbian specific UID3 values to be assigned
        from the "unprotected" pool that permits self-signing of
        those test and demo executables. (Added new UID3 values
        where they were missing for new components.)

        * QGVLauncher/QGVLauncher.pro:
        * QtLauncher/QtLauncher.pro:
        * tests/benchmarks/loading/tst_loading.pro:
        * tests/benchmarks/painting/tst_painting.pro:
        * tests/qwebelement/qwebelement.pro:
        * tests/qwebframe/qwebframe.pro:
        * tests/qwebhistory/qwebhistory.pro:
        * tests/qwebhistoryinterface/qwebhistoryinterface.pro:
        * tests/qwebpage/qwebpage.pro:
        * tests/qwebplugindatabase/qwebplugindatabase.pro:
        * tests/qwebview/qwebview.pro:

2009-09-17  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Simon Hausmann.

        Make PlatformWindow return something else than PlatformWidget
        https://bugs.webkit.org/show_bug.cgi?id=29085

        Reflect the rename of platformWindow and it's return type.

        * WebCoreSupport/ChromeClientQt.cpp:
        (WebCore::ChromeClientQt::platformPageClient):
        * WebCoreSupport/ChromeClientQt.h:

2009-09-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>

        Reviewed by Simon Hausmann.

        [Qt] Add persistence support for configuration options in the
        inspector.

        * Api/qwebinspector.cpp:
        * QtLauncher/main.cpp:
        (main):
        * WebCoreSupport/InspectorClientQt.cpp:
        (WebCore::InspectorClientQt::populateSetting):
        (WebCore::InspectorClientQt::storeSetting):
        (WebCore::variantToSetting):
        (WebCore::settingToVariant):

2009-09-17  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Simon Hausmann.

        Improve documentation for Page Cache.

        * Api/qwebsettings.cpp:

2009-09-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>

        Reviewed by Simon Hausmann.

        [Qt] Update QWebSettings::setUserStyleSheetUrl() docs and test

        https://bugs.webkit.org/show_bug.cgi?id=29081

        The documentation now specifies that the URL has to be a local file
        or a a data-URL (with utf-8 and base64-encoded data), as these are the
        only two schemes that the current code path accepts.

        The auto-test has been updated to reflect this limitation.

        At a later point we should concider adding API for the new way of
        doing both user defined stylesheets and scripts.

        * Api/qwebsettings.cpp:
        * tests/qwebpage/tst_qwebpage.cpp:

24 files changed, 358 insertions, 1183 deletions

diff --git a/src/3rdparty/webkit/WebCore/page/Chrome.cpp b/src/3rdparty/webkit/WebCore/page/Chrome.cpp
index a16db68210..96f0fb7271 100644
--- a/src/3rdparty/webkit/WebCore/page/Chrome.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Chrome.cpp
@@ -87,9 +87,9 @@ IntRect Chrome::windowToScreen(const IntRect& rect) const
     return m_client->windowToScreen(rect);
 }
 
-PlatformWidget Chrome::platformWindow() const
+PlatformPageClient Chrome::platformPageClient() const
 {
-    return m_client->platformWindow();
+    return m_client->platformPageClient();
 }
 
 void Chrome::contentsSizeChanged(Frame* frame, const IntSize& size) const
diff --git a/src/3rdparty/webkit/WebCore/page/Chrome.h b/src/3rdparty/webkit/WebCore/page/Chrome.h
index 79d3eca2d9..033311dd18 100644
--- a/src/3rdparty/webkit/WebCore/page/Chrome.h
+++ b/src/3rdparty/webkit/WebCore/page/Chrome.h
@@ -63,7 +63,7 @@ namespace WebCore {
         virtual void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
         virtual IntPoint screenToWindow(const IntPoint&) const;
         virtual IntRect windowToScreen(const IntRect&) const;
-        virtual PlatformWidget platformWindow() const;
+        virtual PlatformPageClient platformPageClient() const;
         virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const;
         virtual void scrollbarsModeDidChange() const;
 
diff --git a/src/3rdparty/webkit/WebCore/page/ChromeClient.h b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
index 2a1e991837..2d112753f3 100644
--- a/src/3rdparty/webkit/WebCore/page/ChromeClient.h
+++ b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
@@ -128,7 +128,7 @@ namespace WebCore {
         virtual void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect) = 0;
         virtual IntPoint screenToWindow(const IntPoint&) const = 0;
         virtual IntRect windowToScreen(const IntRect&) const = 0;
-        virtual PlatformWidget platformWindow() const = 0;
+        virtual PlatformPageClient platformPageClient() const = 0;
         virtual void contentsSizeChanged(Frame*, const IntSize&) const = 0;
         virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const = 0; // Currently only Mac has a non empty implementation.
         // End methods used by HostWindow.
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
index 783f93d897..809d541de6 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
@@ -105,7 +105,7 @@ public:
     PassRefPtr<MessageEvent> event(ScriptExecutionContext* context)
     {
         OwnPtr<MessagePortArray> messagePorts = MessagePort::entanglePorts(*context, m_channels.release());
-        return MessageEvent::create(m_message, m_origin, "", m_source, messagePorts.release());
+        return MessageEvent::create(messagePorts.release(), m_message, m_origin, "", m_source);
     }
     SecurityOrigin* targetOrigin() const { return m_targetOrigin.get(); }
 
@@ -123,83 +123,36 @@ private:
     RefPtr<SecurityOrigin> m_targetOrigin;
 };
 
-typedef HashMap<DOMWindow*, RegisteredEventListenerVector*> DOMWindowRegisteredEventListenerMap;
+typedef HashCountedSet<DOMWindow*> DOMWindowSet;
 
-static DOMWindowRegisteredEventListenerMap& pendingUnloadEventListenerMap()
+static DOMWindowSet& windowsWithUnloadEventListeners()
 {
-    DEFINE_STATIC_LOCAL(DOMWindowRegisteredEventListenerMap, eventListenerMap, ());
-    return eventListenerMap;
+    DEFINE_STATIC_LOCAL(DOMWindowSet, windowsWithUnloadEventListeners, ());
+    return windowsWithUnloadEventListeners;
 }
 
-static DOMWindowRegisteredEventListenerMap& pendingBeforeUnloadEventListenerMap()
+static DOMWindowSet& windowsWithBeforeUnloadEventListeners()
 {
-    DEFINE_STATIC_LOCAL(DOMWindowRegisteredEventListenerMap, eventListenerMap, ());
-    return eventListenerMap;
+    DEFINE_STATIC_LOCAL(DOMWindowSet, windowsWithBeforeUnloadEventListeners, ());
+    return windowsWithBeforeUnloadEventListeners;
 }
 
-static bool allowsPendingBeforeUnloadListeners(DOMWindow* window)
+static bool allowsBeforeUnloadListeners(DOMWindow* window)
 {
     ASSERT_ARG(window, window);
     Frame* frame = window->frame();
+    if (!frame)
+        return false;
     Page* page = frame->page();
-    return page && frame == page->mainFrame();
-}
-
-static void addPendingEventListener(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window, RegisteredEventListener* listener)
-{
-    ASSERT_ARG(window, window);
-    ASSERT_ARG(listener, listener);
-
-    if (map.isEmpty())
-        disableSuddenTermination();
-
-    pair<DOMWindowRegisteredEventListenerMap::iterator, bool> result = map.add(window, 0);
-    if (result.second)
-        result.first->second = new RegisteredEventListenerVector;
-    result.first->second->append(listener);
-}
-
-static void removePendingEventListener(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window, RegisteredEventListener* listener)
-{
-    ASSERT_ARG(window, window);
-    ASSERT_ARG(listener, listener);
-
-    DOMWindowRegisteredEventListenerMap::iterator it = map.find(window);
-    ASSERT(it != map.end());
-
-    RegisteredEventListenerVector* listeners = it->second;
-    size_t index = listeners->find(listener);
-    ASSERT(index != WTF::notFound);
-    listeners->remove(index);
-
-    if (!listeners->isEmpty())
-        return;
-
-    map.remove(it);
-    delete listeners;
-
-    if (map.isEmpty())
-        enableSuddenTermination();
-}
-
-static void removePendingEventListeners(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window)
-{
-    ASSERT_ARG(window, window);
-
-    RegisteredEventListenerVector* listeners = map.take(window);
-    if (!listeners)
-        return;
-
-    delete listeners;
-
-    if (map.isEmpty())
-        enableSuddenTermination();
+    if (!page)
+        return false;
+    return frame == page->mainFrame();
 }
 
 bool DOMWindow::dispatchAllPendingBeforeUnloadEvents()
 {
-    DOMWindowRegisteredEventListenerMap& map = pendingBeforeUnloadEventListenerMap();
-    if (map.isEmpty())
+    DOMWindowSet& set = windowsWithBeforeUnloadEventListeners();
+    if (set.isEmpty())
         return true;
 
     static bool alreadyDispatched = false;
@@ -208,20 +161,21 @@ bool DOMWindow::dispatchAllPendingBeforeUnloadEvents()
         return true;
 
     Vector<RefPtr<DOMWindow> > windows;
-    DOMWindowRegisteredEventListenerMap::iterator mapEnd = map.end();
-    for (DOMWindowRegisteredEventListenerMap::iterator it = map.begin(); it != mapEnd; ++it)
+    DOMWindowSet::iterator end = set.end();
+    for (DOMWindowSet::iterator it = set.begin(); it != end; ++it)
         windows.append(it->first);
 
     size_t size = windows.size();
     for (size_t i = 0; i < size; ++i) {
         DOMWindow* window = windows[i].get();
-        RegisteredEventListenerVector* listeners = map.get(window);
-        if (!listeners)
+        if (!set.contains(window))
             continue;
 
-        RegisteredEventListenerVector listenersCopy = *listeners;
         Frame* frame = window->frame();
-        if (!frame->shouldClose(&listenersCopy))
+        if (!frame)
+            continue;
+
+        if (!frame->shouldClose())
             return false;
     }
 
@@ -234,14 +188,13 @@ bool DOMWindow::dispatchAllPendingBeforeUnloadEvents()
 
 unsigned DOMWindow::pendingUnloadEventListeners() const
 {
-    RegisteredEventListenerVector* listeners = pendingUnloadEventListenerMap().get(const_cast<DOMWindow*>(this));
-    return listeners ? listeners->size() : 0;
+    return windowsWithUnloadEventListeners().count(const_cast<DOMWindow*>(this));
 }
 
 void DOMWindow::dispatchAllPendingUnloadEvents()
 {
-    DOMWindowRegisteredEventListenerMap& map = pendingUnloadEventListenerMap();
-    if (map.isEmpty())
+    DOMWindowSet& set = windowsWithBeforeUnloadEventListeners();
+    if (set.isEmpty())
         return;
 
     static bool alreadyDispatched = false;
@@ -250,19 +203,18 @@ void DOMWindow::dispatchAllPendingUnloadEvents()
         return;
 
     Vector<RefPtr<DOMWindow> > windows;
-    DOMWindowRegisteredEventListenerMap::iterator mapEnd = map.end();
-    for (DOMWindowRegisteredEventListenerMap::iterator it = map.begin(); it != mapEnd; ++it)
+    DOMWindowSet::iterator end = set.end();
+    for (DOMWindowSet::iterator it = set.begin(); it != end; ++it)
         windows.append(it->first);
 
     size_t size = windows.size();
     for (size_t i = 0; i < size; ++i) {
         DOMWindow* window = windows[i].get();
-        RegisteredEventListenerVector* listeners = map.get(window);
-        if (!listeners)
+        if (!set.contains(window))
             continue;
-        RegisteredEventListenerVector listenersCopy = *listeners;
-        window->dispatchPageTransitionEvent(EventNames().pagehideEvent, false);
-        window->dispatchUnloadEvent(&listenersCopy);
+
+        window->dispatchEvent(PageTransitionEvent::create(EventNames().pagehideEvent, false), window->document());
+        window->dispatchEvent(Event::create(eventNames().unloadEvent, false, false), window->document());
     }
 
     enableSuddenTermination();
@@ -376,8 +328,8 @@ DOMWindow::~DOMWindow()
     if (m_frame)
         m_frame->clearFormerDOMWindow(this);
 
-    removePendingEventListeners(pendingUnloadEventListenerMap(), this);
-    removePendingEventListeners(pendingBeforeUnloadEventListenerMap(), this);
+    windowsWithUnloadEventListeners().clear(this);
+    windowsWithBeforeUnloadEventListeners().clear(this);
 }
 
 ScriptExecutionContext* DOMWindow::scriptExecutionContext() const
@@ -462,6 +414,16 @@ void DOMWindow::clear()
 #endif
 }
 
+#if ENABLE(ORIENTATION_EVENTS)
+int DOMWindow::orientation() const
+{
+    if (!m_frame)
+        return 0;
+    
+    return m_frame->orientation();
+}
+#endif
+
 Screen* DOMWindow::screen() const
 {
     if (!m_screen)
@@ -682,8 +644,7 @@ void DOMWindow::postMessageTimerFired(PostMessageTimer* t)
         }
     }
 
-    ExceptionCode ec = 0;
-    dispatchEvent(timer->event(document()), ec);
+    dispatchEvent(timer->event(document()));
 }
 
 DOMSelection* DOMWindow::getSelection()
@@ -1245,104 +1206,38 @@ void DOMWindow::clearInterval(int timeoutId)
     DOMTimer::removeById(scriptExecutionContext(), timeoutId);
 }
 
-void DOMWindow::handleEvent(Event* event, bool useCapture, RegisteredEventListenerVector* alternateListeners)
+bool DOMWindow::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
-    RegisteredEventListenerVector& listeners = (alternateListeners ? *alternateListeners : m_eventListeners);
-    if (listeners.isEmpty())
-        return;
-
-    // If any HTML event listeners are registered on the window, dispatch them here.
-    RegisteredEventListenerVector listenersCopy = listeners;
-    size_t size = listenersCopy.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listenersCopy[i];
-        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
-            r.listener()->handleEvent(event, true);
-    }
-}
+    if (!EventTarget::addEventListener(eventType, listener, useCapture))
+        return false;
 
-void DOMWindow::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
-{
-    // Remove existing identical listener set with identical arguments.
-    // The DOM 2 spec says that "duplicate instances are discarded" in this case.
-    removeEventListener(eventType, listener.get(), useCapture);
     if (Document* document = this->document())
         document->addListenerTypeIfNeeded(eventType);
 
-    RefPtr<RegisteredEventListener> registeredListener = RegisteredEventListener::create(eventType, listener, useCapture);
-    m_eventListeners.append(registeredListener);
-
     if (eventType == eventNames().unloadEvent)
-        addPendingEventListener(pendingUnloadEventListenerMap(), this, registeredListener.get());
-    else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
-        addPendingEventListener(pendingBeforeUnloadEventListenerMap(), this, registeredListener.get());
-}
-
-void DOMWindow::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
-{
-    size_t size = m_eventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_eventListeners[i];
-        if (r.eventType() == eventType && r.useCapture() == useCapture && *r.listener() == *listener) {
-            if (eventType == eventNames().unloadEvent)
-                removePendingEventListener(pendingUnloadEventListenerMap(), this, &r);
-            else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
-                removePendingEventListener(pendingBeforeUnloadEventListenerMap(), this, &r);
-            r.setRemoved(true);
-            m_eventListeners.remove(i);
-            return;
-        }
-    }
-}
-
-bool DOMWindow::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
-{
-    ASSERT(!eventDispatchForbidden());
-
-    RefPtr<Event> event = e;
-    if (!event || event->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
-    }
-
-    RefPtr<DOMWindow> protect(this);
-
-    event->setTarget(this);
-    event->setCurrentTarget(this);
+        windowsWithUnloadEventListeners().add(this);
+    else if (eventType == eventNames().beforeunloadEvent && allowsBeforeUnloadListeners(this))
+        windowsWithBeforeUnloadEventListeners().add(this);
 
-    handleEvent(event.get(), true);
-    handleEvent(event.get(), false);
-
-    return !event->defaultPrevented();
-}
-
-void DOMWindow::dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable)
-{
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    dispatchEvent(Event::create(eventType, canBubble, cancelable), ec);
+    return true;
 }
 
-// This function accommodates the Firefox quirk of dispatching the load, unload and
-// beforeunload events on the window, but setting event.target to be the Document. 
-inline void DOMWindow::dispatchEventWithDocumentAsTarget(PassRefPtr<Event> e, RegisteredEventListenerVector* alternateEventListeners)
+bool DOMWindow::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    ASSERT(!eventDispatchForbidden());
-
-    RefPtr<Event> event = e;
-    RefPtr<DOMWindow> protect(this);
-    RefPtr<Document> document = this->document();
+    if (!EventTarget::removeEventListener(eventType, listener, useCapture))
+        return false;
 
-    event->setTarget(document);
-    event->setCurrentTarget(this);
+    if (eventType == eventNames().unloadEvent)
+        windowsWithUnloadEventListeners().remove(this);
+    else if (eventType == eventNames().beforeunloadEvent && allowsBeforeUnloadListeners(this))
+        windowsWithBeforeUnloadEventListeners().remove(this);
 
-    handleEvent(event.get(), true, alternateEventListeners);
-    handleEvent(event.get(), false, alternateEventListeners);
+    return true;
 }
 
 void DOMWindow::dispatchLoadEvent()
 {
-    dispatchEventWithDocumentAsTarget(Event::create(eventNames().loadEvent, false, false));
+    dispatchEvent(Event::create(eventNames().loadEvent, false, false), document());
 
     // For load events, send a separate load event to the enclosing frame only.
     // This is a DOM extension and is independent of bubbling/capturing rules of
@@ -1355,747 +1250,44 @@ void DOMWindow::dispatchLoadEvent()
     }
 }
 
-void DOMWindow::dispatchUnloadEvent(RegisteredEventListenerVector* alternateEventListeners)
+bool DOMWindow::dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget> prpTarget)
 {
-    dispatchEventWithDocumentAsTarget(Event::create(eventNames().unloadEvent, false, false), alternateEventListeners);
-}
+    RefPtr<EventTarget> protect = this;
+    RefPtr<Event> event = prpEvent;
 
-PassRefPtr<BeforeUnloadEvent> DOMWindow::dispatchBeforeUnloadEvent(RegisteredEventListenerVector* alternateEventListeners)
-{
-    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = BeforeUnloadEvent::create();
-    dispatchEventWithDocumentAsTarget(beforeUnloadEvent.get(), alternateEventListeners);
-    return beforeUnloadEvent.release();
-}
+    event->setTarget(prpTarget ? prpTarget : this);
+    event->setCurrentTarget(this);
+    event->setEventPhase(Event::AT_TARGET);
 
-void DOMWindow::dispatchPageTransitionEvent(const AtomicString& eventType, bool persisted)
-{
-    dispatchEventWithDocumentAsTarget(PageTransitionEvent::create(eventType, persisted));
+    return fireEventListeners(event.get());
 }
 
 void DOMWindow::removeAllEventListeners()
 {
-    size_t size = m_eventListeners.size();
-    for (size_t i = 0; i < size; ++i)
-        m_eventListeners[i]->setRemoved(true);
-    m_eventListeners.clear();
-
-    removePendingEventListeners(pendingUnloadEventListenerMap(), this);
-    removePendingEventListeners(pendingBeforeUnloadEventListenerMap(), this);
-}
-
-bool DOMWindow::hasEventListener(const AtomicString& eventType)
-{
-    size_t size = m_eventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (m_eventListeners[i]->eventType() == eventType)
-            return true;
-    }
-    return false;
-}
-
-void DOMWindow::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
-{
-    clearAttributeEventListener(eventType);
-    if (listener)
-        addEventListener(eventType, listener, false);
-}
-
-void DOMWindow::clearAttributeEventListener(const AtomicString& eventType)
-{
-    size_t size = m_eventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_eventListeners[i];
-        if (r.eventType() == eventType && r.listener()->isAttribute()) {
-            if (eventType == eventNames().unloadEvent)
-                removePendingEventListener(pendingUnloadEventListenerMap(), this, &r);
-            else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
-                removePendingEventListener(pendingBeforeUnloadEventListenerMap(), this, &r);
-            r.setRemoved(true);
-            m_eventListeners.remove(i);
-            return;
-        }
-    }
-}
-
-EventListener* DOMWindow::getAttributeEventListener(const AtomicString& eventType) const
-{
-    size_t size = m_eventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_eventListeners[i];
-        if (r.eventType() == eventType && r.listener()->isAttribute())
-            return r.listener();
-    }
-    return 0;
-}
-
-EventListener* DOMWindow::onabort() const
-{
-    return getAttributeEventListener(eventNames().abortEvent);
-}
-
-void DOMWindow::setOnabort(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().abortEvent, eventListener);
-}
-
-EventListener* DOMWindow::onblur() const
-{
-    return getAttributeEventListener(eventNames().blurEvent);
-}
-
-void DOMWindow::setOnblur(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().blurEvent, eventListener);
-}
-
-EventListener* DOMWindow::onchange() const
-{
-    return getAttributeEventListener(eventNames().changeEvent);
-}
-
-void DOMWindow::setOnchange(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().changeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onclick() const
-{
-    return getAttributeEventListener(eventNames().clickEvent);
-}
-
-void DOMWindow::setOnclick(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().clickEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondblclick() const
-{
-    return getAttributeEventListener(eventNames().dblclickEvent);
-}
-
-void DOMWindow::setOndblclick(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dblclickEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondrag() const
-{
-    return getAttributeEventListener(eventNames().dragEvent);
-}
-
-void DOMWindow::setOndrag(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondragend() const
-{
-    return getAttributeEventListener(eventNames().dragendEvent);
-}
-
-void DOMWindow::setOndragend(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragendEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondragenter() const
-{
-    return getAttributeEventListener(eventNames().dragenterEvent);
-}
-
-void DOMWindow::setOndragenter(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragenterEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondragleave() const
-{
-    return getAttributeEventListener(eventNames().dragleaveEvent);
-}
-
-void DOMWindow::setOndragleave(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragleaveEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondragover() const
-{
-    return getAttributeEventListener(eventNames().dragoverEvent);
-}
-
-void DOMWindow::setOndragover(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragoverEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondragstart() const
-{
-    return getAttributeEventListener(eventNames().dragstartEvent);
-}
-
-void DOMWindow::setOndragstart(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragstartEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondrop() const
-{
-    return getAttributeEventListener(eventNames().dropEvent);
-}
-
-void DOMWindow::setOndrop(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dropEvent, eventListener);
-}
-
-EventListener* DOMWindow::onerror() const
-{
-    return getAttributeEventListener(eventNames().errorEvent);
-}
-
-void DOMWindow::setOnerror(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().errorEvent, eventListener);
-}
-
-EventListener* DOMWindow::onfocus() const
-{
-    return getAttributeEventListener(eventNames().focusEvent);
-}
-
-void DOMWindow::setOnfocus(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().focusEvent, eventListener);
-}
-
-EventListener* DOMWindow::onhashchange() const
-{
-    return getAttributeEventListener(eventNames().hashchangeEvent);
-}
-
-void DOMWindow::setOnhashchange(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().hashchangeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onkeydown() const
-{
-    return getAttributeEventListener(eventNames().keydownEvent);
-}
-
-void DOMWindow::setOnkeydown(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().keydownEvent, eventListener);
-}
-
-EventListener* DOMWindow::onkeypress() const
-{
-    return getAttributeEventListener(eventNames().keypressEvent);
-}
-
-void DOMWindow::setOnkeypress(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().keypressEvent, eventListener);
-}
-
-EventListener* DOMWindow::onkeyup() const
-{
-    return getAttributeEventListener(eventNames().keyupEvent);
-}
-
-void DOMWindow::setOnkeyup(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().keyupEvent, eventListener);
-}
-
-EventListener* DOMWindow::onload() const
-{
-    return getAttributeEventListener(eventNames().loadEvent);
-}
-
-void DOMWindow::setOnload(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().loadEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmousedown() const
-{
-    return getAttributeEventListener(eventNames().mousedownEvent);
-}
-
-void DOMWindow::setOnmousedown(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mousedownEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmousemove() const
-{
-    return getAttributeEventListener(eventNames().mousemoveEvent);
-}
-
-void DOMWindow::setOnmousemove(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mousemoveEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmouseout() const
-{
-    return getAttributeEventListener(eventNames().mouseoutEvent);
-}
-
-void DOMWindow::setOnmouseout(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mouseoutEvent, eventListener);
-}
+    EventTarget::removeAllEventListeners();
 
-EventListener* DOMWindow::onmouseover() const
-{
-    return getAttributeEventListener(eventNames().mouseoverEvent);
+    windowsWithUnloadEventListeners().clear(this);
+    windowsWithBeforeUnloadEventListeners().clear(this);
 }
 
-void DOMWindow::setOnmouseover(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mouseoverEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmouseup() const
-{
-    return getAttributeEventListener(eventNames().mouseupEvent);
-}
-
-void DOMWindow::setOnmouseup(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mouseupEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmousewheel() const
-{
-    return getAttributeEventListener(eventNames().mousewheelEvent);
-}
-
-void DOMWindow::setOnmousewheel(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mousewheelEvent, eventListener);
-}
-
-EventListener* DOMWindow::onoffline() const
-{
-    return getAttributeEventListener(eventNames().offlineEvent);
-}
-
-void DOMWindow::setOnoffline(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().offlineEvent, eventListener);
-}
-
-EventListener* DOMWindow::ononline() const
-{
-    return getAttributeEventListener(eventNames().onlineEvent);
-}
-
-void DOMWindow::setOnonline(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().onlineEvent, eventListener);
-}
-
-EventListener* DOMWindow::onpagehide() const
-{
-    return getAttributeEventListener(eventNames().pagehideEvent);
-}
-
-void DOMWindow::setOnpagehide(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().pagehideEvent, eventListener);
-}
-
-EventListener* DOMWindow::onpageshow() const
-{
-    return getAttributeEventListener(eventNames().pageshowEvent);
-}
-
-void DOMWindow::setOnpageshow(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().pageshowEvent, eventListener);
-}
-
-EventListener* DOMWindow::onreset() const
-{
-    return getAttributeEventListener(eventNames().resetEvent);
-}
-
-void DOMWindow::setOnreset(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().resetEvent, eventListener);
-}
-
-EventListener* DOMWindow::onresize() const
-{
-    return getAttributeEventListener(eventNames().resizeEvent);
-}
-
-void DOMWindow::setOnresize(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().resizeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onscroll() const
-{
-    return getAttributeEventListener(eventNames().scrollEvent);
-}
-
-void DOMWindow::setOnscroll(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().scrollEvent, eventListener);
-}
-
-EventListener* DOMWindow::onsearch() const
-{
-    return getAttributeEventListener(eventNames().searchEvent);
-}
-
-void DOMWindow::setOnsearch(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().searchEvent, eventListener);
-}
-
-EventListener* DOMWindow::onselect() const
-{
-    return getAttributeEventListener(eventNames().selectEvent);
-}
-
-void DOMWindow::setOnselect(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().selectEvent, eventListener);
-}
-
-EventListener* DOMWindow::onstorage() const
-{
-    return getAttributeEventListener(eventNames().storageEvent);
-}
-
-void DOMWindow::setOnstorage(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().storageEvent, eventListener);
-}
-
-EventListener* DOMWindow::onsubmit() const
-{
-    return getAttributeEventListener(eventNames().submitEvent);
-}
-
-void DOMWindow::setOnsubmit(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().submitEvent, eventListener);
-}
-
-EventListener* DOMWindow::onunload() const
-{
-    return getAttributeEventListener(eventNames().unloadEvent);
-}
-
-void DOMWindow::setOnunload(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().unloadEvent, eventListener);
-}
-
-EventListener* DOMWindow::onbeforeunload() const
-{
-    return getAttributeEventListener(eventNames().beforeunloadEvent);
-}
-
-void DOMWindow::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
-}
-
-EventListener* DOMWindow::onwebkitanimationstart() const
-{
-    return getAttributeEventListener(eventNames().webkitAnimationStartEvent);
-}
-
-void DOMWindow::setOnwebkitanimationstart(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().webkitAnimationStartEvent, eventListener);
-}
-
-EventListener* DOMWindow::onwebkitanimationiteration() const
-{
-    return getAttributeEventListener(eventNames().webkitAnimationIterationEvent);
-}
-
-void DOMWindow::setOnwebkitanimationiteration(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().webkitAnimationIterationEvent, eventListener);
-}
-
-EventListener* DOMWindow::onwebkitanimationend() const
-{
-    return getAttributeEventListener(eventNames().webkitAnimationEndEvent);
-}
-
-void DOMWindow::setOnwebkitanimationend(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().webkitAnimationEndEvent, eventListener);
-}
-
-EventListener* DOMWindow::onwebkittransitionend() const
-{
-    return getAttributeEventListener(eventNames().webkitTransitionEndEvent);
-}
-
-void DOMWindow::setOnwebkittransitionend(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().webkitTransitionEndEvent, eventListener);
-}
-
-EventListener* DOMWindow::oncanplay() const
-{
-    return getAttributeEventListener(eventNames().canplayEvent);
-}
-
-void DOMWindow::setOncanplay(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().canplayEvent, eventListener);
-}
-
-EventListener* DOMWindow::oncanplaythrough() const
-{
-    return getAttributeEventListener(eventNames().canplaythroughEvent);
-}
-
-void DOMWindow::setOncanplaythrough(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().canplaythroughEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondurationchange() const
-{
-    return getAttributeEventListener(eventNames().durationchangeEvent);
-}
-
-void DOMWindow::setOndurationchange(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().durationchangeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onemptied() const
-{
-    return getAttributeEventListener(eventNames().emptiedEvent);
-}
-
-void DOMWindow::setOnemptied(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().emptiedEvent, eventListener);
-}
-
-EventListener* DOMWindow::onended() const
-{
-    return getAttributeEventListener(eventNames().endedEvent);
-}
-
-void DOMWindow::setOnended(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().endedEvent, eventListener);
-}
-
-EventListener* DOMWindow::onloadeddata() const
-{
-    return getAttributeEventListener(eventNames().loadeddataEvent);
-}
-
-void DOMWindow::setOnloadeddata(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().loadeddataEvent, eventListener);
-}
-
-EventListener* DOMWindow::onloadedmetadata() const
-{
-    return getAttributeEventListener(eventNames().loadedmetadataEvent);
-}
-
-void DOMWindow::setOnloadedmetadata(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().loadedmetadataEvent, eventListener);
-}
-
-EventListener* DOMWindow::onpause() const
-{
-    return getAttributeEventListener(eventNames().pauseEvent);
-}
-
-void DOMWindow::setOnpause(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().pauseEvent, eventListener);
-}
-
-EventListener* DOMWindow::onplay() const
-{
-    return getAttributeEventListener(eventNames().playEvent);
-}
-
-void DOMWindow::setOnplay(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().playEvent, eventListener);
-}
-
-EventListener* DOMWindow::onplaying() const
-{
-    return getAttributeEventListener(eventNames().playingEvent);
-}
-
-void DOMWindow::setOnplaying(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().playingEvent, eventListener);
-}
-
-EventListener* DOMWindow::onratechange() const
-{
-    return getAttributeEventListener(eventNames().ratechangeEvent);
-}
-
-void DOMWindow::setOnratechange(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().ratechangeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onseeked() const
-{
-    return getAttributeEventListener(eventNames().seekedEvent);
-}
-
-void DOMWindow::setOnseeked(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().seekedEvent, eventListener);
-}
-
-EventListener* DOMWindow::onseeking() const
-{
-    return getAttributeEventListener(eventNames().seekingEvent);
-}
-
-void DOMWindow::setOnseeking(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().seekingEvent, eventListener);
-}
-
-EventListener* DOMWindow::ontimeupdate() const
-{
-    return getAttributeEventListener(eventNames().timeupdateEvent);
-}
-
-void DOMWindow::setOntimeupdate(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().timeupdateEvent, eventListener);
-}
-
-EventListener* DOMWindow::onvolumechange() const
-{
-    return getAttributeEventListener(eventNames().volumechangeEvent);
-}
-
-void DOMWindow::setOnvolumechange(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().volumechangeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onwaiting() const
-{
-    return getAttributeEventListener(eventNames().waitingEvent);
-}
-
-void DOMWindow::setOnwaiting(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().waitingEvent, eventListener);
-}
-
-EventListener* DOMWindow::onloadstart() const
-{
-    return getAttributeEventListener(eventNames().loadstartEvent);
-}
-
-void DOMWindow::setOnloadstart(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().loadstartEvent, eventListener);
-}
-
-EventListener* DOMWindow::onprogress() const
-{
-    return getAttributeEventListener(eventNames().progressEvent);
-}
-
-void DOMWindow::setOnprogress(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().progressEvent, eventListener);
-}
-
-EventListener* DOMWindow::onstalled() const
-{
-    return getAttributeEventListener(eventNames().stalledEvent);
-}
-
-void DOMWindow::setOnstalled(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().stalledEvent, eventListener);
-}
-
-EventListener* DOMWindow::onsuspend() const
-{
-    return getAttributeEventListener(eventNames().suspendEvent);
-}
-
-void DOMWindow::setOnsuspend(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().suspendEvent, eventListener);
-}
-
-EventListener* DOMWindow::oninput() const
-{
-    return getAttributeEventListener(eventNames().inputEvent);
-}
-
-void DOMWindow::setOninput(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().inputEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmessage() const
-{
-    return getAttributeEventListener(eventNames().messageEvent);
-}
-
-void DOMWindow::setOnmessage(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().messageEvent, eventListener);
-}
-
-EventListener* DOMWindow::oncontextmenu() const
-{
-    return getAttributeEventListener(eventNames().contextmenuEvent);
-}
-
-void DOMWindow::setOncontextmenu(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().contextmenuEvent, eventListener);
-}
-
-EventListener* DOMWindow::oninvalid() const
+void DOMWindow::captureEvents()
 {
-    return getAttributeEventListener(eventNames().invalidEvent);
+    // Not implemented.
 }
 
-void DOMWindow::setOninvalid(PassRefPtr<EventListener> eventListener)
+void DOMWindow::releaseEvents()
 {
-    setAttributeEventListener(eventNames().invalidEvent, eventListener);
+    // Not implemented.
 }
 
-void DOMWindow::captureEvents()
+EventTargetData* DOMWindow::eventTargetData()
 {
-    // Not implemented.
+    return &m_eventTargetData;
 }
 
-void DOMWindow::releaseEvents()
+EventTargetData* DOMWindow::ensureEventTargetData()
 {
-    // Not implemented.
+    return &m_eventTargetData;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.h b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
index db4edda291..f2177ee8e3 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
@@ -85,6 +85,13 @@ namespace WebCore {
 
         void clear();
 
+#if ENABLE(ORIENTATION_EVENTS)
+        // This is the interface orientation in degrees. Some examples are:
+        //  0 is straight up; -90 is when the device is rotated 90 clockwise;
+        //  90 is when rotated counter clockwise.
+        int orientation() const;
+#endif
+
         void setSecurityOrigin(SecurityOrigin* securityOrigin) { m_securityOrigin = securityOrigin; }
         SecurityOrigin* securityOrigin() const { return m_securityOrigin.get(); }
 
@@ -230,159 +237,84 @@ namespace WebCore {
 
         // Events
         // EventTarget API
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+        virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+        virtual bool removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+        virtual void removeAllEventListeners();
 
-        void handleEvent(Event*, bool useCapture, RegisteredEventListenerVector* = 0);
-
-        void dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable);
+        using EventTarget::dispatchEvent;
+        bool dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget> prpTarget);
         void dispatchLoadEvent();
-        void dispatchUnloadEvent(RegisteredEventListenerVector* = 0);
-        PassRefPtr<BeforeUnloadEvent> dispatchBeforeUnloadEvent(RegisteredEventListenerVector* = 0);
-        void dispatchPageTransitionEvent(const AtomicString& eventType, bool persisted);
-
-        // Used for legacy "onEvent" property APIs.
-        void setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
-        void clearAttributeEventListener(const AtomicString& eventType);
-        EventListener* getAttributeEventListener(const AtomicString& eventType) const;
-
-        const RegisteredEventListenerVector& eventListeners() const { return m_eventListeners; }
-        bool hasEventListener(const AtomicString& eventType);
-        void removeAllEventListeners();
-
-        EventListener* onabort() const;
-        void setOnabort(PassRefPtr<EventListener>);
-        EventListener* onblur() const;
-        void setOnblur(PassRefPtr<EventListener>);
-        EventListener* onchange() const;
-        void setOnchange(PassRefPtr<EventListener>);
-        EventListener* onclick() const;
-        void setOnclick(PassRefPtr<EventListener>);
-        EventListener* ondblclick() const;
-        void setOndblclick(PassRefPtr<EventListener>);
-        EventListener* ondrag() const;
-        void setOndrag(PassRefPtr<EventListener>);
-        EventListener* ondragend() const;
-        void setOndragend(PassRefPtr<EventListener>);
-        EventListener* ondragenter() const;
-        void setOndragenter(PassRefPtr<EventListener>);
-        EventListener* ondragleave() const;
-        void setOndragleave(PassRefPtr<EventListener>);
-        EventListener* ondragover() const;
-        void setOndragover(PassRefPtr<EventListener>);
-        EventListener* ondragstart() const;
-        void setOndragstart(PassRefPtr<EventListener>);
-        EventListener* ondrop() const;
-        void setOndrop(PassRefPtr<EventListener>);
-        EventListener* onerror() const;
-        void setOnerror(PassRefPtr<EventListener>);
-        EventListener* onfocus() const;
-        void setOnfocus(PassRefPtr<EventListener>);
-        EventListener* onhashchange() const;
-        void setOnhashchange(PassRefPtr<EventListener>);
-        EventListener* onkeydown() const;
-        void setOnkeydown(PassRefPtr<EventListener>);
-        EventListener* onkeypress() const;
-        void setOnkeypress(PassRefPtr<EventListener>);
-        EventListener* onkeyup() const;
-        void setOnkeyup(PassRefPtr<EventListener>);
-        EventListener* onload() const;
-        void setOnload(PassRefPtr<EventListener>);
-        EventListener* onmousedown() const;
-        void setOnmousedown(PassRefPtr<EventListener>);
-        EventListener* onmousemove() const;
-        void setOnmousemove(PassRefPtr<EventListener>);
-        EventListener* onmouseout() const;
-        void setOnmouseout(PassRefPtr<EventListener>);
-        EventListener* onmouseover() const;
-        void setOnmouseover(PassRefPtr<EventListener>);
-        EventListener* onmouseup() const;
-        void setOnmouseup(PassRefPtr<EventListener>);
-        EventListener* onmousewheel() const;
-        void setOnmousewheel(PassRefPtr<EventListener>);
-        EventListener* onoffline() const;
-        void setOnoffline(PassRefPtr<EventListener>);
-        EventListener* ononline() const;
-        void setOnonline(PassRefPtr<EventListener>);
-        EventListener* onpagehide() const;
-        void setOnpagehide(PassRefPtr<EventListener>);
-        EventListener* onpageshow() const;
-        void setOnpageshow(PassRefPtr<EventListener>);
-        EventListener* onreset() const;
-        void setOnreset(PassRefPtr<EventListener>);
-        EventListener* onresize() const;
-        void setOnresize(PassRefPtr<EventListener>);
-        EventListener* onscroll() const;
-        void setOnscroll(PassRefPtr<EventListener>);
-        EventListener* onsearch() const;
-        void setOnsearch(PassRefPtr<EventListener>);
-        EventListener* onselect() const;
-        void setOnselect(PassRefPtr<EventListener>);
-        EventListener* onstorage() const;
-        void setOnstorage(PassRefPtr<EventListener>);
-        EventListener* onsubmit() const;
-        void setOnsubmit(PassRefPtr<EventListener>);
-        EventListener* onunload() const;
-        void setOnunload(PassRefPtr<EventListener>);
-        EventListener* onbeforeunload() const;
-        void setOnbeforeunload(PassRefPtr<EventListener>);
-        EventListener* onwebkitanimationstart() const;
-        void setOnwebkitanimationstart(PassRefPtr<EventListener>);
-        EventListener* onwebkitanimationiteration() const;
-        void setOnwebkitanimationiteration(PassRefPtr<EventListener>);
-        EventListener* onwebkitanimationend() const;
-        void setOnwebkitanimationend(PassRefPtr<EventListener>);
-        EventListener* onwebkittransitionend() const;
-        void setOnwebkittransitionend(PassRefPtr<EventListener>);
-        EventListener* oncanplay() const;
-        void setOncanplay(PassRefPtr<EventListener>);
-        EventListener* oncanplaythrough() const;
-        void setOncanplaythrough(PassRefPtr<EventListener>);
-        EventListener* ondurationchange() const;
-        void setOndurationchange(PassRefPtr<EventListener>);
-        EventListener* onemptied() const;
-        void setOnemptied(PassRefPtr<EventListener>);
-        EventListener* onended() const;
-        void setOnended(PassRefPtr<EventListener>);
-        EventListener* onloadeddata() const;
-        void setOnloadeddata(PassRefPtr<EventListener>);
-        EventListener* onloadedmetadata() const;
-        void setOnloadedmetadata(PassRefPtr<EventListener>);
-        EventListener* onpause() const;
-        void setOnpause(PassRefPtr<EventListener>);
-        EventListener* onplay() const;
-        void setOnplay(PassRefPtr<EventListener>);
-        EventListener* onplaying() const;
-        void setOnplaying(PassRefPtr<EventListener>);
-        EventListener* onratechange() const;
-        void setOnratechange(PassRefPtr<EventListener>);
-        EventListener* onseeked() const;
-        void setOnseeked(PassRefPtr<EventListener>);
-        EventListener* onseeking() const;
-        void setOnseeking(PassRefPtr<EventListener>);
-        EventListener* ontimeupdate() const;
-        void setOntimeupdate(PassRefPtr<EventListener>);
-        EventListener* onvolumechange() const;
-        void setOnvolumechange(PassRefPtr<EventListener>);
-        EventListener* onwaiting() const;
-        void setOnwaiting(PassRefPtr<EventListener>);
-        EventListener* onloadstart() const;
-        void setOnloadstart(PassRefPtr<EventListener>);
-        EventListener* onprogress() const;
-        void setOnprogress(PassRefPtr<EventListener>);
-        EventListener* onstalled() const;
-        void setOnstalled(PassRefPtr<EventListener>);
-        EventListener* onsuspend() const;
-        void setOnsuspend(PassRefPtr<EventListener>);
-        EventListener* oninput() const;
-        void setOninput(PassRefPtr<EventListener>);
-        EventListener* onmessage() const;
-        void setOnmessage(PassRefPtr<EventListener>);
-        EventListener* oncontextmenu() const;
-        void setOncontextmenu(PassRefPtr<EventListener>);
-        EventListener* oninvalid() const;
-        void setOninvalid(PassRefPtr<EventListener>);
+
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(blur);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(change);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(click);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dblclick);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(drag);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dragend);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dragenter);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dragleave);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dragover);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dragstart);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(drop);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(focus);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(hashchange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(keydown);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(keypress);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(keyup);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(load);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mousedown);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mousemove);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseout);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseover);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseup);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mousewheel);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(offline);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(online);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(pagehide);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(pageshow);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(resize);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(scroll);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(select);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(storage);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(submit);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(unload);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(beforeunload);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplay);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplaythrough);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(durationchange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(emptied);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(ended);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadeddata);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadedmetadata);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(pause);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(play);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(playing);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(ratechange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeked);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeking);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(timeupdate);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(volumechange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(waiting);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(stalled);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(suspend);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
+#if ENABLE(ORIENTATION_EVENTS)
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(orientationchange);
+#endif
+
+        DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkitanimationstart, webkitAnimationStart);
+        DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkitanimationiteration, webkitAnimationIteration);
+        DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkitanimationend, webkitAnimationEnd);
+        DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkittransitionend, webkitTransitionEnd);
 
         void captureEvents();
         void releaseEvents();
@@ -417,8 +349,8 @@ namespace WebCore {
 
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
-
-        void dispatchEventWithDocumentAsTarget(PassRefPtr<Event>, RegisteredEventListenerVector* = 0);
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
 
         RefPtr<SecurityOrigin> m_securityOrigin;
         KURL m_url;
@@ -447,7 +379,7 @@ namespace WebCore {
         mutable RefPtr<NotificationCenter> m_notifications;
 #endif
 
-        RegisteredEventListenerVector m_eventListeners;
+        EventTargetData m_eventTargetData;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
index dcd83d9f9f..f36175efbe 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
@@ -39,6 +39,7 @@ module window {
         CustomNativeConverter,
         CustomPutFunction,
         ExtendsDOMGlobalObject,
+        EventTarget,
         GenerateNativeConverter,
         LegacyParent=JSDOMWindowBase
     ] DOMWindow {
@@ -170,6 +171,13 @@ module window {
         readonly attribute NotificationCenter webkitNotifications;
 #endif
 
+#if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
+        // This is the interface orientation in degrees. Some examples are:
+        //  0 is straight up; -90 is when the device is rotated 90 clockwise;
+        //  90 is when rotated counter clockwise.
+        readonly attribute long orientation;
+#endif
+
                  attribute [Replaceable] Console console;
 
         // cross-document messaging
@@ -265,7 +273,6 @@ module window {
         // attribute EventListener onbeforeprint;
         // attribute EventListener onformchange;
         // attribute EventListener onforminput;
-        // attribute EventListener onhashchange;
         // attribute EventListener onpopstate;
         // attribute EventListener onreadystatechange;
         // attribute EventListener onredo;
@@ -279,6 +286,9 @@ module window {
         attribute EventListener onwebkitanimationiteration;
         attribute EventListener onwebkitanimationstart;
         attribute EventListener onwebkittransitionend;
+#if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
+        attribute EventListener onorientationchange;
+#endif
 
         // EventTarget interface
         [Custom] void addEventListener(in DOMString type,
diff --git a/src/3rdparty/webkit/WebCore/page/DragController.cpp b/src/3rdparty/webkit/WebCore/page/DragController.cpp
index 676c6d9624..ab3a6534bb 100644
--- a/src/3rdparty/webkit/WebCore/page/DragController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DragController.cpp
@@ -47,6 +47,7 @@
 #include "HTMLAnchorElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "HitTestRequest.h"
 #include "HitTestResult.h"
 #include "Image.h"
 #include "MoveSelectionCommand.h"
@@ -54,6 +55,7 @@
 #include "Page.h"
 #include "RenderFileUploadControl.h"
 #include "RenderImage.h"
+#include "RenderView.h"
 #include "ReplaceSelectionCommand.h"
 #include "ResourceRequest.h"
 #include "SelectionController.h"
@@ -254,6 +256,25 @@ static HTMLInputElement* asFileInput(Node* node)
     return 0;
 }
 
+static Element* elementUnderMouse(Document* documentUnderMouse, const IntPoint& p)
+{
+    float zoomFactor = documentUnderMouse->frame()->pageZoomFactor();
+    IntPoint point = roundedIntPoint(FloatPoint(p.x() * zoomFactor, p.y() * zoomFactor));
+
+    HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+    HitTestResult result(point);
+    documentUnderMouse->renderView()->layer()->hitTest(request, result);
+
+    Node* n = result.innerNode();
+    while (n && !n->isElementNode())
+        n = n->parentNode();
+    if (n)
+        n = n->shadowAncestorNode();
+
+    ASSERT(n);
+    return static_cast<Element*>(n);
+}
+
 bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction actionMask, DragOperation& operation)
 {
     ASSERT(dragData);
@@ -288,10 +309,8 @@ bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction a
             return true;
         }
 
-        IntPoint dragPos = dragData->clientPosition();
-        IntPoint point = frameView->windowToContents(dragPos);
-        Element* element = m_documentUnderMouse->elementFromPoint(point.x(), point.y());
-        ASSERT(element);
+        IntPoint point = frameView->windowToContents(dragData->clientPosition());
+        Element* element = elementUnderMouse(m_documentUnderMouse, point);
         if (!asFileInput(element)) {
             VisibleSelection dragCaret = m_documentUnderMouse->frame()->visiblePositionForPoint(point);
             m_page->dragCaretController()->setSelection(dragCaret);
@@ -341,8 +360,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
         return false;
 
     IntPoint point = m_documentUnderMouse->view()->windowToContents(dragData->clientPosition());
-    Element* element =  m_documentUnderMouse->elementFromPoint(point.x(), point.y());
-    ASSERT(element);
+    Element* element = elementUnderMouse(m_documentUnderMouse, point);
     Frame* innerFrame = element->ownerDocument()->frame();
     ASSERT(innerFrame);
 
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
index abe40c777f..8d519efb8f 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
@@ -101,7 +101,7 @@ const double autoscrollInterval = 0.05;
 
 static Frame* subframeForHitTestResult(const MouseEventWithHitTestResults&);
 
-static inline void scrollAndAcceptEvent(float delta, ScrollDirection positiveDirection, ScrollDirection negativeDirection, PlatformWheelEvent& e, Node* node)
+static inline void scrollAndAcceptEvent(float delta, ScrollDirection positiveDirection, ScrollDirection negativeDirection, PlatformWheelEvent& e, Node* node, Node** stopNode)
 {
     if (!delta)
         return;
@@ -110,12 +110,13 @@ static inline void scrollAndAcceptEvent(float delta, ScrollDirection positiveDir
     RenderBox* enclosingBox = node->renderer()->enclosingBox();
 
     if (e.granularity() == ScrollByPageWheelEvent) {
-        if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPage, 1))
+        if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPage, 1, stopNode))
             e.accept();
         return;
-    } 
+    }
+
     float pixelsToScroll = delta > 0 ? delta : -delta;
-    if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPixel, pixelsToScroll))
+    if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPixel, pixelsToScroll, stopNode))
         e.accept();
 }
 
@@ -205,6 +206,7 @@ void EventHandler::clear()
     m_capturesDragging = false;
     m_capturingMouseEventsNode = 0;
     m_latchedWheelEventNode = 0;
+    m_previousWheelScrolledNode = 0;
 }
 
 void EventHandler::selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults& result)
@@ -1774,7 +1776,7 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
     Node* node;
     bool isOverWidget;
     bool didSetLatchedNode = false;
-    
+
     if (m_useLatchedWheelEventNode) {
         if (!m_latchedWheelEventNode) {
             HitTestRequest request(HitTestRequest::ReadOnly);
@@ -1784,20 +1786,22 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
             m_widgetIsLatched = result.isOverWidget();
             didSetLatchedNode = true;
         }
-        
+
         node = m_latchedWheelEventNode.get();
         isOverWidget = m_widgetIsLatched;
     } else {
         if (m_latchedWheelEventNode)
             m_latchedWheelEventNode = 0;
-        
+        if (m_previousWheelScrolledNode)
+            m_previousWheelScrolledNode = 0;
+
         HitTestRequest request(HitTestRequest::ReadOnly);
         HitTestResult result(vPoint);
         doc->renderView()->layer()->hitTest(request, result);
         node = result.innerNode();
         isOverWidget = result.isOverWidget();
     }
-    
+
     if (node) {
         // Figure out which view to send the event to.
         RenderObject* target = node->renderer();
@@ -1814,17 +1818,20 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
         node->dispatchWheelEvent(e);
         if (e.isAccepted())
             return true;
-        
+
         // If we don't have a renderer, send the wheel event to the first node we find with a renderer.
         // This is needed for <option> and <optgroup> elements so that <select>s get a wheel scroll.
         while (node && !node->renderer())
             node = node->parent();
-        
+
         if (node && node->renderer()) {
             // Just break up into two scrolls if we need to.  Diagonal movement on 
             // a MacBook pro is an example of a 2-dimensional mouse wheel event (where both deltaX and deltaY can be set).
-            scrollAndAcceptEvent(e.deltaX(), ScrollLeft, ScrollRight, e, node);
-            scrollAndAcceptEvent(e.deltaY(), ScrollUp, ScrollDown, e, node);
+            Node* stopNode = m_previousWheelScrolledNode.get();
+            scrollAndAcceptEvent(e.deltaX(), ScrollLeft, ScrollRight, e, node, &stopNode);
+            scrollAndAcceptEvent(e.deltaY(), ScrollUp, ScrollDown, e, node, &stopNode);
+            if (!m_useLatchedWheelEventNode)
+                m_previousWheelScrolledNode = stopNode;
         }
     }
 
@@ -1890,7 +1897,7 @@ bool EventHandler::canMouseDownStartSelect(Node* node)
             
     for (RenderObject* curr = node->renderer(); curr; curr = curr->parent()) {
         if (Node* node = curr->node())
-            return node->dispatchEvent(eventNames().selectstartEvent, true, true);
+            return node->dispatchEvent(Event::create(eventNames().selectstartEvent, true, true));
     }
 
     return true;
@@ -1904,7 +1911,7 @@ bool EventHandler::canMouseDragExtendSelect(Node* node)
             
     for (RenderObject* curr = node->renderer(); curr; curr = curr->parent()) {
         if (Node* node = curr->node())
-            return node->dispatchEvent(eventNames().selectstartEvent, true, true);
+            return node->dispatchEvent(Event::create(eventNames().selectstartEvent, true, true));
     }
 
     return true;
@@ -2459,7 +2466,7 @@ void EventHandler::capsLockStateMayHaveChanged()
 
 void EventHandler::sendResizeEvent()
 {
-    m_frame->document()->dispatchWindowEvent(eventNames().resizeEvent, false, false);
+    m_frame->document()->dispatchWindowEvent(Event::create(eventNames().resizeEvent, false, false));
 }
 
 void EventHandler::sendScrollEvent()
@@ -2468,7 +2475,7 @@ void EventHandler::sendScrollEvent()
     if (!v)
         return;
     v->setWasScrolledByUser(true);
-    m_frame->document()->dispatchEvent(eventNames().scrollEvent, true, false);
+    m_frame->document()->dispatchEvent(Event::create(eventNames().scrollEvent, true, false));
 }
 
 bool EventHandler::passMousePressEventToScrollbar(MouseEventWithHitTestResults& mev, Scrollbar* scrollbar)
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.h b/src/3rdparty/webkit/WebCore/page/EventHandler.h
index b390457388..706625289d 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.h
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.h
@@ -378,7 +378,9 @@ private:
     bool m_useLatchedWheelEventNode;
     RefPtr<Node> m_latchedWheelEventNode;
     bool m_widgetIsLatched;
-    
+
+    RefPtr<Node> m_previousWheelScrolledNode;
+
 #if PLATFORM(MAC)
     NSView *m_mouseDownView;
     bool m_sendingEventToSubview;
diff --git a/src/3rdparty/webkit/WebCore/page/EventSource.cpp b/src/3rdparty/webkit/WebCore/page/EventSource.cpp
index afec20f9d7..ae3c0c326e 100644
--- a/src/3rdparty/webkit/WebCore/page/EventSource.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventSource.cpp
@@ -108,7 +108,7 @@ void EventSource::endRequest()
     m_requestInFlight = false;
 
     if (!m_failSilently)
-        dispatchGenericEvent(eventNames().errorEvent);
+        dispatchEvent(Event::create(eventNames().errorEvent, false, false));
 
     if (!scriptExecutionContext()->isWorkerContext())
         cache()->loader()->nonCacheRequestComplete(m_url);
@@ -162,70 +162,12 @@ ScriptExecutionContext* EventSource::scriptExecutionContext() const
     return ActiveDOMObject::scriptExecutionContext();
 }
 
-void EventSource::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end()) {
-        ListenerVector listeners;
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    } else {
-        ListenerVector& listeners = iter->second;
-        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (**listenerIter == *eventListener)
-                return;
-        }
-
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    }
-}
-
-void EventSource::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end())
-        return;
-
-    ListenerVector& listeners = iter->second;
-    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (**listenerIter == *eventListener) {
-            listeners.remove(listenerIter - listeners.begin());
-            return;
-        }
-    }
-}
-
-bool EventSource::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
-{
-    if (!event || event->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
-    }
-
-    EventListener* attributeListener = m_attributeListeners.get(event->type()).get();
-    if (attributeListener) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        attributeListener->handleEvent(event.get(), false);
-    }
-
-    ListenerVector listenersCopy = m_eventListeners.get(event->type());
-    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        listenerIter->get()->handleEvent(event.get(), false);
-    }
-
-    return !event->defaultPrevented();
-}
-
 void EventSource::didReceiveResponse(const ResourceResponse& response)
 {
     int statusCode = response.httpStatusCode();
     if (statusCode == 200 && response.httpHeaderField("Content-Type") == "text/event-stream") {
         m_state = OPEN;
-        dispatchGenericEvent(eventNames().openEvent);
+        dispatchEvent(Event::create(eventNames().openEvent, false, false));
     } else {
         if (statusCode <= 200 || statusCode > 299)
             m_state = CLOSED;
@@ -304,7 +246,7 @@ void EventSource::parseEventStreamLine(unsigned int bufPos, int fieldLength, int
 {
     if (!lineLength) {
         if (!m_data.isEmpty())
-            dispatchMessageEvent();
+            dispatchEvent(createMessageEvent());
         if (!m_eventName.isEmpty())
             m_eventName = "";
     } else if (fieldLength) {
@@ -344,27 +286,26 @@ void EventSource::parseEventStreamLine(unsigned int bufPos, int fieldLength, int
     }
 }
 
-void EventSource::dispatchGenericEvent(const AtomicString& type)
+void EventSource::stop()
 {
-    RefPtr<Event> evt = Event::create(type, false, false);
-    ExceptionCode ec = 0;
-    dispatchEvent(evt.release(), ec);
-    ASSERT(!ec);
+    close();
 }
 
-void EventSource::dispatchMessageEvent()
+PassRefPtr<MessageEvent> EventSource::createMessageEvent()
 {
-    RefPtr<MessageEvent> evt = MessageEvent::create();
-    String eventName = m_eventName.isEmpty() ? eventNames().messageEvent.string() : m_eventName;
-    evt->initMessageEvent(eventName, false, false, String::adopt(m_data), m_origin, m_lastEventId, 0, 0);
-    ExceptionCode ec = 0;
-    dispatchEvent(evt.release(), ec);
-    ASSERT(!ec);
+    RefPtr<MessageEvent> event = MessageEvent::create();
+    event->initMessageEvent(m_eventName.isEmpty() ? eventNames().messageEvent : AtomicString(m_eventName), false, false, String::adopt(m_data), m_origin, m_lastEventId, 0, 0);
+    return event.release();
 }
 
-void EventSource::stop()
+EventTargetData* EventSource::eventTargetData()
 {
-    close();
+    return &m_eventTargetData;
+}
+
+EventTargetData* EventSource::ensureEventTargetData()
+{
+    return &m_eventTargetData;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/EventSource.h b/src/3rdparty/webkit/WebCore/page/EventSource.h
index df55694e16..5b037a4cb0 100644
--- a/src/3rdparty/webkit/WebCore/page/EventSource.h
+++ b/src/3rdparty/webkit/WebCore/page/EventSource.h
@@ -50,6 +50,7 @@
 
 namespace WebCore {
 
+    class MessageEvent;
     class ResourceResponse;
     class TextResourceDecoder;
     class ThreadableLoader;
@@ -71,14 +72,9 @@ namespace WebCore {
 
         State readyState() const;
 
-        void setOnopen(PassRefPtr<EventListener> eventListener) { m_attributeListeners.set(eventNames().openEvent, eventListener); }
-        EventListener* onopen() const { return m_attributeListeners.get(eventNames().openEvent).get(); }
-
-        void setOnmessage(PassRefPtr<EventListener> eventListener) { m_attributeListeners.set(eventNames().messageEvent, eventListener); }
-        EventListener* onmessage() const { return m_attributeListeners.get(eventNames().messageEvent).get(); }
-
-        void setOnerror(PassRefPtr<EventListener> eventListener) { m_attributeListeners.set(eventNames().errorEvent, eventListener); }
-        EventListener* onerror() const { return m_attributeListeners.get(eventNames().errorEvent).get(); }
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(open);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
 
         void close();
 
@@ -88,14 +84,6 @@ namespace WebCore {
         virtual EventSource* toEventSource() { return this; }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-        typedef Vector<RefPtr<EventListener> > ListenerVector;
-        typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
-
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-        EventListenersMap& eventListeners() { return m_eventListeners; }
-
         virtual void stop();
 
     private:
@@ -103,6 +91,8 @@ namespace WebCore {
 
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
 
         virtual void didReceiveResponse(const ResourceResponse& response);
         virtual void didReceiveData(const char* data, int length);
@@ -116,15 +106,11 @@ namespace WebCore {
         void reconnectTimerFired(Timer<EventSource>*);
         void parseEventStream();
         void parseEventStreamLine(unsigned int pos, int fieldLength, int lineLength);
-        void dispatchGenericEvent(const AtomicString& type);
-        void dispatchMessageEvent();
+        PassRefPtr<MessageEvent> createMessageEvent();
 
         KURL m_url;
         State m_state;
 
-        HashMap<AtomicString, RefPtr<EventListener> > m_attributeListeners;
-        EventListenersMap m_eventListeners;
-
         RefPtr<TextResourceDecoder> m_decoder;
         RefPtr<ThreadableLoader> m_loader;
         Timer<EventSource> m_reconnectTimer;
@@ -137,6 +123,8 @@ namespace WebCore {
         String m_lastEventId;
         unsigned long long m_reconnectDelay;
         String m_origin;
+        
+        EventTargetData m_eventTargetData;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/EventSource.idl b/src/3rdparty/webkit/WebCore/page/EventSource.idl
index c438e68205..561bd68f94 100644
--- a/src/3rdparty/webkit/WebCore/page/EventSource.idl
+++ b/src/3rdparty/webkit/WebCore/page/EventSource.idl
@@ -33,7 +33,7 @@ module window {
 
     interface [
         Conditional=EVENTSOURCE,
-        CustomMarkFunction,
+        EventTarget,
         NoStaticTables
     ] EventSource {
 
diff --git a/src/3rdparty/webkit/WebCore/page/FocusController.cpp b/src/3rdparty/webkit/WebCore/page/FocusController.cpp
index bc9e47746a..5e78c7d9b8 100644
--- a/src/3rdparty/webkit/WebCore/page/FocusController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FocusController.cpp
@@ -36,6 +36,7 @@
 #include "Event.h"
 #include "EventHandler.h"
 #include "EventNames.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameView.h"
 #include "FrameTree.h"
@@ -62,7 +63,7 @@ static inline void dispatchEventsOnWindowAndFocusedNode(Document* document, bool
     // https://bugs.webkit.org/show_bug.cgi?id=27105
     if (!focused && document->focusedNode())
         document->focusedNode()->dispatchBlurEvent();
-    document->dispatchWindowEvent(focused ? eventNames().focusEvent : eventNames().blurEvent, false, false);
+    document->dispatchWindowEvent(Event::create(focused ? eventNames().focusEvent : eventNames().blurEvent, false, false));
     if (focused && document->focusedNode())
         document->focusedNode()->dispatchFocusEvent();
 }
@@ -87,12 +88,12 @@ void FocusController::setFocusedFrame(PassRefPtr<Frame> frame)
     // Now that the frame is updated, fire events and update the selection focused states of both frames.
     if (oldFrame && oldFrame->view()) {
         oldFrame->selection()->setFocused(false);
-        oldFrame->document()->dispatchWindowEvent(eventNames().blurEvent, false, false);
+        oldFrame->document()->dispatchWindowEvent(Event::create(eventNames().blurEvent, false, false));
     }
 
     if (newFrame && newFrame->view() && isFocused()) {
         newFrame->selection()->setFocused(true);
-        newFrame->document()->dispatchWindowEvent(eventNames().focusEvent, false, false);
+        newFrame->document()->dispatchWindowEvent(Event::create(eventNames().focusEvent, false, false));
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/page/Frame.cpp b/src/3rdparty/webkit/WebCore/page/Frame.cpp
index 7a3ed27b63..28e6a9e4d8 100644
--- a/src/3rdparty/webkit/WebCore/page/Frame.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Frame.cpp
@@ -97,6 +97,10 @@
 #include "WMLNames.h"
 #endif
 
+#if ENABLE(MATHML)
+#include "MathMLNames.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -127,6 +131,9 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
     , m_eventHandler(this)
     , m_animationController(this)
     , m_lifeSupportTimer(this, &Frame::lifeSupportTimerFired)
+#if ENABLE(ORIENTATION_EVENTS)
+    , m_orientation(0)
+#endif
     , m_caretVisible(false)
     , m_caretPaint(true)
     , m_highlightTextMatches(false)
@@ -152,6 +159,10 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
     WMLNames::init();
 #endif
 
+#if ENABLE(MATHML)
+    MathMLNames::init();
+#endif
+
     XMLNames::init();
 
     if (!ownerElement)
@@ -268,6 +279,15 @@ void Frame::setDocument(PassRefPtr<Document> newDoc)
     m_script.updateDocument();
 }
 
+#if ENABLE(ORIENTATION_EVENTS)
+void Frame::sendOrientationChangeEvent(int orientation)
+{
+    m_orientation = orientation;
+    if (Document* doc = document())
+        doc->dispatchWindowEvent(eventNames().orientationchangeEvent, false, false);
+}
+#endif // ENABLE(ORIENTATION_EVENTS)
+    
 Settings* Frame::settings() const
 {
     return m_page ? m_page->settings() : 0;
@@ -1645,7 +1665,7 @@ void Frame::unfocusWindow()
         page()->chrome()->unfocus();
 }
 
-bool Frame::shouldClose(RegisteredEventListenerVector* alternateEventListeners)
+bool Frame::shouldClose()
 {
     Chrome* chrome = page() ? page()->chrome() : 0;
     if (!chrome || !chrome->canRunBeforeUnloadConfirmPanel())
@@ -1659,7 +1679,8 @@ bool Frame::shouldClose(RegisteredEventListenerVector* alternateEventListeners)
     if (!body)
         return true;
 
-    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = m_domWindow->dispatchBeforeUnloadEvent(alternateEventListeners);
+    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = BeforeUnloadEvent::create();
+    m_domWindow->dispatchEvent(beforeUnloadEvent.get(), m_domWindow->document());
 
     if (!beforeUnloadEvent->defaultPrevented())
         doc->defaultEventHandler(beforeUnloadEvent.get());
diff --git a/src/3rdparty/webkit/WebCore/page/Frame.h b/src/3rdparty/webkit/WebCore/page/Frame.h
index ef803f114c..b98dbc4742 100644
--- a/src/3rdparty/webkit/WebCore/page/Frame.h
+++ b/src/3rdparty/webkit/WebCore/page/Frame.h
@@ -153,6 +153,14 @@ namespace WebCore {
 
         void setDocument(PassRefPtr<Document>);
 
+#if ENABLE(ORIENTATION_EVENTS)
+        // Orientation is the interface orientation in degrees. Some examples are:
+        //  0 is straight up; -90 is when the device is rotated 90 clockwise;
+        //  90 is when rotated counter clockwise.
+        void sendOrientationChangeEvent(int orientation);
+        int orientation() const { return m_orientation; }
+#endif
+
         void clearTimers();
         static void clearTimers(FrameView*, Document*);
 
@@ -190,7 +198,7 @@ namespace WebCore {
     public:
         void focusWindow();
         void unfocusWindow();
-        bool shouldClose(RegisteredEventListenerVector* alternateEventListeners = 0);
+        bool shouldClose();
         void scheduleClose();
 
         void setJSStatusBarText(const String&);
@@ -354,6 +362,10 @@ namespace WebCore {
 
         Timer<Frame> m_lifeSupportTimer;
 
+#if ENABLE(ORIENTATION_EVENTS)
+        int m_orientation;
+#endif
+        
         bool m_caretVisible;
         bool m_caretPaint;
 
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.cpp b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
index b3580182a5..675cba1a33 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
@@ -803,6 +803,22 @@ void FrameView::setScrollPosition(const IntPoint& scrollPoint)
     m_inProgrammaticScroll = wasInProgrammaticScroll;
 }
 
+void FrameView::scrollPositionChanged()
+{
+    frame()->eventHandler()->sendScrollEvent();
+
+#if USE(ACCELERATED_COMPOSITING)
+    // We need to update layer positions after scrolling to account for position:fixed layers.
+    Document* document = m_frame->document();
+    if (!document)
+        return;
+
+    RenderLayer* layer = document->renderer() ? document->renderer()->enclosingLayer() : 0;
+    if (layer)
+        layer->updateLayerPositions(RenderLayer::UpdateCompositingLayers);
+#endif
+}
+
 HostWindow* FrameView::hostWindow() const
 {
     Page* page = frame() ? frame()->page() : 0;
@@ -971,7 +987,8 @@ void FrameView::layoutTimerFired(Timer<FrameView>*)
 
 void FrameView::scheduleRelayout()
 {
-    ASSERT(!m_frame->document()->inPageCache());
+    // FIXME: We should assert the page is not in the page cache, but that is causing
+    // too many false assertions.  See <rdar://problem/7218118>.
     ASSERT(m_frame->view() == this);
 
     if (m_layoutRoot) {
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.h b/src/3rdparty/webkit/WebCore/page/FrameView.h
index 617a8e9f94..4c900ae3fa 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.h
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.h
@@ -131,6 +131,7 @@ public:
 
     virtual void scrollRectIntoViewRecursively(const IntRect&);
     virtual void setScrollPosition(const IntPoint&);
+    void scrollPositionChanged();
 
     String mediaType() const;
     void setMediaType(const String&);
diff --git a/src/3rdparty/webkit/WebCore/page/Page.cpp b/src/3rdparty/webkit/WebCore/page/Page.cpp
index f6f6a81da6..182d22c133 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Page.cpp
@@ -29,8 +29,10 @@
 #include "ContextMenuController.h"
 #include "DOMWindow.h"
 #include "DragController.h"
+#include "ExceptionCode.h"
 #include "EditorClient.h"
 #include "EventNames.h"
+#include "Event.h"
 #include "FileSystem.h"
 #include "FocusController.h"
 #include "Frame.h"
@@ -94,7 +96,7 @@ static void networkStateChanged()
 
     AtomicString eventName = networkStateNotifier().onLine() ? eventNames().onlineEvent : eventNames().offlineEvent;
     for (unsigned i = 0; i < frames.size(); i++)
-        frames[i]->document()->dispatchWindowEvent(eventName, false, false);
+        frames[i]->document()->dispatchWindowEvent(Event::create(eventName, false, false));
 }
 
 Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, EditorClient* editorClient, DragClient* dragClient, InspectorClient* inspectorClient)
diff --git a/src/3rdparty/webkit/WebCore/page/PageGroupLoadDeferrer.cpp b/src/3rdparty/webkit/WebCore/page/PageGroupLoadDeferrer.cpp
index f274de3e88..122658b50f 100644
--- a/src/3rdparty/webkit/WebCore/page/PageGroupLoadDeferrer.cpp
+++ b/src/3rdparty/webkit/WebCore/page/PageGroupLoadDeferrer.cpp
@@ -41,10 +41,10 @@ PageGroupLoadDeferrer::PageGroupLoadDeferrer(Page* page, bool deferSelf)
             if (!otherPage->defersLoading())
                 m_deferredFrames.append(otherPage->mainFrame());
 
-#if !PLATFORM(MAC)
+            // This code is not logically part of load deferring, but we do not want JS code executed beneath modal
+            // windows or sheets, which is exactly when PageGroupLoadDeferrer is used.
             for (Frame* frame = otherPage->mainFrame(); frame; frame = frame->tree()->traverseNext())
                 frame->document()->suspendActiveDOMObjects();
-#endif
         }
     }
 
@@ -60,10 +60,8 @@ PageGroupLoadDeferrer::~PageGroupLoadDeferrer()
         if (Page* page = m_deferredFrames[i]->page()) {
             page->setDefersLoading(false);
 
-#if !PLATFORM(MAC)
             for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
                 frame->document()->resumeActiveDOMObjects();
-#endif
         }
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/page/PositionOptions.h b/src/3rdparty/webkit/WebCore/page/PositionOptions.h
index ed7074bdfe..5cb66f735f 100644
--- a/src/3rdparty/webkit/WebCore/page/PositionOptions.h
+++ b/src/3rdparty/webkit/WebCore/page/PositionOptions.h
@@ -49,10 +49,17 @@ public:
         m_hasTimeout = true;
         m_timeout = timeout;
     }
-    int maximumAge() const { return m_maximumAge; }
+    bool hasMaximumAge() const { return m_hasMaximumAge; }
+    int maximumAge() const
+    {
+        ASSERT(hasMaximumAge());
+        return m_maximumAge;
+    }
+    void clearMaximumAge() { m_hasMaximumAge = false; }
     void setMaximumAge(int age)
     {
         ASSERT(age >= 0);
+        m_hasMaximumAge = true;
         m_maximumAge = age;
     }
     
@@ -60,13 +67,14 @@ private:
     PositionOptions()
         : m_highAccuracy(false)
         , m_hasTimeout(false)
-        , m_maximumAge(0)
     {
+        setMaximumAge(0);
     }
     
     bool m_highAccuracy;
     bool m_hasTimeout;
     int m_timeout;
+    bool m_hasMaximumAge;
     int m_maximumAge;
 };
     
diff --git a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
index 5076adf411..b91c1f1976 100644
--- a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
@@ -221,6 +221,22 @@ bool SecurityOrigin::canRequest(const KURL& url) const
     return false;
 }
 
+bool SecurityOrigin::taintsCanvas(const KURL& url) const
+{
+    if (canRequest(url))
+        return false;
+
+    // This method exists because we treat data URLs as noAccess, contrary
+    // to the current (9/19/2009) draft of the HTML5 specification.  We still
+    // want to let folks paint data URLs onto untainted canvases, so we special
+    // case data URLs below.  If we change to match HTML5 w.r.t. data URL
+    // security, then we can remove this method in favor of !canRequest.
+    if (url.protocolIs("data"))
+        return false;
+
+    return true;
+}
+
 void SecurityOrigin::grantLoadLocalResources()
 {
     // This method exists only to support backwards compatibility with older
diff --git a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
index c8086ac872..732afa8f78 100644
--- a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
+++ b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
@@ -76,6 +76,11 @@ namespace WebCore {
         // XMLHttpRequests.
         bool canRequest(const KURL&) const;
 
+        // Returns true if drawing an image from this URL taints a canvas from
+        // this security origin.  For example, call this function before
+        // drawing an image onto an HTML canvas element with the drawImage API.
+        bool taintsCanvas(const KURL&) const;
+
         // Returns true if this SecurityOrigin can load local resources, such
         // as images, iframes, and style sheets, and can link to local URLs.
         // For example, call this function before creating an iframe to a
diff --git a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
index df627d341c..4fcc53cdab 100644
--- a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
+++ b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
@@ -48,12 +48,14 @@ namespace WebCore {
 
 static bool isNonCanonicalCharacter(UChar c)
 {
+    // We remove all non-ASCII characters, including non-printable ASCII characters.
+    //
     // Note, we don't remove backslashes like PHP stripslashes(), which among other things converts "\\0" to the \0 character.
     // Instead, we remove backslashes and zeros (since the string "\\0" =(remove backslashes)=> "0"). However, this has the 
     // adverse effect that we remove any legitimate zeros from a string.
     //
     // For instance: new String("http://localhost:8000") => new String("http://localhost:8").
-    return (c == '\\' || c == '0' || c < ' ' || c == 127);
+    return (c == '\\' || c == '0' || c < ' ' || c >= 127);
 }
 
 String XSSAuditor::CachingURLCanonicalizer::canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities)
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
index 1d2ebe29c0..691932e4c3 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
@@ -36,6 +36,8 @@
 #include "EventNames.h"
 #include "Frame.h"
 #include "RenderView.h"
+#include "WebKitAnimationEvent.h"
+#include "WebKitTransitionEvent.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/UnusedParam.h>
 
@@ -136,9 +138,9 @@ void AnimationControllerPrivate::updateStyleIfNeededDispatcherFired(Timer<Animat
     Vector<EventToDispatch>::const_iterator eventsToDispatchEnd = m_eventsToDispatch.end();
     for (Vector<EventToDispatch>::const_iterator it = m_eventsToDispatch.begin(); it != eventsToDispatchEnd; ++it) {
         if (it->eventType == eventNames().webkitTransitionEndEvent)
-            it->element->dispatchWebKitTransitionEvent(it->eventType, it->name, it->elapsedTime);
+            it->element->dispatchEvent(WebKitTransitionEvent::create(it->eventType, it->name, it->elapsedTime));
         else
-            it->element->dispatchWebKitAnimationEvent(it->eventType, it->name, it->elapsedTime);
+            it->element->dispatchEvent(WebKitAnimationEvent::create(it->eventType, it->name, it->elapsedTime));
     }
     
     m_eventsToDispatch.clear();