Updated WebKit from /home/jturcott/dev/webkit/ to qtwebkit-4.6-snapshot-20091003 ( 8f810287200d21aded375664cc0a6ac0476dbdea )

Changes in WebKit/qt since the last update:

++ b/WebKit/qt/ChangeLog
2009-10-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Tor Arne Vestbø.

        Remove QWebView::guessUrlFromString() and replace its use
        with the new QUrl::fromUserInput() if using Qt 4.6 or newer.

        * Api/qwebview.cpp:
        * Api/qwebview.h:
        * QGVLauncher/main.cpp:
        (urlFromUserInput):
        (WebPage::applyProxy):
        (MainWindow::load):
        * QtLauncher/main.cpp:
        (urlFromUserInput):
        (MainWindow::MainWindow):
        (MainWindow::changeLocation):
        * tests/qwebview/tst_qwebview.cpp:

2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Tor Arne Vestbø.

        Serialize directly to the stream, and not first to an QByteArray,
        that is later serialized. That is slower and also uses more bytes.

        * Api/qwebhistory.cpp:
        (operator<<):
        (operator>>):

2009-10-28  Shinichiro Hamaji  <hamaji@chromium.org>

        Reviewed by Eric Seidel.

        [Qt] WebFrame::counterValueForElementById must not be exposed
        https://bugs.webkit.org/show_bug.cgi?id=30882

        * Api/qwebframe.cpp:
        (qt_drt_counterValueForElementById):
        * Api/qwebframe.h:

2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>

        Reviewed by Darin Adler.

        Provide a way to get counter values with layoutTestContoller
        https://bugs.webkit.org/show_bug.cgi?id=30555

        * Api/qwebframe.cpp:
        (QWebFrame::counterValueForElementById):
        (QWebHitTestResult::frame):
        * Api/qwebframe.h:

2009-10-28  Antonio Gomes  <tonikitoo@webkit.org>

        Pushing missing WebKit/qt/tests/qwebframe/resources/ dir from bug 29248.

        [Qt] [API] Make it possible to have 'invisible' loads
        https://bugs.webkit.org/show_bug.cgi?id=29248

        * tests/qwebframe/resources/image2.png: Copied from WebKit/qt/tests/qwebelement/image.png.

2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Tor Arne Vestbø.

        [Qt] QWebHistory::saveState() is inconsistent with the Qt API
        https://bugs.webkit.org/show_bug.cgi?id=30710

        Make the versioning internal and enforce it in the WebCore
        part. Adjust the comments, as well as remove now dead code.

        * Api/qwebhistory.cpp:
        (operator<<):
        (operator>>):
        * Api/qwebhistory.h:

2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Holger Freyther.

        [Qt] QWebHistory::saveState() is inconsistent with the Qt API
        https://bugs.webkit.org/show_bug.cgi?id=30710

        Remove the QWebHistory::saveState() and ::restoreState() as
        they are inconsistent with the Qt API.

        Update unittests to reflect the change.

        * Api/qwebhistory.cpp:
        (operator<<):
        (operator>>):
        * Api/qwebhistory.h:
        * tests/qwebhistory/tst_qwebhistory.cpp:
        (saveHistory):
        (restoreHistory):
        (tst_QWebHistory::saveAndRestore_crash_1):
        (tst_QWebHistory::saveAndRestore_crash_2):
        (tst_QWebHistory::saveAndRestore_crash_3):
        (tst_QWebHistory::clear):

2009-10-27  Antonio Gomes  <tonikitoo@webkit.org>

        Reviewed by Holger Freyther.

        Complementary fix to bug 30779.

        By mistake I used QWeakPointer's toStrongRef() method which docs
        explicitly say to not be used in this situation (when the tracked
        pointer is devired from QObject). Instead QWeakPointer's data()
        is recommended.

        * Api/qwebpage.cpp:
        (QWebPage::view):

2009-10-27  Holger Hans Peter Freyther  <zecke@selfish.org>

        Reviewed by Simon Fraser.

        Change HitTestResult methods to use (3d) transformation aware methods
        https://bugs.webkit.org/show_bug.cgi?id=27347

        The HitTestResult::boundingBox method was removed. The
        RenderObject must be used directly. In contrast to the
        old HitTestResult::boundingBox method this code must use
        a (3d) transformation aware method to not run into an
        assert in SVGRenderBase::mapLocalToContainer.

        * Api/qwebframe.cpp:
        (QWebHitTestResultPrivate::QWebHitTestResultPrivate):

2009-10-27  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Rubberstamped by Oliver Hunt.

        Change two methods to be internal for DRT use only.

        Part of [Qt] Review all new API in Qt 4.6
        https://bugs.webkit.org/show_bug.cgi?id=29843#c11

        * Api/qwebsecurityorigin.cpp:
        (qt_drt_whiteListAccessFromOrigin):
        (qt_drt_resetOriginAccessWhiteLists):
        (QWebSecurityOrigin::localSchemes):
        * Api/qwebsecurityorigin.h:

2009-10-27  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Tor Arne Vestbø.

        Make sure that initiating a rotation while rotating won't make
        it end up at rotation positions that are not a multiply of
        180 degrees.

        * QGVLauncher/main.cpp:
        (MainView::animatedFlip):

2009-10-27  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Unreviewed Qt build fix.

        Update the tests as well to the new API change.

        * tests/qwebelement/tst_qwebelement.cpp:
        (tst_QWebElement::clear):

2009-10-27  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Rubberstamped by Tor Arne Vestbø.

        [Qt] QWebElement::removeChildren() should be
        QWebElement::removeAllChildren()
        https://bugs.webkit.org/show_bug.cgi?id=30630

        * Api/qwebelement.cpp:
        (QWebElement::removeAllChildren):
        * Api/qwebelement.h:

2009-10-27  Antonio Gomes  <tonikitoo@webkit.org>

        Reviewed by Antti Koivisto and Holger Freyther.

        Make QWebPagePrivate's (QWidget) view to be a QWeakPointer.
        https://bugs.webkit.org/show_bug.cgi?id=30779

        The fact that it was been set from external objects of qwebpage
        and not being deleted internally can lead to dangling references.

        * Api/qgraphicswebview.cpp:
        (QGraphicsWebView::~QGraphicsWebView):
        * Api/qwebpage.cpp:
        (QWebPagePrivate::QWebPagePrivate):
        (QWebPagePrivate::createContextMenu):
        (QWebPagePrivate::handleSoftwareInputPanel):
        (QWebPagePrivate::keyPressEvent):
        (QWebPage::setView):
        (QWebPage::view):
        (QWebPage::javaScriptAlert):
        (QWebPage::javaScriptConfirm):
        (QWebPage::javaScriptPrompt):
        (QWebPage::shouldInterruptJavaScript):
        (QWebPage::createWindow):
        (QWebPage::extension):
        (QWebPage::chooseFile):
        (QWebPage::userAgentForUrl):
        * Api/qwebpage_p.h:
        * Api/qwebview.cpp:
        (QWebView::~QWebView):

2009-10-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Unreviewed documentation fix from David Boddie (Qt Doc Team)

        Removes the check around the RenderHints property documentation
        that was clearly added to synchronize the source and header files
        when the #if !defined(Q_OS_SYMBIAN) guards was added to the
        property.

        The documentation has also been updated to ensure that Symbian
        users know that there is no actual RenderHints property on their
        platform.

        * Api/qwebview.cpp:

2009-10-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Unreviewed documentation fix from David Boddie (Qt Doc Team)

        Ensure that qdoc will always see the RenderHints property.

        The property was only defined in the header file if the Q_OS_SYMBIAN
        symbol was not defined, resulting in the property not showing up
        in the Qt documentation just because one platform doesn't support it.

        A follow up commit will improve the documentation for the property
        and note that it is not supported on the Symbiam platform.

        * Api/qwebview.h:

2009-10-26  Benjamin Poulain  <benjamin.poulain@nokia.com>

        Reviewed by Tor Arne Vestbø.

        [Qt] Reintroduce QWebElementCollection

        Revert the patch that has replaced QWebElementCollection
        with QList<QWebElement>. Update the tests accordingly.

        Remove the constness of the return type of QWebElement operator[].

        https://bugs.webkit.org/show_bug.cgi?id=30767

        * Api/qwebelement.cpp:
        (QWebElement::findAll):
        (QWebElementCollectionPrivate::QWebElementCollectionPrivate):
        (QWebElementCollectionPrivate::create):
        (QWebElementCollection::QWebElementCollection):
        (QWebElementCollection::operator=):
        (QWebElementCollection::~QWebElementCollection):
        (QWebElementCollection::operator+):
        (QWebElementCollection::append):
        (QWebElementCollection::count):
        (QWebElementCollection::at):
        (QWebElementCollection::toList):
        * Api/qwebelement.h:
        (const_iterator::begin):
        (const_iterator::end):
        (const_iterator::operator[]):
        * Api/qwebframe.cpp:
        (QWebFrame::findAllElements):
        * Api/qwebframe.h:
        * QtLauncher/main.cpp:
        (MainWindow::selectElements):
        * tests/qwebelement/tst_qwebelement.cpp:
        (tst_QWebElement::simpleCollection):
        (tst_QWebElement::iteration):
        (tst_QWebElement::emptyCollection):
        (tst_QWebElement::appendCollection):
        (tst_QWebElement::nullSelect):
        (tst_QWebElement::hasSetFocus):
        (tst_QWebElement::render):
        * tests/qwebpage/tst_qwebpage.cpp:
        (tst_QWebPage::inputMethods):

2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Reviewed by Holger Freyther.

        [Qt] [Symbian] Set the capability and memory required to run QtWebKit for Symbian
        https://bugs.webkit.org/show_bug.cgi?id=30476

        Assign ReadUserData WriteUserData NetworkServices Symbian capabilities
        to all QtWebkit executables.

        * QGVLauncher/QGVLauncher.pro:
        * QtLauncher/QtLauncher.pro:
        * tests/benchmarks/loading/tst_loading.pro:
        * tests/benchmarks/painting/tst_painting.pro:
        * tests/qgraphicswebview/qgraphicswebview.pro:
        * tests/qwebelement/qwebelement.pro:
        * tests/qwebframe/qwebframe.pro:
        * tests/qwebhistory/qwebhistory.pro:
        * tests/qwebhistoryinterface/qwebhistoryinterface.pro:
        * tests/qwebpage/qwebpage.pro:
        * tests/qwebplugindatabase/qwebplugindatabase.pro:
        * tests/qwebview/qwebview.pro:

2009-10-22  Gavin Barraclough  <barraclough@apple.com>

        Reviewed by NOBODY (speculative build fix - qt is currently already broken!)
        Build fix following bug #30696.

        * Api/qwebelement.cpp:
        (setupScriptContext):
        * Api/qwebframe.cpp:
        (QWebFrame::evaluateJavaScript):

2009-10-22  Shu Chang  <Chang.Shu@nokia.com>

        Reviewed by Eric Seidel.

        [Qt] Enable track visited links in QWebPage
        https://bugs.webkit.org/show_bug.cgi?id=30574

        Test: fast/history/clicked-link-is-visited.html

        * Api/qwebpage.cpp:
        (QWebPagePrivate::QWebPagePrivate):

2009-10-22  Girish Ramakrishnan  <girish@forwardbias.in>

        Reviewed by Eric Seidel.

        [Qt] Add Print Shortcut to QtLauncher

        https://bugs.webkit.org/show_bug.cgi?id=30682

        * QtLauncher/main.cpp:
        (MainWindow::setupUI):

2009-10-22  Antonio Gomes  <tonikitoo@webkit.org>

        Rubberstamped by Tor Arne Vestbø.

        Code standarlization for QGVLauncher.

        1) Made member initilization lists in constructors
           to be per line.
        2) Made applyProxy method inline as all other methods in
           WebPage class.

        * QGVLauncher/main.cpp:
        (WebPage::WebPage):
        (WebPage::applyProxy):
        (MainView::MainView):
        (MainWindow::MainWindow):
        (MainWindow::init):

2009-10-22  Antonio Gomes  <tonikitoo@webkit.org>

        Reviewed by Tor Arne Vestbø.

        Add a Y-Axis rotation to QGVLauncher.

        It uses the QStateMachine API from Qt 4.6.

        * QGVLauncher/main.cpp:
        (WebView::WebView):
        (WebView::setYRotation):
        (WebView::yRotation):
        (MainView::flip):
        (MainView::animatedYFlip):
        (SharedScene::SharedScene):
        (SharedScene::webView):
        (MainWindow::init):
        (MainWindow::animatedYFlip):
        (MainWindow::buildUI):

2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed By Adam Barth.

        Add some actions to the menu for cursor debugging.

        GraphicsView based launcher only.

        * QGVLauncher/main.cpp:
        (MainView::setWaitCursor):
        (MainView::resetCursor):
        (MainView::flip):
        (MainWindow::setWaitCursor):
        (MainWindow::resetCursor):
        (MainWindow::buildUI):

2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Rubberstamped by Adam Barth.

        Remove clipRenderToViewport as agreed upon in
        https://bugs.webkit.org/show_bug.cgi?id=29843

        * Api/qwebframe.cpp:
        * Api/qwebframe.h:
        * Api/qwebframe_p.h:
        (QWebFramePrivate::QWebFramePrivate):

2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Adam Barth.

        Update the tests to test the new render functionality, and take
        into consideration that render() clips to the frame itself as well
        as the viewport.

        QWebFrame::render() now always clips, so the old tests were bogus.

        Rendering pure contents (no scrollbars etc) without clipping can now
        be accomplished using QWebFrame::documentElement()->render(...)

        * Api/qwebframe.cpp:
        * Api/qwebframe.h:
        * Api/qwebframe_p.h:
        (QWebFramePrivate::QWebFramePrivate):
        * tests/qwebframe/tst_qwebframe.cpp:

2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Rubberstamped by Adam Barth.

        As we do not support rendering a QWebFrame without it being clipped
        the the frame as well as the viewport, we now set the viewport size
        to the size of the contents.

        Rendering pure contents (no scrollbars etc) without clipping can be
        acomplished using QWebFrame::documentElement()->render(...)

        * tests/qwebelement/tst_qwebelement.cpp:
        (tst_QWebElement::render):

2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Tor Arne Vestbø.

        Add menu item to dump the plugin list to the console,
        which can be handy for debugging.

        * QtLauncher/main.cpp:
        (MainWindow::dumpPlugins):
        (MainWindow::setupUI):

2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Tor Arne Vestbø.

        Introduce new render method on QWebFrame, which supports specifying
        which layers to render (scrollbars, contents, pan-icon).

        * Api/qwebframe.cpp:
        (QWebFramePrivate::renderPrivate):
        (QWebFrame::render):
        * Api/qwebframe.h:
        * Api/qwebframe_p.h:

2009-10-19  Antonio Gomes  <tonikitoo@webkit.org>

        Reviewed by Ariya Hidayat.

        [Qt] Infinite loop (leading to crash) when setting cursor in QGraphicsWebView
        https://bugs.webkit.org/show_bug.cgi?id=30549

        Patch reimplements QGraphicsItem's itemChange method, and make
        CursorChange event to be emitted after cursor has already been
        set.

        QWidget::setCursor send the event just after it sets the cursor,
        then patch makes both behaviors compatible.

        * Api/qgraphicswebview.cpp:
        (QGraphicsWebView::itemChange):
        * Api/qgraphicswebview.h:

492 files changed, 14466 insertions, 4844 deletions

diff --git a/src/3rdparty/webkit/ChangeLog b/src/3rdparty/webkit/ChangeLog
index fb7dddf4f9..dc43e0ee22 100644
--- a/src/3rdparty/webkit/ChangeLog
+++ b/src/3rdparty/webkit/ChangeLog
@@ -1,3 +1,45 @@
+2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Export fastMalloc, fastCalloc, fastRealloc and fastFree
+        https://bugs.webkit.org/show_bug.cgi?id=30769
+
+        Export the FastMalloc functions outside of the libwebkit library
+        to be able to instrument memory allocations. These are C++ symbols
+        but do not require the C++ runtime to be useful and should be of
+        no harm to plain C code.
+
+        * autotools/symbols.filter:
+
+2009-10-26  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Jan Alonzo.
+
+        Alternative solution to regression introduced in r48672.
+
+        * GNUmakefile.am:
+
+2009-10-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Update for 1.1.16 release.
+
+        * configure.ac:
+
+2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] [Symbian] Set the capability and memory required to run QtWebKit for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=30476
+
+        Set the stack size to 80 Kb and heap size to the 128kB - 32MB range
+        to all executables linking against WebKit library.
+
+        * WebKit.pri:
+
 2009-10-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
 
         Reviewed by Holger Freyther.
diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 8d6c2df6a8..e6ab07344f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,3 +1,527 @@
+2009-10-29  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add cacheFlush support for Thumb-2 on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=30865
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-10-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSC JIT on ARMv7 cannot link jumps >16Mb range
+        https://bugs.webkit.org/show_bug.cgi?id=30891
+
+        Start planing all relative jumps as move-32-bit-immediate-to-register-BX.
+        In the cases where the jump would fall within a relative jump range, use a relative jump.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::~ARMv7Assembler):
+        (JSC::ARMv7Assembler::LinkRecord::LinkRecord):
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::executableCopy):
+        (JSC::ARMv7Assembler::linkJump):
+        (JSC::ARMv7Assembler::relinkJump):
+        (JSC::ARMv7Assembler::setInt32):
+        (JSC::ARMv7Assembler::isB):
+        (JSC::ARMv7Assembler::isBX):
+        (JSC::ARMv7Assembler::isMOV_imm_T3):
+        (JSC::ARMv7Assembler::isMOVT):
+        (JSC::ARMv7Assembler::isNOP_T1):
+        (JSC::ARMv7Assembler::isNOP_T2):
+        (JSC::ARMv7Assembler::linkJumpAbsolute):
+        (JSC::ARMv7Assembler::twoWordOp5i6Imm4Reg4EncodedImmFirst):
+        (JSC::ARMv7Assembler::twoWordOp5i6Imm4Reg4EncodedImmSecond):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::twoWordOp5i6Imm4Reg4EncodedImm):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::makeJump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+        * jit/JIT.h:
+        * wtf/Platform.h:
+
+2009-10-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve for..in enumeration performance
+        https://bugs.webkit.org/show_bug.cgi?id=30887
+
+        Improve indexing of an object with a for..in iterator by
+        identifying cases where get_by_val is being used with a iterator
+        as the subscript and replace it with a new get_by_pname
+        bytecode.  get_by_pname then optimizes lookups that directly access
+        the base object.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetByVal):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::pushOptimisedForIn):
+        (JSC::BytecodeGenerator::popOptimisedForIn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emitSlow_op_get_by_pname):
+        * parser/Nodes.cpp:
+        (JSC::ForInNode::emitBytecode):
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::getOffset):
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::addAnonymousSlotsTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+          Track the existence (or not) of non-enumerable properties.
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageCapacity):
+        (JSC::Structure::propertyStorageSize):
+        (JSC::Structure::hasNonEnumerableProperties):
+        (JSC::Structure::hasAnonymousSlots):
+
+2009-10-28  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attemp to fix Windows build.
+
+        Touch the cpp file to cause recompile.
+
+        * wtf/Threading.cpp:
+        (WTF::threadEntryPoint):
+
+2009-10-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30805
+        Add MessageQueue::removeIf(Predicate&) to remove certain tasks without pulling them from the queue.
+        Existing Database tests cover this since Database removes tasks when it is stopped.
+
+        * wtf/MessageQueue.h:
+        (WTF::::removeIf):
+
+2009-10-28  Afonso R. Costa Jr.  <afonso.costa@openbossa.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Enable YARR when YARR_JIT is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=30730
+
+        When enabling or disabling JIT using JAVASCRIPTCORE_JIT, the ENABLE_YARR should
+        be toggled also.
+
+        * JavaScriptCore.pri:
+
+2009-10-24  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix strict aliasing warning by switching reinterpret_cast to bitwise_cast.
+
+        strict-aliasing warnings in JSFunction.h
+        https://bugs.webkit.org/show_bug.cgi?id=27869
+
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::scopeChain):
+        (JSC::JSFunction::setScopeChain):
+        (JSC::JSFunction::setNativeFunction):
+
+2009-10-28  Jan-Arve Sæther <jan-arve.saether@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Build-fix for 64-bit Windows
+
+        * wtf/Platform.h: Make sure to use WTF_USE_JSVALUE64
+
+2009-10-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix!).
+
+        * jit/JIT.h:
+
+2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Export fastMalloc, fastCalloc, fastRealloc and fastFree on GCC/Unix
+        https://bugs.webkit.org/show_bug.cgi?id=30769
+
+        When using -fvisibility=hidden to hide all internal symbols by default
+        the malloc symbols will be hidden as well. For memory instrumentation
+        it is needed to provide an instrumented version of these symbols and
+        override the normal routines and by changing the visibility back to
+        default this becomes possible.
+
+        The only other solution would be to use system malloc instead of the
+        TCmalloc implementation but this will not allow to analyze memory
+        behavior with the default allocator.
+
+        * wtf/FastMalloc.h: Define WTF_FAST_MALLOC_EXPORT for GCC and !darwin
+
+2009-10-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Samuel Q. Weinig.
+
+        Make the asserts protecting the offsets in the JIT more descriptive.
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little bit of refactoring in the date code.
+
+        * JavaScriptCore.exp: Don't export this unused symbol.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h: Removed some unused functions. Changed the default
+        constructor to ensure that a DateInstance is always initialized.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype): Pass an initializer to our constructor,
+        since it now requires one.
+
+        * wtf/DateMath.cpp:
+        (WTF::msToGregorianDateTime): Only compute our offset from UTC if our
+        output will require it. Otherwise, our offset is 0.
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Mark DateInstaceCache.h private, so other frameworks can see it.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: re-readded this file.
+
+        * runtime/DateInstanceCache.h: Added.
+        (JSC::DateInstanceData::create):
+        (JSC::DateInstanceData::DateInstanceData):
+        (JSC::DateInstanceCache::DateInstanceCache):
+        (JSC::DateInstanceCache::add):
+        (JSC::DateInstanceCache::lookup):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler and Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30800
+        Cache recently computed date data.
+        
+        SunSpider reports a ~0.5% speedup, mostly from date-format-tofte.js.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added new file.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        (JSC::DateInstance::getGregorianDateTime): Use the shared cache.
+
+        * runtime/DateInstance.h: Renamed m_cache to m_data, to avoid the confusion
+        of a "cache cache".
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Pass an ExecState to these functions, so they
+        can access the DateInstanceCache.
+
+        * runtime/JSGlobalData.h: Keep a DateInstanceCache.
+
+2009-10-27  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Ensures that JavaScriptCore/wtf/CurrentTime.cpp is not built in PLATFORM(CHROMIUM) builds.
+
+        Chromium uses a different method to calculate the current time than is used in
+        JavaScriptCore/wtf/CurrentTime.cpp. This can lead to time skew when calls to currentTime() and Chromium's time
+        function are mixed.  In particular, timers can get scheduled in the past which leads to 100% CPU use.
+        See http://code.google.com/p/chromium/issues/detail?id=25892 for an example.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30833
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * wtf/CurrentTime.cpp:
+
+2009-10-27  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Fix typo in RegexInterpreter.cpp and RegexJIT.cpp alterantive to
+        alternative.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::alternativeBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::alternativeDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Make .rc files compile on Windows without depending on MFC headers
+        https://bugs.webkit.org/show_bug.cgi?id=30750
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc: Use
+        winresrc.h because it exists even when MFC is not installed, and is
+        all that's needed here.
+
+2009-10-26  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        The thunkReturnAddress is on JITStackFrame on ARM JIT as well
+        https://bugs.webkit.org/show_bug.cgi?id=30782
+
+        Move the thunkReturnAddress from top of the stack into the JITStackFrame
+        structure. This is a requirement for JSValue32_64 support on ARM.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::ret): Return with link register
+        (JSC::MacroAssemblerARM::prepareCall): Store the return address in link register
+        * jit/JIT.h: Remove unused ctiReturnRegister
+        * jit/JITInlineMethods.h: Same as ARMv7
+        (JSC::JIT::restoreArgumentReference): Ditto.
+        (JSC::JIT::restoreArgumentReferenceForTrampoline): Ditto.
+        * jit/JITOpcodes.cpp: Remove ctiReturnRegister related instruction
+        * jit/JITStubs.cpp: Store thunkReturnAddress on JITStackFrame. Use
+        small trampoline functions which handle return addresses for each
+        CTI_STUB_FUNCTION.
+        * jit/JITStubs.h: Store thunkReturnAddress on JITStackFrame
+        (JSC::JITStackFrame::returnAddressSlot): Return with the address of thunkReturnAddress
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter): Remove the unnecessary instruction
+
+2009-10-26  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Adds ability to disable ReadWriteLock on platforms (eg Android) that use pthreads but do not support pthread_rwlock.
+        https://bugs.webkit.org/show_bug.cgi?id=30713
+
+        * wtf/Platform.h: Modified. Defines HAVE_PTHREAD_RWLOCK for all platforms currently using pthreads.
+        * wtf/Threading.h: Modified. Use pthread_rwlock_t only when HAVE_PTHREAD_RWLOCK is defined.
+        * wtf/ThreadingPthreads.cpp: Modified. Build ReadWriteLock methods only when HAVE_PTHREAD_RWLOCK is defined.
+
+2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] [Symbian] Set the capability and memory required to run QtWebKit for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=30476
+
+        Assign ReadUserData WriteUserData NetworkServices Symbian capabilities
+        to jsc.exe.
+
+        * jsc.pro:
+
+2009-10-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Fixes a leak in createThreadInternal on Android.
+        https://bugs.webkit.org/show_bug.cgi?id=30698
+
+        * wtf/ThreadingPthreads.cpp: Modified.
+        (WTF::createThreadInternal): Avoid leaking a ThreadData object on failure.
+
+2009-10-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fixed ASSERT when opening Safari's Caches window while the Web Inspector
+        is open.
+
+        * runtime/Collector.cpp:
+        (JSC::typeName): Added two new types to the type name list in the Collector.
+        These types have been around for a while, but nobody remembered to consider them here.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::isPropertyNameIterator):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::isPropertyNameIterator): Give the Collector
+        a way to tell if a cell is a JSPropertyNameIterator.
+
+2009-10-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30686
+        Remove debug-specific def file.
+        Only Debug_All target uses JavaScriptCore_debug.dll naming, and since
+        that target is only used internally, maintaining two files just to
+        suppress a single link warning isn't worthwhile.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Removed.
+
+2009-10-21  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7270320> Screenshots of off-screen plug-ins are blank
+        <rdar://problem/7270314> After halting a transparent PluginView on
+        Windows, the transparency is applied twice
+
+        Reviewed by Dan Bernstein.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Export WTF::deleteOwnedPtr(HDC).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Ditto.
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: updated variable name.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_next_pname): Slightly tweaked this #ifdef to match the
+        size of a JSValue because m_jsStrings is an array of JSValues.
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fixed a 64-bit regression caused by the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=30570.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_next_pname): Use TimesEight stepping on 64-bit, since
+        64-bit pointers are eight bytes long.
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Refactored DateInstance::msToGregorianDateTime so that a DateInstance's
+        caller doesn't need to supply the DateInstance's own internal value to
+        the DateInstance.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::getGregorianDateTime): Renamed from "msToGregorianDateTime".
+
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Also renamed "utc" to "outputIsUTC", for clarity.
+
+2009-10-20  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        The op_next_pname should use 4 bytes addressing mode in case of JSValue32
+        https://bugs.webkit.org/show_bug.cgi?id=30570
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_next_pname):
+
+2009-10-20  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Move OverridesMarkChildren flag from DatePrototype to its parent class
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.h:
+
 2009-10-19  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
index 4b316c8e7b..03c23c35c2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
@@ -194,6 +194,7 @@
             'runtime/DateConversion.h',
             'runtime/DateInstance.cpp',
             'runtime/DateInstance.h',
+            'runtime/DateInstanceCache.h',
             'runtime/DatePrototype.cpp',
             'runtime/DatePrototype.h',
             'runtime/Error.cpp',
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
index 89c483e08c..eb26664661 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
@@ -39,10 +39,12 @@ win32-* {
 contains(JAVASCRIPTCORE_JIT,yes) {
     DEFINES+=ENABLE_JIT=1
     DEFINES+=ENABLE_YARR_JIT=1
+    DEFINES+=ENABLE_YARR=1
 }
 contains(JAVASCRIPTCORE_JIT,no) {
     DEFINES+=ENABLE_JIT=0
     DEFINES+=ENABLE_YARR_JIT=0
+    DEFINES+=ENABLE_YARR=0
 }
 
 # In debug mode JIT disabled until crash fixed
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
index 078de44748..02ce2e93a1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -407,6 +407,11 @@ register writeback
 
 class ARMv7Assembler {
 public:
+    ~ARMv7Assembler()
+    {
+        ASSERT(m_jumpsToLink.isEmpty());
+    }
+
     typedef ARMRegisters::RegisterID RegisterID;
     typedef ARMRegisters::FPRegisterID FPRegisterID;
 
@@ -477,6 +482,17 @@ public:
 
 private:
 
+    struct LinkRecord {
+        LinkRecord(intptr_t from, intptr_t to)
+            : from(from)
+            , to(to)
+        {
+        }
+
+        intptr_t from;
+        intptr_t to;
+    };
+
     // ARMv7, Appx-A.6.3
     bool BadReg(RegisterID reg)
     {
@@ -574,6 +590,7 @@ private:
         OP_SUB_SP_imm_T1    = 0xB080,
         OP_BKPT             = 0xBE00,
         OP_IT               = 0xBF00,
+        OP_NOP_T1           = 0xBF00,
     } OpcodeID;
 
     typedef enum {
@@ -608,6 +625,7 @@ private:
         OP_MOV_imm_T3   = 0xF240,
         OP_SUB_imm_T4   = 0xF2A0,
         OP_MOVT         = 0xF2C0,
+        OP_NOP_T2a      = 0xF3AF,
         OP_LDRH_reg_T2  = 0xF830,
         OP_LDRH_imm_T3  = 0xF830,
         OP_STR_imm_T4   = 0xF840,
@@ -626,6 +644,7 @@ private:
 
     typedef enum {
         OP_B_T4b        = 0x9000,
+        OP_NOP_T2b      = 0x8000,
     } OpcodeID2;
 
     struct FourFours {
@@ -1481,6 +1500,15 @@ public:
     void* executableCopy(ExecutablePool* allocator)
     {
         void* copy = m_formatter.executableCopy(allocator);
+
+        unsigned jumpCount = m_jumpsToLink.size();
+        for (unsigned i = 0; i < jumpCount; ++i) {
+            uint16_t* location = reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(copy) + m_jumpsToLink[i].from);
+            uint16_t* target = reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(copy) + m_jumpsToLink[i].to);
+            linkJumpAbsolute(location, target);
+        }
+        m_jumpsToLink.clear();
+
         ASSERT(copy);
         return copy;
     }
@@ -1503,11 +1531,7 @@ public:
     {
         ASSERT(to.m_offset != -1);
         ASSERT(from.m_offset != -1);
-
-        uint16_t* location = reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(m_formatter.data()) + from.m_offset);
-        intptr_t relative = to.m_offset - from.m_offset;
-
-        linkWithOffset(location, relative);
+        m_jumpsToLink.append(LinkRecord(from.m_offset, to.m_offset));
     }
 
     static void linkJump(void* code, JmpSrc from, void* to)
@@ -1515,9 +1539,7 @@ public:
         ASSERT(from.m_offset != -1);
         
         uint16_t* location = reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
-        intptr_t relative = reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(location);
-
-        linkWithOffset(location, relative);
+        linkJumpAbsolute(location, to);
     }
 
     // bah, this mathod should really be static, since it is used by the LinkBuffer.
@@ -1541,10 +1563,9 @@ public:
         ASSERT(!(reinterpret_cast<intptr_t>(from) & 1));
         ASSERT(!(reinterpret_cast<intptr_t>(to) & 1));
 
-        intptr_t relative = reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(from);
-        linkWithOffset(reinterpret_cast<uint16_t*>(from), relative);
+        linkJumpAbsolute(reinterpret_cast<uint16_t*>(from), to);
 
-        ExecutableAllocator::cacheFlush(reinterpret_cast<uint16_t*>(from) - 2, 2 * sizeof(uint16_t));
+        ExecutableAllocator::cacheFlush(reinterpret_cast<uint16_t*>(from) - 5, 5 * sizeof(uint16_t));
     }
     
     static void relinkCall(void* from, void* to)
@@ -1613,14 +1634,14 @@ private:
     static void setInt32(void* code, uint32_t value)
     {
         uint16_t* location = reinterpret_cast<uint16_t*>(code);
+        ASSERT(isMOV_imm_T3(location - 4) && isMOVT(location - 2));
 
-        uint16_t lo16 = value;
-        uint16_t hi16 = value >> 16;
-
-        spliceHi5(location - 4, lo16);
-        spliceLo11(location - 3, lo16);
-        spliceHi5(location - 2, hi16);
-        spliceLo11(location - 1, hi16);
+        ARMThumbImmediate lo16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(value));
+        ARMThumbImmediate hi16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(value >> 16));
+        location[-4] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOV_imm_T3, lo16);
+        location[-3] = twoWordOp5i6Imm4Reg4EncodedImmSecond((location[-3] >> 8) & 0xf, lo16);
+        location[-2] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOVT, hi16);
+        location[-1] = twoWordOp5i6Imm4Reg4EncodedImmSecond((location[-1] >> 8) & 0xf, hi16);
 
         ExecutableAllocator::cacheFlush(location - 4, 4 * sizeof(uint16_t));
     }
@@ -1630,41 +1651,89 @@ private:
         setInt32(code, reinterpret_cast<uint32_t>(value));
     }
 
-    // Linking & patching:
-    // This method assumes that the JmpSrc being linked is a T4 b instruction.
-    static void linkWithOffset(uint16_t* instruction, intptr_t relative)
-    {
-        // Currently branches > 16m = mostly deathy.
-        if (((relative << 7) >> 7) != relative) {
-            // FIXME: This CRASH means we cannot turn the JIT on by default on arm-v7.
-            fprintf(stderr, "Error: Cannot link T4b.\n");
-            CRASH();
-        }
-        
-        // ARM encoding for the top two bits below the sign bit is 'peculiar'.
-        if (relative >= 0)
-            relative ^= 0xC00000;
+    static bool isB(void* address)
+    {
+        uint16_t* instruction = static_cast<uint16_t*>(address);
+        return ((instruction[0] & 0xf800) == OP_B_T4a) && ((instruction[1] & 0xd000) == OP_B_T4b);
+    }
+
+    static bool isBX(void* address)
+    {
+        uint16_t* instruction = static_cast<uint16_t*>(address);
+        return (instruction[0] & 0xff87) == OP_BX;
+    }
 
-        // All branch offsets should be an even distance.
-        ASSERT(!(relative & 1));
+    static bool isMOV_imm_T3(void* address)
+    {
+        uint16_t* instruction = static_cast<uint16_t*>(address);
+        return ((instruction[0] & 0xFBF0) == OP_MOV_imm_T3) && ((instruction[1] & 0x8000) == 0);
+    }
 
-        int word1 = ((relative & 0x1000000) >> 14) | ((relative & 0x3ff000) >> 12);
-        int word2 = ((relative & 0x800000) >> 10) | ((relative & 0x400000) >> 11) | ((relative & 0xffe) >> 1);
+    static bool isMOVT(void* address)
+    {
+        uint16_t* instruction = static_cast<uint16_t*>(address);
+        return ((instruction[0] & 0xFBF0) == OP_MOVT) && ((instruction[1] & 0x8000) == 0);
+    }
 
-        instruction[-2] = OP_B_T4a | word1;
-        instruction[-1] = OP_B_T4b | word2;
+    static bool isNOP_T1(void* address)
+    {
+        uint16_t* instruction = static_cast<uint16_t*>(address);
+        return instruction[0] == OP_NOP_T1;
     }
 
-    // These functions can be used to splice 16-bit immediates back into previously generated instructions.
-    static void spliceHi5(uint16_t* where, uint16_t what)
+    static bool isNOP_T2(void* address)
     {
-        uint16_t pattern = (what >> 12) | ((what & 0x0800) >> 1);
-        *where = (*where & 0xFBF0) | pattern;
+        uint16_t* instruction = static_cast<uint16_t*>(address);
+        return (instruction[0] == OP_NOP_T2a) && (instruction[1] == OP_NOP_T2b);
     }
-    static void spliceLo11(uint16_t* where, uint16_t what)
+
+    static void linkJumpAbsolute(uint16_t* instruction, void* target)
     {
-        uint16_t pattern = ((what & 0x0700) << 4) | (what & 0x00FF);
-        *where = (*where & 0x8F00) | pattern;
+        // FIMXE: this should be up in the MacroAssembler layer. :-(
+        const uint16_t JUMP_TEMPORARY_REGISTER = ARMRegisters::ip;
+
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+
+        ASSERT( (isMOV_imm_T3(instruction - 5) && isMOVT(instruction - 3) && isBX(instruction - 1))
+            || (isNOP_T1(instruction - 5) && isNOP_T2(instruction - 4) && isB(instruction - 2)) );
+
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        if (((relative << 7) >> 7) == relative) {
+            // ARM encoding for the top two bits below the sign bit is 'peculiar'.
+            if (relative >= 0)
+                relative ^= 0xC00000;
+
+            // All branch offsets should be an even distance.
+            ASSERT(!(relative & 1));
+            // There may be a better way to fix this, but right now put the NOPs first, since in the
+            // case of an conditional branch this will be coming after an ITTT predicating *three*
+            // instructions!  Looking backwards to modify the ITTT to an IT is not easy, due to
+            // variable wdith encoding - the previous instruction might *look* like an ITTT but
+            // actually be the second half of a 2-word op.
+            instruction[-5] = OP_NOP_T1;
+            instruction[-4] = OP_NOP_T2a;
+            instruction[-3] = OP_NOP_T2b;
+            instruction[-2] = OP_B_T4a | ((relative & 0x1000000) >> 14) | ((relative & 0x3ff000) >> 12);
+            instruction[-1] = OP_B_T4b | ((relative & 0x800000) >> 10) | ((relative & 0x400000) >> 11) | ((relative & 0xffe) >> 1);
+        } else {
+            ARMThumbImmediate lo16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(reinterpret_cast<uint32_t>(target) + 1));
+            ARMThumbImmediate hi16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(reinterpret_cast<uint32_t>(target) >> 16));
+            instruction[-5] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOV_imm_T3, lo16);
+            instruction[-4] = twoWordOp5i6Imm4Reg4EncodedImmSecond(JUMP_TEMPORARY_REGISTER, lo16);
+            instruction[-3] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOVT, hi16);
+            instruction[-2] = twoWordOp5i6Imm4Reg4EncodedImmSecond(JUMP_TEMPORARY_REGISTER, hi16);
+            instruction[-1] = OP_BX | (JUMP_TEMPORARY_REGISTER << 3);
+        }
+    }
+
+    static uint16_t twoWordOp5i6Imm4Reg4EncodedImmFirst(uint16_t op, ARMThumbImmediate imm)
+    {
+        return op | (imm.m_value.i << 10) | imm.m_value.imm4;
+    }
+    static uint16_t twoWordOp5i6Imm4Reg4EncodedImmSecond(uint16_t rd, ARMThumbImmediate imm)
+    {
+        return (imm.m_value.imm3 << 12) | (rd << 8) | imm.m_value.imm8;
     }
 
     class ARMInstructionFormatter {
@@ -1723,8 +1792,11 @@ private:
 
         void twoWordOp5i6Imm4Reg4EncodedImm(OpcodeID1 op, int imm4, RegisterID rd, ARMThumbImmediate imm)
         {
-            m_buffer.putShort(op | (imm.m_value.i << 10) | imm4);
-            m_buffer.putShort((imm.m_value.imm3 << 12) | (rd << 8) | imm.m_value.imm8);
+            ARMThumbImmediate newImm = imm;
+            newImm.m_value.imm4 = imm4;
+
+            m_buffer.putShort(ARMv7Assembler::twoWordOp5i6Imm4Reg4EncodedImmFirst(op, newImm));
+            m_buffer.putShort(ARMv7Assembler::twoWordOp5i6Imm4Reg4EncodedImmSecond(rd, newImm));
         }
 
         void twoWordOp12Reg4Reg4Imm12(OpcodeID1 op, RegisterID reg1, RegisterID reg2, uint16_t imm)
@@ -1749,6 +1821,8 @@ private:
     private:
         AssemblerBuffer m_buffer;
     } m_formatter;
+
+    Vector<LinkRecord> m_jumpsToLink;
 };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
index aa8cbb036a..7a72b0698f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -65,6 +65,7 @@ public:
     };
 
     static const RegisterID stackPointerRegister = ARMRegisters::sp;
+    static const RegisterID linkRegister = ARMRegisters::lr;
 
     static const Scale ScalePtr = TimesFour;
 
@@ -530,7 +531,7 @@ public:
 
     void ret()
     {
-        pop(ARMRegisters::pc);
+        m_assembler.mov_r(ARMRegisters::pc, linkRegister);
     }
 
     void set32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
@@ -746,11 +747,9 @@ protected:
 
     void prepareCall()
     {
-        ensureSpace(3 * sizeof(ARMWord), sizeof(ARMWord));
+        ensureSpace(2 * sizeof(ARMWord), sizeof(ARMWord));
 
-        // S0 might be used for parameter passing
-        m_assembler.add_r(ARMRegisters::S1, ARMRegisters::pc, ARMAssembler::OP2_IMM | 0x4);
-        m_assembler.push_r(ARMRegisters::S1);
+        m_assembler.mov_r(linkRegister, ARMRegisters::pc);
     }
 
     void call32(RegisterID base, int32_t offset)
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index a549604ff0..c4795172d2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -990,13 +990,15 @@ public:
 protected:
     ARMv7Assembler::JmpSrc makeJump()
     {
-        return m_assembler.b();
+        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        return m_assembler.bx(dataTempRegister);
     }
 
     ARMv7Assembler::JmpSrc makeBranch(ARMv7Assembler::Condition cond)
     {
-        m_assembler.it(cond);
-        return m_assembler.b();
+        m_assembler.it(cond, true, true);
+        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        return m_assembler.bx(dataTempRegister);
     }
     ARMv7Assembler::JmpSrc makeBranch(Condition cond) { return makeBranch(armV7Condition(cond)); }
     ARMv7Assembler::JmpSrc makeBranch(DoubleCondition cond) { return makeBranch(armV7Condition(cond)); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
index 18ca2aeaa8..c9159341dc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -824,6 +824,16 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printf("[%4d] get_by_val\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
             break;
         }
+        case op_get_by_pname: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            int r3 = (++it)->u.operand;
+            int r4 = (++it)->u.operand;
+            int r5 = (++it)->u.operand;
+            printf("[%4d] get_by_pname\t %s, %s, %s, %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str(), registerName(r4).c_str(), registerName(r5).c_str());
+            break;
+        }
         case op_put_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
@@ -1015,14 +1025,17 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             break;
         }
         case op_get_pnames: {
-            int r0 = it[0].u.operand;
-            int r1 = it[1].u.operand;
-            printf("[%4d] get_pnames\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            int r0 = it[1].u.operand;
+            int r1 = it[2].u.operand;
+            int r2 = it[3].u.operand;
+            int r3 = it[4].u.operand;
+            int offset = it[5].u.operand;
+            printf("[%4d] get_pnames\t %s, %s, %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str(), offset, location + offset);
             it += OPCODE_LENGTH(op_get_pnames) - 1;
             break;
         }
         case op_next_pname: {
-            int dest = it[0].u.operand;
+            int dest = it[1].u.operand;
             int iter = it[4].u.operand;
             int offset = it[5].u.operand;
             printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(dest).c_str(), registerName(iter).c_str(), offset, location + offset);
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
index 8968252bcc..4facbef5b2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
@@ -113,6 +113,7 @@ namespace JSC {
         macro(op_put_by_id_generic, 8) \
         macro(op_del_by_id, 4) \
         macro(op_get_by_val, 4) \
+        macro(op_get_by_pname, 7) \
         macro(op_put_by_val, 4) \
         macro(op_del_by_val, 4) \
         macro(op_put_by_index, 4) \
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 41b5c39803..04dae15374 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -1281,6 +1281,19 @@ RegisterID* BytecodeGenerator::emitDeleteById(RegisterID* dst, RegisterID* base,
 
 RegisterID* BytecodeGenerator::emitGetByVal(RegisterID* dst, RegisterID* base, RegisterID* property)
 {
+    for (size_t i = m_forInContextStack.size(); i > 0; i--) {
+        ForInContext& context = m_forInContextStack[i - 1];
+        if (context.propertyRegister == property) {
+            emitOpcode(op_get_by_pname);
+            instructions().append(dst->index());
+            instructions().append(base->index());
+            instructions().append(property->index());
+            instructions().append(context.expectedSubscriptRegister->index());
+            instructions().append(context.iterRegister->index());
+            instructions().append(context.indexRegister->index());
+            return dst;
+        }
+    }
     emitOpcode(op_get_by_val);
     instructions().append(dst->index());
     instructions().append(base->index());
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 61de1739d2..4648fb57e6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -61,6 +61,13 @@ namespace JSC {
         FinallyContext finallyContext;
     };
 
+    struct ForInContext {
+        RefPtr<RegisterID> expectedSubscriptRegister;
+        RefPtr<RegisterID> iterRegister;
+        RefPtr<RegisterID> indexRegister;
+        RefPtr<RegisterID> propertyRegister;
+    };
+
     class BytecodeGenerator : public FastAllocBase {
     public:
         typedef DeclarationStacks::VarStack VarStack;
@@ -331,6 +338,17 @@ namespace JSC {
         void pushFinallyContext(Label* target, RegisterID* returnAddrDst);
         void popFinallyContext();
 
+        void pushOptimisedForIn(RegisterID* expectedBase, RegisterID* iter, RegisterID* index, RegisterID* propertyRegister)
+        {
+            ForInContext context = { expectedBase, iter, index, propertyRegister };
+            m_forInContextStack.append(context);
+        }
+
+        void popOptimisedForIn()
+        {
+            m_forInContextStack.removeLast();
+        }
+
         LabelScope* breakTarget(const Identifier&);
         LabelScope* continueTarget(const Identifier&);
 
@@ -467,6 +485,7 @@ namespace JSC {
 
         Vector<ControlFlowContext> m_scopeContextStack;
         Vector<SwitchInfo> m_switchContextStack;
+        Vector<ForInContext> m_forInContextStack;
 
         int m_nextGlobalIndex;
         int m_nextParameterIndex;
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
index 53964ad62d..c77a0f1757 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
@@ -2417,6 +2417,33 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_del_by_id);
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_get_by_pname) {
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int property = vPC[3].u.operand;
+        int expected = vPC[4].u.operand;
+        int iter = vPC[5].u.operand;
+        int i = vPC[6].u.operand;
+
+        JSValue baseValue = callFrame->r(base).jsValue();
+        JSPropertyNameIterator* it = callFrame->r(iter).propertyNameIterator();
+        JSValue subscript = callFrame->r(property).jsValue();
+        JSValue expectedSubscript = callFrame->r(expected).jsValue();
+        int index = callFrame->r(i).i() - 1;
+        JSValue result;
+        int offset = 0;
+        if (subscript == expectedSubscript && baseValue.isCell() && (baseValue.asCell()->structure() == it->cachedStructure()) && it->getOffset(index, offset)) {
+            callFrame->r(dst) = asObject(baseValue)->getDirectOffset(offset);
+            vPC += OPCODE_LENGTH(op_get_by_pname);
+            NEXT_INSTRUCTION();
+        }
+        Identifier propertyName(callFrame, subscript.toString(callFrame));
+        result = baseValue.get(callFrame, propertyName);
+        CHECK_FOR_EXCEPTION();
+        callFrame->r(dst) = result;
+        vPC += OPCODE_LENGTH(op_get_by_pname);
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_get_by_val) {
         /* get_by_val dst(r) base(r) property(r)
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
index 1d15ef03d6..5c43eebcf0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
@@ -189,6 +189,22 @@ public:
         sys_dcache_flush(code, size);
         sys_icache_invalidate(code, size);
     }
+#elif PLATFORM(ARM_THUMB2) && PLATFORM(LINUX)
+    static void cacheFlush(void* code, size_t size)
+    {
+        asm volatile (
+            "push    {r7}\n"
+            "mov     r0, %0\n"
+            "mov     r1, %1\n"
+            "movw    r7, #0x2\n"
+            "movt    r7, #0xf\n"
+            "movs    r2, #0x0\n"
+            "svc     0x0\n"
+            "pop     {r7}\n"
+            :
+            : "r" (code), "r" (reinterpret_cast<char*>(code) + size)
+            : "r0", "r1");
+    }
 #elif PLATFORM(SYMBIAN)
     static void cacheFlush(void* code, size_t size)
     {
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
index fa0ac2e1ca..000e4b8214 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
@@ -239,6 +239,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_eq_null)
         DEFINE_OP(op_get_by_id)
         DEFINE_OP(op_get_by_val)
+        DEFINE_OP(op_get_by_pname)
         DEFINE_OP(op_get_global_var)
         DEFINE_OP(op_get_pnames)
         DEFINE_OP(op_get_scoped_var)
@@ -385,6 +386,7 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_eq)
         DEFINE_SLOWCASE_OP(op_get_by_id)
         DEFINE_SLOWCASE_OP(op_get_by_val)
+        DEFINE_SLOWCASE_OP(op_get_by_pname)
         DEFINE_SLOWCASE_OP(op_instanceof)
         DEFINE_SLOWCASE_OP(op_jfalse)
         DEFINE_SLOWCASE_OP(op_jnless)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
index 9406d1f236..e19ea1750c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
@@ -38,6 +38,8 @@
 #define JIT_CLASS_ALIGNMENT
 #endif
 
+#define ASSERT_JIT_OFFSET(actual, expected) ASSERT_WITH_MESSAGE(actual == expected, "JIT Offset \"%s\" should be %d, not %d.\n", #expected, static_cast<int>(actual), static_cast<int>(expected));
+
 #include "CodeBlock.h"
 #include "Interpreter.h"
 #include "JITCode.h"
@@ -249,7 +251,6 @@ namespace JSC {
 
         static const RegisterID timeoutCheckRegister = ARMRegisters::r5;
         static const RegisterID callFrameRegister = ARMRegisters::r4;
-        static const RegisterID ctiReturnRegister = ARMRegisters::r6;
 
         static const RegisterID regT0 = ARMRegisters::r0;
         static const RegisterID regT1 = ARMRegisters::r1;
@@ -427,6 +428,7 @@ namespace JSC {
 #endif
         void compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, Structure* structure, size_t cachedOffset);
         void compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset);
+        void compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID structure, RegisterID offset);
         void compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, Structure* structure, size_t cachedOffset);
 
         // Arithmetic opcode helpers
@@ -528,6 +530,7 @@ namespace JSC {
 #endif
         void compileGetDirectOffset(RegisterID base, RegisterID result, Structure* structure, size_t cachedOffset);
         void compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID result, size_t cachedOffset);
+        void compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID structure, RegisterID offset, RegisterID scratch);
         void compilePutDirectOffset(RegisterID base, RegisterID value, Structure* structure, size_t cachedOffset);
 
 #if PLATFORM(X86_64)
@@ -583,26 +586,26 @@ namespace JSC {
 #elif PLATFORM(ARM_THUMB2)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
-        static const int patchOffsetPutByIdExternalLoad = 20;
+        static const int patchOffsetPutByIdExternalLoad = 26;
         static const int patchLengthPutByIdExternalLoad = 12;
-        static const int patchOffsetPutByIdPropertyMapOffset = 40;
+        static const int patchOffsetPutByIdPropertyMapOffset = 46;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 10;
-        static const int patchOffsetGetByIdBranchToSlowCase = 20;
-        static const int patchOffsetGetByIdExternalLoad = 20;
+        static const int patchOffsetGetByIdBranchToSlowCase = 26;
+        static const int patchOffsetGetByIdExternalLoad = 26;
         static const int patchLengthGetByIdExternalLoad = 12;
-        static const int patchOffsetGetByIdPropertyMapOffset = 40;
-        static const int patchOffsetGetByIdPutResult = 44;
+        static const int patchOffsetGetByIdPropertyMapOffset = 46;
+        static const int patchOffsetGetByIdPutResult = 50;
 #if ENABLE(OPCODE_SAMPLING)
         static const int patchOffsetGetByIdSlowCaseCall = 0; // FIMXE
 #else
         static const int patchOffsetGetByIdSlowCaseCall = 28;
 #endif
-        static const int patchOffsetOpCallCompareToJump = 10;
+        static const int patchOffsetOpCallCompareToJump = 16;
 
-        static const int patchOffsetMethodCheckProtoObj = 18;
-        static const int patchOffsetMethodCheckProtoStruct = 28;
-        static const int patchOffsetMethodCheckPutFunction = 46;
+        static const int patchOffsetMethodCheckProtoObj = 24;
+        static const int patchOffsetMethodCheckProtoStruct = 34;
+        static const int patchOffsetMethodCheckPutFunction = 58;
 #elif PLATFORM(ARM_TRADITIONAL)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 4;
@@ -619,7 +622,7 @@ namespace JSC {
 #if ENABLE(OPCODE_SAMPLING)
         #error "OPCODE_SAMPLING is not yet supported"
 #else
-        static const int patchOffsetGetByIdSlowCaseCall = 36;
+        static const int patchOffsetGetByIdSlowCaseCall = 28;
 #endif
         static const int patchOffsetOpCallCompareToJump = 12;
 
@@ -640,7 +643,7 @@ namespace JSC {
         static const int sequenceGetByIdHotPathInstructionSpace = 28;
         static const int sequenceGetByIdHotPathConstantSpace = 3;
         // sequenceGetByIdSlowCase
-        static const int sequenceGetByIdSlowCaseInstructionSpace = 40;
+        static const int sequenceGetByIdSlowCaseInstructionSpace = 32;
         static const int sequenceGetByIdSlowCaseConstantSpace = 2;
         // sequencePutById
         static const int sequencePutByIdInstructionSpace = 28;
@@ -682,6 +685,7 @@ namespace JSC {
         void emit_op_eq_null(Instruction*);
         void emit_op_get_by_id(Instruction*);
         void emit_op_get_by_val(Instruction*);
+        void emit_op_get_by_pname(Instruction*);
         void emit_op_get_global_var(Instruction*);
         void emit_op_get_scoped_var(Instruction*);
         void emit_op_init_arguments(Instruction*);
@@ -771,6 +775,7 @@ namespace JSC {
         void emitSlow_op_eq(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_get_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_by_pname(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_instanceof(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jfalse(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jnless(Instruction*, Vector<SlowCaseEntry>::iterator&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
index cfaa69f6c9..f7fcc0a6e2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
@@ -614,7 +614,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     END_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
 
     addSlowCase(jumpToSlow);
-    ASSERT(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow) == patchOffsetOpCallCompareToJump);
+    ASSERT_JIT_OFFSET(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow), patchOffsetOpCallCompareToJump);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
 
     // The following is the fast case, only used whan a callee can be linked.
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
index f26457ab0f..93d6ce76ed 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
@@ -144,7 +144,7 @@ ALWAYS_INLINE void JIT::endUninterruptedSequence(int insnSpace, int constSpace)
 
 #endif
 
-#if PLATFORM(ARM_THUMB2)
+#if PLATFORM(ARM)
 
 ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
 {
@@ -161,7 +161,7 @@ ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
     loadPtr(address, linkRegister);
 }
 
-#else // PLATFORM(X86) || PLATFORM(X86_64) || PLATFORM(ARM_TRADITIONAL)
+#else // PLATFORM(X86) || PLATFORM(X86_64)
 
 ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
 {
@@ -191,16 +191,13 @@ ALWAYS_INLINE void JIT::restoreArgumentReference()
 {
     move(stackPointerRegister, firstArgumentRegister);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
-#if PLATFORM(ARM_TRADITIONAL)
-    move(ctiReturnRegister, ARMRegisters::lr);
-#endif
 }
 ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
 {
 #if PLATFORM(X86)
     // Within a trampoline the return address will be on the stack at this point.
     addPtr(Imm32(sizeof(void*)), stackPointerRegister, firstArgumentRegister);
-#elif PLATFORM(ARM_THUMB2)
+#elif PLATFORM(ARM)
     move(stackPointerRegister, firstArgumentRegister);
 #endif
     // In the trampoline on x86-64, the first argument register is not overwritten.
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
index e10d1059b6..14736cfb80 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
@@ -1792,7 +1792,6 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // Setup arg4: This is a plain hack
     move(stackPointerRegister, ARMRegisters::S0);
 
-    move(ctiReturnRegister, ARMRegisters::lr);
     call(Address(regT1, OBJECT_OFFSETOF(JSFunction, m_data)));
 
     addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
@@ -2500,7 +2499,13 @@ void JIT::emit_op_next_pname(Instruction* currentInstruction)
     // Grab key @ i
     loadPtr(addressFor(it), regT1);
     loadPtr(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStrings)), regT2);
+
+#if USE(JSVALUE64)
     loadPtr(BaseIndex(regT2, regT0, TimesEight), regT2);
+#else
+    loadPtr(BaseIndex(regT2, regT0, TimesFour), regT2);
+#endif
+
     emitPutVirtualRegister(dst, regT2);
 
     // Increment i
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
index 424111191d..bf367a6077 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -33,6 +33,7 @@
 #include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
+#include "JSPropertyNameIterator.h"
 #include "Interpreter.h"
 #include "LinkBuffer.h"
 #include "RepatchBuffer.h"
@@ -934,6 +935,69 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
 
 #endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID structure, RegisterID offset)
+{
+    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
+    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
+    ASSERT(sizeof(JSValue) == 8);
+
+    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
+    Jump finishedLoad = jump();
+    notUsingInlineStorage.link(this);
+    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
+    finishedLoad.link(this);
+}
+
+void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    unsigned expected = currentInstruction[4].u.operand;
+    unsigned iter = currentInstruction[5].u.operand;
+    unsigned i = currentInstruction[6].u.operand;
+
+    emitLoad2(property, regT1, regT0, base, regT3, regT2);
+    emitJumpSlowCaseIfNotJSCell(property, regT1);
+    addSlowCase(branchPtr(NotEqual, regT0, payloadFor(expected)));
+    // Property registers are now available as the property is known
+    emitJumpSlowCaseIfNotJSCell(base, regT3);
+    emitLoadPayload(iter, regT1);
+    
+    // Test base's structure
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
+    addSlowCase(branchPtr(NotEqual, regT0, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure))));
+    load32(addressFor(i), regT3);
+    sub32(Imm32(1), regT3);
+    addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
+    compileGetDirectOffset(regT2, regT1, regT0, regT0, regT3);    
+
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_pname), dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_get_by_pname(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    linkSlowCaseIfNotJSCell(iter, property);
+    linkSlowCase(iter);
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    
+    JITStubCall stubCall(this, cti_op_get_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.call(dst);
+}
+
 #else // USE(JSVALUE32_64)
 
 void JIT::emit_op_get_by_val(Instruction* currentInstruction)
@@ -967,6 +1031,48 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
     emitPutVirtualRegister(dst);
 }
 
+void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    unsigned expected = currentInstruction[4].u.operand;
+    unsigned iter = currentInstruction[5].u.operand;
+    unsigned i = currentInstruction[6].u.operand;
+
+    emitGetVirtualRegister(property, regT0);
+    addSlowCase(branchPtr(NotEqual, regT0, addressFor(expected)));
+    emitGetVirtualRegisters(base, regT0, iter, regT1);
+    emitJumpSlowCaseIfNotJSCell(regT0, base);
+
+    // Test base's structure
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    addSlowCase(branchPtr(NotEqual, regT2, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure))));
+    load32(addressFor(i), regT3);
+    sub32(Imm32(1), regT3);
+    addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
+    compileGetDirectOffset(regT0, regT0, regT2, regT3, regT1);
+
+    emitPutVirtualRegister(dst, regT0);
+}
+
+void JIT::emitSlow_op_get_by_pname(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+
+    linkSlowCase(iter);
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, cti_op_get_by_val);
+    stubCall.addArgument(base, regT2);
+    stubCall.addArgument(property, regT2);
+    stubCall.call(dst);
+}
+
 void JIT::emit_op_put_by_val(Instruction* currentInstruction)
 {
     unsigned base = currentInstruction[1].u.operand;
@@ -1132,9 +1238,9 @@ void JIT::emit_op_method_check(Instruction* currentInstruction)
 
     Jump match = jump();
 
-    ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
-    ASSERT(differenceBetween(info.structureToCompare, protoStructureToCompare) == patchOffsetMethodCheckProtoStruct);
-    ASSERT(differenceBetween(info.structureToCompare, putFunction) == patchOffsetMethodCheckPutFunction);
+    ASSERT_JIT_OFFSET(differenceBetween(info.structureToCompare, protoObj), patchOffsetMethodCheckProtoObj);
+    ASSERT_JIT_OFFSET(differenceBetween(info.structureToCompare, protoStructureToCompare), patchOffsetMethodCheckProtoStruct);
+    ASSERT_JIT_OFFSET(differenceBetween(info.structureToCompare, putFunction), patchOffsetMethodCheckPutFunction);
 
     // Link the failure cases here.
     notCell.link(this);
@@ -1201,22 +1307,22 @@ void JIT::compileGetByIdHotPath(int, int baseVReg, Identifier*, unsigned propert
     DataLabelPtr structureToCompare;
     Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
     addSlowCase(structureCheck);
-    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetGetByIdStructure);
-    ASSERT(differenceBetween(hotPathBegin, structureCheck) == patchOffsetGetByIdBranchToSlowCase);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureToCompare), patchOffsetGetByIdStructure);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureCheck), patchOffsetGetByIdBranchToSlowCase)
 
     Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
     Label externalLoadComplete(this);
-    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetGetByIdExternalLoad);
-    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthGetByIdExternalLoad);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, externalLoad), patchOffsetGetByIdExternalLoad);
+    ASSERT_JIT_OFFSET(differenceBetween(externalLoad, externalLoadComplete), patchLengthGetByIdExternalLoad);
 
     DataLabel32 displacementLabel = loadPtrWithAddressOffsetPatch(Address(regT0, patchGetByIdDefaultOffset), regT0);
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel) == patchOffsetGetByIdPropertyMapOffset);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, displacementLabel), patchOffsetGetByIdPropertyMapOffset);
 
     Label putResult(this);
 
     END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
 
-    ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, putResult), patchOffsetGetByIdPutResult);
 }
 
 void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -1251,7 +1357,7 @@ void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident
 
     END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
 
-    ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
+    ASSERT_JIT_OFFSET(differenceBetween(coldPathBegin, call), patchOffsetGetByIdSlowCaseCall);
 
     // Track the location of the call; this will be used to recover patch information.
     m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
@@ -1282,19 +1388,19 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
     // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
     DataLabelPtr structureToCompare;
     addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
-    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetPutByIdStructure);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureToCompare), patchOffsetPutByIdStructure);
 
     // Plant a load from a bogus ofset in the object's property map; we will patch this later, if it is to be used.
     Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
     Label externalLoadComplete(this);
-    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetPutByIdExternalLoad);
-    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, externalLoad), patchOffsetPutByIdExternalLoad);
+    ASSERT_JIT_OFFSET(differenceBetween(externalLoad, externalLoadComplete), patchLengthPutByIdExternalLoad);
 
     DataLabel32 displacementLabel = storePtrWithAddressOffsetPatch(regT1, Address(regT0, patchGetByIdDefaultOffset));
 
     END_UNINTERRUPTED_SEQUENCE(sequencePutById);
 
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel) == patchOffsetPutByIdPropertyMapOffset);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, displacementLabel), patchOffsetPutByIdPropertyMapOffset);
 }
 
 void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -1351,6 +1457,20 @@ void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID res
     } 
 }
 
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID structure, RegisterID offset, RegisterID scratch)
+{
+    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
+    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
+
+    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
+    loadPtr(BaseIndex(base, offset, ScalePtr, OBJECT_OFFSETOF(JSObject, m_inlineStorage)), result);
+    Jump finishedLoad = jump();
+    notUsingInlineStorage.link(this);
+    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), scratch);
+    loadPtr(BaseIndex(scratch, offset, ScalePtr, 0), result);    
+    finishedLoad.link(this);
+}
+
 void JIT::testPrototype(Structure* structure, JumpList& failureCases)
 {
     if (structure->m_prototype.isNull())
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
index 457518c50d..c999618ec5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
@@ -75,25 +75,12 @@ namespace JSC {
 #define THUMB_FUNC_PARAM(name)
 #endif
 
-#if PLATFORM(LINUX) && (PLATFORM(X86_64) || PLATFORM(X86))
+#if PLATFORM(LINUX) && PLATFORM(X86_64)
 #define SYMBOL_STRING_RELOCATION(name) #name "@plt"
 #else
 #define SYMBOL_STRING_RELOCATION(name) SYMBOL_STRING(name)
 #endif
 
-#if PLATFORM(DARWIN)
-    // Mach-O platform
-#define HIDE_SYMBOL(name) ".private_extern _" #name
-#elif PLATFORM(AIX)
-    // IBM's own file format
-#define HIDE_SYMBOL(name) ".lglobl " #name
-#elif PLATFORM(LINUX) || PLATFORM(FREEBSD) || PLATFORM(OPENBSD) || PLATFORM(SOLARIS) || (PLATFORM(HPUX) && PLATFORM(IA64)) || PLATFORM(SYMBIAN) || PLATFORM(NETBSD)
-    // ELF platform
-#define HIDE_SYMBOL(name) ".hidden " #name
-#else
-#define HIDE_SYMBOL(name)
-#endif
-
 #if USE(JSVALUE32_64)
 
 #if COMPILER(GCC) && PLATFORM(X86)
@@ -106,9 +93,7 @@ COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x58, JITStackFrame_
 COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x50, JITStackFrame_code_offset_matches_ctiTrampoline);
 
 asm volatile (
-".text\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "pushl %ebp" "\n"
     "movl %esp, %ebp" "\n"
@@ -129,7 +114,6 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 #if !USE(JIT_STUB_ARGUMENT_VA_LIST)
     "movl %esp, %ecx" "\n"
@@ -145,7 +129,6 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     
 asm volatile (
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "addl $0x3c, %esp" "\n"
     "popl %ebx" "\n"
@@ -170,7 +153,6 @@ COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x80, JITStackFrame_code_
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "pushq %rbp" "\n"
     "movq %rsp, %rbp" "\n"
@@ -197,7 +179,6 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "movq %rsp, %rdi" "\n"
     "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
@@ -213,7 +194,6 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "addq $0x48, %rsp" "\n"
     "popq %rbx" "\n"
@@ -235,7 +215,6 @@ asm volatile (
 ".text" "\n"
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
 ".thumb" "\n"
 ".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
@@ -262,7 +241,6 @@ asm volatile (
 ".text" "\n"
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 ".thumb" "\n"
 ".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
@@ -368,9 +346,7 @@ COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x30, JITStackFrame_code_
 COMPILE_ASSERT(offsetof(struct JITStackFrame, savedEBX) == 0x1c, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
 
 asm volatile (
-".text\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "pushl %ebp" "\n"
     "movl %esp, %ebp" "\n"
@@ -391,7 +367,6 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 #if !USE(JIT_STUB_ARGUMENT_VA_LIST)
     "movl %esp, %ecx" "\n"
@@ -407,7 +382,6 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     
 asm volatile (
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "addl $0x1c, %esp" "\n"
     "popl %ebx" "\n"
@@ -430,9 +404,7 @@ COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x48, JITStackFrame_code_
 COMPILE_ASSERT(offsetof(struct JITStackFrame, savedRBX) == 0x78, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
 
 asm volatile (
-".text\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "pushq %rbp" "\n"
     "movq %rsp, %rbp" "\n"
@@ -466,7 +438,6 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "movq %rsp, %rdi" "\n"
     "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
@@ -482,7 +453,6 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "addq $0x78, %rsp" "\n"
     "popq %rbx" "\n"
@@ -504,7 +474,6 @@ asm volatile (
 ".text" "\n"
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
 ".thumb" "\n"
 ".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
@@ -531,7 +500,6 @@ asm volatile (
 ".text" "\n"
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 ".thumb" "\n"
 ".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
@@ -549,7 +517,6 @@ asm volatile (
 ".text" "\n"
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
 ".thumb" "\n"
 ".thumb_func " THUMB_FUNC_PARAM(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
@@ -564,45 +531,31 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
 #elif COMPILER(GCC) && PLATFORM(ARM_TRADITIONAL)
 
 asm volatile (
-".text\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "stmdb sp!, {r1-r3}" "\n"
     "stmdb sp!, {r4-r8, lr}" "\n"
-    "mov r6, pc" "\n"
-    "add r6, r6, #40" "\n"
-    "sub sp, sp, #32" "\n"
-    "ldr r4, [sp, #60]" "\n"
+    "sub sp, sp, #36" "\n"
+    "mov r4, r2" "\n"
     "mov r5, #512" "\n"
-    // r0 contains the code
-    "add r8, pc, #4" "\n"
-    "str r8, [sp, #-4]!" "\n"
+    "mov lr, pc" "\n"
     "mov pc, r0" "\n"
-    "add sp, sp, #32" "\n"
+    "add sp, sp, #36" "\n"
     "ldmia sp!, {r4-r8, lr}" "\n"
     "add sp, sp, #12" "\n"
     "mov pc, lr" "\n"
-
-    // the return instruction
-    "ldr pc, [sp], #4" "\n"
 );
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "mov r0, sp" "\n"
-    "mov lr, r6" "\n"
-    "add r8, pc, #4" "\n"
-    "str r8, [sp, #-4]!" "\n"
-    "b " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
+    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
 
 // Both has the same return sequence
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
-    "add sp, sp, #32" "\n"
+    "add sp, sp, #36" "\n"
     "ldmia sp!, {r4-r8, lr}" "\n"
     "add sp, sp, #12" "\n"
     "mov pc, lr" "\n"
@@ -935,7 +888,6 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         ".text" "\n" \
         ".align 2" "\n" \
         ".globl " SYMBOL_STRING(cti_##op) "\n" \
-        HIDE_SYMBOL(cti_##op) "\n"             \
         ".thumb" "\n" \
         ".thumb_func " THUMB_FUNC_PARAM(cti_##op) "\n" \
         SYMBOL_STRING(cti_##op) ":" "\n" \
@@ -946,6 +898,22 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         ); \
     rtype JITStubThunked_##op(STUB_ARGS_DECLARATION) \
 
+#elif PLATFORM(ARM_TRADITIONAL) && COMPILER(GCC)
+
+#define DEFINE_STUB_FUNCTION(rtype, op) \
+    extern "C" { \
+        rtype JITStubThunked_##op(STUB_ARGS_DECLARATION); \
+    }; \
+    asm volatile ( \
+        ".globl " SYMBOL_STRING(cti_##op) "\n" \
+        SYMBOL_STRING(cti_##op) ":" "\n" \
+        "str lr, [sp, #32]" "\n" \
+        "bl " SYMBOL_STRING(JITStubThunked_##op) "\n" \
+        "ldr lr, [sp, #32]" "\n" \
+        "mov pc, lr" "\n" \
+        ); \
+    rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
+
 #else
 #define DEFINE_STUB_FUNCTION(rtype, op) rtype JIT_STUB cti_##op(STUB_ARGS_DECLARATION)
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
index ccbcd2a25f..69776cb337 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
@@ -163,6 +163,8 @@ namespace JSC {
         JITStubArg padding; // Unused
         JITStubArg args[7];
 
+        ReturnAddressPtr thunkReturnAddress;
+
         void* preservedR4;
         void* preservedR5;
         void* preservedR6;
@@ -173,11 +175,13 @@ namespace JSC {
         RegisterFile* registerFile;
         CallFrame* callFrame;
         JSValue* exception;
+
+        // These arguments passed on the stack.
         Profiler** enabledProfilerReference;
         JSGlobalData* globalData;
 
         // When JIT code makes a call, it pushes its return address just below the rest of the stack.
-        ReturnAddressPtr* returnAddressSlot() { return reinterpret_cast<ReturnAddressPtr*>(this) - 1; }
+        ReturnAddressPtr* returnAddressSlot() { return &thunkReturnAddress; }
     };
 #else
 #error "JITStackFrame not defined for this platform."
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
index b1e317e468..45009dce44 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
@@ -1477,6 +1477,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     generator.emitNode(base.get(), m_expr);
     RefPtr<RegisterID> i = generator.newTemporary();
     RefPtr<RegisterID> size = generator.newTemporary();
+    RefPtr<RegisterID> expectedSubscript;
     RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), base.get(), i.get(), size.get(), scope->breakTarget());
     generator.emitJump(scope->continueTarget());
 
@@ -1484,6 +1485,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     generator.emitLabel(loopStart.get());
 
     RegisterID* propertyName;
+    bool optimizedForinAccess = false;
     if (m_lexpr->isResolveNode()) {
         const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
         propertyName = generator.registerFor(ident);
@@ -1494,6 +1496,10 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
             generator.emitExpressionInfo(divot(), startOffset(), endOffset());
             generator.emitPutById(base, ident, propertyName);
+        } else {
+            expectedSubscript = generator.emitMove(generator.newTemporary(), propertyName);
+            generator.pushOptimisedForIn(expectedSubscript.get(), iter.get(), i.get(), propertyName);
+            optimizedForinAccess = true;
         }
     } else if (m_lexpr->isDotAccessorNode()) {
         DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
@@ -1518,6 +1524,9 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
     generator.emitNode(dst, m_statement);
 
+    if (optimizedForinAccess)
+        generator.popOptimisedForIn();
+
     generator.emitLabel(scope->continueTarget());
     generator.emitNextPropertyName(propertyName, base.get(), i.get(), size.get(), iter.get(), loopStart.get());
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
index a69115c2a7..b885049348 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
@@ -240,9 +240,7 @@ void Heap::destroy()
 template <HeapType heapType>
 NEVER_INLINE CollectorBlock* Heap::allocateBlock()
 {
-    // Disable the use of vm_map for the Qt build on Darwin, because when compiled on 10.4
-    // it crashes on 10.5
-#if PLATFORM(DARWIN) && !PLATFORM(QT)
+#if PLATFORM(DARWIN)
     vm_address_t address = 0;
     // FIXME: tag the region as a JavaScriptCore heap when we get a registered VM tag: <rdar://problem/6054788>.
     vm_map(current_task(), &address, BLOCK_SIZE, BLOCK_OFFSET_MASK, VM_FLAGS_ANYWHERE | VM_TAG_FOR_COLLECTOR_MEMORY, MEMORY_OBJECT_NULL, 0, FALSE, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
@@ -334,9 +332,7 @@ NEVER_INLINE void Heap::freeBlock(size_t block)
 
 NEVER_INLINE void Heap::freeBlock(CollectorBlock* block)
 {
-    // Disable the use of vm_deallocate for the Qt build on Darwin, because when compiled on 10.4
-    // it crashes on 10.5
-#if PLATFORM(DARWIN) && !PLATFORM(QT)
+#if PLATFORM(DARWIN)    
     vm_deallocate(current_task(), reinterpret_cast<vm_address_t>(block), BLOCK_SIZE);
 #elif PLATFORM(SYMBIAN)
     userChunk->Free(reinterpret_cast<TAny*>(block));
@@ -1291,6 +1287,10 @@ static const char* typeName(JSCell* cell)
 #endif
     if (cell->isGetterSetter())
         return "gettersetter";
+    if (cell->isAPIValueWrapper())
+        return "value wrapper";
+    if (cell->isPropertyNameIterator())
+        return "for-in iterator";
     ASSERT(cell->isObject());
     const ClassInfo* info = cell->classInfo();
     return info ? info->className : "Object";
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
index f9b7d84f5b..9908fef80c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
@@ -112,9 +112,7 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
         }
     }
 
-    DateInstance* result = new (exec) DateInstance(exec->lexicalGlobalObject()->dateStructure());
-    result->setInternalValue(jsNumber(exec, timeClip(value)));
-    return result;
+    return new (exec) DateInstance(exec, value);
 }
     
 static JSObject* constructWithDateConstructor(ExecState* exec, JSObject*, const ArgList& args)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
index 4cd58f5ae0..d4c9ef7408 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
@@ -32,95 +32,43 @@ using namespace WTF;
 
 namespace JSC {
 
-struct DateInstance::Cache {
-    double m_gregorianDateTimeCachedForMS;
-    GregorianDateTime m_cachedGregorianDateTime;
-    double m_gregorianDateTimeUTCCachedForMS;
-    GregorianDateTime m_cachedGregorianDateTimeUTC;
-};
-
 const ClassInfo DateInstance::info = {"Date", 0, 0, 0};
 
-DateInstance::DateInstance(NonNullPassRefPtr<Structure> structure)
+DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structure)
     : JSWrapperObject(structure)
-    , m_cache(0)
 {
+    setInternalValue(jsNaN(exec));
 }
 
 DateInstance::DateInstance(ExecState* exec, double time)
     : JSWrapperObject(exec->lexicalGlobalObject()->dateStructure())
-    , m_cache(0)
 {
     setInternalValue(jsNumber(exec, timeClip(time)));
 }
 
-DateInstance::~DateInstance()
+bool DateInstance::getGregorianDateTime(ExecState* exec, bool outputIsUTC, GregorianDateTime& t) const
 {
-    delete m_cache;
-}
+    double milli = internalNumber();
+    if (isnan(milli))
+        return false;
 
-void DateInstance::msToGregorianDateTime(double milli, bool outputIsUTC, GregorianDateTime& t) const
-{
-    if (!m_cache) {
-        m_cache = new Cache;
-        m_cache->m_gregorianDateTimeCachedForMS = NaN;
-        m_cache->m_gregorianDateTimeUTCCachedForMS = NaN;
-    }
+    if (!m_data)
+        m_data = exec->globalData().dateInstanceCache.add(milli);
 
     if (outputIsUTC) {
-        if (m_cache->m_gregorianDateTimeUTCCachedForMS != milli) {
-            WTF::msToGregorianDateTime(milli, true, m_cache->m_cachedGregorianDateTimeUTC);
-            m_cache->m_gregorianDateTimeUTCCachedForMS = milli;
+        if (m_data->m_gregorianDateTimeUTCCachedForMS != milli) {
+            WTF::msToGregorianDateTime(internalNumber(), true, m_data->m_cachedGregorianDateTimeUTC);
+            m_data->m_gregorianDateTimeUTCCachedForMS = milli;
         }
-        t.copyFrom(m_cache->m_cachedGregorianDateTimeUTC);
+        t.copyFrom(m_data->m_cachedGregorianDateTimeUTC);
     } else {
-        if (m_cache->m_gregorianDateTimeCachedForMS != milli) {
-            WTF::msToGregorianDateTime(milli, false, m_cache->m_cachedGregorianDateTime);
-            m_cache->m_gregorianDateTimeCachedForMS = milli;
+        if (m_data->m_gregorianDateTimeCachedForMS != milli) {
+            WTF::msToGregorianDateTime(internalNumber(), false, m_data->m_cachedGregorianDateTime);
+            m_data->m_gregorianDateTimeCachedForMS = milli;
         }
-        t.copyFrom(m_cache->m_cachedGregorianDateTime);
+        t.copyFrom(m_data->m_cachedGregorianDateTime);
     }
-}
 
-bool DateInstance::getTime(GregorianDateTime& t, int& offset) const
-{
-    double milli = internalNumber();
-    if (isnan(milli))
-        return false;
-    
-    msToGregorianDateTime(milli, false, t);
-    offset = gmtoffset(t);
-    return true;
-}
-
-bool DateInstance::getUTCTime(GregorianDateTime& t) const
-{
-    double milli = internalNumber();
-    if (isnan(milli))
-        return false;
-    
-    msToGregorianDateTime(milli, true, t);
-    return true;
-}
-
-bool DateInstance::getTime(double& milli, int& offset) const
-{
-    milli = internalNumber();
-    if (isnan(milli))
-        return false;
-    
-    GregorianDateTime t;
-    msToGregorianDateTime(milli, false, t);
-    offset = gmtoffset(t);
-    return true;
-}
-
-bool DateInstance::getUTCTime(double& milli) const
-{
-    milli = internalNumber();
-    if (isnan(milli))
-        return false;
-    
     return true;
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
index 36d90b144b..38b321c699 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
@@ -32,27 +32,26 @@ namespace JSC {
     class DateInstance : public JSWrapperObject {
     public:
         DateInstance(ExecState*, double);
-        explicit DateInstance(NonNullPassRefPtr<Structure>);
-        virtual ~DateInstance();
+        explicit DateInstance(ExecState*, NonNullPassRefPtr<Structure>);
 
         double internalNumber() const { return internalValue().uncheckedGetNumber(); }
 
-        bool getTime(WTF::GregorianDateTime&, int& offset) const;
-        bool getUTCTime(WTF::GregorianDateTime&) const;
-        bool getTime(double& milliseconds, int& offset) const;
-        bool getUTCTime(double& milliseconds) const;
-
         static JS_EXPORTDATA const ClassInfo info;
 
-        void msToGregorianDateTime(double, bool outputIsUTC, WTF::GregorianDateTime&) const;
+        bool getGregorianDateTime(ExecState*, bool outputIsUTC, WTF::GregorianDateTime&) const;
+
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+        }
+
+    protected:
+        static const unsigned StructureFlags = OverridesMarkChildren | JSWrapperObject::StructureFlags;
 
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
 
-        using JSWrapperObject::internalValue;
-
-        struct Cache;
-        mutable Cache* m_cache;
+        mutable RefPtr<DateInstanceData> m_data;
     };
 
     DateInstance* asDateInstance(JSValue);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstanceCache.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstanceCache.h
new file mode 100644
index 0000000000..b626c1dd28
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstanceCache.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DateInstanceCache_h
+#define DateInstanceCache_h
+
+#include <wtf/DateMath.h>
+#include <wtf/HashFunctions.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace JSC {
+
+    extern const double NaN;
+
+    class DateInstanceData : public RefCounted<DateInstanceData> {
+    public:
+        static PassRefPtr<DateInstanceData> create() { return adoptRef(new DateInstanceData); }
+
+        double m_gregorianDateTimeCachedForMS;
+        WTF::GregorianDateTime m_cachedGregorianDateTime;
+        double m_gregorianDateTimeUTCCachedForMS;
+        WTF::GregorianDateTime m_cachedGregorianDateTimeUTC;
+
+    private:
+        DateInstanceData()
+            : m_gregorianDateTimeCachedForMS(NaN)
+            , m_gregorianDateTimeUTCCachedForMS(NaN)
+        {
+        }
+    };
+
+    class DateInstanceCache {
+    public:
+        DateInstanceCache()
+        {
+            for (size_t i = 0; i < cacheSize; ++i)
+                m_cache[i].key = NaN;
+        }
+        
+        DateInstanceData* add(double d)
+        {
+            CacheEntry& entry = lookup(d);
+            if (d == entry.key)
+                return entry.value.get();
+
+            entry.key = d;
+            entry.value = DateInstanceData::create();
+            return entry.value.get();
+        }
+
+    private:
+        static const size_t cacheSize = 64;
+
+        struct CacheEntry {
+            double key;
+            RefPtr<DateInstanceData> value;
+        };
+
+        CacheEntry& lookup(double d) { return m_cache[WTF::FloatHash<double>::hash(d) & (cacheSize - 1)]; }
+
+        CacheEntry m_cache[cacheSize];
+    };
+
+} // namespace JSC
+
+#endif // DateInstanceCache_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
index e46ab67a32..3f3e1f915a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
@@ -251,11 +251,12 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, L
     return jsNontrivialString(exec, timebuffer);
 }
 
-static JSCell* formatLocaleDate(ExecState* exec, DateInstance* dateObject, double timeInMilliseconds, LocaleDateTimeFormat format, const ArgList&)
+static JSCell* formatLocaleDate(ExecState* exec, DateInstance* dateObject, double, LocaleDateTimeFormat format, const ArgList&)
 {
     GregorianDateTime gregorianDateTime;
-    const bool notUTC = false;
-    dateObject->msToGregorianDateTime(timeInMilliseconds, notUTC, gregorianDateTime);
+    const bool outputIsUTC = false;
+    if (!dateObject->getGregorianDateTime(exec, outputIsUTC, gregorianDateTime))
+        return jsNontrivialString(exec, "Invalid Date");
     return formatLocaleDate(exec, gregorianDateTime, format);
 }
 
@@ -396,9 +397,8 @@ const ClassInfo DatePrototype::info = {"Date", &DateInstance::info, 0, ExecState
 // ECMA 15.9.4
 
 DatePrototype::DatePrototype(ExecState* exec, NonNullPassRefPtr<Structure> structure)
-    : DateInstance(structure)
+    : DateInstance(exec, structure)
 {
-    setInternalValue(jsNaN(exec));
     // The constructor will be added later, after DateConstructor has been built.
 }
 
@@ -420,16 +420,14 @@ JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return jsNontrivialString(exec, formatDate(t) + " " + formatTime(t, utc));
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNontrivialString(exec, "Invalid Date");
+    return jsNontrivialString(exec, formatDate(t) + " " + formatTime(t, outputIsUTC));
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -437,16 +435,14 @@ JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, utc));
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNontrivialString(exec, "Invalid Date");
+    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, outputIsUTC));
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -454,19 +450,17 @@ JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
     
-    const bool utc = true;
+    const bool outputIsUTC = true;
     
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (!isfinite(milli))
-        return jsNontrivialString(exec, "Invalid Date");
     
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNontrivialString(exec, "Invalid Date");
     // Maximum amount of space we need in buffer: 6 (max. digits in year) + 2 * 5 (2 characters each for month, day, hour, minute, second) + 4 (. + 3 digits for milliseconds)
     // 6 for formatting and one for null termination = 27.  We add one extra character to allow us to force null termination.
     char buffer[28];
-    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + t.year, t.month + 1, t.monthDay, t.hour, t.minute, t.second, static_cast<int>(fmod(milli, 1000)));
+    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + t.year, t.month + 1, t.monthDay, t.hour, t.minute, t.second, static_cast<int>(fmod(thisDateObj->internalNumber(), 1000)));
     buffer[sizeof(buffer) - 1] = 0;
     return jsNontrivialString(exec, buffer);
 }
@@ -476,15 +470,13 @@ JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec, JSObject*, JSVa
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNontrivialString(exec, "Invalid Date");
     return jsNontrivialString(exec, formatDate(t));
 }
 
@@ -493,16 +485,14 @@ JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSVa
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return jsNontrivialString(exec, formatTime(t, utc));
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNontrivialString(exec, "Invalid Date");
+    return jsNontrivialString(exec, formatTime(t, outputIsUTC));
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -511,11 +501,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JS
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
-
-    return formatLocaleDate(exec, thisDateObj, milli, LocaleDateAndTime, args);
+    return formatLocaleDate(exec, thisDateObj, thisDateObj->internalNumber(), LocaleDateAndTime, args);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -524,11 +510,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
-
-    return formatLocaleDate(exec, thisDateObj, milli, LocaleDate, args);
+    return formatLocaleDate(exec, thisDateObj, thisDateObj->internalNumber(), LocaleDate, args);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -537,11 +519,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
-
-    return formatLocaleDate(exec, thisDateObj, milli, LocaleTime, args);
+    return formatLocaleDate(exec, thisDateObj, thisDateObj->internalNumber(), LocaleTime, args);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -549,12 +527,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
-
-    return jsNumber(exec, milli);
+    return asDateInstance(thisValue)->internalValue(); 
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -562,15 +535,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, 1900 + t.year);
 }
 
@@ -579,15 +550,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JS
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, 1900 + t.year);
 }
 
@@ -596,16 +565,14 @@ JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, utc));
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNontrivialString(exec, "Invalid Date");
+    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, outputIsUTC));
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -613,15 +580,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.month);
 }
 
@@ -630,15 +595,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.month);
 }
 
@@ -647,15 +610,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.monthDay);
 }
 
@@ -664,15 +625,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.monthDay);
 }
 
@@ -681,15 +640,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue th
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.weekDay);
 }
 
@@ -698,15 +655,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.weekDay);
 }
 
@@ -715,15 +670,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.hour);
 }
 
@@ -732,15 +685,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.hour);
 }
 
@@ -749,15 +700,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.minute);
 }
 
@@ -766,15 +715,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSV
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.minute);
 }
 
@@ -783,15 +730,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.second);
 }
 
@@ -800,15 +745,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSV
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.second);
 }
 
@@ -847,15 +790,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*,
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, -gmtoffset(t) / minutesPerHour);
 }
 
@@ -890,7 +831,7 @@ static JSValue setNewValueFromTimeArgs(ExecState* exec, JSValue thisValue, const
     double ms = milli - secs * msPerSecond;
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, inputIsUTC, t);
+    thisDateObj->getGregorianDateTime(exec, inputIsUTC, t);
 
     if (!fillStructuresUsingTimeArgs(exec, args, numArgsToUse, &ms, &t)) {
         JSValue result = jsNaN(exec);
@@ -922,11 +863,11 @@ static JSValue setNewValueFromDateArgs(ExecState* exec, JSValue thisValue, const
     if (numArgsToUse == 3 && isnan(milli))
         // Based on ECMA 262 15.9.5.40 - .41 (set[UTC]FullYear)
         // the time must be reset to +0 if it is NaN. 
-        thisDateObj->msToGregorianDateTime(0, true, t);
+        WTF::msToGregorianDateTime(0, true, t);
     else {
         double secs = floor(milli / msPerSecond);
         ms = milli - secs * msPerSecond;
-        thisDateObj->msToGregorianDateTime(milli, inputIsUTC, t);
+        thisDateObj->getGregorianDateTime(exec, inputIsUTC, t);
     }
     
     if (!fillStructuresUsingDateArgs(exec, args, numArgsToUse, &ms, &t)) {
@@ -1029,7 +970,7 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue);     
     if (args.isEmpty()) { 
@@ -1045,11 +986,11 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
     if (isnan(milli))
         // Based on ECMA 262 B.2.5 (setYear)
         // the time must be reset to +0 if it is NaN. 
-        thisDateObj->msToGregorianDateTime(0, true, t);
+        WTF::msToGregorianDateTime(0, true, t);
     else {   
         double secs = floor(milli / msPerSecond);
         ms = milli - secs * msPerSecond;
-        thisDateObj->msToGregorianDateTime(milli, utc, t);
+        thisDateObj->getGregorianDateTime(exec, outputIsUTC, t);
     }
     
     bool ok = true;
@@ -1061,7 +1002,7 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
     }
             
     t.year = (year > 99 || year < 0) ? year - 1900 : year;
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, utc));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, outputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
@@ -1071,15 +1012,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
 
     // NOTE: IE returns the full year even in getYear.
     return jsNumber(exec, t.year);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
index 5fe4f47aa7..f565775499 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
@@ -43,7 +43,7 @@ namespace JSC {
         }
 
     protected:
-        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | DateInstance::StructureFlags;
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | DateInstance::StructureFlags;
 
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
index 16a5131516..722ae339ed 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
@@ -59,6 +59,7 @@ namespace JSC {
         virtual bool isGetterSetter() const;
         bool inherits(const ClassInfo*) const;
         virtual bool isAPIValueWrapper() const { return false; }
+        virtual bool isPropertyNameIterator() const { return false; }
 
         Structure* structure() const;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
index b4356c4969..fcac9aaaa0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
@@ -66,7 +66,7 @@ namespace JSC {
 
         NativeFunction nativeFunction()
         {
-            return *reinterpret_cast<NativeFunction*>(m_data);
+            return *WTF::bitwise_cast<NativeFunction*>(m_data);
         }
 
         virtual ConstructType getConstructData(ConstructData&);
@@ -97,7 +97,7 @@ namespace JSC {
         ScopeChain& scopeChain()
         {
             ASSERT(!isHostFunctionNonInline());
-            return *reinterpret_cast<ScopeChain*>(m_data);
+            return *WTF::bitwise_cast<ScopeChain*>(m_data);
         }
         void clearScopeChain()
         {
@@ -112,11 +112,11 @@ namespace JSC {
         void setScopeChain(const ScopeChain& sc)
         {
             ASSERT(!isHostFunctionNonInline());
-            *reinterpret_cast<ScopeChain*>(m_data) = sc;
+            *WTF::bitwise_cast<ScopeChain*>(m_data) = sc;
         }
         void setNativeFunction(NativeFunction func)
         {
-            *reinterpret_cast<NativeFunction*>(m_data) = func;
+            *WTF::bitwise_cast<NativeFunction*>(m_data) = func;
         }
         unsigned char m_data[sizeof(void*)];
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
index 3ad90ad8d1..d2aa2da436 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
@@ -30,6 +30,7 @@
 #define JSGlobalData_h
 
 #include "Collector.h"
+#include "DateInstanceCache.h"
 #include "ExecutableAllocator.h"
 #include "JITStubs.h"
 #include "JSValue.h"
@@ -116,7 +117,8 @@ namespace JSC {
         const MarkedArgumentBuffer* emptyList; // Lists are supposed to be allocated on the stack to have their elements properly marked, which is not the case here - but this list has nothing to mark.
         SmallStrings smallStrings;
         NumericStrings numericStrings;
-
+        DateInstanceCache dateInstanceCache;
+        
 #if ENABLE(ASSEMBLER)
         ExecutableAllocator executableAllocator;
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
index 1dbab945f9..5a89c40a8a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
@@ -202,8 +202,8 @@ namespace JSC {
         void allocatePropertyStorageInline(size_t oldSize, size_t newSize);
         bool isUsingInlineStorage() const { return m_structure->isUsingInlineStorage(); }
 
-        static const size_t inlineStorageCapacity = sizeof(EncodedJSValue) == 2 * sizeof(void*) ? 4 : 3;
-        static const size_t nonInlineBaseStorageCapacity = 16;
+        static const unsigned inlineStorageCapacity = sizeof(EncodedJSValue) == 2 * sizeof(void*) ? 4 : 3;
+        static const unsigned nonInlineBaseStorageCapacity = 16;
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index 2cd9f75dc9..6fd03446eb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -43,7 +43,12 @@ JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject
 
     PropertyNameArray propertyNames(exec);
     o->getPropertyNames(exec, propertyNames);
-    JSPropertyNameIterator* jsPropertyNameIterator = new (exec) JSPropertyNameIterator(exec, propertyNames.data());
+    size_t numCacheableSlots = 0;
+    if (!o->structure()->hasNonEnumerableProperties() && !o->structure()->hasAnonymousSlots() &&
+        !o->structure()->isUncacheableDictionary() && !o->structure()->typeInfo().overridesGetPropertyNames())
+        numCacheableSlots = o->structure()->propertyStorageSize();
+
+    JSPropertyNameIterator* jsPropertyNameIterator = new (exec) JSPropertyNameIterator(exec, propertyNames.data(), numCacheableSlots);
 
     if (o->structure()->isDictionary())
         return jsPropertyNameIterator;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
index 0559e0b5ee..529ae8b363 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -50,8 +50,18 @@ namespace JSC {
             return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren));
         }
 
+        virtual bool isPropertyNameIterator() const { return true; }
+
         virtual void markChildren(MarkStack&);
 
+        bool getOffset(size_t i, int& offset)
+        {
+            if (i >= m_numCacheableSlots)
+                return false;
+            offset = i;
+            return true;
+        }
+
         JSValue get(ExecState*, JSObject*, size_t i);
         size_t size() { return m_jsStringsSize; }
 
@@ -62,17 +72,19 @@ namespace JSC {
         StructureChain* cachedPrototypeChain() { return m_cachedPrototypeChain.get(); }
 
     private:
-        JSPropertyNameIterator(ExecState*, PropertyNameArrayData* propertyNameArrayData);
+        JSPropertyNameIterator(ExecState*, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlot);
 
         Structure* m_cachedStructure;
         RefPtr<StructureChain> m_cachedPrototypeChain;
-        size_t m_jsStringsSize;
+        uint32_t m_numCacheableSlots;
+        uint32_t m_jsStringsSize;
         OwnArrayPtr<JSValue> m_jsStrings;
     };
 
-inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, PropertyNameArrayData* propertyNameArrayData)
+inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlots)
     : JSCell(exec->globalData().propertyNameIteratorStructure.get())
     , m_cachedStructure(0)
+    , m_numCacheableSlots(numCacheableSlots)
     , m_jsStringsSize(propertyNameArrayData->propertyNameVector().size())
     , m_jsStrings(new JSValue[m_jsStringsSize])
 {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
index a11050f7dd..65b62f9532 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
@@ -375,6 +375,7 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
     transition->m_specificValueInPrevious = specificValue;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
+    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
 
     if (structure->m_propertyTable) {
         if (structure->m_isPinnedPropertyTable)
@@ -417,6 +418,7 @@ PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure,
 
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
+    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
 
     // Don't set m_offset, as one can not transition to this.
 
@@ -433,6 +435,7 @@ PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structur
 
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
+    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
 
     // Don't set m_offset, as one can not transition to this.
 
@@ -464,6 +467,7 @@ PassRefPtr<Structure> Structure::addAnonymousSlotsTransition(Structure* structur
     transition->m_specificValueInPrevious = 0;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
+    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
 
     if (structure->m_propertyTable) {
         if (structure->m_isPinnedPropertyTable)
@@ -492,6 +496,7 @@ PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
     RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = transition->m_hasGetterSetterProperties;
+    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
 
     // Don't set m_offset, as one can not transition to this.
 
@@ -510,6 +515,7 @@ PassRefPtr<Structure> Structure::toDictionaryTransition(Structure* structure, Di
     transition->m_dictionaryKind = kind;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
+    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
     
     structure->materializePropertyMapIfNecessary();
     transition->m_propertyTable = structure->copyPropertyTable();
@@ -550,6 +556,9 @@ size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, u
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
+    if (attributes & DontEnum)
+        m_hasNonEnumerableProperties = true;
+
     size_t offset = put(propertyName, attributes, specificValue);
     if (propertyStorageSize() > propertyStorageCapacity())
         growPropertyStorageCapacity();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
index 2496c1b4d4..f355c532d4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
@@ -95,8 +95,8 @@ namespace JSC {
         Structure* previousID() const { return m_previous.get(); }
 
         void growPropertyStorageCapacity();
-        size_t propertyStorageCapacity() const { return m_propertyStorageCapacity; }
-        size_t propertyStorageSize() const { return m_propertyTable ? m_propertyTable->keyCount + m_propertyTable->anonymousSlotCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : m_offset + 1; }
+        unsigned propertyStorageCapacity() const { return m_propertyStorageCapacity; }
+        unsigned propertyStorageSize() const { return m_propertyTable ? m_propertyTable->keyCount + m_propertyTable->anonymousSlotCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : m_offset + 1; }
         bool isUsingInlineStorage() const;
 
         size_t get(const Identifier& propertyName);
@@ -119,6 +119,10 @@ namespace JSC {
         bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
         void setHasGetterSetterProperties(bool hasGetterSetterProperties) { m_hasGetterSetterProperties = hasGetterSetterProperties; }
 
+        bool hasNonEnumerableProperties() const { return m_hasNonEnumerableProperties; }
+
+        bool hasAnonymousSlots() const { return m_propertyTable && m_propertyTable->anonymousSlotCount; }
+        
         bool isEmpty() const { return m_propertyTable ? !m_propertyTable->keyCount : m_offset == noOffset; }
 
         JSCell* specificValue() { return m_specificValueInPrevious; }
@@ -190,12 +194,13 @@ namespace JSC {
 
         PropertyMapHashTable* m_propertyTable;
 
-        size_t m_propertyStorageCapacity;
+        uint32_t m_propertyStorageCapacity;
         signed char m_offset;
 
         unsigned m_dictionaryKind : 2;
         bool m_isPinnedPropertyTable : 1;
         bool m_hasGetterSetterProperties : 1;
+        bool m_hasNonEnumerableProperties : 1;
 #if COMPILER(WINSCW)
         // Workaround for Symbian WINSCW compiler that cannot resolve unsigned type of the declared 
         // bitfield, when used as argument in make_pair() function calls in structure.ccp.
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
index a3d52906e2..b36cae5abb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
@@ -63,6 +63,10 @@ extern "C" time_t mktime(struct tm *t);
 #include <sys/time.h>
 #endif
 
+#if PLATFORM(CHROMIUM)
+#error Chromium uses a different timer implementation
+#endif
+
 namespace WTF {
 
 const double msPerSecond = 1000.0;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
index 0386494941..2110432c31 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
@@ -501,13 +501,13 @@ double gregorianDateTimeToMS(const GregorianDateTime& t, double milliSeconds, bo
     return result;
 }
 
+// input is UTC
 void msToGregorianDateTime(double ms, bool outputIsUTC, GregorianDateTime& tm)
 {
-    // input is UTC
     double dstOff = 0.0;
-    const double utcOff = getUTCOffset();
-
-    if (!outputIsUTC) {  // convert to local time
+    double utcOff = 0.0;
+    if (!outputIsUTC) {
+        utcOff = getUTCOffset();
         dstOff = getDSTOffset(ms, utcOff);
         ms += dstOff + utcOff;
     }
@@ -522,8 +522,7 @@ void msToGregorianDateTime(double ms, bool outputIsUTC, GregorianDateTime& tm)
     tm.month    =  monthFromDayInYear(tm.yearDay, isLeapYear(year));
     tm.year     =  year - 1900;
     tm.isDST    =  dstOff != 0.0;
-
-    tm.utcOffset = outputIsUTC ? 0 : static_cast<long>((dstOff + utcOff) / msPerSecond);
+    tm.utcOffset = static_cast<long>((dstOff + utcOff) / msPerSecond);
     tm.timeZone = NULL;
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
index ca0961c967..541b05d3af 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
@@ -26,13 +26,19 @@
 #include <stdlib.h>
 #include <new>
 
+#if COMPILER(GCC)
+#define WTF_FAST_MALLOC_EXPORT __attribute__((visibility("default")))
+#else
+#define WTF_FAST_MALLOC_EXPORT
+#endif
+
 namespace WTF {
 
     // These functions call CRASH() if an allocation fails.
-    void* fastMalloc(size_t);
+    void* fastMalloc(size_t) WTF_FAST_MALLOC_EXPORT;
     void* fastZeroedMalloc(size_t);
-    void* fastCalloc(size_t numElements, size_t elementSize);
-    void* fastRealloc(void*, size_t);
+    void* fastCalloc(size_t numElements, size_t elementSize) WTF_FAST_MALLOC_EXPORT;
+    void* fastRealloc(void*, size_t) WTF_FAST_MALLOC_EXPORT;
 
     struct TryMallocReturnValue {
         TryMallocReturnValue(void* data)
@@ -71,7 +77,7 @@ namespace WTF {
     TryMallocReturnValue tryFastCalloc(size_t n_elements, size_t element_size);
     TryMallocReturnValue tryFastRealloc(void* p, size_t n);
 
-    void fastFree(void*);
+    void fastFree(void*) WTF_FAST_MALLOC_EXPORT;
 
 #ifndef NDEBUG    
     void fastMallocForbid();
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
index 12291cc318..9c9a4a789a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
@@ -55,9 +55,13 @@ namespace WTF {
         bool waitForMessage(DataType&);
         template<typename Predicate>
         MessageQueueWaitResult waitForMessageFilteredWithTimeout(DataType&, Predicate&, double absoluteTime);
-        void kill();
+
+        template<typename Predicate>
+        void removeIf(Predicate&);
 
         bool tryGetMessage(DataType&);
+
+        void kill();
         bool killed() const;
 
         // The result of isEmpty() is only valid if no other thread is manipulating the queue at the same time.
@@ -149,6 +153,17 @@ namespace WTF {
     }
 
     template<typename DataType>
+    template<typename Predicate>
+    inline void MessageQueue<DataType>::removeIf(Predicate& predicate)
+    {
+        MutexLocker lock(m_mutex);
+        DequeConstIterator<DataType> found = m_queue.end();
+        while ((found = m_queue.findIf(predicate)) != m_queue.end()) {
+            m_queue.remove(found);
+       }
+    }
+
+    template<typename DataType>
     inline bool MessageQueue<DataType>::isEmpty()
     {
         MutexLocker lock(m_mutex);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
index 7151b51499..7632435a98 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
@@ -466,6 +466,7 @@
 #if PLATFORM(MAC) && !PLATFORM(IPHONE)
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
+#define HAVE_PTHREAD_RWLOCK 1
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER) && defined(__x86_64__)
 #define WTF_USE_PLUGIN_HOST_PROCESS 1
 #endif
@@ -482,6 +483,7 @@
 #if PLATFORM(CHROMIUM) && PLATFORM(DARWIN)
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
+#define HAVE_PTHREAD_RWLOCK 1
 #endif
 
 #if PLATFORM(IPHONE)
@@ -498,6 +500,7 @@
 #define HAVE_READLINE 1
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
+#define HAVE_PTHREAD_RWLOCK 1
 #endif
 
 #if PLATFORM(WIN)
@@ -511,6 +514,7 @@
 #if PLATFORM(GTK)
 #if HAVE(PTHREAD_H)
 #define WTF_USE_PTHREADS 1
+#define HAVE_PTHREAD_RWLOCK 1
 #endif
 #endif
 
@@ -518,6 +522,7 @@
 #define HAVE_POSIX_MEMALIGN 1
 #define WTF_USE_CURL 1
 #define WTF_USE_PTHREADS 1
+#define HAVE_PTHREAD_RWLOCK 1
 #define USE_SYSTEM_MALLOC 1
 #define ENABLE_NETSCAPE_PLUGIN_API 0
 #endif
@@ -698,7 +703,7 @@
 #endif
 
 #if !defined(WTF_USE_JSVALUE64) && !defined(WTF_USE_JSVALUE32) && !defined(WTF_USE_JSVALUE32_64)
-#if PLATFORM(X86_64) && (PLATFORM(DARWIN) || PLATFORM(LINUX))
+#if PLATFORM(X86_64) && (PLATFORM(DARWIN) || PLATFORM(LINUX) || PLATFORM(WIN_OS))
 #define WTF_USE_JSVALUE64 1
 #elif PLATFORM(ARM) || PLATFORM(PPC64)
 #define WTF_USE_JSVALUE32 1
@@ -725,8 +730,7 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
 #elif PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)
-    /* Under development, temporarily disabled until 16Mb link range limit in assembler is fixed. */
-    #define ENABLE_JIT 0
+    #define ENABLE_JIT 1
     #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
 /* The JIT is tested & working on x86 Windows */
 #elif PLATFORM(X86) && PLATFORM(WIN)
@@ -792,8 +796,7 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 /* YARR supports x86 & x86-64, and has been tested on Mac and Windows. */
 #if (PLATFORM(X86) && PLATFORM(MAC)) \
  || (PLATFORM(X86_64) && PLATFORM(MAC)) \
- /* Under development, temporarily disabled until 16Mb link range limit in assembler is fixed. */ \
- || (PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE) && 0) \
+ || (PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)) \
  || (PLATFORM(X86) && PLATFORM(WIN))
 #define ENABLE_YARR 1
 #define ENABLE_YARR_JIT 1
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
index d21d1ffccf..c9b574251b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
@@ -32,6 +32,7 @@
 // Use these to declare and define a static local variable (static T;) so that
 //  it is leaked so that its destructors are not called at exit. Using this
 //  macro also allows workarounds a compiler bug present in Apple's version of GCC 4.0.1.
+#ifndef DEFINE_STATIC_LOCAL
 #if COMPILER(GCC) && defined(__APPLE_CC__) && __GNUC__ == 4 && __GNUC_MINOR__ == 0 && __GNUC_PATCHLEVEL__ == 1
 #define DEFINE_STATIC_LOCAL(type, name, arguments) \
     static type* name##Ptr = new type arguments; \
@@ -40,6 +41,7 @@
 #define DEFINE_STATIC_LOCAL(type, name, arguments) \
     static type& name = *new type arguments
 #endif
+#endif
 
 // OBJECT_OFFSETOF: Like the C++ offsetof macro, but you can use it with classes.
 // The magic number 0x4000 is insignificant. We use it to avoid using NULL, since
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
index 56bf43814f..1d4185ccea 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
@@ -51,7 +51,7 @@ static void* threadEntryPoint(void* contextData)
 
     setThreadNameInternal(context->name);
 
-    // Block until our creating thread has completed any extra setup work
+    // Block until our creating thread has completed any extra setup work.
     {
         MutexLocker locker(context->creationMutex);
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
index 515454517d..71c940261f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
@@ -128,7 +128,11 @@ void detachThread(ThreadIdentifier);
 
 #if USE(PTHREADS)
 typedef pthread_mutex_t PlatformMutex;
+#if HAVE(PTHREAD_RWLOCK)
 typedef pthread_rwlock_t PlatformReadWriteLock;
+#else
+typedef void* PlatformReadWriteLock;
+#endif
 typedef pthread_cond_t PlatformCondition;
 #elif PLATFORM(GTK)
 typedef GOwnPtr<GMutex> PlatformMutex;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
index e4fb4198da..6cad5e3618 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
@@ -167,6 +167,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
 
     if (pthread_create(&threadHandle, 0, runThreadWithRegistration, static_cast<void*>(threadData))) {
         LOG_ERROR("Failed to create pthread at entry point %p with data %p", entryPoint, data);
+        delete threadData;
         return 0;
     }
     return establishIdentifierForPthreadHandle(threadHandle);
@@ -270,7 +271,7 @@ void Mutex::unlock()
     ASSERT_UNUSED(result, !result);
 }
 
-
+#if HAVE(PTHREAD_RWLOCK)
 ReadWriteLock::ReadWriteLock()
 {
     pthread_rwlock_init(&m_readWriteLock, NULL);
@@ -324,6 +325,7 @@ void ReadWriteLock::unlock()
     int result = pthread_rwlock_unlock(&m_readWriteLock);
     ASSERT_UNUSED(result, !result);
 }
+#endif  // HAVE(PTHREAD_RWLOCK)
 
 ThreadCondition::ThreadCondition()
 { 
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
index aafea3cf9e..d0880866a3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
@@ -1490,7 +1490,7 @@ public:
         closeBodyAlternative();
     }
 
-    void alterantiveBodyDisjunction()
+    void alternativeBodyDisjunction()
     {
         int newAlternativeIndex = m_bodyDisjunction->terms.size();
         m_bodyDisjunction->terms[m_currentAlternativeIndex].alternative.next = newAlternativeIndex - m_currentAlternativeIndex;
@@ -1499,7 +1499,7 @@ public:
         m_currentAlternativeIndex = newAlternativeIndex;
     }
 
-    void alterantiveDisjunction()
+    void alternativeDisjunction()
     {
         int newAlternativeIndex = m_bodyDisjunction->terms.size();
         m_bodyDisjunction->terms[m_currentAlternativeIndex].alternative.next = newAlternativeIndex - m_currentAlternativeIndex;
@@ -1515,9 +1515,9 @@ public:
 
             if (alt) {
                 if (disjunction == m_pattern.m_body)
-                    alterantiveBodyDisjunction();
+                    alternativeBodyDisjunction();
                 else
-                    alterantiveDisjunction();
+                    alternativeDisjunction();
             }
 
             PatternAlternative* alternative = disjunction->m_alternatives[alt];
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
index b635a451d5..5ce579ab27 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
@@ -1264,7 +1264,7 @@ class RegexGenerator : private MacroAssembler {
         // complex here in compilation, and in the common case we should end up coallescing the checks.
         //
         // FIXME: a nice improvement here may be to stop trying to match sooner, based on the least
-        // of the minimum-alterantive-lengths.  E.g. if I have two alternatives of length 200 and 150,
+        // of the minimum-alternative-lengths.  E.g. if I have two alternatives of length 200 and 150,
         // and a string of length 100, we'll end up looping index from 0 to 100, checking whether there
         // is sufficient input to run either alternative (constantly failing).  If there had been only
         // one alternative, or if the shorter alternative had come first, we would have terminated
@@ -1309,9 +1309,6 @@ class RegexGenerator : private MacroAssembler {
         loadPtr(Address(X86Registers::ebp, 2 * sizeof(void*)), output);
     #endif
 #elif PLATFORM(ARM)
-#if PLATFORM(ARM_TRADITIONAL)
-        push(ARMRegisters::lr);
-#endif
         push(ARMRegisters::r4);
         push(ARMRegisters::r5);
         push(ARMRegisters::r6);
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 488c6a0f90..98f007c13f 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,8 +4,8 @@ This is a snapshot of the Qt port of WebKit from
 
 The commit imported was from the
 
-        qtwebkit-4.6-snapshot-22102009 branch/tag
+        qtwebkit-4.6-snapshot-20091003 branch/tag
 
 and has the sha1 checksum
 
-        0639bb8e812c8923287cd5523248ca64fa5f7a50
+        8f810287200d21aded375664cc0a6ac0476dbdea
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 4e5dff8527..2b36014a14 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,3 +1,4260 @@
+2009-11-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Antti Koivisto.
+
+        [Qt] Build fix for Windows CE
+
+        * plugins/PluginDatabase.cpp:
+
+2009-11-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix Qt build on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30905
+
+        * WebCore.pro:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::create):
+
+2009-10-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Don't run JavaScript URLs in view source mode
+        https://bugs.webkit.org/show_bug.cgi?id=30881
+
+        Just say no.
+
+        Test: http/tests/security/view-source-no-javascript-url.html
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+
+2009-10-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Fixes style problems pointed out by Evan Martin.
+
+        * platform/gtk/Language.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        64-bit Leopard build fix after r50259
+        
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        Declared ATSUTextInserted in 64-bit.
+        (WebCore::fontHasMirroringInfo): Use %d format and cast to int.
+        (WebCore::disableLigatures): Ditto.
+        (WebCore::initializeATSUStyle): Ditto.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Ditto.
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Tiger build fix after r50259
+
+        * platform/graphics/mac/ComplexTextController.h:
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Attempted Tiger build fix after r50259
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+
+2009-10-28  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30899
+        WebKit fails to build release on 32-bit Windows systems
+
+        * WebCore.vcproj/WebCore.vcproj: Excluded files from project.
+        * bindings/js/JSBindingsAllInOne.cpp: Added.
+
+2009-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fixed typos in color names.
+
+        * inspector/front-end/Color.js:
+
+2009-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Share code between the ATSUI- and Core Text-based Font implementations by doing the
+        following:
+        - Generalize CoreTextController as ComplexTextController, keeping the Core Text-specific
+          parts in ComplexTextControllerCoreText.cpp.
+        - Generalize FontMacCoreText as FontComplexTextMac using ComplexTextController
+        - Implement ATSUI-specific parts of ComplexTextController in ComplexTextControllerATSUI.
+        - Remove FontMacATSUI.
+
+        * WebCore.xcodeproj/project.pbxproj: Removed CoreTextController.{cpp,h}, FontMacATSUI.mm,
+        and FontMacCoreText.cpp, and added ComplexTextController.{cpp,h},
+        ComplexTextControllerATSUI.cpp, ComplexTextControllerCoreText.cpp, and
+        FontComplexTextMac.cpp.
+
+        * platform/graphics/mac/ComplexTextController.cpp: Copied from CoreTextController.cpp and
+        kept the non-Core Text-specific bits.
+        (WebCore::ComplexTextController::ComplexTextController): Updated for renames, including
+        its own.
+        (WebCore::ComplexTextController::offsetForPosition): Updated for renames and for
+        m_complexTextRuns holding references instead of objects.
+        (WebCore::ComplexTextController::collectComplexTextRuns): Updated for renames, including
+        its own.
+        (WebCore::ComplexTextController::advance): Updated for renames.
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Updated for renames and for
+        m_complexTextRuns holding references instead of objects, and changed to use the glyphs()
+        and advances() accessors.
+
+        * platform/graphics/mac/ComplexTextController.h: Copied from CoreTextController.h and
+        renamed CoreTextController to ComplexTextController and CoreTextRun to ComplexTextRun. Made
+        the latter RefCounted, added ATSUI-specific members to it, and made some other members
+        Core Text-specific. Renamed m_coreTextRuns to m_complexTextRuns and made it hold references
+        rather than objects.
+        (WebCore::ComplexTextController::ComplexTextRun::create):
+        (WebCore::ComplexTextController::ComplexTextRun::glyphs):
+        (WebCore::ComplexTextController::ComplexTextRun::advances):
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp: Added. Includes ATSUI-specific
+        parts of the ComplexTextController implementation. 
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): This ATSUI
+        callback populates the ComplexTextRun’s glyphs, advances and indices vectors. It is invoked
+        when the ComplexTextRun constructor calls ATSUGetGlyphBounds().
+        (WebCore::isArabicLamWithAlefLigature): Helper function, copied from FontMacATSUI.mm.
+        (WebCore::shapeArabic): Helper function, adapted from FontMacATSUI.mm.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Sets up the
+        ATSUTextLayout, substituting the text buffer if necessary for things like shaping Arabic,
+        mirroring glyphs or directionality overrides, then calls ATSUGetGlyphBounds() in order to
+        get the glyphs, advances and indices vectors populated.
+        (WebCore::fontHasMirroringInfo): Helper function, copied from FontMacATSUI.mm.
+        (WebCore::disableLigatures): Ditto.
+        (WebCore::initializeATSUStyle): Ditto, somewhat cleaned up and simplified.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Constructs
+        ComplexTextRuns, either missing-glyphs ones or ATSUTextLayout-based ones.
+
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp: Copied from
+        CoreTextController.cpp and kept the Core Text-specific bits.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Updated for renames,
+        including its own, and moved the code to initialize m_glyphs and m_advances here. Previously
+        this was done in adjustGlyphsAndAdvances().
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Updated for renames,
+        including its own.
+        * platform/graphics/mac/CoreTextController.cpp: Removed.
+        * platform/graphics/mac/CoreTextController.h: Removed.
+        * platform/graphics/mac/FontComplexTextMac.cpp: Renamed FontMacCoreText.cpp to this.
+        (WebCore::Font::selectionRectForComplexText): Changed to use ComplexTextController instead
+        of CoreTextController.
+        (WebCore::Font::drawComplexText): Ditto.
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        (WebCore::Font::offsetForPositionForComplexText): Ditto.
+        * platform/graphics/mac/FontMacATSUI.mm: Removed.
+        * platform/graphics/mac/FontMacCoreText.cpp: Removed.
+
+2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: add support for 'option' role
+        https://bugs.webkit.org/show_bug.cgi?id=30843
+
+        Test: accessibility/aria-option-role.html
+
+        * accessibility/AccessibilityListBoxOption.h:
+        (WebCore::AccessibilityListBoxOption::canHaveChildren):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+
+2009-10-28  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix GCC compiler warnings in WebCore, and enable -Wall and -Werror for Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=30716
+
+        * WebCore.gyp/WebCore.gyp:  Enable "chromium_code" flag, just on Mac build for now.
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::createARIARoleMap):  Fix struct visibiity warning.
+        * bindings/v8/ScriptCallStack.h:  Fix out-of-order member initialization warning.
+        * bindings/v8/V8Collection.h:
+        (WebCore::getV8Object):  Function in header should not be 'static' (fixes unused-static warning.)
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):  Fix signed/unsigned comparison warning.
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::applyGrouping):  Fix unused-variable warning.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):  Enable ListButtonPart case to avoid
+            warning about missing cases in 'switch' statement.
+        * editing/EditorCommand.cpp:
+        (WebCore::createCommandMap):  Fix struct visibiity warning.
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):  Fix out-of-order member initialization warning.
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart):  Add empty 'default' case in
+            'switch' statement to avoid missing-case warning.
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):  Ditto.
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::createFunctionMap):  Fix struct visibiity warning.
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: crashes in WebCore::RedirectScheduler::timerFired(WebCore::Timer<WebCore::RedirectScheduler>*)
+        https://bugs.webkit.org/show_bug.cgi?id=30839
+
+        Added null check for the case when the frame is detached from the page.
+
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30817
+        Use parentObjectUnignored instead of parentObject in webkit_accessible_get_parent
+
+        Also removes the hack I had originally added to solve bug 25411, because
+        the fix here is what I should have done in the first place.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+
+2009-10-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30805
+        Add MessageQueue::removeIf(Predicate&) to remove certain tasks without pulling them from the queue.
+        Existing Database tests cover this, no change in functionality.
+
+        * storage/DatabaseThread.cpp:
+        (WebCore::SameDatabasePredicate::SameDatabasePredicate): Added predicate that flags the tasks belonging to a specified database.
+        (WebCore::SameDatabasePredicate::operator()):
+        (WebCore::DatabaseThread::unscheduleDatabaseTasks): changed to use the new removeIf method.
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Glue subsequent timeline records with same category
+        and title together.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30885
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+
+2009-10-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fails new test fast/js/navigator-language.html
+        https://bugs.webkit.org/show_bug.cgi?id=30440
+
+        Reimplement WebCore::defaultLanguage to account for changes in
+        locale done by setLocale.
+
+        Already existing test: fast/js/navigator-language.html
+
+        * platform/gtk/Language.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7303145> 
+        Can't exit full screen mode or restart movie after pressing command -R.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::removedFromDocument):
+        (WebCore::HTMLMediaElement::documentWillBecomeInactive):
+            Exit from fullscreen if necessary.
+        * html/HTMLMediaElement.h:
+
+2009-10-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Unreviewed - a trivial fix to get Windows bots running.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30841
+        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
+
+        * platform/network/cf/ResourceRequestCFNet.cpp: (WebCore::setHeaderFields): Don't try to
+        access empty vector's data.
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+
+        Remove the extraneous object of ROLE_PANEL.
+
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+
+2009-10-28  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 30547: (Chromium) searchbox not rendered properly due to the css property -webkit-border-radius
+        https://bugs.webkit.org/show_bug.cgi?id=30547
+
+        Test: fast/css/text-input-with-webkit-border-radius.html
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::paintTextFieldInternal):
+          Implemented rounded border rendering in Chromium Windows theme renderer.
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Pull items collections from resources panel and
+        timeline panel into AbstractTimelinePanel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30875
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel):
+        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
+        (WebInspector.AbstractTimelinePanel.prototype.createItemTreeElement):
+        (WebInspector.AbstractTimelinePanel.prototype.createItemGraph):
+        (WebInspector.AbstractTimelinePanel.prototype._showCategory):
+        (WebInspector.AbstractTimelinePanel.prototype._hideCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.filter):
+        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
+        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.reset):
+        (WebInspector.AbstractTimelinePanel.prototype.get calculator):
+        (WebInspector.AbstractTimelinePanel.prototype.set calculator):
+        (WebInspector.AbstractTimelinePanel.prototype.addItem):
+        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
+        (WebInspector.AbstractTimelinePanel.prototype.refreshItem):
+        (WebInspector.AbstractTimelinePanel.prototype.revealAndSelectItem):
+        (WebInspector.AbstractTimelinePanel.prototype.sortItems):
+        (WebInspector.AbstractTimelinePanel.prototype.adjustScrollPosition):
+        (WebInspector.AbstractTimelineCategory):
+        (WebInspector.AbstractTimelineCategory.prototype.toString):
+        * inspector/front-end/ResourceCategory.js:
+        (WebInspector.ResourceCategory):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.createItemTreeElement):
+        (WebInspector.ResourcesPanel.prototype.createItemGraph):
+        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
+        (WebInspector.ResourcesPanel.prototype.populateSidebar):
+        (WebInspector.ResourcesPanel.prototype.get searchableViews):
+        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction.sortFuction):
+        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction):
+        (WebInspector.ResourcesPanel.prototype.searchMatchFound):
+        (WebInspector.ResourcesPanel.prototype.searchCanceled):
+        (WebInspector.ResourcesPanel.prototype.performSearch):
+        (WebInspector.ResourcesPanel.prototype.refresh):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype.removeResource):
+        (WebInspector.ResourcesPanel.prototype.addMessageToResource):
+        (WebInspector.ResourcesPanel.prototype.clearMessages):
+        (WebInspector.ResourcesPanel.prototype.refreshResource):
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.showResource):
+        (WebInspector.ResourcesPanel.prototype._sortResourcesIfNeeded):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        (WebInspector.ResourcesPanel.prototype.get _resources):
+        (WebInspector.ResourceTimeCalculator.prototype._upperBound):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get categories):
+        (WebInspector.TimelinePanel.prototype.populateSidebar):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.createItemTreeElement):
+        (WebInspector.TimelinePanel.prototype.createItemGraph):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelineCategory):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-10-28  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Resets InspectorFrontend in InspectorTimelineAgent instead of removing it so
+        that it remains active on refreshs and page transitions.
+        https://bugs.webkit.org/show_bug.cgi?id=30874
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::resetFrontendProxyObject):
+        * inspector/InspectorTimelineAgent.h:
+
+2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide a way to get counter values with layoutTestContoller
+        https://bugs.webkit.org/show_bug.cgi?id=30555
+
+        Expose WebCore::counterValueForElement as a WebCore API.
+
+        * WebCore.base.exp:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeCounterValuesFromChildren):
+        (WebCore::counterValueForElement):
+        * rendering/RenderTreeAsText.h:
+
+2009-10-28  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, Chromium build fix for r50225.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+
+2009-10-28  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Adds InspectorTimelineAgent  instrumentation for encountering a
+        <SCRIPT> tag when parsing an HTML document. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=30861
+
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        (WebCore::ScriptSourceCode::startLine):
+        (WebCore::ScriptSourceCode::url):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::willScriptTag):
+        (WebCore::InspectorTimelineAgent::didScriptTag):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createScriptTagTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+
+2009-10-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Makes sure that Geolocation watch IDs remain positive on overflow.
+        https://bugs.webkit.org/show_bug.cgi?id=30122
+
+        No new tests possible.
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::watchPosition): Modified. Reset the watch ID to 1 on overflow.
+
+2009-10-28  George Staikos  <george.staikos@torchmobile.com>
+
+        Attempt to fix the Mac debug build after 50225.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+
+2009-10-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30841
+        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
+
+        Tests: http/tests/ssl/referer-301.html
+               http/tests/ssl/referer-303.html
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+        Remove Referer header if redirecting from https to another protocol.
+
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::clearHTTPReferrer): Update request counterparts, as it is
+        always done when changing or adding header fields.
+        (WebCore::ResourceRequestBase::clearHTTPOrigin): Ditto.
+
+        * platform/network/ResourceRequestBase.h: clearHTTPReferrer() and clearHTTPOrigin() are
+        no longer inline, since they have non-trivial implementations.
+
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest): Fixed to synchronize header field removals.
+        (WebCore::ResourceRequest::doUpdateResourceRequest): Ditto.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::setHeaderFields):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        Match Mac changes.
+        
+2009-10-28  Joe Mason  <jmason@rim.com>
+
+        Reviewed by Adam Treat.
+
+        Add FrameLoader::defaultObjectContentType, containing common code for
+        implementing FrameLoaderClient::objectContentType.  (Currently the gtk
+        and win ports have copied this code, and the qt port uses similar code
+        with a few extra clauses.  Moving this to a utility function cuts down
+        on copied code.)   This causes no behavioural change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30868
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+        * loader/FrameLoader.h:
+
+2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] QWebHistory::saveState() is inconsistent with the Qt API
+        https://bugs.webkit.org/show_bug.cgi?id=30710
+
+        Enforce the versioning, by ignoring any version different
+        from 1.
+
+        * history/qt/HistoryItemQt.cpp:
+        (WebCore::HistoryItem::restoreState):
+        (WebCore::HistoryItem::saveState):
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: follow up fix to InspectorControllerStub.
+        Define it after inspector.js due to namespace
+
+        https://bugs.webkit.org/show_bug.cgi?id=30866
+
+        * inspector/front-end/inspector.html:
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add InspectorController stub in order to
+        support opening in standalone mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30866
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/InspectorControllerStub.js: Added.
+        (.WebInspector.InspectorControllerStub):
+        (.WebInspector.InspectorControllerStub.prototype.wrapCallback):
+        (.WebInspector.InspectorControllerStub.prototype.isWindowVisible):
+        (.WebInspector.InspectorControllerStub.prototype.platform):
+        (.WebInspector.InspectorControllerStub.prototype.closeWindow):
+        (.WebInspector.InspectorControllerStub.prototype.attach):
+        (.WebInspector.InspectorControllerStub.prototype.detach):
+        (.WebInspector.InspectorControllerStub.prototype.storeLastActivePanel):
+        (.WebInspector.InspectorControllerStub.prototype.clearMessages):
+        (.WebInspector.InspectorControllerStub.prototype.searchingForNode):
+        (.WebInspector.InspectorControllerStub.prototype.search):
+        (.WebInspector.InspectorControllerStub.prototype.toggleNodeSearch):
+        (.WebInspector.InspectorControllerStub.prototype.setAttachedWindowHeight):
+        (.WebInspector.InspectorControllerStub.prototype.moveByUnrestricted):
+        (.WebInspector.InspectorControllerStub.prototype.addResourceSourceToFrame):
+        (.WebInspector.InspectorControllerStub.prototype.addSourceToFrame):
+        (.WebInspector.InspectorControllerStub.prototype.getResourceDocumentNode):
+        (.WebInspector.InspectorControllerStub.prototype.highlightDOMNode):
+        (.WebInspector.InspectorControllerStub.prototype.hideDOMNodeHighlight):
+        (.WebInspector.InspectorControllerStub.prototype.inspectedWindow):
+        (.WebInspector.InspectorControllerStub.prototype.loaded):
+        (.WebInspector.InspectorControllerStub.prototype.localizedStringsURL):
+        (.WebInspector.InspectorControllerStub.prototype.windowUnloading):
+        (.WebInspector.InspectorControllerStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorControllerStub.prototype.debuggerEnabled):
+        (.WebInspector.InspectorControllerStub.prototype.enableResourceTracking):
+        (.WebInspector.InspectorControllerStub.prototype.disableResourceTracking):
+        (.WebInspector.InspectorControllerStub.prototype.resourceTrackingEnabled):
+        (.WebInspector.InspectorControllerStub.prototype.enableDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.disableDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.addBreakpoint):
+        (.WebInspector.InspectorControllerStub.prototype.removeBreakpoint):
+        (.WebInspector.InspectorControllerStub.prototype.updateBreakpoint):
+        (.WebInspector.InspectorControllerStub.prototype.pauseInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.pauseOnExceptions):
+        (.WebInspector.InspectorControllerStub.prototype.setPauseOnExceptions):
+        (.WebInspector.InspectorControllerStub.prototype.resumeDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.profilerEnabled):
+        (.WebInspector.InspectorControllerStub.prototype.enableProfiler):
+        (.WebInspector.InspectorControllerStub.prototype.disableProfiler):
+        (.WebInspector.InspectorControllerStub.prototype.startProfiling):
+        (.WebInspector.InspectorControllerStub.prototype.stopProfiling):
+        (.WebInspector.InspectorControllerStub.prototype.getProfileHeaders):
+        (.WebInspector.InspectorControllerStub.prototype.getProfile):
+        (.WebInspector.InspectorControllerStub.prototype.takeHeapSnapshot):
+        (.WebInspector.InspectorControllerStub.prototype.databaseTableNames):
+        (.WebInspector.InspectorControllerStub.prototype.stepIntoStatementInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.stepOutOfFunctionInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.stepOverStatementInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.setSetting):
+        (.WebInspector.InspectorControllerStub.prototype.dispatchOnInjectedScript):
+        (.WebInspector.InspectorControllerStub.prototype.releaseWrapperObjectGroup):
+        (.WebInspector.InspectorControllerStub.prototype.setting):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.UIString):
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+
+        Expands upon the new funtionality which allows platforms to indicate
+        that a particular object should not be ignored, so that they can
+        specify that an object should be ignored or that it should be left up
+        to the default handling to decide.
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::accessibilityIsIgnored):
+
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        Expose the table summary as the accessible description because there is no summary object.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_description):
+
+2009-10-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds ScriptController::intializeThreading(), with both JSC and V8 implementations.
+        https://bugs.webkit.org/show_bug.cgi?id=30678
+
+        This new method is used from common code, rather than calling JSC::initializeThreading() (or the V8 equivalent) directly.
+
+        Build fix, no new tests required.
+
+        * bindings/js/ScriptController.cpp: Modified.
+        (WebCore::ScriptController::initializeThreading): Added.
+        * bindings/js/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
+        * bindings/v8/ScriptController.cpp: Modified.
+        (WebCore::ScriptController::initializeThreading): Added.
+        * bindings/v8/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
+        * loader/icon/IconDatabase.cpp: Modified.
+        (WebCore::iconDatabase): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
+        * storage/Database.cpp: Modified.
+        (WebCore::Database::Database): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
+
+2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        Document a feature of the m_liveDecodedResources list.
+        https://bugs.webkit.org/show_bug.cgi?id=30209
+
+        The code made the assumption that the list is sorted by
+        the m_lastDecodedAccessTime property of the CachedResource.
+        The above is not true when CachedResource::setDecodedSize
+        is called and the item is inserted the first time. In this
+        case the m_lastDecodedAccessTime is still zero and the
+        m_liveDecodedResources list becomes unsorted.
+
+        It is impossible that Cache::pruneLiveResources will
+        stop to process the list too early due this feature and
+        the alternatives of updating m_lastDecodedAccessTime in
+        CachedResource::setDecodedSize or changing the insert
+        to search the right position have a negative impact on
+        performance. The best solution for now is to document
+        this feature.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::pruneLiveResources):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::setDecodedSize):
+
+2009-10-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+
+        Make text controls always implement the text interface, and the
+        editable text interface when they are not read only. This is what
+        ATK-users expect.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getInterfaceMaskFromObject):
+
+2009-10-27  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Fraser.
+
+        Change HitTestResult methods to use (3d) transformation aware methods
+        https://bugs.webkit.org/show_bug.cgi?id=27347
+
+        The current HitTestResult methods are not using the (3d)
+        transformation aware routines. This can lead to an assertion
+        SVGRenderBase::mapLocalToContainer method.
+
+        Change HitTestResult::imageRect to use the (3d) transformation
+        aware RenderBox::absoluteContentQuad to avoid running into
+        an assertion with SVG content.
+
+        Remove HitTestResult::boundingBox() as it is only used in
+        two places and conceptually doesn't belong into a HitTest
+        which is operating on points.
+
+        A classic test case is not possible as the methods are not excercised
+        from within HTML/SVG but from the WebKit API Layer. A unittest
+        for Qt/Gtk+/Mac would need to be written but Qt/Gtk+ currently
+        do not support 3d transformations making it impossible to write
+        a reliable test case and the Mac port is currently not doing
+        unit testing.
+
+
+        * rendering/HitTestResult.cpp: Remove boundingBox() method
+        (WebCore::HitTestResult::imageRect): Use transformation aware method
+        * rendering/HitTestResult.h: Remove boundingBox()
+
+2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Custom Cursor doesn't use hotspot.
+        https://bugs.webkit.org/show_bug.cgi?id=30820
+
+        Cursors loaded from a QPixmap didn't specifiy the
+        hotspot. Take the hotspot values from the mac
+        implementation.
+
+        * platform/qt/CursorQt.cpp:
+
+2009-10-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Initial revision of the Timeline grid.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30834
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelineCalculator):
+        * inspector/front-end/Images/timelineBarBlue.png: Added.
+        * inspector/front-end/Images/timelineBarGray.png: Added.
+        * inspector/front-end/Images/timelineBarGreen.png: Added.
+        * inspector/front-end/Images/timelineBarOrange.png: Added.
+        * inspector/front-end/Images/timelineBarPurple.png: Added.
+        * inspector/front-end/Images/timelineBarRed.png: Added.
+        * inspector/front-end/Images/timelineBarYellow.png: Added.
+        * inspector/front-end/Images/timelineCheckmarks.png: Added.
+        * inspector/front-end/Images/timelineDots.png: Added.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceTimeCalculator):
+        (WebInspector.ResourceTransferSizeCalculator):
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype.get categories):
+        (WebInspector.TimelinePanel.prototype.populateSidebar):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClick):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype.showCategory):
+        (WebInspector.TimelinePanel.prototype.hideCategory):
+        (WebInspector.TimelineRecordTreeElement):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.computePercentageFromEventTime):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        (WebInspector.TimelineGraph):
+        (WebInspector.TimelineGraph.prototype.get graphElement):
+        (WebInspector.TimelineGraph.prototype.refreshLabelPositions):
+        (WebInspector.TimelineGraph.prototype.refresh):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Move runAfterPendingDispatches to TestController for Clarity
+        https://bugs.webkit.org/show_bug.cgi?id=30844
+
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.runAfterPendingDispatches):
+        * inspector/front-end/inspector.js: moved runAfterPendingDispatches
+
+2009-10-27  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add missing forward declaration of FramelessScrollView.
+        https://bugs.webkit.org/show_bug.cgi?id=30824
+
+        * platform/chromium/FramelessScrollViewClient.h:
+
+2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        WAI-ARIA: add support for 'presentation' role
+        https://bugs.webkit.org/show_bug.cgi?id=30806
+
+        Test: accessibility/aria-presentational-role.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::RoleEntry::):
+
+2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ARIA menu/menu item need AXRoleDescription
+        https://bugs.webkit.org/show_bug.cgi?id=30804
+
+        Make sure that role descriptions will default to the system's first, before
+        returning an unknown role.
+
+        Test: platform/mac/accessibility/aria-menu-role-descriptions.html
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: migrated away from API that no longer exists.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: migrated away from API that no longer exists.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2009-10-27  Oliver Hunt  <oliver@apple.com>
+
+        Fix wording in comment.
+
+        * bridge/objc/objc_instance.mm:
+        (allocateAutoReleasePool):
+
+2009-10-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash occurs after launching Newsfire 1.6 for the first time
+        https://bugs.webkit.org/show_bug.cgi?id=30807
+
+        We allocate an autorelease pool but then store it off the stack. In a
+        GC environment this led to it being collected, and thus caused badness
+        to ensue.  To work around this we simply avoid using a pool at all in
+        a GC environment as it would be a no-op anyway.
+
+        * bridge/objc/objc_instance.mm:
+        (allocateAutoReleasePool):
+        (ObjcInstance::virtualBegin):
+
+2009-10-27  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        When a Geolocation method is called, immediately calls the error calback asynchronously if permissions
+        have already been denied.
+        https://bugs.webkit.org/show_bug.cgi?id=27944.
+
+        Tests: fast/dom/Geolocation/permission-denied-already-error.html
+               fast/dom/Geolocation/permission-denied-already-success.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. GeoNotifier takes Geolocation object as constructor argument.
+        (WebCore::Geolocation::GeoNotifier::setFatalError): Added. Sets a fatal error for this notifier, causing it to terminate immediately and call the error callback asynchronously.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Added. Used to call the error callback asynchronously on fatal error.
+        (WebCore::Geolocation::getCurrentPosition): Modified. Calls startRequest.
+        (WebCore::Geolocation::watchPosition): Modified. Calls startRequest.
+        (WebCore::Geolocation::startRequest): Added. Common functionality for starting a one-shot or watch request. Sets a fatal error on the notifier if permissions have already been denied.
+        (WebCore::Geolocation::fatalErrorOccurred): Added. Registers that a notifier has encountered a fatal error and should be destroyed.
+        (WebCore::Geolocation::setIsAllowed): Modified. Uses a standard error message for the error callback when permissions are denied.
+        * page/Geolocation.h: Modified.
+        (WebCore::Geolocation::isDenied): Added. Determines whether permissions have been denied.
+
+2009-10-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a bug where I was using the wrong Canvas pointer to do a cross-domain check
+        https://bugs.webkit.org/show_bug.cgi?id=30840
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+
+2009-10-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVGStyledElement::getPresentationAttribute() can return a shared CSSValue (some SVG tests randomly fail on the bot, and in release builds)
+        https://bugs.webkit.org/show_bug.cgi?id=29620
+
+        SVG was modifying CSSValues cached of off CSSMappedAttributeDeclarations.
+        This patch fixes the check to make sure that a new CSSMappedAttributeDeclaration is
+        created before returning a CSSValue that JavaScript can modify.
+
+        Test: svg/dom/getPresentationAttribute-cache-corruption.svg
+
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::getPresentationAttribute):
+
+2009-10-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Incomplete repaint of text field in relative positioned inline at imdb.com
+        https://bugs.webkit.org/show_bug.cgi?id=30047
+
+        Test: fast/repaint/inline-relative-positioned.html
+
+        Implemented offsetFromContainer(), mapLocalToContainer() and
+        mapAbsoluteToLocalPoint() in RenderInline.
+
+        * rendering/RenderBox.h: Fixed argument names in the declaration of
+        mapLocalToContainer().
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::offsetFromContainer):
+        (WebCore::RenderInline::mapLocalToContainer):
+        (WebCore::RenderInline::mapAbsoluteToLocalPoint):
+        * rendering/RenderInline.h:
+
+2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Speculative build fix for Chromium.
+
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-10-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        Make WebGL context failure more robust and make it succeed in more cases
+        https://bugs.webkit.org/show_bug.cgi?id=30349
+
+        Bubble a failure to get a CGLContext up to HTMLContextElement so it can
+        return null from getContext. Also added a more robust pixel format choosing 
+        mechanism and can render correctly when a SW renderer is chosen.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * html/canvas/CanvasRenderingContext.h:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.h:
+        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
+        (WebCore::CanvasRenderingContext3D::cleanupAfterGraphicsCall):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer copyCGLPixelFormatForDisplayMask:]):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::setPixelFormat):
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::ensureContext):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Mac build fix: a forwarding header.
+
+        * ForwardingHeaders/wtf/DateInstanceCache.h: Added.
+
+2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Making fontWeightIsBold static to fix Snow Leopard build.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::fontWeightIsBold):
+
+2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKit cannot remove nested bold tags
+        https://bugs.webkit.org/show_bug.cgi?id=30784
+
+        This patch modifies getPropertiesNotInComputedStyle so that it compares font-weight
+        more flexibly. Instead of comparing cssText, it uses fontWeightIsBold which converts
+        all font weights to either bold or unbold state.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::fontWeightIsBold):
+        (WebCore::getPropertiesNotInComputedStyle): Removes font-weight property
+        if two style have the same value under getFontWeightValue
+
+2009-10-27  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Give an ability to WebKit to free statically allocated pointers
+        before quit.
+        https://bugs.webkit.org/show_bug.cgi?id=27980
+
+        No new tests for this as the change does not affect WebKit
+        functionality, but only memory usage.
+
+        * JavaScriptCore/wtf/StdLibExtras.h:
+        Allowed for the override of DEFINE_STATIC_LOCAL via compiler 
+        commandline options or elsewhere in the code. Useful for 
+        implementing custom builds that free resources allocated via
+        DEFINE_STATIC_LOCAL.
+
+2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Build fix, no review needed.
+
+        Fixing the BUILD. m_estimatedSize in Database.h should be of type
+        'unsigned long' instead of 'unsigned long long'.
+
+        No tests required.
+
+        * storage/Database.h:
+
+2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Refactoring the Database class to not depend on
+        OriginQuotaManager. Also, adding a SecurityOrigin copy to each
+        Database instance, that is safe to use on the file
+        thread. Finally, adding new simple fields and getters to the
+        Database object for storing/getting the display name and estimated
+        size specified by the user in the openDatabase() call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30548
+
+        * page/SecurityOrigin.h:
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase): Storing the display name and
+        the estimated size in the Database object.
+        (WebCore::Database::Database): Storing the display name and the
+        estimated size in the Database object, as well as a SecurityOrigin
+        instance that is safe to use on the DB thread.
+        (WebCore::Database::maximumSize): Delegate the call to
+        DatabaseTracker::getMaxSizeForDatabase().
+        (WebCore::Database::databaseThreadSecurityOrigin): Return the
+        SecurityOrigin instance that's safe to use on the DB thread.
+        (WebCore::Database::threadSafeSecurityOrigin): Return the
+        SecurityOrigin instance that's safe to use on the current thread.
+        (WebCore::Database::displayName): Return the display name
+        specified by the user in the openDatabase() call.
+        (WebCore::Database::estimatedSize): Return the estimated size
+        specified by the user in the openDatabase() call.
+        (WebCore::Database::fileName): Return the name of the file where
+        the current Database is tored.
+        * storage/Database.h:
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase): Returns the
+        maximum size for a DB file based on the current size of that file
+        and the space available for that origin.
+        * storage/DatabaseTracker.h:
+        * storage/SQLTransaction.cpp:
+        * storage/SQLTransactionClient.cpp:
+        (WebCore::SQLTransactionClient::didCommitTransaction): Use the
+        correct SecurityOrigin instance.
+
+2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Pretty Print all HTML Collection Types like we do for NodeList
+        https://bugs.webkit.org/show_bug.cgi?id=30709
+
+        Test: inspector/console-format-collections.html
+
+        * inspector/front-end/InjectedScript.js:
+        (Object.type): check for instances of HTMLCollection like we do for NodeList
+        * inspector/front-end/inspector.js: added WebInspector.pendingDispatches counter
+        (WebInspector.dispatch): increment and decrement dispatch counter
+        (WebInspector.runAfterPendingDispatches): run when there are no more dispatches
+
+2009-10-27  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds XMLHttpRequest support to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=30578
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::didChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::didLoadXHR):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord):
+        (WebCore::TimelineRecordFactory::createXHRLoadTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2009-10-27  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (Safari 4.0.3-ToT): After pressing Shift-PageDown, pressing Shift-Up 
+        extends the top of the selection upwards (but should shrink the selection instead)
+        <rdar://problem/7269075>
+        https://bugs.webkit.org/show_bug.cgi?id=29981
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modify): Added setting m_lastChangeWasHorizontalExtension.
+
+2009-10-27  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Tim Hatcher.
+        
+        Removed an extra console.log from ElementsTreeOutline.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+
+2009-10-27  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Rewrote JavaScriptSourceSyntaxHighlighter to be more accurate
+        https://bugs.webkit.org/show_bug.cgi?id=27147
+
+        Tests: LayoutTests/inspector/javascript-syntax-highlight.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.process): Added. Processes 100 tokens at a time.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.lex): Added. Scans for a token.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.appendNonToken): Added. Appends the non-token characters that lex ignored.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.syntaxHighlightNode): Added. To syntax highlight node in ElementsTreeOutline.
+
+2009-10-27  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Missing null check after string conversion in error reporting
+        https://bugs.webkit.org/show_bug.cgi?id=30774
+
+        Add null check after string conversion in error reporting code.
+        ToString conversion can fail for instance when an exception is
+        thrown during conversion.
+
+        Test: fast/dom/error-to-string-stack-overflow.html
+
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-10-27  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Use a pair of maps to store Geolocation watchers.
+        https://bugs.webkit.org/show_bug.cgi?id=29178
+
+        The pair of maps allows us to look up a watcher either by its ID or by its GeoNotifier object.
+        The ability to look up by a watcher by its GeoNotifier object will be required when implementing
+        Geolocation::fatalErrorOccurred. See https://bugs.webkit.org/show_bug.cgi?id=27944
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::Watchers::set): Added. Adds a watcher with the given ID.
+        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by ID.
+        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by GeoNotifier object.
+        (WebCore::Geolocation::Watchers::clear): Added. Removes all watchers.
+        (WebCore::Geolocation::Watchers::isEmpty): Added. Determines if there are no watchers.
+        (WebCore::Geolocation::Watchers::getNotifiersVector): Added. Gets a vector of the GeoNotifier objects.
+        (WebCore::Geolocation::watchPosition): Modified. Rename watcher identifier static variable.
+        (WebCore::Geolocation::stopTimersForWatchers): Modified. Use Watchers::getNotifiersVector.
+        (WebCore::Geolocation::handleError): Modified. Use Watchers::getNotifiersVector.
+        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Use Watchers::getNotifiersVector.
+        * page/Geolocation.h: Modified. Adds Geolocation::Watchers class.
+
+2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] DOM Storage runtime flag should default to on
+        https://bugs.webkit.org/show_bug.cgi?id=30828
+
+        The DOM Storage runtime flag was supposed to default to on.  I accidentally
+        changed the logic to default to false when I moved the flag.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+
+2009-10-27  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix crash found in chromium test_shell.
+        https://bugs.webkit.org/show_bug.cgi?id=30808
+
+        When WebSocket is deleted without close, webkit would crash
+        when it handles didClose.
+
+        Check scriptExecutionContext before post task for event.
+        Use WebSocketChannel::disconnect() instead of close() in WebSocket
+        destructor, so that WebSocketChannel should not call deleted WebSocket
+        back in didClose().
+        To make sure WebSocketChannel alive while it is processing WebSocket
+        protocol over SocketStreamHandle, ref() in connect() and deref() in
+        didClose().
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::~WebSocket):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::disconnect):
+        (WebCore::WebSocketChannel::didClose):
+        (WebCore::WebSocketChannel::didReceiveData):
+        * websockets/WebSocketChannel.h:
+
+2009-10-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Updated Apple license
+
+        * LICENSE-APPLE:
+
+2009-10-27  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig.
+
+        Re-enable the check that disallows pages with unload handlers in the page cache.
+
+        <rdar://problem/7196485> and http://webkit.org/b/29021 
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-10-27  Timothy Hatcher  <timothy@apple.com>
+
+        Remove more empty files that didn't get removed earlier.
+
+        * inspector/DOMDispatchTimelineItem.cpp: Removed.
+        * inspector/DOMDispatchTimelineItem.h: Removed.
+
+2009-10-27  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix assertion crashes introduced by changes made in r50110.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement): only call popCurrentNode() if there are nodes left in the stack.
+
+2009-10-27  Timothy Hatcher  <timothy@apple.com>
+
+        Remove empty files that didn't get removed earlier.
+
+        * inspector/TimelineItem.cpp: Removed.
+        * inspector/TimelineItem.h: Removed.
+
+2009-10-27  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        First part of the implementation of AtkTable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getCell):
+        (getCellIndex):
+        (webkit_accessible_table_ref_at):
+        (webkit_accessible_table_get_index_at):
+        (webkit_accessible_table_get_n_columns):
+        (webkit_accessible_table_get_n_rows):
+        (webkit_accessible_table_get_column_extent_at):
+        (webkit_accessible_table_get_row_extent_at):
+        (webkit_accessible_table_get_row_header):
+        (atk_table_interface_init):
+        (AtkInterfacesInitFunctions):
+        (GetAtkInterfaceTypeFromWAIType):
+
+2009-10-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Lars Knoll.
+
+        [Qt] Don't lose remainder when computing wheel event deltas
+
+        * platform/qt/WheelEventQt.cpp:
+
+2009-10-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        Fix QtWebKit build for WIN_OS if Netscape plug-in support
+        is turned off and refactor some related code
+        https://bugs.webkit.org/show_bug.cgi?id=30786
+
+        No new tests as there is no new functionality introduced.
+
+        * platform/FileSystem.h: Refactor to make sure that each different
+        type definition is only repeated once.
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::compareFileVersion): Move it out from the
+        ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH guard and combine it with the
+        function body from PluginPackageWin.
+
+        * plugins/win/PluginPackageWin.cpp: Remove compareFileVersion as
+        it is now in PluginPackage.cpp.
+
+2009-10-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27011
+        [Gtk] Implement support for get_index_in_parent
+
+        Implement atk_object_get_index_in_parent.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_index_in_parent):
+
+2009-10-27  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r50131.
+        http://trac.webkit.org/changeset/50131
+
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::ObjcInstance):
+        (ObjcInstance::virtualEnd):
+
+2009-10-26  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30491
+
+        Fixes an issue where pressing return/enter on the keyboard 
+        in <isindex> does not submit it if is not within a <form>.
+
+        According to the HTML 2.0 thru HTML 4.01 spec 
+        (http://www.w3.org/MarkUp/html-spec/html-spec_7.html#SEC7.5), the 
+        <isindex> element does not need to be within a <form> element in 
+        order to submit it. It can submitted on its own. Also, if present,
+        the href property of the <base> element will dictate where to submit
+        the value of the <isindex> element (this is analogous to the action 
+        property of the <form> element).
+
+        Tests: http/tests/misc/isindex-with-no-form-base-href.html
+               http/tests/misc/isindex-with-no-form.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler): Calls createTemporaryFormForIsIndex()
+        to create a <form> if none is present and we are an <isindex> element.
+        (WebCore::HTMLInputElement::createTemporaryFormForIsIndex): Added.
+        * html/HTMLInputElement.h:
+
+2009-10-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Crash occurs after launching Newsfire 1.6 for the first time
+        https://bugs.webkit.org/show_bug.cgi?id=30807
+
+        Use a RetainPtr in ObjcBinding to ensure that we adequately
+        protect the autorelease pool from GC in GC'd applications.
+
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::ObjcInstance):
+        (ObjcInstance::virtualEnd):
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r50125.
+
+        * WebCore.pro: Rename TimelineItem to TimelineRecord.
+
+2009-10-26  Matt Mueller  <mattm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Refactor synchronizable property handling to store one shouldSynchronize flag per set of properties rather than one per property.
+
+        Fixes reading uninitialized memory in SynchronizableProperty hash function as well as simplifying the code.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30658
+
+        Covered by running various svg tests under valgrind, ex:
+        LayoutTests/svg/custom/js-late-mask-and-object-creation.svg
+
+        * svg/SynchronizablePropertyController.cpp:
+        (WebCore::SynchronizableProperties::addProperty):
+        (WebCore::SynchronizableProperties::synchronize):
+        (WebCore::SynchronizableProperties::startAnimation):
+        (WebCore::SynchronizableProperties::stopAnimation):
+        (WebCore::SynchronizablePropertyController::registerProperty):
+        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
+        (WebCore::SynchronizablePropertyController::synchronizeProperty):
+        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
+        (WebCore::SynchronizablePropertyController::startAnimation):
+        (WebCore::SynchronizablePropertyController::stopAnimation):
+        * svg/SynchronizablePropertyController.h:
+        (WebCore::SynchronizableProperties::SynchronizableProperties):
+        (WebCore::SynchronizableProperties::setNeedsSynchronization):
+
+2009-10-26  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Renames TimelineItem to TimelineRecord and updates all call sites.
+        https://bugs.webkit.org/show_bug.cgi?id=30785
+
+        * GNUmakefile.am: 
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addRecordToTimeline):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didInstallTimer):
+        (WebCore::InspectorTimelineAgent::didRemoveTimer):
+        (WebCore::InspectorTimelineAgent::willFireTimer):
+        (WebCore::InspectorTimelineAgent::didFireTimer):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        (WebCore::InspectorTimelineAgent::RecordEntry::RecordEntry):
+        * inspector/TimelineItemFactory.cpp: Removed.
+        * inspector/TimelineItemFactory.h: Removed.
+        * inspector/TimelineRecordFactory.cpp: Added.
+        (WebCore::TimelineRecordFactory::createGenericRecord):
+        (WebCore::TimelineRecordFactory::createDOMDispatchRecord):
+        (WebCore::TimelineRecordFactory::createGenericTimerRecord):
+        (WebCore::TimelineRecordFactory::createTimerInstallRecord):
+        * inspector/TimelineRecordFactory.h: Added.
+        (WebCore::TimelineRecordFactory::TimelineRecordFactory):
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.addRecordToTimeline):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.getRecordTypeName):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+
+2009-10-26  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Windowless Plugins : Print preview shows only part of flash when view is scrolled
+        
+        When printing, QPrinter's preview mode uses a QPicture to capture the output. The
+        QPicture holds a reference to the X Pixmap. As a result, the print preview would
+        update itself when the X Pixmap changes. To prevent the print preview from updating
+        whenever m_drawable is updated (i.e when the view updates), we create a copy.
+        
+        We require that a QPixmap::copy() result in a QPixmap backed by a XPixmap
+        regardless of the graphicssystem. This is taken care of by
+        commit d310f7c710ecb331a9689861f0551eabd38e946e in Qt (4.6)
+        
+        The beauty of this patch is that the newly created X Pixmap is managed by Qt and
+        it will free the Pixmap whenever the user closes the print preview dialog and
+        handles the case of displaying multiple preview dialogs nicely.
+        
+        All credit to Samuel Rødal for suggesting usage of QPixmap::copy().
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30714
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-26  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Don't store properties in the MediaPlayerPrivate class
+
+        Access them via the MediaPlayer class instead.
+        https://bugs.webkit.org/show_bug.cgi?id=30462
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::setVisible):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-10-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30801>.
+        Web Inspector: Control + ]/[ on Windows doesn't change Panels.
+        
+        In my testing, Windows uses "U+00DB" and "U+00DD" to represent
+        [ and ], so we should honor those as well.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Make .rc files compile on Windows without depending on MFC headers
+        https://bugs.webkit.org/show_bug.cgi?id=30750
+
+        * WebCore.vcproj/QTMovieWin.rc: Use winresrc.h because it exists 
+        even when MFC is not installed, and is all that's needed here.
+
+2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Build corrections for ENABLE_FILTERS in Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30797
+
+        Build correction for ENABLE_FILTERS feature.  No new tests needed.
+
+        * platform/graphics/filters/FEColorMatrix.cpp: Use MathExtras.h and
+          its piDouble constant.
+        * platform/graphics/filters/FEGaussianBlur.cpp: Use MathExtras.h and
+          its piDouble constant.  Remove unnecessary call to floor used in
+          the division of an unsigned, converting to int.
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp: Correct include
+          style for MathExtras.h.
+
+2009-10-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7289467> and http://webkit.org/b/30798 - REGRESSION (r48687): www.myuhc.com doesn't load.
+
+        Test: fast/loader/grandparent-completion-starts-redirect.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::completed): Notify all descendants that the load completed, not just direct children.
+
+2009-10-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Re-add CSSPropertyWebkitBackgroundSize in one more place
+
+        Fixes transitions/multiple-background-size-transitions.html, transitions/background-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+
+2009-10-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Tidy up the DOM Storage runtime flag stuff
+        https://bugs.webkit.org/show_bug.cgi?id=30794
+
+        Clean up the DOM Storage runtime flag stuff to match the new way of doing
+        things.  No behavioral changes.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::setLocalStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::localStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::setSessionStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::sessionStorageEnabled):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * storage/Storage.cpp:
+        * storage/Storage.h:
+
+2009-10-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7308952> and http://webkit.org/b/30424 - REGRESSION (r48687): Pages on ucas.com appear blank.
+
+        Test: fast/loader/history-forward-in-head.html
+
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation): Restore the moved canGoBackOrForward() check.
+          This restores the side effect of an invalid history navigation canceling previous scheduled redirects
+          and also fixes the bug of scheduling an invalid history navigation canceling parsing of the current document.
+        (WebCore::RedirectScheduler::timerFired): Removed the canGoBackOrForward() check as it is now made before
+          the redirect is scheduled.
+
+2009-10-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30049
+        <rdar://problem/7286002> Manipulating DOM from a script while parsing XHTML can cause a crash
+
+        Tests: fast/parser/remove-current-node-parent-x-2.xhtml
+               fast/parser/remove-current-node-parent-x.xhtml
+
+        * dom/XMLTokenizer.h: Store the whole stack of parent nodes - element.parentNode() is
+        unreliable after DOM manipulation.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::pushCurrentNode): Push the new node onto stack.
+        (WebCore::XMLTokenizer::popCurrentNode): This is now called instead of setCurrentNode when
+        exiting a node.
+        (WebCore::XMLTokenizer::clearCurrentNodeStack): We're aborting; or just done parsing. This
+        replaces setCurrentNode(0).
+        (WebCore::XMLTokenizer::enterText): Call pushCurrentNode().
+        (WebCore::XMLTokenizer::exitText): Call popCurrentNode(), removing a long-standing FIXME
+        (not sure if it was ever practical though - how can a parent become null while adding text?)
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::~XMLTokenizer): Call clearCurrentNodeStack().
+        (WebCore::XMLTokenizer::startElementNs): Call pushCurrentNode().
+        (WebCore::XMLTokenizer::endElementNs): Call popCurrentNode() to safely get to a parent. Also
+        added a check fo script element still being in document - Firefox parses those that aren't,
+        but doesn't execute them.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::parseStartElement):
+        (WebCore::XMLTokenizer::parseEndElement):
+        Match libxml2 version changes.
+
+2009-10-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        background-size: X treated as background-size: X X, not background-size: X auto
+        https://bugs.webkit.org/show_bug.cgi?id=28440
+
+        Updated fast/backgrounds/size/resources/parsing-background-size-values.js
+        and fast/backgrounds/size/resources/parsing-inherit.js
+
+        Reinstated -webkit-background-size and kept its behavior of filling in
+        the second value with the first one; and changed background-size to have
+        the behavior of filling in the second value with 'auto'.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (computedProperties): Re-added CSSPropertyWebkitBackgroundSize.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Ditto.
+        (WebCore::CSSParser::parseFillSize): Adapted for the new parsing rule.
+        (WebCore::CSSParser::parseFillProperty): Re-added
+        CSSPropertyWebkitBackgroundSize.
+        (WebCore::cssPropertyID): Removed mapping of -webkit-background-size to
+        background-size.
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in: Re-added -webkit-background-size.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Re-added
+        CSSPropertyWebkitBackgroundSize.
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Use "%lli" to format "long long" on WIN_OS to fix HTML5 WebDB crash
+        https://bugs.webkit.org/show_bug.cgi?id=30777
+
+        No new tests as the crash can be reproduced by existing storage
+        LayoutTests (by hitting an assert in debug mode Webkit on WIN_OS).
+
+        * platform/text/String.cpp:
+        (WebCore::String::number): Qt's QString::vsprintf does not
+        understand the "%I64u" format string. Always use the "%lli"
+        format string for Qt port.
+
+2009-10-26  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Roll back r50073 because r50041-50043 were reverted.  r50073 was
+        a chromium side fix for r50041.
+        https://bugs.webkit.org/show_bug.cgi?id=30789
+
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+
+2009-10-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=30765
+        REGRESSION (r48701): Removing an event listener causes the one added just after it not to fire
+        
+        and related bugs.
+
+        If the event listener being removed is prior to the current firing event
+        iterator, we need to decrement the current firing event iterator in
+        addition to the endpoint. (Otherwise, shrinking the event listener vector
+        by one implicity moves the current firing event iterator forward by one.
+        It's like relativity, only without the planets.)
+        
+        Also took the opportunity to change some pointers to references, since
+        they can't be null.
+
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::removeAllEventListeners): Update iterator in addition
+        to end, if need be.
+        (WebCore::EventTarget::fireEventListeners): Updated for interface changes.
+        Added a comment to explain a behavior that was implicit enough to be
+        confusing.
+
+        * dom/EventTarget.h:
+        (WebCore::FiringEventIterator::FiringEventIterator):
+        (WebCore::EventTarget::isFiringEventListeners): Updated for interface changes.
+
+2009-10-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30792>.
+        Web Inspector: When changing resource scope, resource graph can get in weird state.
+        
+        If the user was scrolled down while looking at All resources, and then just
+        selects Fonts, or something that doesn't have many resources, then the graph
+        will stay scrolled down, even when there is no content there.
+        
+        When the filter is updated, scroll to the top of the graph view, so this won't
+        happen.
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+
+2009-10-26  Sam Weinig  <sam@webkit.org>
+
+        Fix mac clean build.
+
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Extract AbstractTimelinePanel that will be a base
+        class for ResourcesPanel and TimelinePanel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30776
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AbstractTimelinePanel.js: Added.
+        (WebInspector.AbstractTimelinePanel):
+        (WebInspector.AbstractTimelinePanel.prototype.get categories):
+        (WebInspector.AbstractTimelinePanel.prototype.showCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.hideCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.createTimelinePanels):
+        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel.createFilterElement):
+        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel):
+        (WebInspector.AbstractTimelinePanel.prototype.filter):
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.AbstractTimelinePanel.prototype._updateSummaryGraph):
+        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.AbstractTimelinePanel.prototype.get needsRefresh):
+        (WebInspector.AbstractTimelinePanel.prototype.set needsRefresh):
+        (WebInspector.AbstractTimelinePanel.prototype.refreshIfNeeded):
+        (WebInspector.AbstractTimelinePanel.prototype.show):
+        (WebInspector.AbstractTimelinePanel.prototype.resize):
+        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.computeSummaryValues):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.TimelineCalculator.prototype.get boundarySpan):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype._value):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        * inspector/front-end/ResourceCategory.js:
+        (WebInspector.ResourceCategory):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
+        (WebInspector.ResourcesPanel.prototype.get categories):
+        (WebInspector.ResourcesPanel.prototype.showCategory):
+        (WebInspector.ResourcesPanel.prototype.hideCategory):
+        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
+        (WebInspector.ResourcesPanel.prototype.populateSidebar):
+        (WebInspector.ResourcesPanel.prototype.createPanelEnabler):
+        (WebInspector.ResourcesPanel.prototype.createStatusbarButtons):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype.resize):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth):
+        (WebInspector.ResourceTimeCalculator):
+        (WebInspector.ResourceTransferSizeCalculator):
+        (WebInspector.ResourceTransferSizeCalculator.prototype.computeBarGraphLabels):
+        * inspector/front-end/SummaryBar.js:
+        (WebInspector.SummaryBar.prototype.update):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-10-26  Avi Drissman  <avi@google.com>
+
+        Reviewed by Darin Adler.
+
+        Use Helvetica in the Inspector as intended.
+        https://bugs.webkit.org/show_bug.cgi?id=30787
+
+        * inspector/front-end/inspector.css:
+
+2009-10-26  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Don't set window.opener to 0 for the current FrameLoader if a noreferrer link was clicked, only suppress opener in a new frame.
+        https://bugs.webkit.org/show_bug.cgi?id=30781
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::urlSelected): Don't suppress opener in the current frame for noreferrer navigations.
+
+2009-10-26  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Data loss occurs when unbolding nested bold tags.
+        https://bugs.webkit.org/show_bug.cgi?id=30083
+
+        Fixes the loop in swapInNodePreservingAttributesAndChildren by saving nextSibling() of child
+        to a temporary valuable.  It was originally calling nextSibling() after appending the child
+        to new parent, in which case, nextSibling is always 0.
+
+        Test: editing/style/unbolding-nested-b.html
+
+        * editing/ReplaceNodeWithSpanCommand.cpp:
+        (WebCore::swapInNodePreservingAttributesAndChildren):
+
+2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Storage events should use Document::url() rather than documentURI()
+        https://bugs.webkit.org/show_bug.cgi?id=30535
+
+        Storage events should use Document::url() rather than Document::documentURI()
+        per http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
+
+        Test: storage/domstorage/documentURI.html
+
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch):
+
+2009-10-26  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Rollout r50041-50043.  The HTML5 spec changed to make HTMLOptionsCollection
+        inherit from HTMLCollection.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        (WebCore::JSHTMLAllCollection::namedItem):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        (WebCore::toJS):
+        * bindings/js/JSHTMLCollectionFunctions.h: Removed.
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::length):
+        (WebCore::JSHTMLOptionsCollection::indexSetter):
+        * bindings/objc/DOMHTML.mm:
+        (kitClass):
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/HTMLCollection.idl:
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Build fix for ENABLE_FILTERS under Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30762
+
+        Build correction for ENABLE_FILTERS feature.  No new tests needed.
+
+        * WebCore.vcproj/WebCore.vcproj:  Make the following changes:
+          (1) Create a new 'filters' sub-folder of the platform/graphics 
+              folder to properly show the sources held in this directory.
+          (2) Move the files that are currently shown in svn/graphics/filters
+              to platform/graphics/filters (where they actually live on disk).
+          (3) Add the missing SVGFilter, SVGFilterBuilder, and SVGFETile to
+              the project so they are built.
+          (4) Remove SVGFEFloodElement.cpp from the build, since it is already
+              being compiled by SVGAllInOne.cpp.  Its presence as a separate
+              entity is causing a linker warning for duplicate symbols.
+          (5) Add ImageBuffer.cpp to the build to support color space
+              calculations for non-CG builds.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Add the platform/graphics/filters
+          path to the search paths in the project.
+
+2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        console.assert should prefix messages with "Assertion failed: "
+        https://bugs.webkit.org/show_bug.cgi?id=19135
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype.toMessageElement): Append "Assertion failed: " for AssertMessageType.
+        (WebInspector.ConsoleMessage.prototype.toString):
+        * page/Console.cpp:
+        (WebCore::Console::assertCondition): Use AssertMessageType.
+        * page/Console.h:
+        (WebCore::MessageType): Added AssertMessageType.
+
+2009-10-26  Rahul Kuchhal  <kuchhal@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Prevent crash when optgroup element is empty by adding a NULL check.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30365
+
+        Test: fast/forms/select-empty-optgroup.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::appendFormData):
+
+2009-10-21  Steven Knight  <sgk@chromium.org>
+
+        Reviewed by David Levin.
+
+        Refactor gyp for separate webcore_bindings{,_sources} targets.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30447
+
+        Handle long link lines by building .idl-generated bindings in a
+        separate webcore_bindings library target.  Avoid Visual Studio
+        dependency issues by building additional generated .cpp and .h files
+        in a separate webcore_bindings_sources target.
+
+        Chrome should still build and test successfully.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-26  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        Make the number of connections for chromium controlled by
+        chromium rather than by ResourceRequestBase.
+        https://bugs.webkit.org/show_bug.cgi?id=30661
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/chromium/ResourceRequest.cpp:
+
+2009-10-26  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. make distcheck build fixes.
+
+        * GNUmakefile.am:
+
+2009-10-26  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Unbreak Chromium build: that requires adding custom implementations
+        for HTMLOptionsCollection's item and namedItem.  Keep v8 binding
+        close to JSC bindings as well.
+        https://bugs.webkit.org/show_bug.cgi?id=30780
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::getNamedItemsFromCollection):
+        (WebCore::getItemFromCollection):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adam Barth and Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30723
+        <rdar://problem/6189415> Input names added to multipart/form-data headers need to be escaped.
+
+        Test: http/tests/security/escape-form-data-field-names.html
+
+        * platform/network/FormDataBuilder.cpp:
+        (WebCore::appendQuotedString):
+        (WebCore::FormDataBuilder::beginMultiPartHeader):
+        (WebCore::FormDataBuilder::addFilenameToMultiPartHeader):
+        Percent-escape line breaks and quotation marks.
+
+2009-10-26  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Adds DOMTimer support to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=30467
+
+        * inspector/InspectorTimelineAgent.cpp: Added timer support and fixed some method names.
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didInstallTimer): Added.
+        (WebCore::InspectorTimelineAgent::didRemoveTimer): Added.
+        (WebCore::InspectorTimelineAgent::willFireTimer): Added.
+        (WebCore::InspectorTimelineAgent::didFireTimer): Added.
+        (WebCore::InspectorTimelineAgent::addItemToTimeline): Added.
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentTimelineItem): Renamed.
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineItemFactory.cpp: Add methods for timer-related ScriptObjects.
+        (WebCore::TimelineItemFactory::createGenericTimerTimelineItem):
+        (WebCore::TimelineItemFactory::createTimerInstallTimelineItem):
+        * inspector/TimelineItemFactory.h:
+        * page/DOMTimer.cpp: Added instrumentation points.
+        (WebCore::DOMTimer::install):
+        (WebCore::DOMTimer::removeById):
+        (WebCore::DOMTimer::fired):
+
+2009-10-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6988966> Hardware layers do not show up in page snapshots
+
+        Add a method that gets called when snapshotting Canvas3DLayers for page snapshots,
+        that allows the layer to return a CGImageRef of its contents.
+        
+        * platform/graphics/mac/Canvas3DLayer.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer copyImageSnapshotWithColorSpace:]):
+
+2009-10-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Pass "console" as object group when evaluating selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30738
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
+
+2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix for Console not showing repeat count when repeatedly logging an Event
+        https://bugs.webkit.org/show_bug.cgi?id=30324
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::updateRepeatCountInConsole): Added.
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addConsoleMessage): Calls updateRepeatCountInConsole if it is a repeating message.
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage): Renamed WebCore::InspectorFrontend::addMessageToConsole
+        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount): Added. Called when repeatCount is incremented.
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.addMessage): Removed calls to msg.isEqual.
+        (WebInspector.ConsoleView.prototype.updateMessageRepeatCount): Added.
+        (WebInspector.ConsoleView.prototype._incrementErrorWarningCount): Added. Updates the error/warning count.
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        (WebInspector.ConsoleMessage):
+        (WebInspector.ConsoleMessage.prototype.toMessageElement): Use ConsoleMessage._updateRepeatCount
+        (WebInspector.ConsoleMessage.prototype._updateRepeatCount):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addConsoleMessage): Renamed WebInspector.addMessageToConsole.
+        (WebInspector.updateConsoleMessageRepeatCount): Added.
+
+2009-10-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        crash with AX on when an image map contains an anchor tag
+        https://bugs.webkit.org/show_bug.cgi?id=30739
+
+        Tests: accessibility/crashing-a-tag-in-map.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::addChildren):
+
+2009-10-26  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds feature ENABLE guards to V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=30697
+
+        This adds guards for the following features to the V8 bindings,
+        to allow builds with V8 to succeed when these features are not enabled.
+        - DATABASE
+        - WORKERS
+        - SHARED_WORKERS
+        - SVG
+        - XPATH
+        - XSLT
+        - INSPECTOR
+
+        This is a build fix only, no new tests required.
+
+        * bindings/v8/DOMObjectsInclude.h: Modified.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Modified.
+        * bindings/v8/V8Index.cpp: Modified.
+        * bindings/v8/V8Index.h: Modified.
+
+2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25679
+        [Gtk] Improve accessibility of focusable lists
+
+        Fixes the issues with the Atk states exposed for ListBoxOption
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkStateSetFromCoreObject):
+
+2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27085
+        [Gtk] Incorrect rendering of list
+
+        Adds a way for platforms to indicate that a particular object
+        should not be ignored.
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::accessibilityIsIgnored):
+
+2009-10-26  Kinuko Yasuda  <kinuko@google.com>
+
+        Reviewed by Jan Alonzo.
+
+        Bug 30619: [Linux] Menu key doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=30619
+
+        Test: manual-tests/keyboard-menukey-event.html
+        No new layout tests: testing this will require changes in the test
+        controller in a platform-specific way.
+
+        * platform/chromium/KeyCodeConversionGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
+        GDK_Menu to return VKEY_APPS instead of VKEY_MENU.
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
+        GDK_Menu to return V_APPS instead of VK_MENU.
+
+2009-10-25  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Reuse already fetched proxy.
+        https://bugs.webkit.org/show_bug.cgi?id=30747
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+
+2009-10-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        Build fix for WIN_OS if Netscape plugin support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=30753
+
+        * plugins/PluginDatabase.cpp:
+
+2009-10-25  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        A quick fix for Bug 29103.
+        Since String::startsWith() cannot fold non-ASCII characters, this change folds the prefix string
+        and the option string before calling String::startsWith().
+        https://bugs.webkit.org/show_bug.cgi?id=29103
+
+        Tests: fast/forms/listbox-typeahead-cyrillic.html
+               fast/forms/listbox-typeahead-greek.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::typeAheadFind):
+
+2009-10-25  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Expanding a node in the Console should not show the element in Elements panel
+        https://bugs.webkit.org/show_bug.cgi?id=30749
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.onmousedown): Check if inside disclosure triangle.
+
+2009-10-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=30751
+        HTMLOptionsCollection should not inherit from HTMLCollection
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Added JSHTMLCollectionFunctions.h
+
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        (WebCore::JSHTMLAllCollection::namedItem):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLOptionsCollection::getCallData):
+        (WebCore::JSHTMLOptionsCollection::canGetItemsForName):
+        (WebCore::JSHTMLOptionsCollection::nameGetter):
+        (WebCore::JSHTMLOptionsCollection::indexSetter):
+        (WebCore::JSHTMLOptionsCollection::item):
+        (WebCore::JSHTMLOptionsCollection::namedItem):
+        Refactor to use generic implementation of HTMLCollection bindings functions
+        from JSHTMLCollectionFunctions.h
+
+        * bindings/js/JSHTMLCollectionFunctions.h: Added.
+        (WebCore::getCollectionNamedItems):
+        (WebCore::getCollectionItems):
+        (WebCore::callHTMLCollectionGeneric):
+        Added generic functions that JSHTMLCollection, JSHTMLAllCollection and
+        JSHTMLOptionsCollection can all use.
+
+        * bindings/js/JSHTMLDocumentCustom.cpp: Add include of JSHTMLAllCollection.h
+        for toJS on document.all.
+
+        * bindings/objc/DOMHTML.mm:
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper):
+        Remove special cases for HTMLOptionsCollection.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/HTMLAllCollection.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-24  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fixed issue with IME inside console
+        https://bugs.webkit.org/show_bug.cgi?id=30660
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._promptKeyDown):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._promptKeyDown):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.searchKeyDown): Moved performSearch here from WebInspector.searchKeyUp.
+        (WebInspector.startEditing.element.handleKeyEvent):
+        (WebInspector.startEditing):
+        * inspector/front-end/utilities.js:
+        (isEnterKey): Added. Check if in IME.
+
+2009-10-24  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30752>.
+        Web Inspector: Multiple Selection on Scope Bars by default Conflicts with other behavior on OSX.
+        
+        Have the scope bars select one scope by default, but if the multiple selection key
+        is pressed, allow for multiple selection.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        (WebInspector.ConsoleView.prototype.filter):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.filter):
+        (WebInspector.ResourcesPanel.prototype._updateFilter):
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Make the scope bars in the Web Inspector match other scope bars in Mac OS X.
+        Also cleans up the CSS to use classes instead of ID selectors.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28186
+
+        Reviewed by Dan Bernstein.
+
+        * inspector/front-end/ResourcesPanel.js: Add the scope-bar class.
+        * inspector/front-end/inspector.css: Lots of changes to make it look right.
+        * inspector/front-end/inspector.html: Add the scope-bar class.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Fix selecting Resources in the Web Inspector's Resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30743
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.isCategoryVisible): Added.
+        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable): Call
+        isCategoryVisible on the ResourcesPanel.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Fix the Scope Bar in the Web Inspector's Resource panel, so that selecting
+        All will deselect the other filters.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30744
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.createFilterElement): Better syntax.
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.filter): Use a normal for loop,
+        and the child variable instead of target in the loop. Other clean up.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Make resizing the Web Inspector's Elements panel sidebar work again.
+        Also makes Resources panel use the sidebar code in Panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30742
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel): Don't create the sidebar with an argument.
+        (WebInspector.Panel.prototype.show): Call updateSidebarWidth.
+        (WebInspector.Panel.prototype.handleKeyEvent): Call handleSidebarKeyEvent.
+        (WebInspector.Panel.prototype.handleSidebarKeyEvent): Added.
+        (WebInspector.Panel.prototype.createSidebar): Renamed from _createSidebar.
+        (WebInspector.Panel.prototype._sidebarDragging): Call updateSidebarWidth.
+        (WebInspector.Panel.prototype.updateSidebarWidth): Renamed from _updateSidebarWidth.
+        (WebInspector.Panel.prototype.setSidebarWidth): Added. Called by updateSidebarWidth.
+        (WebInspector.Panel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel): Call createSidebar.
+        (WebInspector.ProfilesPanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show): Remove call to _updateSidebarWidth.
+        (WebInspector.ResourcesPanel.prototype.showResource): Call updateSidebarWidth
+        (WebInspector.ResourcesPanel.prototype.closeVisibleResource): Ditto.
+        (WebInspector.ResourcesPanel.prototype.setSidebarWidth): Added.
+        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth): Added.
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel): Call createSidebar.
+        (WebInspector.StoragePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel): Call createSidebar.
+        (WebInspector.TimelinePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Call updateSelection() in a few places so hovering in the Web Inspector's
+        Elements panel always has the correct row selection height.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30735
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton): Call updateSelection().
+        (WebInspector.ElementsTreeElement.prototype._insertInLastAttributePosition): Ditto.
+        * inspector/front-end/inspector.css: Prevent text wrapping in the middle of the add attribute text.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Remove the re-root tree feature from the Web Inspector's
+        Elements panel. This feature wasn't super useful and gets
+        in the way of double-click to edit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30736
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+
+2009-10-24  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Implements ReturnsNew hint for V8 bindings generation code.
+        https://bugs.webkit.org/show_bug.cgi?id=30745
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+
+2009-10-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Missing images at 350.org due to wrong URLs
+        https://bugs.webkit.org/show_bug.cgi?id=30748
+
+        Test: fast/dom/HTMLImageElement/parse-src.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::getURLAttribute): Pass the attribute value through deprecateParseURL().
+        This matches what the Objective-C bindings do, as well as what HTMLImageLoader::sourceURI()
+        and SVGImageLoader::sourceURI() do.
+
+2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r50013.
+
+        * WebCore.pro:
+
+2009-10-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Fix up to accommodate for HTMLAllCollection changes in
+        http://trac.webkit.org/changeset/49998.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+
+2009-10-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        <rdar://problem/7294131> Assertion failure in AuthenticationMac at
+        mac(const Credential&) after authenticating to MobileMe Gallery movie
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::Credential): Initialize m_persistence.
+        (WebCore::Credential::isEmpty): Made this method const.
+        * platform/network/Credential.h:
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac): Return nil if the Credential is empty.
+
+2009-10-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30617>.
+        Web Inspector: Resources Scope Bar Should Allow Combinations.
+        
+        Refactor the filtering in ResourcePanel to make it match ConsoleView,
+        and add a divider between All, and the other choices of Resource types.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.filter):
+        (WebInspector.ResourcesPanel.prototype._updateFilter):
+        * inspector/front-end/inspector.css:
+
+2009-10-23  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Ignore the Refresh header if we're in view source mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27239
+
+        Test: http/tests/security/view-source-no-refresh.html
+
+        * loader/FrameLoader.cpp: ignore Refresh in view-source mode.
+
+2009-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30734
+        Remove XMLTokenizer::m_currentNodeIsReferenced
+
+        No change in behavior, no tests.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::setCurrentNode):
+        * dom/XMLTokenizer.h:
+        Don't store a boolean for the current node being the document - we can always check for that.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        A fragment passed to XMLTokenizer is never null - in fact, the first thing we do is dereference
+        it unconditionally, and then begin checking it for null, as if it could help.
+
+2009-10-23  Beth Dakin  <bdakin@apple.com>
+
+        No review since this is a build fix.
+
+        Build fix for the Mac. (Build is only broken when SVG filters are 
+        enabled.)
+
+        Labelled these function static.
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::identity):
+        (WebCore::table):
+        (WebCore::discrete):
+        (WebCore::linear):
+        (WebCore::gamma):
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::boxBlur):
+
+2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement a Timeline panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30725
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/Images/timelineIcon.png: Added.
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.addItemToTimeline):
+        (WebInspector.timelineProfilerWasStarted):
+        (WebInspector.timelineProfilerWasStopped):
+        * inspector/front-end/TimelinePanel.js: Added.
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype.handleKeyEvent):
+        (WebInspector.TimelinePanel.prototype.timelineWasStarted):
+        (WebInspector.TimelinePanel.prototype.timelineWasStopped):
+        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
+        (WebInspector.TimelinePanel.prototype._innerAddItemToTimeline):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButton):
+        (WebInspector.TimelinePanel.prototype.setMainViewWidth):
+        (WebInspector.TimelinePanel.prototype.getItemTypeName):
+        (WebInspector.TimelineRecordTreeElement):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-10-23  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Clash Between Search's onkeyup and incremental search events
+        https://bugs.webkit.org/show_bug.cgi?id=30731
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.performSearch): prevent incremental search event from clobbering a forced search
+
+2009-10-23  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Removes the need for C++ Timeline types in InspectorTimelineAgent in favor
+        of ScriptObjects.
+        https://bugs.webkit.org/show_bug.cgi?id=30707
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/DOMDispatchTimelineItem.cpp: Removed.
+        * inspector/DOMDispatchTimelineItem.h: Removed.
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentTimelineItem):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::TimelineItemEntry::TimelineItemEntry):
+        * inspector/TimelineItem.cpp: Removed.
+        * inspector/TimelineItem.h: Removed.
+        * inspector/TimelineItemFactory.cpp: Added.
+        (WebCore::TimelineItemFactory::createGenericTimelineItem):
+        (WebCore::TimelineItemFactory::createDOMDispatchTimelineItem):
+        * inspector/TimelineItemFactory.h: Added.
+        (WebCore::):
+        (WebCore::TimelineItemFactory::TimelineItemFactory):
+
+2009-10-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30729
+        Provide private API to request the global context for a specific world.
+        Used to initialize parameters on the global object.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::globalObject):
+        * bindings/js/ScriptController.h:
+
+2009-10-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes style problems in Android-specific files.
+        https://bugs.webkit.org/show_bug.cgi?id=30717
+
+        Style changes only, no new tests possible.
+
+        * page/android/EventHandlerAndroid.cpp: Modified.
+        (WebCore::EventHandler::passMouseDownEventToWidget): Fixes whitespace in method signature.
+        (WebCore::EventHandler::passSubframeEventToSubframe): Fixes whitespace in method signature.
+        (WebCore::EventHandler::passWheelEventToWidget): Fixes whitespace in method signature.
+        (WebCore::EventHandler::passMouseMoveEventToSubframe): Fixes whitespace in method signature.
+        * platform/android/ClipboardAndroid.h: Modified. Fixes header include order and indenting.
+        * platform/android/CursorAndroid.cpp: Modified. 
+        (WebCore::grabCursor): Fixes function braces.
+        (WebCore::grabbingCursor): Fixes function braces.
+        * platform/android/FileChooserAndroid.cpp: Modified.
+        (WebCore::FileChooser::basenameForWidth): Fixes braces on while statement, and updates String::copy to String::threadsafeCopy.
+        * platform/android/FileSystemAndroid.cpp: Modified. Fixes header include order.
+        (WebCore::unloadModule): Fixes zero test.
+        (WebCore::writeToFile): Fixes if statement structure.
+        * platform/android/KeyEventAndroid.cpp: Modified.
+        (WebCore::windowsKeyCodeForKeyEvent): Fixes switch statement indenting.
+        (WebCore::keyIdentifierForAndroidKeyCode): Fixes switch statement indenting.
+        * platform/android/ScreenAndroid.cpp: Modified. Fixes header include order and switch statement indenting.
+        * platform/android/TemporaryLinkStubs.cpp: Modified. Fixes header include order.
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Another shot at a fixed build.
+
+        * DerivedSources.cpp:
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Another shot at a fixed build.
+
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-23  Brady Eidson  <beidson@apple.com>
+
+        50,000!
+
+        * ChangeLog: Point out revision 50,000.
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=30695
+        Drop .tags() support from HTMLCollection
+
+        - Make .tags() only work for HTMLAllCollections in JS. .tags() is still
+          available for all HTMLCollection like objects in Objective-C since that
+          is API.
+        - Auto-generate HTMLAllCollection.
+
+        Test: fast/dom/HTMLDocument/document-all.html
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSHTMLAllCollection.cpp: Removed.
+        * bindings/js/JSHTMLAllCollection.h: Removed.
+        * bindings/js/JSHTMLAllCollectionCustom.cpp: Added.
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::getCallData):
+        (WebCore::JSHTMLAllCollection::canGetItemsForName):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        (WebCore::JSHTMLAllCollection::namedItem):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.cpp:
+        (WebCore::Document::all):
+        * dom/Document.h:
+        * dom/HTMLAllCollection.idl: Removed.
+        * html/HTMLAllCollection.cpp: Added.
+        (WebCore::HTMLAllCollection::create):
+        (WebCore::HTMLAllCollection::HTMLAllCollection):
+        (WebCore::HTMLAllCollection::~HTMLAllCollection):
+        * html/HTMLAllCollection.h: Added.
+        * html/HTMLAllCollection.idl: Added.
+        * html/HTMLCollection.h:
+        * html/HTMLCollection.idl:
+        * html/HTMLDocument.idl:
+        * page/DOMWindow.idl:
+
+2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: pull basic sidebar implementation into the Panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30720
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel):
+        (WebInspector.Panel.prototype.jumpToPreviousSearchResult):
+        (WebInspector.Panel.prototype.handleKeyEvent):
+        (WebInspector.Panel.prototype._createSidebar):
+        (WebInspector.Panel.prototype._startSidebarDragging):
+        (WebInspector.Panel.prototype._sidebarDragging):
+        (WebInspector.Panel.prototype._endSidebarDragging):
+        (WebInspector.Panel.prototype._updateSidebarWidth):
+        (WebInspector.Panel.prototype.setCenterViewWidth):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.setCenterViewWidth):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.setCenterViewWidth):
+
+2009-10-23  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Slight optimizations to object returning and exception handling in generated V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=30599
+
+        * bindings/scripts/CodeGeneratorV8.pm: Generate better code
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertToV8Object): Added overload that takes a Ref<>
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Remove unnecessary template param to prevent compile error
+
+2009-10-23  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Volume slider always starts at half volume
+        https://bugs.webkit.org/show_bug.cgi?id=28322
+
+        Sets the value attribute of volume slider to the volume attribute
+        of the media element. Also update the value attribute of the
+        input element for the volume slider when the volume attribute
+        of the media element is updated.
+
+        Test: media/video-volume-slider.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::update):
+        Set the value attribute of the input element for the volume slider
+        using the current volume of the media element.
+        * rendering/MediaControlElements.h:
+        Add method definition of update().
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
+        Creates a volume slider with value attribute equals to the current
+        volume attribute of the media element.
+
+2009-10-23  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Chrome Linux: fix caret positioning in LTR complex languages
+        The caret is positioned off by one in languages like Thai.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28284
+
+        A group of us spent a while trying various approaches to write a test
+        for this; however, since it is only that the blinking cursor is
+        displayed incorrectly, we concluded it can not be tested.
+
+        (Patch by Hironori Bono.)
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::selectionRectForComplexText):
+
+2009-10-23  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium build after IsoldatedWorld change (r49963).
+        https://bugs.webkit.org/show_bug.cgi?id=30719
+
+        * bindings/ScriptControllerBase.cpp:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::executeScriptInIsolatedWorld):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        * dom/Document.cpp:
+        (WebCore::Document::createWrapperCache):
+        * dom/ScriptExecutionContext.cpp:
+        * dom/ScriptExecutionContext.h:
+        * xml/XMLHttpRequest.cpp:
+        * xml/XMLHttpRequest.h:
+
+2009-10-23  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix caretRangeFromPoint()/elementFromPoint() returns wrong result 
+        for a zoomed and scrolled page.
+        https://bugs.webkit.org/show_bug.cgi?id=30689.
+
+        The real cause is the wrong calculation of event.clientX/Y when
+        page is zoomed and scolled.
+        After Sam fixed the event.clientX/Y in r49551, the hit test point
+        should be recalculated (revert r49490).
+
+        Test: fast/dom/Document/CaretRangeFromPoint/caretRangeFromPoint-in-zoom-and-scroll.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint): calculate the correct point
+        relative to document when page is zoomed and scrolled.
+        (WebCore::Document::caretRangeFromPoint): calculate the correct point
+        relative to document when page is zoomed and scrolled.
+
+2009-10-22  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Adding a class that allows us to enable/disable features at
+        runtime. Adding a flag to enable database support.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30653
+
+        * WebCore.gypi:
+        * bindings/v8/RuntimeEnabledFeatures.cpp: Added.
+        * bindings/v8/RuntimeEnabledFeatures.h: Added.
+        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+
+2009-10-23  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector injects _inspectorCommandLineAPI into global object when opened
+        https://bugs.webkit.org/show_bug.cgi?id=30675
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript._ensureCommandLineAPIInstalled): Moved _inspectorCommandLineAPI from window to console.
+
+2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] don't undef NULL in Symbian emulator
+
+        npapi.h way of defining mwerks compiler,__intel__
+        and win32 are all true for Symbian emulator.
+        Changed the definions so that NULL won't be undefined
+        when compiling for Symbian emulator nor target HW.
+
+        * bridge/npapi.h:
+
+2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Correct linking of sqlite3 for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=30569
+
+        ".lib" will try to include library as static library
+        causing the library to be searched from wrong directory and if found
+        will be statically linked instead of the inteded dynamic linking.
+
+        * WebCore.pro:
+
+2009-10-23  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION: Copy is copying incorrect background-color
+        <rdar://problem/7248529>
+        https://bugs.webkit.org/show_bug.cgi?id=29697
+
+        Test: editing/execCommand/indent-paragraphs.html
+
+        This change removes the BackgroundColor from the list 
+        of inheritable CSS properties and changes significantly
+        the way we perform indentation.
+        The new implementation of IndentOutdentCommand uses a new method
+        defined in CompositeEditCommand called moveParagraphWithClones.
+        This is an improved version of the original moveParagraph that
+        is aimed at preserving the original markup of the paragraph being
+        moved.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::): removed CSSPropertyBackgroundColor from editingStyleProperties.
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::CompositeEditCommand): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement): Added.
+        (WebCore::CompositeEditCommand::cleanupAfterDeletion): Added.
+        (WebCore::CompositeEditCommand::moveParagraphWithClones): Added.
+        (WebCore::CompositeEditCommand::moveParagraphs): Modified to use cleanupAfterDeletion.
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary): Removed trailing blanks.
+        * editing/CompositeEditCommand.h: Added three new methods.
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Changed to use moveParagraphWithClones.
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Changed to use moveParagraphWithClones.
+        (WebCore::IndentOutdentCommand::indentRegion): Removed comment.
+        * editing/IndentOutdentCommand.h: Removed prepareBlockquoteLevelForInsertion method.
+
+2009-10-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds missing UnusedParam.h includes, required when INSPECTOR is not enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=30677
+
+        Build fix, no new tests required.
+
+        * page/Console.cpp: Modified. Added UnusedParam.h include.
+        * workers/WorkerContext.cpp: Modified. Added UnusedParam.h include.
+
+2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Plugins : Use window's winId() instead of the widget's.
+
+        As per, https://developer.mozilla.org/en/NPN_GetValue
+        NPNVnetscapeWindow on Unix/X11: "Gets the browser toplevel window in which the
+        plug-in is displayed; returns Window".
+
+        The issue was found because NPNVNetscapeWindow winId() ends up creating
+        a native window resulting in flicker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30706
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::getValue):
+
+2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowless Plugins : Don't use m_clipRect when painting.
+
+        Though it works, it is not correct to use m_clipRect for painting
+        in Windowless mode. Instead, the rect paramater that is passed
+        as a part of PluginView::paint() must be used. This change will
+        also result in some speedup since previously we used to paint all
+        the visible parts of a windowless plugin (even if those parts were
+        not dirty).
+
+        Also, fix invalidateRect() to compute the correct width and height.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30711
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::invalidateRect):
+
+2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        Plugins : Use test.swf in the plugins manual tests.
+
+        They previously referenced youtube videos which among other things are
+        cumbersome to use without internet connection. The old youtube link is
+        just commented out so that testing with youtube can be done with
+        little effort.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30662
+
+        * manual-tests/plugins/test.swf: Copied from LayoutTests/fast/replaced/resources/test.swf.
+        * manual-tests/plugins/windowed.html:
+        * manual-tests/plugins/windowless.html:
+        * manual-tests/qt/plugin-sibling-frame-include.html:
+
+2009-10-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix the Windows Release build by moving Accessibility files
+        into all-in-one file and excluding them from the build.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * accessibility/AccessibilityAllInOne.cpp: Added.
+
+2009-10-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig & Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30696
+        Add support for IsolatedWorlds to JSC bindings.
+
+        An IsolatedWorld is basically a parallel, separate copy of the window shells and DOM wrapper objects for
+        a given document.  To support isolation this patch:
+
+            * Adds support to the ScriptController to track multiple window shells, one per world.
+            * Adds support to Document to support multiple separate wrapper-maps, one per world.
+            * Replaces the single global DOM wrapper map (on the WebCoreJSClientData) with separate maps,
+              stored on the (new) IsolatedWorld objects.
+
+        In addition to supporting separate copies of these objects, two other features are supported:
+
+            * It is necessary to track the current world on entry into JSC, so that within callbacks out to WebCore
+              we can determine which world (and as such, set of DOM bindings) we should be operating on.
+            * EventListeners & Callbacks are run in the world they were registered in.
+              This requires the handler to retain a reference to the world.
+
+        No new tests. (Enabled existing isolated world layout tests.)
+
+        * WebCore.base.exp:
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h:
+        (WebCore::JSCallbackData::JSCallbackData):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::removeWrappers):
+        (WebCore::DOMObjectWrapperMap::get):
+        (WebCore::DOMObjectWrapperMap::set):
+        (WebCore::DOMObjectWrapperMap::remove):
+        (WebCore::DOMObjectWrapperMap::take):
+        (WebCore::IsolatedWorld::IsolatedWorld):
+        (WebCore::IsolatedWorld::~IsolatedWorld):
+        (WebCore::EnterIsolatedWorld::EnterIsolatedWorld):
+        (WebCore::EnterIsolatedWorld::~EnterIsolatedWorld):
+        (WebCore::JSGlobalDataWorldIterator::JSGlobalDataWorldIterator):
+        (WebCore::JSGlobalDataWorldIterator::operator bool):
+        (WebCore::JSGlobalDataWorldIterator::operator*):
+        (WebCore::JSGlobalDataWorldIterator::operator->):
+        (WebCore::JSGlobalDataWorldIterator::operator++):
+        (WebCore::getCurrentWorld):
+        (WebCore::getNormalWorld):
+        (WebCore::commonNormalWorld):
+        (WebCore::commonCurrentWorld):
+        (WebCore::DOMObjectHashTableMap::mapFor):
+        (WebCore::DOMObjectWrapperMap::mapFor):
+        (WebCore::forgetDOMObject):
+        (WebCore::getCachedDOMNodeWrapper):
+        (WebCore::forgetDOMNode):
+        (WebCore::cacheDOMNodeWrapper):
+        (WebCore::forgetAllDOMNodesForDocument):
+        (WebCore::forgetWorldOfDOMNodesForDocument):
+        (WebCore::isObservableThroughDOM):
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markActiveObjectsForContext):
+        (WebCore::takeWrappers):
+        (WebCore::updateDOMNodeDocument):
+        (WebCore::markDOMObjectWrapper):
+        (WebCore::allowsAccessFromFrame):
+        (WebCore::printErrorMessageForFrame):
+        (WebCore::JSC_DebuggerCallFrame_evaluateInWorld):
+        (WebCore::JSC_callInWorld):
+        (WebCore::JSC_constructInWorld):
+        (WebCore::JSC_evaluateInWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::IsolatedWorld::rememberDocument):
+        (WebCore::IsolatedWorld::forgetDocument):
+        (WebCore::IsolatedWorld::rememberScriptController):
+        (WebCore::IsolatedWorld::forgetScriptController):
+        (WebCore::DOMObjectHashTableMap::~DOMObjectHashTableMap):
+        (WebCore::DOMObjectHashTableMap::get):
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        (WebCore::WebCoreJSClientData::currentWorld):
+        (WebCore::WebCoreJSClientData::normalWorld):
+        (WebCore::WebCoreJSClientData::rememberWorld):
+        (WebCore::WebCoreJSClientData::forgetWorld):
+        (WebCore::debuggerWorld):
+        (WebCore::pluginWorld):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        (WebCore::toJSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::printErrorMessage):
+        (WebCore::JSDOMWindowBase::commonJSGlobalData):
+        (WebCore::toJS):
+        (WebCore::toJSDOMWindow):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::toJS):
+        (WebCore::toJSDOMWindowShell):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::open):
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        (WebCore::JSHTMLFrameSetElement::nameGetter):
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::databaseForId):
+        (WebCore::JSInspectorBackend::inspectedWindow):
+        (WebCore::JSInspectorBackend::nodeForId):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/JSMessageChannelCustom.cpp:
+        (WebCore::JSMessageChannel::markChildren):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::markChildren):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSSharedWorkerCustom.cpp:
+        (WebCore::JSSharedWorker::markChildren):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::constructXMLHttpRequest):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren):
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::processingUserGestureEvent):
+        (WebCore::ScriptController::attachDebugger):
+        (WebCore::ScriptController::updateDocument):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::createRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        * bindings/js/ScriptController.h:
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        (WebCore::ScriptController::globalObject):
+        (WebCore::ScriptController::forgetWorld):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        (WebCore::scriptStateFromPage):
+        * bindings/js/ScriptState.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::WorkerScriptController):
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/objc/DOMInternal.mm:
+        (-[WebScriptObject _initializeScriptDOMNodeImp]):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_Construct):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        * dom/Document.cpp:
+        (WebCore::Document::createWrapperCache):
+        * dom/Document.h:
+        (WebCore::Document::wrapperCacheMap):
+        (WebCore::Document::getWrapperCache):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * platform/network/mac/AuthenticationMac.mm:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::dropProtection):
+        * xml/XMLHttpRequest.h:
+        (WebCore::XMLHttpRequest::create):
+
+2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: EventListenersSidebarPane TODO No Longer Needed
+        https://bugs.webkit.org/show_bug.cgi?id=30705
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+
+2009-10-22  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30506
+        <rdar://problem/7319845> Resources that the server sent as 304 not modified are not shown
+        in the inspectors resource pane
+
+        I don't know how to make a test for this.
+
+        The issue here was that preloaded resources weren't added to DocLoader document resource set,
+        but Web Inspector asked DocLoader to fetch data from CachedResource. Even when (if) document
+        parser eventually requested the same resource for real and it got added to resource set, it
+        was too late - the Inspector wasn't updated.
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::cachedResource):
+        (WebCore::InspectorResource::type):
+        (WebCore::InspectorResource::resourceData):
+        * inspector/InspectorResource.h:
+        Fix the issue by trying to fetch corresponding CachedResource harder - also look in global
+        cache. This seems safe, and easier than updating the Inspector on transitions between
+        resource states (revalidate vs. revalidate done and preload vs. non-preload).
+
+2009-10-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6942706> ER: Add a CSS property that allows 
+        shadows to work for SVG content
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=30479
+
+        This patch adds a new SVG-specific CSS property called -webkit-
+        shadow that has the same syntax as -webkit-box-shadow
+
+        Add CSSPropertyWebkitShadow to the list of SVG CSS properties, and 
+        make valueForShadow a member function rather than a static function 
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::valueForShadow):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSComputedStyleDeclaration.h:
+
+        Call valueForShadow for CSSPropertyWebkitShadow
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+
+        Do standard CSS stuff for CSSPropertyWebkitShadow
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/SVGCSSPropertyNames.in:
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+
+        Set the appropriate shadow on the paint context if we have one. 
+        This seems to be all we have to do to have an SVG-shaped shadow.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+        Add shadow to SVGRenderStyle. I added a new macro that I don't like 
+        just because that's the way things are done here right now.
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::SVGRenderStyle):
+        (WebCore::SVGRenderStyle::operator==):
+        * rendering/style/SVGRenderStyle.h:
+        * rendering/style/SVGRenderStyleDefs.cpp:
+        (StyleShadowSVGData::StyleShadowSVGData):
+        (StyleShadowSVGData::operator==):
+        * rendering/style/SVGRenderStyleDefs.h:
+        (WebCore::StyleShadowSVGData::create):
+        (WebCore::StyleShadowSVGData::copy):
+        (WebCore::StyleShadowSVGData::operator!=):
+
+2009-10-22  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+ 
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25530
+        [Gtk] Implement LABEL_FOR/LABELLED_BY relationship pair for labels
+
+        Implements atk_object_ref_relation_set and LABEL_FOR/LABELLED_BY.
+        Also causes the accessible name for labeled controls to be based on
+        the label as expected, rather than based on the contents.
+
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (correspondingLabelForControlElement):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkRelationSetFromCoreObject):
+        (webkit_accessible_ref_relation_set):
+        (webkit_accessible_class_init):
+        (webkit_accessible_get_name):
+
+2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: windowFocused and windowBlured Fail to Clear/Mark Inspector as "inactive"
+        https://bugs.webkit.org/show_bug.cgi?id=30663
+
+          Correctly handle focusing/blurring on inner <iframe>'s such as Source Frames.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.windowFocused): fix for inner iframes
+        (WebInspector.windowBlurred): fix for inner iframes
+        (WebInspector.addMainEventListeners): change useCapture to false
+
+2009-10-22  Jaime Yap  <jaimeyap@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Makes a page reload optional when activating resource monitoring in
+        InspectorController. It leaves the default behavior as performing the reload.
+        Reload is an optional param so callsites do not have to change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30684
+
+        No new tests added.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::enableResourceTracking):
+        * inspector/InspectorController.h:
+
+2009-10-22  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix memory leak in QNetworkReplyHandler::abort().
+        In QNetworkReplyHandler::release(), m_reply should no longer point to its parent
+        after being released.
+        https://bugs.webkit.org/show_bug.cgi?id=30167
+
+        No layout test available as a non-functional fix.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::abort):
+        (WebCore::QNetworkReplyHandler::release):
+
+2009-10-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix DOMAgent leak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30615
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::releaseDOMAgent):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+
+2009-10-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Rework event listeners to not hold references to frame or V8 context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30648
+
+        Covered by existing layout tests: fast/events/attribute-listener*
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added passing ScriptExecutionContext*
+            to event listener handling code.
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep): Changed to use currentContext().
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Reworked to match JSC logic.
+        (WebCore::getEventListenerHandlerBody): Added ScriptExecutionContext* param.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Removed Frame* param
+            and usage.
+        (WebCore::V8AbstractEventListener::handleEvent): Chaged to use ScriptExecutionContext*.
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Ditto.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::getListenerObject): Ditto.
+        (WebCore::V8AbstractEventListener::prepareListenerObject): Ditto.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):  Added ScriptExecutionContext* param.
+        (WebCore::V8DOMWrapper::getEventListener): Ditto.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Ditto.
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper): Removed ContextType* template param,
+            because it's no longer needed.
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::sharedContext): Renamed from shared_context.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener): Removed Frame* param and usage.
+        (WebCore::V8LazyEventListener::callListenerFunction): Added ScriptExecutionContext* param.
+        (WebCore::V8LazyEventListener::prepareListenerObject): Ditto.
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::create): Reordered params to match JSC impl.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy): Adjusted formatting to match WebKit style.
+        (WebCore::V8Proxy::evaluateInNewContext): Changed to use m_context directly.
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId): Ditto.
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase): Ditto.
+        (WebCore::V8Proxy::isContextInitialized): Ditto.
+        (WebCore::V8Proxy::updateDocumentWrapperCache): Ditto.
+        (WebCore::V8Proxy::clearDocumentWrapperCache): Ditto.
+        (WebCore::V8Proxy::disposeContextHandles): Added explicit disposing of m_context. 
+        (WebCore::V8Proxy::clearForClose): Changed to use m_context directly.
+        (WebCore::V8Proxy::clearForNavigation): Ditto.
+        (WebCore::V8Proxy::setSecurityToken): Ditto.
+        (WebCore::V8Proxy::updateDocument): Ditto.
+        (WebCore::V8Proxy::initContextIfNeeded): Ditto.
+        (WebCore::V8Proxy::context): Changed to use v8::Local.
+        (WebCore::V8Proxy::mainWorldContext): Changed to use m_context directly. 
+        (WebCore::V8Proxy::setContextDebugId): Ditto.
+        (WebCore::toV8Context):
+        * bindings/v8/V8Proxy.h: Removed shared_context decl, changed to use straight
+            v8::Persistent for m_context.
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::workerProxy): Added.
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener): Removed
+            WorkerContextExecutionProxy* param.
+        (WebCore::V8WorkerContextEventListener::handleEvent): Started using ScriptExecutionContext*.
+        (WebCore::V8WorkerContextEventListener::reportError): Ditto.
+        (WebCore::V8WorkerContextEventListener::callListenerFunction): Ditto.
+        (WebCore::V8WorkerContextEventListener::getReceiverObject): Ditto.
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create): Removed
+            WorkerContextExecutionProxy* param.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener): Removed ContextType*
+            template param.
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener): Removed Frame* param.
+        (WebCore::V8EventListener::getListenerFunction): Started using ScriptExecutionContext*.
+        (WebCore::V8EventListener::callListenerFunction): Ditto.
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create): Removed Frame* param.
+
+2009-10-14  Gaurav Shah  <gauravsh@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Replaces temporary link stub for <keygen> tag handler for the Chromium
+        browser with a call via the Chromium Bridge.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30360
+
+        * platform/SSLKeyGenerator.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/SSLKeyGeneratorChromium.cpp:
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/chromium/TemporaryLinkStubs.cpp:
+        (WebCore::KURL::fileSystemPath):
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+
+2009-10-22  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes Chromium Mac pasteboard handling to flow through the same code paths as other platforms.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30591
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage):
+
+2009-10-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make accelerated compositing debug indicators work in release builds
+        https://bugs.webkit.org/show_bug.cgi?id=30588
+        
+        Allow some debug indicators, that show which page elements go into compositing layers,
+        to work in release builds, when the runtime prefs are set.
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        (WebCore::GraphicsLayer::setZPosition):
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::clearBorderColor):
+        (WebCore::GraphicsLayer::showRepaintCounter):
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::updateMasksToBounds):
+        (WebCore::GraphicsLayerCA::updateLayerDrawsContent):
+        (WebCore::GraphicsLayerCA::setDebugBorder):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        (WebCore::GraphicsLayerCA::setupContentsLayer):
+        * platform/graphics/mac/WebLayer.mm:
+
+2009-10-22  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Inspector should support monitorEvents/un monitorEvents() in the command line
+        https://bugs.webkit.org/show_bug.cgi?id=19879
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback): Ignores event listeners generated by monitorEvent
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled): Added _inspectorCommandLineAPI._logEvent, _allEventTypes, 
+        _normalizeEventTypes, monitorEvent, unmonitorEvent.
+
+2009-10-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: windowFocused and windowBlurred Fail to Clear/Mark Inspector as "inactive"
+        https://bugs.webkit.org/show_bug.cgi?id=30663
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.windowFocused):
+        (WebInspector.windowBlurred):
+
+2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Error - requestContentType [undefined] is not an object
+        https://bugs.webkit.org/show_bug.cgi?id=30666
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshFormData):
+
+2009-10-22  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        [Haiku] Correction of the accented letter width (they were 2 characters long).
+        https://bugs.webkit.org/show_bug.cgi?id=30629
+
+        * platform/graphics/haiku/SimpleFontDataHaiku.cpp:
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-10-21  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7270320> Screenshots of off-screen plug-ins are blank
+        <rdar://problem/7270314> After halting a transparent PluginView on
+        Windows, the transparency is applied twice
+
+        Replace use of Frame::nodeImage() with a function that takes a snapshot
+        of a PluginView.
+
+        Reviewed by Dan Bernstein.
+
+        * plugins/PluginView.h:
+        Made paintWindowedPluginIntoContext() non-const, as it now calls
+        paintIntoTransformedContext(). Declare paintIntoTransformedContext()
+        and snapshot() for Windows platforms.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintIntoTransformedContext):
+        Paints into the passed HDC without applying any coordinate translations.
+        Code moved from paintWindowedPluginIntoContext() and paint(). Removed
+        the memset() of windowpos in lieu of assignment.
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        Code moved to paintIntoTransformedContext().
+        (WebCore::PluginView::paint):
+        Ditto.
+        (WebCore::PluginView::snapshot):
+        Create a context, and if the plug-in is windowless, translate it so the
+        plug-in will draw at the correct location. Create a bitmap, and select
+        it into the context. Paint the plug-in, and create a BitmapImage from
+        the bitmap.
+        (WebCore::PluginView::halt):
+        Use snapshot().
+
+2009-10-22  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix calculation of length in WebSocketChannel.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=30656
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-10-21  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding the ability to enable/disable functions in V8 at runtime.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30650
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-21  Darin Adler  <darin@apple.com>
+
+        Swedish search (and other languages as well) is broken while fixing Japanese search
+        https://bugs.webkit.org/show_bug.cgi?id=30646
+
+        Rolled Japanese tailoring out that was done to fix
+        https://bugs.webkit.org/show_bug.cgi?id=30437 earlier.
+        It was overriding the locale-specific tailoring.
+        We'll land a fix once we figure out how to add the
+        Japanese tailoring without removing anything.
+
+        * editing/TextIterator.cpp: Rolled out r49924.
+
+2009-10-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: chromium build fix - add missing image to gypi.
+
+        * WebCore.gypi:
+
+2009-10-21  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes part of <http://webkit.org/b/30522>.
+        Web Inspector: DOM Exceptions throughout the Inspector should be more human readable.
+
+        Expose the description attribute that is now a member of
+        ExceptionBase as of r49723, so when a user logs an exception, they
+        can see the description in the Web Inspector.
+
+        Test: fast/dom/dom-exception-description.html
+
+        * dom/DOMCoreException.idl:
+        * dom/EventException.idl:
+        * dom/RangeException.idl:
+        * svg/SVGException.idl:
+        * xml/XMLHttpRequestException.idl:
+        * xml/XPathException.idl:
+
+2009-10-21  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30616>.
+        REGRESSION (r49036): Web Inspector: Summary graph no longer switching to size summary.
+        
+        Add a check to make sure a function we need to calculate percentages is
+        defined before we use it.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
+
+2009-10-21  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        REGRESSION: Clicking on nodes in the console should take you to the element in the DOM
+        https://bugs.webkit.org/show_bug.cgi?id=27231
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatnode): Turns on ElementsTreeOutline.showInElementsPanelEnabled
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline): Added ElementsTreeOutline.showInElementsPanelEnabled
+        (WebInspector.ElementsTreeElement.prototype.onmousedown): Reveals the node in the Elements panel if 
+        treeOutline.showInElementsPanelEnabled is true.
+
+2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30637
+        Fix a compiler warning in windows.
+
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-21  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix the crash when a node not in a document receives dispatchEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=30611
+
+        Test: fast/events/dispatch-event-no-document.html
+
+        * dom/EventTarget.cpp: Check for scriptExecutionContext() at the moment of dispatchEvent; do nothing if no context.
+        (WebCore::EventTarget::dispatchEvent):
+
+2009-10-21  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: disable subpixel text on layers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30635
+        http://code.google.com/p/chromium/issues/detail?id=25365
+
+        With the addition of layers for drawing rounded corners in r49641,
+        subpixel text on rounded rectangles broke. This is because the layer
+        only contains a single alpha channel and this is insufficient to
+        compose subpixel text correctly.
+
+        On Windows, a large body of code in TransparencyWin.cpp exists to try
+        to deal with this. Even then, in some cases, it downgrades to
+        anti-aliased text. We need a fix for the grevious effects quickly thus
+        this patch disables subpixel text when rendering into a layer.
+
+        This would be covered by existing tests except that subpixel text is
+        disabled for pixel tests on Chromium Linux.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::isCanvasMultiLayered):
+        (WebCore::adjustTextRenderMode):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+
+2009-10-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMac 10.4 build fix, make sure we specify the Sqlite3 dependency correctly as otherwise
+        it will use the sqlite3 system library rather than WebCoreSQLite3.
+
+        * wscript:
+
+2009-10-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed background-clip parsing regressions introduced in r46240.
+
+        Test: fast/css/background-clip-text.html
+
+        * css/CSSParser.cpp:
+        (WebCore::parseBackgroundClip): Added this helper method.
+        (WebCore::CSSParser::parseFillShorthand): Use parseBackgroundClip() to
+        reparse the value. The old code called parseFillProperty() again, which
+        didn’t work, because parseFillProperty() advances the value list.
+        (WebCore::CSSParser::parseFillProperty): Changed to use
+        parseBackgroundClip().
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::operator EFillBox): Added a case for
+        CSSValueWebkitText.
+
+2009-10-21  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enable creation of custom SidebarTreeElements for different ProfileTypes
+
+        ProfileTypes can now create sidebar tree elements of custom types.
+        https://bugs.webkit.org/show_bug.cgi?id=30520
+
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
+        (WebInspector.CPUProfileType.prototype.createSidebarTreeElementForProfile):
+        (WebInspector.CPUProfileType.prototype.createView):
+        (WebInspector.CPUProfile.prototype.get head):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType.prototype.buttonClicked):
+        (WebInspector.ProfileType.prototype.viewForProfile):
+        (WebInspector.ProfileType.prototype.createView):
+        (WebInspector.ProfileType.prototype.createSidebarTreeElementForProfile):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+
+2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Selectors in the Styles pane should trigger a search for that selector when clicked
+        https://bugs.webkit.org/show_bug.cgi?id=17126
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult): only change focusedDOMNode on a manual search
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype._clickSelector): trigger a search
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._startEditing): correctly start editing attribute value instead of name
+
+2009-10-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix DOM Agent leak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30615
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+
+2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        Plugins: Create manual tests for testing plugins
+        
+        Create two test files:
+        1. windowed.html - Test plugin in windowed mode.
+        2. windowless.html - Test plugin in windowless mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30503
+
+        * manual-tests/plugins/windowed.html: Added.
+        * manual-tests/plugins/windowless.html: Added.
+
+2009-10-21  Satoshi Nakagawa  <psychs@limechat.net>
+
+        Reviewed by Darin Adler.
+
+        Fixed Japanese text search problems.
+        Treat small kana letters and kana letters as different characters in search.
+        Do not ignore diacritic marks in search for Japanese texts.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30437
+
+        Test: fast/text/international/japanese-kana-letters.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::createCollator):
+        (WebCore::collator):
+        (WebCore::createSearcher):
+
+2009-10-20  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Changes TimelineItems to be created with raw timestamps as opposed
+        to a time relative to a start of session.  Normalized timestamps cause
+        problems when monitoring a browsing session across multiple page
+        transitions.
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+
+2009-10-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix leak of WebSocketChannel by adopting the newly-created reference.
+
+        * websockets/WebSocketChannel.h:
+        (WebCore::WebSocketChannel::create):
+
+2009-10-20  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage runtime flag changes
+        https://bugs.webkit.org/show_bug.cgi?id=30602
+
+        Part 1/2.  Removing sessionStorageEnabled in next patch after the
+        Chromium side of the changes lands.
+
+        Revert my changes to Settings and instead implement DOM Storage enabling via
+        the methods agreed upon in https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        This stuff was (intentionally) never exposed to web pages or DRT, so there's no
+        LayoutTest visible changes and thus no tests.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+        * storage/Storage.cpp:
+        (WebCore::Storage::setLocalStorageAvailable):
+        (WebCore::Storage::localStorageAvailable):
+        (WebCore::Storage::setSessionStorageAvailable):
+        (WebCore::Storage::sessionStorageAvailable):
+        * storage/Storage.h:
+
+2009-10-20  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Need to turn off notifications properly at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=30409
+
+        This code only affects chromium, and is all behind a compile time
+        flag current turned off, so no new tests.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::setIsAvailable):
+        (WebCore::NotificationCenter::isAvailable):
+        * notifications/NotificationCenter.h:
+        * page/DOMWindow.idl:
+        * workers/WorkerContext.idl:
+
+2009-10-20  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fixes RefPtr initialization in the V8 implementation of WebCore::ScriptString to use the ::create() idiom and
+        use adoptRef() properly.  I failed to read the RefPtr docs the first time through :(
+
+        No new tests, error was caught by valgrind on the Chromium builders.
+
+        * bindings/v8/ScriptString.h:
+        (WebCore::ScriptString::ScriptString):
+        (WebCore::ScriptString::operator=):
+        * bindings/v8/ScriptStringImpl.h:
+        (WebCore::ScriptStringImpl::create):
+
+2009-10-20  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: populate child nodes before sorting them.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29673
+
+        * inspector/front-end/BottomUpProfileDataGridTree.js:
+        (WebInspector.BottomUpProfileDataGridNode): Swapped with BottomUpProfileDataGridTree to be consistent with TopDownProfileDataGridNode.
+        (WebInspector.BottomUpProfileDataGridNode.prototype._takePropertiesFromProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._keepOnlyChild):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._exclude):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._merge):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._sharedPopulate):
+        (WebInspector.BottomUpProfileDataGridTree.prototype.exclude):
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.sort): Added missing parentheses.
+        (WebInspector.ProfileDataGridNode.prototype.get _parent):
+        (WebInspector.ProfileDataGridNode.prototype._populate):
+        * inspector/front-end/TopDownProfileDataGridTree.js:
+        (WebInspector.TopDownProfileDataGridNode.prototype._sharedPopulate):
+
+2009-10-20  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove redundant String ref/deref calls in generated V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=30579
+
+        * bindings/v8/V8Binding.h:
+        (WebCore::toString): Fix return type of 'toString' to make it truly a no-op
+            instead of constructing/destructing a String.
+
+2009-10-20  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25411
+        [GTK] ATK accessible ancestry broken
+
+        Work around for the problem of bogus additional objects in the ancestry.
+        We now set the parent when we ref the child, then ask the Atk child if
+        it knows its parent. This solves the bulk of the cases. For those it
+        doesn't, fall back to the existing logic.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+        (webkit_accessible_ref_child):
+
+2009-10-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Alice Liu.
+
+        Fixes <http://webkit.org/b/30421>.
+        Web Inpsector: Local Files can show up on Cookies List with Cookies from other Domain.
+
+        When a page like Google generates an about:blank, it shows up as a local file on
+        the list of Cookie domains, but has all of the cookies of Google. When we are adding
+        cookie domains to the inspector, we should only add the domain is the URL of the resource
+        is in the HTTP protocol family or a file URL.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+
+2009-10-20  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Use a version of libWebKitSystemInterface with global symbols marked
+        private_extern for Chromium Mac.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30590
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/mac: Added.
+        * WebCore.gyp/mac/Empty.cpp: Added.
+        * WebCore.gyp/mac/adjust_visibility.sh: Added.
+
+2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CSSProperty
+        https://bugs.webkit.org/show_bug.cgi?id=30564
+
+        Inherits CSSProperty class from FastAllocBase because it has been
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:367.
+
+        * css/CSSProperty.h:
+
+2009-10-20  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Hide Chromium's media slider thumb if no source has been loaded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30529
+
+        Covered by existing layout tests, notably:
+            LayoutTests/media/controls-rendering.html
+            LayoutTests/media/unsupported-tracks.html
+            LayoutTests/media/video-src-none.html
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::hasSource): Returns true if an HTMLMediaElement has a valid source set.
+        (WebCore::paintMediaMuteButton): Refactored to use hasSource().
+        (WebCore::paintMediaPlayButton): Ditto.
+        (WebCore::paintMediaSliderThumb): Add call to hasSource() to determine if we should paint the thumb.
+
+2009-10-20  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Added getter for FrameLoader:m_suppressOpenerInNewFrame.
+        This will allow Chromium to more intelligently detect
+        noreferrer links and therefore open them in a new process.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30581
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::suppressOpenerInNewFrame): Added.
+
+2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSParserFunction
+        https://bugs.webkit.org/show_bug.cgi?id=30563
+
+        Inherits CSSParserFunction struct from FastAllocBase because it has been
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:4827.
+
+        * css/CSSProperty.h:
+
+2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Watched Expressions Buttons Do Not Match Inspector Styles
+        https://bugs.webkit.org/show_bug.cgi?id=30554
+
+        * inspector/front-end/inspector.css: added style to pane buttons
+
+2009-10-20  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Set debug id for contexts of isolated worlds to distinguish them in debugger.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30559
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        * bindings/v8/V8Proxy.h:
+
+2009-10-20  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Unreviewed buildfix.
+        [Qt] Add FEGaussianBlur.h and FEGaussianBlur.cpp which were refactored in r49778 to WebCore.pro.
+
+        * WebCore.pro:
+
 2009-10-20  Fumitoshi Ukai  <ukai@chromium.org>
 
         Reviewed by David Levin.
@@ -2704,7 +6961,6 @@
         (InjectedScript.CallFrameProxy.prototype._wrapScopeChain): don't send call frame properties until they're needed.
         * inspector/front-end/ScriptsPanel.js:
 
->>>>>>> .r49765
 2009-10-13  Yongjun Zhang  <yongjun.zhang@nokia.com>
 
         Reviewed by Ariya Hidayat.
diff --git a/src/3rdparty/webkit/WebCore/DerivedSources.cpp b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
index be83136a47..1edbf7dbd1 100644
--- a/src/3rdparty/webkit/WebCore/DerivedSources.cpp
+++ b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
@@ -82,6 +82,7 @@
 #include "JSFile.cpp"
 #include "JSFileList.cpp"
 #include "JSHistory.cpp"
+#include "JSHTMLAllCollection.cpp"
 #include "JSHTMLAnchorElement.cpp"
 #include "JSHTMLAppletElement.cpp"
 #include "JSHTMLAreaElement.cpp"
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/DateInstanceCache.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/DateInstanceCache.h
new file mode 100644
index 0000000000..f39bdee4bc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/DateInstanceCache.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_DateInstanceCache_h
+#define WebCore_FWD_DateInstanceCache_h
+#include <JavaScriptCore/DateInstanceCache.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/LICENSE-APPLE b/src/3rdparty/webkit/WebCore/LICENSE-APPLE
index 92514e22b9..f29b41c3b2 100644
--- a/src/3rdparty/webkit/WebCore/LICENSE-APPLE
+++ b/src/3rdparty/webkit/WebCore/LICENSE-APPLE
@@ -1,22 +1,21 @@
-Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
+1.  Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+2.  Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
 
-THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
-EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
-CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/src/3rdparty/webkit/WebCore/WebCore.gypi b/src/3rdparty/webkit/WebCore/WebCore.gypi
index c0da0ec831..c0baaf40b5 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.gypi
+++ b/src/3rdparty/webkit/WebCore/WebCore.gypi
@@ -1,6 +1,6 @@
 {
     'variables': {
-        'webcore_files': [
+        'webcore_bindings_idl_files': [
 
             #IDL files
             'css/CSSCharsetRule.idl',
@@ -51,7 +51,6 @@
             'dom/EventException.idl',
             'dom/EventListener.idl',
             'dom/EventTarget.idl',
-            'dom/HTMLAllCollection.idl',
             'dom/KeyboardEvent.idl',
             'dom/MessageChannel.idl',
             'dom/MessageEvent.idl',
@@ -103,6 +102,7 @@
             'html/DataGridColumnList.idl',
             'html/File.idl',
             'html/FileList.idl',
+            'html/HTMLAllCollection.idl',
             'html/HTMLAnchorElement.idl',
             'html/HTMLAppletElement.idl',
             'html/HTMLAreaElement.idl',
@@ -374,6 +374,8 @@
             'xml/XPathNSResolver.idl',
             'xml/XPathResult.idl',
             'xml/XSLTProcessor.idl',
+        ],
+        'webcore_files': [
 
             # Source/Header Files
             'accessibility/AXObjectCache.cpp',
@@ -491,8 +493,7 @@
             'bindings/js/JSGeolocationCustom.cpp',
             'bindings/js/JSHistoryCustom.cpp',
             'bindings/js/JSHistoryCustom.h',
-            'bindings/js/JSHTMLAllCollection.cpp',
-            'bindings/js/JSHTMLAllCollection.h',
+            'bindings/js/JSHTMLAllCollectionCustom.cpp',
             'bindings/js/JSHTMLAppletElementCustom.cpp',
             'bindings/js/JSHTMLAppletElementCustom.h',
             'bindings/js/JSHTMLCanvasElementCustom.cpp',
@@ -677,6 +678,7 @@
             'bindings/v8/custom/V8FileListCustom.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.h',
+            'bindings/v8/custom/V8HTMLAllCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLCanvasElementCustom.cpp',
             'bindings/v8/custom/V8HTMLCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLDataGridElementCustom.cpp',
@@ -742,6 +744,8 @@
             'bindings/v8/NPV8Object.cpp',
             'bindings/v8/NPV8Object.h',
             'bindings/v8/OwnHandle.h',
+            'bindings/v8/RuntimeEnabledFeatures.cpp',
+            'bindings/v8/RuntimeEnabledFeatures.h',
             'bindings/v8/ScheduledAction.cpp',
             'bindings/v8/ScheduledAction.h',
             'bindings/v8/ScopedDOMDataStore.cpp',
@@ -1325,6 +1329,8 @@
             'html/FileList.h',
             'html/FormDataList.cpp',
             'html/FormDataList.h',
+            'html/HTMLAllCollection.cpp',
+            'html/HTMLAllCollection.h',
             'html/HTMLAnchorElement.cpp',
             'html/HTMLAnchorElement.h',
             'html/HTMLAppletElement.cpp',
@@ -1507,8 +1513,6 @@
             'inspector/InspectorClient.h',
             'inspector/ConsoleMessage.cpp',
             'inspector/ConsoleMessage.h',
-            'inspector/DOMDispatchTimelineItem.cpp',
-            'inspector/DOMDispatchTimelineItem.h',
             'inspector/InspectorBackend.cpp',
             'inspector/InspectorBackend.h',
             'inspector/InspectorController.cpp',
@@ -1534,8 +1538,8 @@
             'inspector/JavaScriptProfile.h',
             'inspector/JavaScriptProfileNode.cpp',
             'inspector/JavaScriptProfileNode.h',
-            'inspector/TimelineItem.cpp',
-            'inspector/TimelineItem.h',
+            'inspector/TimelineRecordFactory.cpp',
+            'inspector/TimelineRecordFactory.h',
             'loader/appcache/ApplicationCache.cpp',
             'loader/appcache/ApplicationCache.h',
             'loader/appcache/ApplicationCacheGroup.cpp',
@@ -2376,6 +2380,7 @@
             'platform/network/chromium/NetworkStateNotifierChromium.cpp',
             'platform/network/chromium/NetworkStateNotifierPrivate.h',
             'platform/network/chromium/ResourceError.h',
+            'platform/network/chromium/ResourceRequest.cpp',
             'platform/network/chromium/ResourceRequest.h',
             'platform/network/chromium/ResourceResponse.h',
             'platform/network/chromium/SocketStreamError.h',
@@ -3582,6 +3587,7 @@
         'webinspector_files': [
 
             'inspector/front-end/inspector.html',
+            'inspector/front-end/AbstractTimelinePanel.js',
             'inspector/front-end/BottomUpProfileDataGridTree.js',
             'inspector/front-end/Breakpoint.js',
             'inspector/front-end/BreakpointsSidebarPane.js',
@@ -3605,6 +3611,7 @@
             'inspector/front-end/EventListenersSidebarPane.js',
             'inspector/front-end/FontView.js',
             'inspector/front-end/ImageView.js',
+            'inspector/front-end/InspectorControllerStub.js',
             'inspector/front-end/InjectedScript.js',
             'inspector/front-end/InjectedScriptAccess.js',
             'inspector/front-end/inspector.js',
@@ -3641,6 +3648,7 @@
             'inspector/front-end/TestController.js',
             'inspector/front-end/TextPrompt.js',
             'inspector/front-end/TimelineAgent.js',
+            'inspector/front-end/TimelinePanel.js',
             'inspector/front-end/TopDownProfileDataGridTree.js',
             'inspector/front-end/treeoutline.js',
             'inspector/front-end/utilities.js',
@@ -3696,6 +3704,7 @@
             'inspector/front-end/Images/paneBottomGrow.png',
             'inspector/front-end/Images/paneBottomGrowActive.png',
             'inspector/front-end/Images/paneGrowHandleLine.png',
+            'inspector/front-end/Images/paneSettingsButtons.png',
             'inspector/front-end/Images/pauseOnExceptionButtonGlyph.png',
             'inspector/front-end/Images/percentButtonGlyph.png',
             'inspector/front-end/Images/profileGroupIcon.png',
@@ -3747,6 +3756,16 @@
             'inspector/front-end/Images/timelineHollowPillPurple.png',
             'inspector/front-end/Images/timelineHollowPillRed.png',
             'inspector/front-end/Images/timelineHollowPillYellow.png',
+            'inspector/front-end/Images/timelineIcon.png',
+            'inspector/front-end/Images/timelineBarBlue.png',
+            'inspector/front-end/Images/timelineBarGray.png',
+            'inspector/front-end/Images/timelineBarGreen.png',
+            'inspector/front-end/Images/timelineBarOrange.png',
+            'inspector/front-end/Images/timelineBarPurple.png',
+            'inspector/front-end/Images/timelineBarRed.png',
+            'inspector/front-end/Images/timelineBarYellow.png',
+            'inspector/front-end/Images/timelineCheckmarks.png',
+            'inspector/front-end/Images/timelineDots.png',
             'inspector/front-end/Images/timelinePillBlue.png',
             'inspector/front-end/Images/timelinePillGray.png',
             'inspector/front-end/Images/timelinePillGreen.png',
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index d633a7a091..e81d15df64 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -394,6 +394,7 @@ IDL_BINDINGS += \
     html/DataGridColumnList.idl \
     html/File.idl \
     html/FileList.idl \
+    html/HTMLAllCollection.idl \
     html/HTMLAudioElement.idl \
     html/HTMLAnchorElement.idl \
     html/HTMLAppletElement.idl \
@@ -703,10 +704,10 @@ SOURCES += \
     bindings/js/JSEventTarget.cpp \
     bindings/js/JSExceptionBase.cpp \
     bindings/js/JSGeolocationCustom.cpp \
-    bindings/js/JSHTMLAllCollection.cpp \
     bindings/js/JSHistoryCustom.cpp \
     bindings/js/JSHTMLAppletElementCustom.cpp \
     bindings/js/JSHTMLCanvasElementCustom.cpp \
+    bindings/js/JSHTMLAllCollectionCustom.cpp \
     bindings/js/JSHTMLCollectionCustom.cpp \
     bindings/js/JSHTMLDataGridElementCustom.cpp \
     bindings/js/JSHTMLDocumentCustom.cpp \
@@ -990,6 +991,7 @@ SOURCES += \
     html/File.cpp \
     html/FileList.cpp \
     html/FormDataList.cpp \
+    html/HTMLAllCollection.cpp \
     html/HTMLAnchorElement.cpp \
     html/HTMLAppletElement.cpp \
     html/HTMLAreaElement.cpp \
@@ -1075,7 +1077,6 @@ SOURCES += \
     html/PreloadScanner.cpp \
     html/ValidityState.cpp \
     inspector/ConsoleMessage.cpp \
-    inspector/DOMDispatchTimelineItem.cpp \
     inspector/InspectorBackend.cpp \
     inspector/InspectorController.cpp \
     inspector/InspectorDatabaseResource.cpp \
@@ -1084,7 +1085,7 @@ SOURCES += \
     inspector/InspectorFrontend.cpp \
     inspector/InspectorResource.cpp \
     inspector/InspectorTimelineAgent.cpp \
-    inspector/TimelineItem.cpp \
+    inspector/TimelineRecordFactory.cpp \
     loader/archive/ArchiveFactory.cpp \
     loader/archive/ArchiveResource.cpp \
     loader/archive/ArchiveResourceCollection.cpp \
@@ -1187,6 +1188,7 @@ SOURCES += \
     platform/FileChooser.cpp \
     platform/GeolocationService.cpp \
     platform/image-decoders/qt/RGBA32BufferQt.cpp \
+    platform/graphics/filters/FEGaussianBlur.cpp \
     platform/graphics/FontDescription.cpp \
     platform/graphics/FontFamily.cpp \
     platform/graphics/BitmapImage.cpp \
@@ -1402,7 +1404,6 @@ HEADERS += \
     bindings/js/JSEventSourceConstructor.h \
     bindings/js/JSEventTarget.h \
     bindings/js/JSHistoryCustom.h \
-    bindings/js/JSHTMLAllCollection.h \
     bindings/js/JSHTMLAppletElementCustom.h \
     bindings/js/JSHTMLEmbedElementCustom.h \
     bindings/js/JSHTMLInputElementCustom.h \
@@ -1663,6 +1664,7 @@ HEADERS += \
     html/File.h \
     html/FileList.h \
     html/FormDataList.h \
+    html/HTMLAllCollection.h \
     html/HTMLAnchorElement.h \
     html/HTMLAppletElement.h \
     html/HTMLAreaElement.h \
@@ -1752,7 +1754,6 @@ HEADERS += \
     html/TimeRanges.h \
     html/ValidityState.h \
     inspector/ConsoleMessage.h \
-    inspector/DOMDispatchTimelineItem.h \
     inspector/InspectorBackend.h \
     inspector/InspectorController.h \
     inspector/InspectorDatabaseResource.h \
@@ -1764,7 +1765,7 @@ HEADERS += \
     inspector/JavaScriptDebugServer.h \
     inspector/JavaScriptProfile.h \
     inspector/JavaScriptProfileNode.h \
-    inspector/TimelineItem.h \
+    inspector/TimelineRecordFactory.h \
     loader/appcache/ApplicationCacheGroup.h \
     loader/appcache/ApplicationCacheHost.h \
     loader/appcache/ApplicationCache.h \
@@ -1873,6 +1874,7 @@ HEADERS += \
     platform/graphics/filters/FEColorMatrix.h \
     platform/graphics/filters/FEComponentTransfer.h \
     platform/graphics/filters/FEComposite.h \
+    platform/graphics/filters/FEGaussianBlur.h \
     platform/graphics/filters/FilterEffect.h \
     platform/graphics/filters/SourceAlpha.h \
     platform/graphics/filters/SourceGraphic.h \
@@ -2498,13 +2500,15 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
         }
     
         win32-* {
-            INCLUDEPATH += $$PWD/plugins/win
+            INCLUDEPATH += $$PWD/plugins/win \
+                           $$PWD/platform/win
     
             SOURCES += page/win/PageWin.cpp \
                        plugins/win/PluginDatabaseWin.cpp \
                        plugins/win/PluginPackageWin.cpp \
                        plugins/win/PluginMessageThrottlerWin.cpp \
-                       plugins/win/PluginViewWin.cpp
+                       plugins/win/PluginViewWin.cpp \
+                       platform/win/BitmapInfo.cpp
     
             LIBS += \
                 -ladvapi32 \
@@ -3376,18 +3380,3 @@ CONFIG(QTDIR_build):isEqual(QT_MAJOR_VERSION, 4):greaterThan(QT_MINOR_VERSION, 4
             plugins/win/PaintHooks.asm
     }
 }
-
-# Temporary workaround to pick up the DEF file from the same place as all the others
-symbian {
-    shared {
-        contains(MMP_RULES, defBlock) {
-            MMP_RULES -= defBlock
-
-            MMP_RULES += "$${LITERAL_HASH}ifdef WINSCW" \
-                    "DEFFILE ../../../s60installs/bwins/$${TARGET}.def" \
-                    "$${LITERAL_HASH}elif defined EABI" \
-                    "DEFFILE ../../../s60installs/eabi/$${TARGET}.def" \
-                    "$${LITERAL_HASH}endif"
-        }
-    }
-}
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityAllInOne.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityAllInOne.cpp
new file mode 100755
index 0000000000..04124bd32c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityAllInOne.cpp
@@ -0,0 +1,44 @@
+/*

+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 

+ */

+

+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.

+

+#include <AccessibilityARIAGrid.cpp>

+#include <AccessibilityARIAGridCell.cpp>

+#include <AccessibilityARIAGridRow.cpp>

+#include <AccessibilityImageMapLink.cpp>

+#include <AccessibilityList.cpp>

+#include <AccessibilityListBox.cpp>

+#include <AccessibilityListBoxOption.cpp>

+#include <AccessibilityMediaControls.cpp>

+#include <AccessibilityObject.cpp>

+#include <AccessibilityRenderObject.cpp>

+#include <AccessibilitySlider.cpp>

+#include <AccessibilityTable.cpp>

+#include <AccessibilityTableCell.cpp>

+#include <AccessibilityTableColumn.cpp>

+#include <AccessibilityTableHeaderContainer.cpp>

+#include <AccessibilityTableRow.cpp>

+#include <AXObjectCache.cpp>

diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
index 1b588cd457..933cdeb351 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
@@ -68,6 +68,7 @@ public:
 private:
     HTMLElement* m_optionElement;
     
+    virtual bool canHaveChildren() const { return false; }
     HTMLSelectElement* listBoxOptionParentNode() const;
     int listBoxOptionIndex() const;
     IntRect listBoxOptionRect() const;
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
index c5ba1ed75b..8fc40e860a 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
@@ -160,6 +160,7 @@ enum AccessibilityRole {
     DefinitionListDefinitionRole,
     AnnotationRole,
     SliderThumbRole,
+    IgnoredRole,
     
     // ARIA Grouping roles
     LandmarkApplicationRole,
@@ -188,6 +189,12 @@ enum AccessibilityOrientation {
     AccessibilityOrientationHorizontal,
 };
     
+enum AccessibilityObjectPlatformInclusion {
+    IncludeObject,
+    IgnoreObject,
+    DefaultBehavior,
+};
+
 struct VisiblePositionRange {
 
     VisiblePosition start;
@@ -459,6 +466,13 @@ public:
     bool accessibilityIgnoreAttachment() const { return true; }
 #endif
 
+    // gives platforms the opportunity to indicate if and how an object should be included
+#if HAVE(ACCESSIBILITY)
+    AccessibilityObjectPlatformInclusion accessibilityPlatformIncludesObject() const;
+#else
+    AccessibilityObjectPlatformInclusion accessibilityPlatformIncludesObject() const { return DefaultBehavior; }
+#endif
+
     // allows for an AccessibilityObject to update its render tree or perform
     // other operations update type operations
     virtual void updateBackingStore() { }
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
index 834e931a9c..4c50b9a3ba 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -1258,6 +1258,14 @@ bool AccessibilityRenderObject::ariaIsHidden() const
 
 bool AccessibilityRenderObject::accessibilityIsIgnored() const
 {
+    // is the platform is interested in this object?
+    AccessibilityObjectPlatformInclusion decision = accessibilityPlatformIncludesObject();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    // the decision must, therefore, be DefaultBehavior.
+
     // ignore invisible element
     if (!m_renderer || m_renderer->style()->visibility() != VISIBLE)
         return true;
@@ -1268,6 +1276,9 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     if (isPresentationalChildOfAriaRole())
         return true;
         
+    if (roleValue() == IgnoredRole)
+        return true;
+    
     // ignore popup menu items because AppKit does
     for (RenderObject* parent = m_renderer->parent(); parent; parent = parent->parent()) {
         if (parent->isMenuList())
@@ -2212,6 +2223,21 @@ AccessibilityObject* AccessibilityRenderObject::correspondingControlForLabelElem
     return axObjectCache()->getOrCreate(correspondingControl->renderer());     
 }
 
+AccessibilityObject* AccessibilityRenderObject::correspondingLabelForControlElement() const
+{
+    if (!m_renderer)
+        return 0;
+
+    Node* node = m_renderer->node();
+    if (node && node->isHTMLElement()) {
+        HTMLLabelElement* label = labelForElement(static_cast<Element*>(node));
+        if (label)
+            return axObjectCache()->getOrCreate(label->renderer());
+    }
+
+    return 0;
+}
+
 AccessibilityObject* AccessibilityRenderObject::observableObject() const
 {
     for (RenderObject* renderer = m_renderer; renderer && renderer->node(); renderer = renderer->parent()) {
@@ -2224,13 +2250,13 @@ AccessibilityObject* AccessibilityRenderObject::observableObject() const
     
 typedef HashMap<String, AccessibilityRole, CaseFoldingHash> ARIARoleMap;
 
+struct RoleEntry {
+    String ariaRole;
+    AccessibilityRole webcoreRole;
+};
+
 static const ARIARoleMap& createARIARoleMap()
 {
-    struct RoleEntry {
-        String ariaRole;
-        AccessibilityRole webcoreRole;
-    };
-
     const RoleEntry roles[] = {
         { "application", LandmarkApplicationRole },
         { "article", DocumentArticleRole },
@@ -2263,6 +2289,8 @@ static const ARIARoleMap& createARIARoleMap()
         { "menuitemradio", MenuItemRole },
         { "note", DocumentNoteRole },
         { "navigation", LandmarkNavigationRole },
+        { "option", ListBoxOptionRole },
+        { "presentation", IgnoredRole },
         { "progressbar", ProgressIndicatorRole },
         { "radio", RadioButtonRole },
         { "radiogroup", RadioGroupRole },
@@ -2508,6 +2536,8 @@ bool AccessibilityRenderObject::canHaveChildren() const
         case PopUpButtonRole:
         case CheckBoxRole:
         case RadioButtonRole:
+        case StaticTextRole:
+        case ListBoxOptionRole:
             return false;
         default:
             return true;
@@ -2561,7 +2591,7 @@ void AccessibilityRenderObject::addChildren()
             for (Node* current = map->firstChild(); current; current = current->traverseNextNode(map)) {
 
                 // add an <area> element for this child if it has a link
-                if (current->isLink()) {
+                if (current->hasTagName(areaTag) && current->isLink()) {
                     AccessibilityImageMapLink* areaObject = static_cast<AccessibilityImageMapLink*>(m_renderer->document()->axObjectCache()->getOrCreate(ImageMapLinkRole));
                     areaObject->setHTMLAreaElement(static_cast<HTMLAreaElement*>(current));
                     areaObject->setHTMLMapElement(map);
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
index d82ca71ab7..c6fd74876f 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
@@ -134,6 +134,7 @@ public:
     virtual bool exposesTitleUIElement() const;
     virtual AccessibilityObject* titleUIElement() const;
     virtual AccessibilityObject* correspondingControlForLabelElement() const;
+    virtual AccessibilityObject* correspondingLabelForControlElement() const;
 
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
diff --git a/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp b/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
index 17100274f4..07f13d4bb7 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
@@ -29,6 +29,11 @@ bool AccessibilityObject::accessibilityIgnoreAttachment() const
     return false;
 }
 
+AccessibilityObjectPlatformInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
+{
+    return DefaultBehavior;
+}
+
 } // namespace WebCore
 
 #endif // HAVE(ACCESSIBILITY)
diff --git a/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp b/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
index 4d73d837a0..7dc68ef196 100644
--- a/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
@@ -53,6 +53,7 @@ ScriptValue ScriptController::executeScript(const ScriptSourceCode& sourceCode)
     return result;
 }
 
+
 bool ScriptController::executeIfJavaScriptURL(const KURL& url, bool userGesture, bool replaceDocument)
 {
     if (!protocolIsJavaScript(url))
@@ -61,6 +62,9 @@ bool ScriptController::executeIfJavaScriptURL(const KURL& url, bool userGesture,
     if (m_frame->page() && !m_frame->page()->javaScriptURLsAreAllowed())
         return true;
 
+    if (m_frame->inViewSourceMode())
+        return true;
+
     const int javascriptSchemeLength = sizeof("javascript:") - 1;
 
     String script = decodeURLEscapeSequences(url.string().substring(javascriptSchemeLength));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
index a6cbd91f9b..6eca7bdbed 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
@@ -50,7 +50,7 @@ JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -60,7 +60,7 @@ JSValue JSAbstractWorker::removeEventListener(ExecState* exec, const ArgList& ar
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp
new file mode 100644
index 0000000000..f08303a0c6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "GCController.cpp"
+#include "JSAbstractWorkerCustom.cpp"
+#include "JSAttrCustom.cpp"
+#include "JSAudioConstructor.cpp"
+#include "JSCDATASectionCustom.cpp"
+#include "JSCSSRuleCustom.cpp"
+#include "JSCSSRuleListCustom.cpp"
+#include "JSCSSStyleDeclarationCustom.cpp"
+#include "JSCSSValueCustom.cpp"
+#include "JSCallbackData.cpp"
+#include "JSCanvasRenderingContext2DCustom.cpp"
+#include "JSCanvasRenderingContextCustom.cpp"
+#include "JSClipboardCustom.cpp"
+#include "JSConsoleCustom.cpp"
+#include "JSCoordinatesCustom.cpp"
+#include "JSCustomSQLStatementCallback.cpp"
+#include "JSCustomSQLStatementErrorCallback.cpp"
+#include "JSCustomSQLTransactionCallback.cpp"
+#include "JSCustomSQLTransactionErrorCallback.cpp"
+#include "JSCustomVoidCallback.cpp"
+#include "JSCustomXPathNSResolver.cpp"
+#include "JSDOMApplicationCacheCustom.cpp"
+#include "JSDOMBinding.cpp"
+#include "JSDOMGlobalObject.cpp"
+#include "JSDOMWindowBase.cpp"
+#include "JSDOMWindowCustom.cpp"
+#include "JSDOMWindowShell.cpp"
+#include "JSDataGridColumnListCustom.cpp"
+#include "JSDataGridDataSource.cpp"
+#include "JSDatabaseCustom.cpp"
+#include "JSDedicatedWorkerContextCustom.cpp"
+#include "JSDesktopNotificationsCustom.cpp"
+#include "JSDocumentCustom.cpp"
+#include "JSDocumentFragmentCustom.cpp"
+#include "JSElementCustom.cpp"
+#include "JSEventCustom.cpp"
+#include "JSEventListener.cpp"
+#include "JSEventSourceConstructor.cpp"
+#include "JSEventSourceCustom.cpp"
+#include "JSEventTarget.cpp"
+#include "JSExceptionBase.cpp"
+#include "JSHTMLAllCollectionCustom.cpp"
+#include "JSHTMLAppletElementCustom.cpp"
+#include "JSHTMLCanvasElementCustom.cpp"
+#include "JSHTMLCollectionCustom.cpp"
+#include "JSHTMLDataGridElementCustom.cpp"
+#include "JSHTMLDocumentCustom.cpp"
+#include "JSHTMLElementCustom.cpp"
+#include "JSHTMLEmbedElementCustom.cpp"
+#include "JSHTMLFormElementCustom.cpp"
+#include "JSHTMLFrameElementCustom.cpp"
+#include "JSHTMLFrameSetElementCustom.cpp"
+#include "JSHTMLIFrameElementCustom.cpp"
+#include "JSHTMLInputElementCustom.cpp"
+#include "JSHTMLObjectElementCustom.cpp"
+#include "JSHTMLOptionsCollectionCustom.cpp"
+#include "JSHTMLSelectElementCustom.cpp"
+#include "JSHistoryCustom.cpp"
+#include "JSImageConstructor.cpp"
+#include "JSImageDataCustom.cpp"
+#include "JSInspectedObjectWrapper.cpp"
+#include "JSInspectorBackendCustom.cpp"
+#include "JSJavaScriptCallFrameCustom.cpp"
+#include "JSLazyEventListener.cpp"
+#include "JSLocationCustom.cpp"
+#include "JSMessageChannelConstructor.cpp"
+#include "JSMessageChannelCustom.cpp"
+#include "JSMessageEventCustom.cpp"
+#include "JSMessagePortCustom.cpp"
+#include "JSMimeTypeArrayCustom.cpp"
+#include "JSNamedNodeMapCustom.cpp"
+#include "JSNavigatorCustom.cpp"
+#include "JSNodeCustom.cpp"
+#include "JSNodeFilterCondition.cpp"
+#include "JSNodeFilterCustom.cpp"
+#include "JSNodeIteratorCustom.cpp"
+#include "JSNodeListCustom.cpp"
+#include "JSOptionConstructor.cpp"
+#include "JSPluginArrayCustom.cpp"
+#include "JSPluginCustom.cpp"
+#include "JSPluginElementFunctions.cpp"
+#include "JSQuarantinedObjectWrapper.cpp"
+#include "JSSQLResultSetRowListCustom.cpp"
+#include "JSSQLTransactionCustom.cpp"
+#include "JSSVGElementInstanceCustom.cpp"
+#include "JSSVGLengthCustom.cpp"
+#include "JSSVGMatrixCustom.cpp"
+#include "JSSVGPathSegCustom.cpp"
+#include "JSSVGPathSegListCustom.cpp"
+#include "JSSVGPointListCustom.cpp"
+#include "JSSharedWorkerConstructor.cpp"
+#include "JSSharedWorkerCustom.cpp"
+#include "JSStorageCustom.cpp"
+#include "JSStyleSheetCustom.cpp"
+#include "JSStyleSheetListCustom.cpp"
+#include "JSTextCustom.cpp"
+#include "JSTreeWalkerCustom.cpp"
+#include "JSWebKitCSSMatrixConstructor.cpp"
+#include "JSWebKitPointConstructor.cpp"
+#include "JSWebSocketConstructor.cpp"
+#include "JSWebSocketCustom.cpp"
+#include "JSWorkerConstructor.cpp"
+#include "JSWorkerContextBase.cpp"
+#include "JSWorkerContextCustom.cpp"
+#include "JSWorkerCustom.cpp"
+#include "JSXMLHttpRequestConstructor.cpp"
+#include "JSXMLHttpRequestCustom.cpp"
+#include "JSXMLHttpRequestUploadCustom.cpp"
+#include "JSXSLTProcessorConstructor.cpp"
+#include "JSXSLTProcessorCustom.cpp"
+#include "ScheduledAction.cpp"
+#include "ScriptArray.cpp"
+#include "ScriptCachedFrameData.cpp"
+#include "ScriptCallFrame.cpp"
+#include "ScriptCallStack.cpp"
+#include "ScriptController.cpp"
+#include "ScriptControllerWin.cpp"
+#include "ScriptEventListener.cpp"
+#include "ScriptFunctionCall.cpp"
+#include "ScriptObjectQuarantine.cpp"
+#include "ScriptState.cpp"
+#include "SerializedScriptValue.cpp"
+#include "WorkerScriptController.cpp"
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
index d08f7601d9..38292c7b68 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
@@ -48,7 +48,12 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
 
     ExecState* exec = globalObject()->globalExec();
     
-    JSValue function = callback()->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function;
+    {
+        // Switch worlds, just in case handleEvent is a getter and causes JS execution!
+        EnterDOMWrapperWorld worldEntry(exec, m_isolatedWorld.get());
+        function = callback()->get(exec, Identifier(exec, "handleEvent"));
+    }
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -59,7 +64,7 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
     }
     
     globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = call(exec, function, callType, callData, callback(), args);
+    JSValue result = callInWorld(exec, function, callType, callData, callback(), args, m_isolatedWorld.get());
     globalObject()->globalData()->timeoutChecker.stop();
 
     Document::updateStyleForAllDocuments();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
index 4fc9f8494c..5c867019c1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
@@ -29,6 +29,7 @@
 #ifndef JSCallbackData_h
 #define JSCallbackData_h
 
+#include "JSDOMBinding.h"
 #include "JSDOMGlobalObject.h"
 #include <runtime/JSObject.h>
 #include <runtime/Protect.h>
@@ -47,6 +48,7 @@ public:
     JSCallbackData(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
         : m_callback(callback)
         , m_globalObject(globalObject)
+        , m_isolatedWorld(currentWorld(globalObject->globalExec()))
     {
     }
     
@@ -63,6 +65,7 @@ public:
 private:
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
     JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+    RefPtr<DOMWrapperWorld> m_isolatedWorld;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index da4a53a952..c2884d7a3a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -90,7 +90,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     args.append(jsString(exec, prefix));
 
     m_globalObject->globalData()->timeoutChecker.start();
-    JSValue retval = call(exec, function, callType, callData, m_customResolver, args);
+    JSValue retval = callInWorld(exec, function, callType, callData, m_customResolver, args, currentWorld(m_globalObject->globalExec()));
     m_globalObject->globalData()->timeoutChecker.stop();
 
     String result;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index 8634589ed2..91ee51ada4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -91,7 +91,7 @@ JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList&
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -101,7 +101,7 @@ JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgLis
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index 8168323c5f..ef69c7b1e9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -21,6 +21,8 @@
 #include "config.h"
 #include "JSDOMBinding.h"
 
+#include "debugger/DebuggerCallFrame.h"
+
 #include "ActiveDOMObject.h"
 #include "DOMCoreException.h"
 #include "Document.h"
@@ -44,6 +46,7 @@
 #include "MessagePort.h"
 #include "RangeException.h"
 #include "ScriptController.h"
+#include "Settings.h"
 #include "XMLHttpRequestException.h"
 #include <runtime/Error.h>
 #include <runtime/JSFunction.h>
@@ -72,6 +75,7 @@ namespace WebCore {
 using namespace HTMLNames;
 
 typedef Document::JSWrapperCache JSWrapperCache;
+typedef Document::JSWrapperCacheMap JSWrapperCacheMap;
 
 // For debugging, keep a set of wrappers currently registered, and check that
 // all are unregistered before they are destroyed. This has helped us fix at
@@ -80,6 +84,7 @@ typedef Document::JSWrapperCache JSWrapperCache;
 static void addWrapper(DOMObject* wrapper);
 static void removeWrapper(DOMObject* wrapper);
 static void removeWrappers(const JSWrapperCache& wrappers);
+static void removeWrappers(const DOMObjectWrapperMap& wrappers);
 
 #ifdef NDEBUG
 
@@ -95,6 +100,10 @@ static inline void removeWrappers(const JSWrapperCache&)
 {
 }
 
+static inline void removeWrappers(const DOMObjectWrapperMap&)
+{
+}
+
 #else
 
 static HashSet<DOMObject*>& wrapperSet()
@@ -124,7 +133,15 @@ static void removeWrapper(DOMObject* wrapper)
 
 static void removeWrappers(const JSWrapperCache& wrappers)
 {
-    for (JSWrapperCache::const_iterator it = wrappers.begin(); it != wrappers.end(); ++it)
+    JSWrapperCache::const_iterator wrappersEnd = wrappers.end();
+    for (JSWrapperCache::const_iterator it = wrappers.begin(); it != wrappersEnd; ++it)
+        removeWrapper(it->second);
+}
+
+static inline void removeWrappers(const DOMObjectWrapperMap& wrappers)
+{
+    DOMObjectWrapperMap::const_iterator wrappersEnd = wrappers.end();
+    for (DOMObjectWrapperMap::const_iterator it = wrappers.begin(); it != wrappersEnd; ++it)
         removeWrapper(it->second);
 }
 
@@ -135,67 +152,120 @@ DOMObject::~DOMObject()
 
 #endif
 
-class DOMObjectWrapperMap {
-public:
-    static DOMObjectWrapperMap& mapFor(JSGlobalData&);
+DOMWrapperWorld::DOMWrapperWorld(JSC::JSGlobalData* globalData)
+    : m_globalData(globalData)
+{
+}
+
+DOMWrapperWorld::~DOMWrapperWorld()
+{
+    JSGlobalData::ClientData* clientData = m_globalData->clientData;
+    ASSERT(clientData);
+    static_cast<WebCoreJSClientData*>(clientData)->forgetWorld(this);
+
+    removeWrappers(m_wrappers);
 
-    DOMObject* get(void* objectHandle)
+    for (HashSet<Document*>::iterator iter = documentsWithWrappers.begin(); iter != documentsWithWrappers.end(); ++iter)
+        forgetWorldOfDOMNodesForDocument(*iter, this);
+    for (HashSet<ScriptController*>::iterator iter = scriptControllersWithShells.begin(); iter != scriptControllersWithShells.end(); ++iter)
+        (*iter)->forgetWorld(this);
+}
+
+EnterDOMWrapperWorld::EnterDOMWrapperWorld(JSC::JSGlobalData& globalData, DOMWrapperWorld* isolatedWorld)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    ASSERT(clientData);
+    m_clientData = static_cast<WebCoreJSClientData*>(clientData);
+    m_clientData->m_worldStack.append(isolatedWorld);
+}
+
+EnterDOMWrapperWorld::EnterDOMWrapperWorld(JSC::ExecState* exec, DOMWrapperWorld* isolatedWorld)
+{
+    JSGlobalData::ClientData* clientData = exec->globalData().clientData;
+    ASSERT(clientData);
+    m_clientData = static_cast<WebCoreJSClientData*>(clientData);
+    m_clientData->m_worldStack.append(isolatedWorld);
+}
+
+EnterDOMWrapperWorld::~EnterDOMWrapperWorld()
+{
+    m_clientData->m_worldStack.removeLast();
+}
+
+class JSGlobalDataWorldIterator {
+public:
+    JSGlobalDataWorldIterator(JSGlobalData* globalData)
+        : m_pos(static_cast<WebCoreJSClientData*>(globalData->clientData)->m_worldSet.begin())
+        , m_end(static_cast<WebCoreJSClientData*>(globalData->clientData)->m_worldSet.end())
     {
-        return m_map.get(objectHandle);
     }
 
-    void set(void* objectHandle, DOMObject* wrapper)
+    operator bool()
     {
-        addWrapper(wrapper);
-        m_map.set(objectHandle, wrapper);
+        return m_pos != m_end;
     }
 
-    void remove(void* objectHandle)
+    DOMWrapperWorld* operator*()
     {
-        removeWrapper(m_map.take(objectHandle));
+        ASSERT(m_pos != m_end);
+        return *m_pos;
     }
 
-private:
-    HashMap<void*, DOMObject*> m_map;
-};
-
-// Map from static HashTable instances to per-GlobalData ones.
-class DOMObjectHashTableMap {
-public:
-    static DOMObjectHashTableMap& mapFor(JSGlobalData&);
-
-    ~DOMObjectHashTableMap()
+    DOMWrapperWorld* operator->()
     {
-        HashMap<const JSC::HashTable*, JSC::HashTable>::iterator mapEnd = m_map.end();
-        for (HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.begin(); iter != m_map.end(); ++iter)
-            iter->second.deleteTable();
+        ASSERT(m_pos != m_end);
+        return *m_pos;
     }
 
-    const JSC::HashTable* get(const JSC::HashTable* staticTable)
+    JSGlobalDataWorldIterator& operator++()
     {
-        HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.find(staticTable);
-        if (iter != m_map.end())
-            return &iter->second;
-        return &m_map.set(staticTable, JSC::HashTable(*staticTable)).first->second;
+        ++m_pos;
+        return *this;
     }
 
 private:
-    HashMap<const JSC::HashTable*, JSC::HashTable> m_map;
+    HashSet<DOMWrapperWorld*>::iterator m_pos;
+    HashSet<DOMWrapperWorld*>::iterator m_end;
 };
 
-class WebCoreJSClientData : public JSGlobalData::ClientData {
-public:
-    DOMObjectHashTableMap hashTableMap;
-    DOMObjectWrapperMap wrapperMap;
-};
+static inline DOMWrapperWorld* currentWorld(JSC::JSGlobalData& globalData)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    ASSERT(clientData);
+    return static_cast<WebCoreJSClientData*>(clientData)->currentWorld();
+}
+
+DOMWrapperWorld* currentWorld(JSC::ExecState* exec)
+{
+    return currentWorld(exec->globalData());
+}
+
+DOMWrapperWorld* normalWorld(JSC::JSGlobalData& globalData)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    ASSERT(clientData);
+    return static_cast<WebCoreJSClientData*>(clientData)->normalWorld();
+}
+
+DOMWrapperWorld* mainThreadNormalWorld()
+{
+    ASSERT(isMainThread());
+    return normalWorld(*JSDOMWindow::commonJSGlobalData());
+}
+
+DOMWrapperWorld* mainThreadCurrentWorld()
+{
+    ASSERT(isMainThread());
+
+    JSGlobalData::ClientData* clientData = JSDOMWindowBase::commonJSGlobalData()->clientData;
+    ASSERT(clientData);
+    return static_cast<WebCoreJSClientData*>(clientData)->currentWorld();
+}
 
 DOMObjectHashTableMap& DOMObjectHashTableMap::mapFor(JSGlobalData& globalData)
 {
     JSGlobalData::ClientData* clientData = globalData.clientData;
-    if (!clientData) {
-        clientData = new WebCoreJSClientData;
-        globalData.clientData = clientData;
-    }
+    ASSERT(clientData);
     return static_cast<WebCoreJSClientData*>(clientData)->hashTableMap;
 }
 
@@ -204,64 +274,102 @@ const JSC::HashTable* getHashTableForGlobalData(JSGlobalData& globalData, const
     return DOMObjectHashTableMap::mapFor(globalData).get(staticTable);
 }
 
-inline DOMObjectWrapperMap& DOMObjectWrapperMap::mapFor(JSGlobalData& globalData)
+//inline DOMObjectWrapperMap& DOMObjectWrapperMap::mapFor(JSGlobalData& globalData)
+inline DOMObjectWrapperMap& DOMObjectWrapperMapFor(JSGlobalData& globalData)
 {
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    if (!clientData) {
-        clientData = new WebCoreJSClientData;
-        globalData.clientData = clientData;
-    }
-    return static_cast<WebCoreJSClientData*>(clientData)->wrapperMap;
+    return currentWorld(globalData)->m_wrappers;
 }
 
 DOMObject* getCachedDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle) 
 {
-    return DOMObjectWrapperMap::mapFor(globalData).get(objectHandle);
+    return DOMObjectWrapperMapFor(globalData).get(objectHandle);
 }
 
 void cacheDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle, DOMObject* wrapper) 
 {
-    DOMObjectWrapperMap::mapFor(globalData).set(objectHandle, wrapper);
+    addWrapper(wrapper);
+    DOMObjectWrapperMapFor(globalData).set(objectHandle, wrapper);
 }
 
-void forgetDOMObject(JSGlobalData& globalData, void* objectHandle)
+JSNode* getCachedDOMNodeWrapper(Document* document, Node* node)
 {
-    DOMObjectWrapperMap::mapFor(globalData).remove(objectHandle);
+    if (document)
+        return document->getWrapperCache(mainThreadCurrentWorld())->get(node);
+    return static_cast<JSNode*>(DOMObjectWrapperMapFor(*JSDOMWindow::commonJSGlobalData()).get(node));
 }
 
-JSNode* getCachedDOMNodeWrapper(Document* document, Node* node)
+void forgetDOMObject(DOMObject* wrapper, void* objectHandle)
 {
-    if (!document)
-        return static_cast<JSNode*>(DOMObjectWrapperMap::mapFor(*JSDOMWindow::commonJSGlobalData()).get(node));
-    return document->wrapperCache().get(node);
+    JSC::JSGlobalData* globalData = Heap::heap(wrapper)->globalData();
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        DOMObjectWrapperMap& wrappers = worldIter->m_wrappers;
+        DOMObjectWrapperMap::iterator iter = wrappers.find(objectHandle);
+        if ((iter != wrappers.end()) && (iter->second == wrapper)) {
+            removeWrapper(wrapper);
+            wrappers.remove(iter);
+            return;
+        }
+    }
+
+    // If the world went away, it should have removed this wrapper from the set.
+    ASSERT(!wrapperSet().contains(wrapper));
 }
 
-void forgetDOMNode(Document* document, Node* node)
+void forgetDOMNode(DOMObject* wrapper, Node* node, Document* document)
 {
     if (!document) {
-        DOMObjectWrapperMap::mapFor(*JSDOMWindow::commonJSGlobalData()).remove(node);
+        forgetDOMObject(wrapper, node);
         return;
     }
-    removeWrapper(document->wrapperCache().take(node));
+
+    JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+    for (JSWrapperCacheMap::iterator wrappersIter = wrapperCacheMap.begin(); wrappersIter != wrapperCacheMap.end(); ++wrappersIter) {
+        JSWrapperCache* wrappers = wrappersIter->second;
+        JSWrapperCache::iterator iter = wrappers->find(node);
+        if ((iter != wrappers->end()) && (iter->second == wrapper)) {
+            wrappers->remove(iter);
+            removeWrapper(wrapper);
+            return;
+        }
+    }
+
+    // If the world went away, it should have removed this wrapper from the set.
+    ASSERT(!wrapperSet().contains(wrapper));
 }
 
 void cacheDOMNodeWrapper(Document* document, Node* node, JSNode* wrapper)
 {
     if (!document) {
-        DOMObjectWrapperMap::mapFor(*JSDOMWindow::commonJSGlobalData()).set(node, wrapper);
+        addWrapper(wrapper);
+        DOMObjectWrapperMapFor(*JSDOMWindow::commonJSGlobalData()).set(node, wrapper);
         return;
     }
     addWrapper(wrapper);
-    document->wrapperCache().set(node, wrapper);
+    document->getWrapperCache(mainThreadCurrentWorld())->set(node, wrapper);
 }
 
 void forgetAllDOMNodesForDocument(Document* document)
 {
     ASSERT(document);
-    removeWrappers(document->wrapperCache());
+    JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+    JSWrapperCacheMap::const_iterator wrappersMapEnd = wrapperCacheMap.end();
+    for (JSWrapperCacheMap::const_iterator wrappersMapIter = wrapperCacheMap.begin(); wrappersMapIter != wrappersMapEnd; ++wrappersMapIter) {
+        JSWrapperCache* wrappers = wrappersMapIter->second;
+        removeWrappers(*wrappers);
+        delete wrappers;
+        wrappersMapIter->first->forgetDocument(document);
+    }
+}
+
+void forgetWorldOfDOMNodesForDocument(Document* document, DOMWrapperWorld* world)
+{
+    JSWrapperCache* wrappers = document->wrapperCacheMap().take(world);
+    ASSERT(wrappers); // 'world' should only know about 'document' if 'document' knows about 'world'!
+    removeWrappers(*wrappers);
+    delete wrappers;
 }
 
-static inline bool isObservableThroughDOM(JSNode* jsNode)
+static inline bool isObservableThroughDOM(JSNode* jsNode, DOMWrapperWorld* world)
 {
     // Certain conditions implicitly make a JS DOM node wrapper observable
     // through the DOM, even if no explicit reference to it remains.
@@ -287,14 +395,14 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
         // the custom markChildren functions rather than here.
         if (node->isElementNode()) {
             if (NamedNodeMap* attributes = static_cast<Element*>(node)->attributeMap()) {
-                if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), attributes)) {
+                if (DOMObject* wrapper = world->m_wrappers.get(attributes)) {
                     if (wrapper->hasCustomProperties())
                         return true;
                 }
             }
             if (node->isStyledElement()) {
                 if (CSSMutableStyleDeclaration* style = static_cast<StyledElement*>(node)->inlineStyleDecl()) {
-                    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), style)) {
+                    if (DOMObject* wrapper = world->m_wrappers.get(style)) {
                         if (wrapper->hasCustomProperties())
                             return true;
                     }
@@ -302,7 +410,7 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
             }
             if (static_cast<Element*>(node)->hasTagName(canvasTag)) {
                 if (CanvasRenderingContext* context = static_cast<HTMLCanvasElement*>(node)->renderingContext()) {
-                    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), context)) {
+                    if (DOMObject* wrapper = world->m_wrappers.get(context)) {
                         if (wrapper->hasCustomProperties())
                             return true;
                     }
@@ -333,14 +441,19 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
     return false;
 }
 
-void markDOMNodesForDocument(MarkStack& markStack, Document* doc)
+void markDOMNodesForDocument(MarkStack& markStack, Document* document)
 {
-    JSWrapperCache& nodeDict = doc->wrapperCache();
-    JSWrapperCache::iterator nodeEnd = nodeDict.end();
-    for (JSWrapperCache::iterator nodeIt = nodeDict.begin(); nodeIt != nodeEnd; ++nodeIt) {
-        JSNode* jsNode = nodeIt->second;
-        if (isObservableThroughDOM(jsNode))
-            markStack.append(jsNode);
+    JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+    for (JSWrapperCacheMap::iterator wrappersIter = wrapperCacheMap.begin(); wrappersIter != wrapperCacheMap.end(); ++wrappersIter) {
+        DOMWrapperWorld* world = wrappersIter->first;
+        JSWrapperCache* nodeDict = wrappersIter->second;
+
+        JSWrapperCache::iterator nodeEnd = nodeDict->end();
+        for (JSWrapperCache::iterator nodeIt = nodeDict->begin(); nodeIt != nodeEnd; ++nodeIt) {
+            JSNode* jsNode = nodeIt->second;
+            if (isObservableThroughDOM(jsNode, world))
+                markStack.append(jsNode);
+        }
     }
 }
 
@@ -353,12 +466,10 @@ void markActiveObjectsForContext(MarkStack& markStack, JSGlobalData& globalData,
     HashMap<ActiveDOMObject*, void*>::const_iterator activeObjectsEnd = activeObjects.end();
     for (HashMap<ActiveDOMObject*, void*>::const_iterator iter = activeObjects.begin(); iter != activeObjectsEnd; ++iter) {
         if (iter->first->hasPendingActivity()) {
-            DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, iter->second);
             // Generally, an active object with pending activity must have a wrapper to mark its listeners.
             // However, some ActiveDOMObjects don't have JS wrappers (timers created by setTimeout is one example).
             // FIXME: perhaps need to make sure even timers have a markable 'wrapper'.
-            if (wrapper)
-                markStack.append(wrapper);
+            markDOMObjectWrapper(markStack, globalData, iter->second);
         }
     }
 
@@ -366,10 +477,31 @@ void markActiveObjectsForContext(MarkStack& markStack, JSGlobalData& globalData,
     HashSet<MessagePort*>::const_iterator portsEnd = messagePorts.end();
     for (HashSet<MessagePort*>::const_iterator iter = messagePorts.begin(); iter != portsEnd; ++iter) {
         // If the message port is remotely entangled, then always mark it as in-use because we can't determine reachability across threads.
-        if (!(*iter)->locallyEntangledPort() || (*iter)->hasPendingActivity()) {
-            DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, *iter);
-            if (wrapper)
-                markStack.append(wrapper);
+        if (!(*iter)->locallyEntangledPort() || (*iter)->hasPendingActivity())
+            markDOMObjectWrapper(markStack, globalData, *iter);
+    }
+}
+
+typedef std::pair<JSNode*, DOMWrapperWorld*> WrapperAndWorld;
+typedef WTF::Vector<WrapperAndWorld, 8> WrapperSet;
+
+static inline void takeWrappers(Node* node, Document* document, WrapperSet& wrapperSet)
+{
+    if (document) {
+        JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+        for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
+            if (JSNode* wrapper = iter->second->take(node)) {
+                removeWrapper(wrapper);
+                wrapperSet.append(WrapperAndWorld(wrapper, iter->first));
+            }
+        }
+    } else {
+        for (JSGlobalDataWorldIterator worldIter(JSDOMWindow::commonJSGlobalData()); worldIter; ++worldIter) {
+            DOMWrapperWorld* world = *worldIter;
+            if (JSNode* wrapper = static_cast<JSNode*>(world->m_wrappers.take(node))) {
+                removeWrapper(wrapper);
+                wrapperSet.append(WrapperAndWorld(wrapper, world));
+            }
         }
     }
 }
@@ -377,13 +509,18 @@ void markActiveObjectsForContext(MarkStack& markStack, JSGlobalData& globalData,
 void updateDOMNodeDocument(Node* node, Document* oldDocument, Document* newDocument)
 {
     ASSERT(oldDocument != newDocument);
-    JSNode* wrapper = getCachedDOMNodeWrapper(oldDocument, node);
-    if (!wrapper)
-        return;
-    removeWrapper(wrapper);
-    cacheDOMNodeWrapper(newDocument, node, wrapper);
-    forgetDOMNode(oldDocument, node);
-    addWrapper(wrapper);
+
+    WrapperSet wrapperSet;
+    takeWrappers(node, oldDocument, wrapperSet);
+
+    for (unsigned i = 0; i < wrapperSet.size(); ++i) {
+        JSNode* wrapper = wrapperSet[i].first;
+        if (newDocument)
+            newDocument->getWrapperCache(wrapperSet[i].second)->set(node, wrapper);
+        else
+            wrapperSet[i].second->m_wrappers.set(node, wrapper);
+        addWrapper(wrapper);
+    }
 }
 
 void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void* object)
@@ -393,10 +530,11 @@ void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void*
     // but doing this correctly would be challenging.
     if (!object)
         return;
-    DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, object);
-    if (!wrapper)
-        return;
-    markStack.append(wrapper);
+
+    for (JSGlobalDataWorldIterator worldIter(&globalData); worldIter; ++worldIter) {
+        if (DOMObject* wrapper = worldIter->m_wrappers.get(object))
+            markStack.append(wrapper);
+    }
 }
 
 JSValue jsStringOrNull(ExecState* exec, const String& s)
@@ -543,7 +681,7 @@ bool allowsAccessFromFrame(ExecState* exec, Frame* frame)
 {
     if (!frame)
         return false;
-    JSDOMWindow* window = toJSDOMWindow(frame);
+    JSDOMWindow* window = toJSDOMWindow(frame, currentWorld(exec));
     return window && window->allowsAccessFrom(exec);
 }
 
@@ -551,7 +689,7 @@ bool allowsAccessFromFrame(ExecState* exec, Frame* frame, String& message)
 {
     if (!frame)
         return false;
-    JSDOMWindow* window = toJSDOMWindow(frame);
+    JSDOMWindow* window = toJSDOMWindow(frame, currentWorld(exec));
     return window && window->allowsAccessFrom(exec, message);
 }
 
@@ -565,8 +703,16 @@ void printErrorMessageForFrame(Frame* frame, const String& message)
 {
     if (!frame)
         return;
-    if (JSDOMWindow* window = toJSDOMWindow(frame))
-        window->printErrorMessage(message);
+    if (message.isEmpty())
+        return;
+
+    Settings* settings = frame->settings();
+    if (!settings)
+        return;
+    if (settings->privateBrowsingEnabled())
+        return;
+
+    frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, 1, String()); // FIXME: provide a real line number and source URL.
 }
 
 Frame* toLexicalFrame(ExecState* exec)
@@ -664,4 +810,28 @@ bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDe
     return false;
 }
 
+JSValue DebuggerCallFrame_evaluateInWorld(const JSC::DebuggerCallFrame& debuggerCallFrame, const UString& script, JSValue& exception)
+{
+    EnterDOMWrapperWorld worldEntry(debuggerCallFrame.dynamicGlobalObject()->globalExec(), debuggerWorld());
+    return debuggerCallFrame.evaluate(script, exception);
+}
+
+JSValue callInWorld(ExecState* exec, JSValue function, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args, DOMWrapperWorld* isolatedWorld)
+{
+    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
+    return JSC::call(exec, function, callType, callData, thisValue, args);
+}
+
+JSObject* constructInWorld(ExecState* exec, JSValue object, ConstructType constructType, const ConstructData& constructData, const ArgList& args, DOMWrapperWorld* isolatedWorld)
+{
+    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
+    return JSC::construct(exec, object, constructType, constructData, args);
+}
+
+Completion evaluateInWorld(ExecState* exec, ScopeChain& scopeChain, const SourceCode& sourceCode, JSValue thisValue, DOMWrapperWorld* isolatedWorld)
+{
+    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
+    return JSC::evaluate(exec, scopeChain, sourceCode, thisValue);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
index 9af45d7648..ba41d85992 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
@@ -30,16 +30,18 @@
 
 namespace JSC {
     class JSGlobalData;
+    class DebuggerCallFrame;
 }
 
 namespace WebCore {
 
     class Document;
     class Frame;
+    class JSNode;
     class KURL;
     class Node;
     class String;
-    class JSNode;
+    class ScriptController;
 
     typedef int ExceptionCode;
 
@@ -136,14 +138,104 @@ namespace WebCore {
         }
     };
 
+    typedef HashMap<void*, DOMObject*> DOMObjectWrapperMap;
+
+    class DOMWrapperWorld : public RefCounted<DOMWrapperWorld> {
+    public:
+        DOMWrapperWorld(JSC::JSGlobalData*);
+        ~DOMWrapperWorld();
+
+        void rememberDocument(Document* document) { documentsWithWrappers.add(document); }
+        void forgetDocument(Document* document) { documentsWithWrappers.remove(document); }
+        void rememberScriptController(ScriptController* scriptController) { scriptControllersWithShells.add(scriptController); }
+        void forgetScriptController(ScriptController* scriptController) { scriptControllersWithShells.remove(scriptController); }
+
+        // FIXME: can we make this private?
+        DOMObjectWrapperMap m_wrappers;
+
+    private:
+        JSC::JSGlobalData* m_globalData;
+        HashSet<Document*> documentsWithWrappers;
+        HashSet<ScriptController*> scriptControllersWithShells;
+    };
+
+    // Map from static HashTable instances to per-GlobalData ones.
+    class DOMObjectHashTableMap {
+    public:
+        static DOMObjectHashTableMap& mapFor(JSC::JSGlobalData&);
+
+        ~DOMObjectHashTableMap()
+        {
+            HashMap<const JSC::HashTable*, JSC::HashTable>::iterator mapEnd = m_map.end();
+            for (HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.begin(); iter != m_map.end(); ++iter)
+                iter->second.deleteTable();
+        }
+
+        const JSC::HashTable* get(const JSC::HashTable* staticTable)
+        {
+            HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.find(staticTable);
+            if (iter != m_map.end())
+                return &iter->second;
+            return &m_map.set(staticTable, JSC::HashTable(*staticTable)).first->second;
+        }
+
+    private:
+        HashMap<const JSC::HashTable*, JSC::HashTable> m_map;
+    };
+
+    class WebCoreJSClientData : public JSC::JSGlobalData::ClientData {
+        friend class EnterDOMWrapperWorld;
+        friend class JSGlobalDataWorldIterator;
+
+    public:
+        WebCoreJSClientData(JSC::JSGlobalData* globalData)
+            : m_normalWorld(globalData)
+        {
+            m_worldStack.append(&m_normalWorld);
+            m_worldSet.add(&m_normalWorld);
+        }
+        // FIXME: add a destructor to assert m_worldSet only contains m_normalWorld?
+
+        DOMWrapperWorld* currentWorld() { return m_worldStack.last(); }
+        DOMWrapperWorld* normalWorld() { return &m_normalWorld; }
+
+        void rememberWorld(DOMWrapperWorld* world)
+        {
+            ASSERT(!m_worldSet.contains(world));
+            m_worldSet.add(world);
+        }
+        void forgetWorld(DOMWrapperWorld* world)
+        {
+            ASSERT(m_worldSet.contains(world));
+            m_worldSet.remove(world);
+        }
+
+        DOMObjectHashTableMap hashTableMap;
+    private:
+        Vector<DOMWrapperWorld*> m_worldStack;
+        HashSet<DOMWrapperWorld*> m_worldSet;
+        DOMWrapperWorld m_normalWorld;
+    };
+
+    class EnterDOMWrapperWorld {
+    public:
+        EnterDOMWrapperWorld(JSC::JSGlobalData&, DOMWrapperWorld*);
+        EnterDOMWrapperWorld(JSC::ExecState*, DOMWrapperWorld*);
+        ~EnterDOMWrapperWorld();
+
+    private:
+        WebCoreJSClientData* m_clientData;
+    };
+
     DOMObject* getCachedDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle);
     void cacheDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle, DOMObject* wrapper);
-    void forgetDOMObject(JSC::JSGlobalData&, void* objectHandle);
+    void forgetDOMNode(DOMObject* wrapper, Node* node, Document* document);
+    void forgetDOMObject(DOMObject* wrapper, void* objectHandle);
 
     JSNode* getCachedDOMNodeWrapper(Document*, Node*);
     void cacheDOMNodeWrapper(Document*, Node*, JSNode* wrapper);
-    void forgetDOMNode(Document*, Node*);
     void forgetAllDOMNodesForDocument(Document*);
+    void forgetWorldOfDOMNodesForDocument(Document*, DOMWrapperWorld*);
     void updateDOMNodeDocument(Node*, Document* oldDocument, Document* newDocument);
     void markDOMNodesForDocument(JSC::MarkStack&, Document*);
     void markActiveObjectsForContext(JSC::MarkStack&, JSC::JSGlobalData&, ScriptExecutionContext*);
@@ -154,6 +246,13 @@ namespace WebCore {
     JSC::Structure* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSC::ExecState*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
 
+    DOMWrapperWorld* currentWorld(JSC::ExecState*);
+    DOMWrapperWorld* normalWorld(JSC::JSGlobalData&);
+    DOMWrapperWorld* mainThreadCurrentWorld();
+    DOMWrapperWorld* mainThreadNormalWorld();
+    inline DOMWrapperWorld* debuggerWorld() { return mainThreadNormalWorld(); }
+    inline DOMWrapperWorld* pluginWorld() { return mainThreadNormalWorld(); }
+
     JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
     void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
 
@@ -305,6 +404,11 @@ namespace WebCore {
     bool processingUserGesture(JSC::ExecState*);
     KURL completeURL(JSC::ExecState*, const String& relativeURL);
 
+    JSC::JSValue DebuggerCallFrame_evaluateInWorld(const JSC::DebuggerCallFrame& debuggerCallFrame, const JSC::UString& script, JSC::JSValue& exception);
+    JSC::JSValue callInWorld(JSC::ExecState*, JSC::JSValue function, JSC::CallType, const JSC::CallData&, JSC::JSValue thisValue, const JSC::ArgList&, DOMWrapperWorld*);
+    JSC::JSObject* constructInWorld(JSC::ExecState* exec, JSC::JSValue object, JSC::ConstructType constructType, const JSC::ConstructData& constructData, const JSC::ArgList& args, DOMWrapperWorld*);
+    JSC::Completion evaluateInWorld(JSC::ExecState*, JSC::ScopeChain&, const JSC::SourceCode&, JSC::JSValue thisValue, DOMWrapperWorld*);
+
 } // namespace WebCore
 
 #endif // JSDOMBinding_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
index 53bb26b84c..011a4e4c91 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -63,7 +63,7 @@ PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JS
     if (!val.isObject())
         return 0;
 
-    return JSEventListener::create(asObject(val), true).get();
+    return JSEventListener::create(asObject(val), true, currentWorld(globalExec())).get();
 }
 
 void JSDOMGlobalObject::setCurrentEvent(Event* evt)
@@ -81,15 +81,34 @@ void JSDOMGlobalObject::destroyJSDOMGlobalObjectData(void* jsDOMGlobalObjectData
     delete static_cast<JSDOMGlobalObjectData*>(jsDOMGlobalObjectData);
 }
 
-JSDOMGlobalObject* toJSDOMGlobalObject(Document* document)
+JSDOMGlobalObject* toJSDOMGlobalObject(Document* document, JSC::ExecState* exec)
 {
-    return toJSDOMWindow(document->frame());
+    return toJSDOMWindow(document->frame(), currentWorld(exec));
 }
 
-JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext* scriptExecutionContext)
+JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext* scriptExecutionContext, JSC::ExecState* exec)
 {
     if (scriptExecutionContext->isDocument())
-        return toJSDOMGlobalObject(static_cast<Document*>(scriptExecutionContext));
+        return toJSDOMGlobalObject(static_cast<Document*>(scriptExecutionContext), exec);
+
+#if ENABLE(WORKERS)
+    if (scriptExecutionContext->isWorkerContext())
+        return static_cast<WorkerContext*>(scriptExecutionContext)->script()->workerContextWrapper();
+#endif
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+JSDOMGlobalObject* toJSDOMGlobalObject(Document* document, DOMWrapperWorld* world)
+{
+    return toJSDOMWindow(document->frame(), world);
+}
+
+JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext* scriptExecutionContext, DOMWrapperWorld* world)
+{
+    if (scriptExecutionContext->isDocument())
+        return toJSDOMGlobalObject(static_cast<Document*>(scriptExecutionContext), world);
 
 #if ENABLE(WORKERS)
     if (scriptExecutionContext->isWorkerContext())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
index ce26857062..6b75a6f6d0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -33,6 +33,7 @@ namespace WebCore {
 
     class Document;
     class Event;
+    class DOMWrapperWorld;
     class JSLazyEventListener;
     class JSEventListener;
     class ScriptExecutionContext;
@@ -102,8 +103,11 @@ namespace WebCore {
         return constructor;
     }
 
-    JSDOMGlobalObject* toJSDOMGlobalObject(Document*);
-    JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext*);
+    JSDOMGlobalObject* toJSDOMGlobalObject(Document*, JSC::ExecState*);
+    JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext*, JSC::ExecState*);
+
+    JSDOMGlobalObject* toJSDOMGlobalObject(Document*, DOMWrapperWorld*);
+    JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext*, DOMWrapperWorld*);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
index a04ef89e00..86ff149bb4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -53,10 +53,11 @@ JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRef
     addStaticGlobals(staticGlobals, sizeof(staticGlobals) / sizeof(GlobalPropertyInfo));
 }
 
-void JSDOMWindowBase::updateDocument()
+void JSDOMWindowBase::updateDocument(DOMWrapperWorld* world)
 {
     ASSERT(d()->impl->document());
     ExecState* exec = globalExec();
+    EnterDOMWrapperWorld worldEntry(exec, world);
     symbolTablePutWithAttributes(Identifier(exec, "document"), toJS(exec, this, d()->impl->document()), DontDelete | ReadOnly);
 }
 
@@ -79,21 +80,7 @@ String JSDOMWindowBase::crossDomainAccessErrorMessage(const JSGlobalObject* othe
 
 void JSDOMWindowBase::printErrorMessage(const String& message) const
 {
-    if (message.isEmpty())
-        return;
-
-    Frame* frame = impl()->frame();
-    if (!frame)
-        return;
-
-    Settings* settings = frame->settings();
-    if (!settings)
-        return;
-    
-    if (settings->privateBrowsingEnabled())
-        return;
-
-    impl()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, 1, String()); // FIXME: provide a real line number and source URL.
+    printErrorMessageForFrame(impl()->frame(), message);
 }
 
 ExecState* JSDOMWindowBase::globalExec()
@@ -157,13 +144,16 @@ JSDOMWindowShell* JSDOMWindowBase::shell() const
 
 JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
 {
-    static JSGlobalData* globalData;
+    ASSERT(isMainThread());
+
+    static JSGlobalData* globalData = 0;
     if (!globalData) {
         globalData = JSGlobalData::createLeaked().releaseRef();
         globalData->timeoutChecker.setTimeoutInterval(10000); // 10 seconds
 #ifndef NDEBUG
         globalData->mainThreadOnly = true;
 #endif
+        globalData->clientData = new WebCoreJSClientData(globalData);
     }
 
     return globalData;
@@ -181,21 +171,21 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject*, DOMWindow* domWindow)
     return toJS(exec, domWindow);
 }
 
-JSValue toJS(ExecState*, DOMWindow* domWindow)
+JSValue toJS(ExecState* exec, DOMWindow* domWindow)
 {
     if (!domWindow)
         return jsNull();
     Frame* frame = domWindow->frame();
     if (!frame)
         return jsNull();
-    return frame->script()->windowShell();
+    return frame->script()->windowShell(currentWorld(exec));
 }
 
-JSDOMWindow* toJSDOMWindow(Frame* frame)
+JSDOMWindow* toJSDOMWindow(Frame* frame, DOMWrapperWorld* world)
 {
     if (!frame)
         return 0;
-    return frame->script()->windowShell()->window();
+    return frame->script()->windowShell(world)->window();
 }
 
 JSDOMWindow* toJSDOMWindow(JSValue value)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
index 52c3c1d8e9..31e24868fe 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
@@ -32,6 +32,7 @@ namespace WebCore {
     class DOMWindow;
     class Event;
     class Frame;
+    class DOMWrapperWorld;
     class JSDOMWindow;
     class JSDOMWindowShell;
     class JSLocation;
@@ -46,7 +47,7 @@ namespace WebCore {
         JSDOMWindowBase(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
     public:
-        void updateDocument();
+        void updateDocument(DOMWrapperWorld*);
 
         DOMWindow* impl() const { return d()->impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
@@ -102,7 +103,7 @@ namespace WebCore {
     JSC::JSValue toJS(JSC::ExecState*, DOMWindow*);
 
     // Returns JSDOMWindow or 0
-    JSDOMWindow* toJSDOMWindow(Frame*);
+    JSDOMWindow* toJSDOMWindow(Frame*, DOMWrapperWorld*);
     JSDOMWindow* toJSDOMWindow(JSC::JSValue);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
index deb92cb1b3..2804b3ce65 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -771,7 +771,8 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
     newFrame->loader()->setOpener(openerFrame);
     newFrame->page()->setOpenedByDOM();
 
-    JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
+    // FIXME: If a window is created from an isolated world, what are the consequences of this? 'dialogArguments' only appears back in the normal world?
+    JSDOMWindow* newWindow = toJSDOMWindow(newFrame, normalWorld(exec->globalData()));
 
     if (dialogArgs)
         newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
@@ -831,7 +832,7 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
         if (!shouldAllowNavigation(exec, frame))
             return jsUndefined();
 
-        const JSDOMWindow* targetedWindow = toJSDOMWindow(frame);
+        const JSDOMWindow* targetedWindow = toJSDOMWindow(frame, currentWorld(exec));
         if (!completedURL.isEmpty() && (!protocolIsJavaScript(completedURL) || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
             bool userGesture = processingUserGesture(exec);
 
@@ -932,7 +933,7 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
     if (!dialogFrame)
         return jsUndefined();
 
-    JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
+    JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame, currentWorld(exec));
     dialogFrame->page()->chrome()->runModal();
 
     Identifier returnValue(exec, "returnValue");
@@ -975,7 +976,7 @@ JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
 
 JSValue JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args);
+    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
@@ -984,7 +985,7 @@ JSValue JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
 
 JSValue JSDOMWindow::setInterval(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args);
+    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
@@ -1052,7 +1053,7 @@ JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -1066,7 +1067,7 @@ JSValue JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
index 3c3ff4c239..9072f91bc3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -171,18 +171,18 @@ void* JSDOMWindowShell::operator new(size_t size)
 // Conversion methods
 // ----
 
-JSValue toJS(ExecState*, Frame* frame)
+JSValue toJS(ExecState* exec, Frame* frame)
 {
     if (!frame)
         return jsNull();
-    return frame->script()->windowShell();
+    return frame->script()->windowShell(currentWorld(exec));
 }
 
-JSDOMWindowShell* toJSDOMWindowShell(Frame* frame)
+JSDOMWindowShell* toJSDOMWindowShell(Frame* frame, DOMWrapperWorld* isolatedWorld)
 {
     if (!frame)
         return 0;
-    return frame->script()->windowShell();
+    return frame->script()->windowShell(isolatedWorld);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
index 1bb0938ba6..36cb8d6ad6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
@@ -88,7 +88,7 @@ namespace WebCore {
     };
 
     JSC::JSValue toJS(JSC::ExecState*, Frame*);
-    JSDOMWindowShell* toJSDOMWindowShell(Frame*);
+    JSDOMWindowShell* toJSDOMWindowShell(Frame*, DOMWrapperWorld*);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
index 9bff637d09..7485c1f86e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
@@ -67,7 +67,7 @@ JSValue JSNotification::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener)), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener)), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -77,7 +77,7 @@ JSValue JSNotification::removeEventListener(ExecState* exec, const ArgList& args
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
index 4f273fe2af..1a999a859e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
@@ -31,10 +31,11 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSEventListener::JSEventListener(JSObject* function, bool isAttribute)
+JSEventListener::JSEventListener(JSObject* function, bool isAttribute, DOMWrapperWorld* isolatedWorld)
     : EventListener(JSEventListenerType)
     , m_jsFunction(function)
     , m_isAttribute(isAttribute)
+    , m_isolatedWorld(isolatedWorld)
 {
 }
 
@@ -65,7 +66,7 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
     if (!jsFunction)
         return;
 
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(scriptExecutionContext);
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(scriptExecutionContext, m_isolatedWorld.get());
     if (!globalObject)
         return;
 
@@ -86,7 +87,12 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
 
     ExecState* exec = globalObject->globalExec();
 
-    JSValue handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
+    JSValue handleEventFunction;
+    {
+        // Switch worlds, just in case handleEvent is a getter and causes JS execution!
+        EnterDOMWrapperWorld worldEntry(exec, m_isolatedWorld.get());
+        handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
+    }
     CallData callData;
     CallType callType = handleEventFunction.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -108,8 +114,8 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
 
         globalData->timeoutChecker.start();
         JSValue retval = handleEventFunction
-            ? call(exec, handleEventFunction, callType, callData, jsFunction, args)
-            : call(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args);
+            ? callInWorld(exec, handleEventFunction, callType, callData, jsFunction, args, m_isolatedWorld.get())
+            : callInWorld(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args, m_isolatedWorld.get());
         globalData->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
@@ -140,7 +146,7 @@ bool JSEventListener::reportError(ScriptExecutionContext* context, const String&
     if (!jsFunction)
         return false;
 
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(context);
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(context, m_isolatedWorld.get());
     ExecState* exec = globalObject->globalExec();
 
     CallData callData;
@@ -160,7 +166,7 @@ bool JSEventListener::reportError(ScriptExecutionContext* context, const String&
     JSValue thisValue = globalObject->toThisObject(exec);
 
     globalData->timeoutChecker.start();
-    JSValue returnValue = call(exec, jsFunction, callType, callData, thisValue, args);
+    JSValue returnValue = callInWorld(exec, jsFunction, callType, callData, thisValue, args, m_isolatedWorld.get());
     globalData->timeoutChecker.stop();
 
     // If an error occurs while handling the script error, it should be bubbled up.
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
index 285a9c49d1..bf3af4811f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
@@ -30,9 +30,9 @@ namespace WebCore {
 
     class JSEventListener : public EventListener {
     public:
-        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, bool isAttribute)
+        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, bool isAttribute, DOMWrapperWorld* isolatedWorld)
         {
-            return adoptRef(new JSEventListener(listener, isAttribute));
+            return adoptRef(new JSEventListener(listener, isAttribute, isolatedWorld));
         }
 
         static const JSEventListener* cast(const EventListener* listener)
@@ -59,10 +59,11 @@ namespace WebCore {
         void clearJSFunctionInline();
 
     protected:
-        JSEventListener(JSC::JSObject* function, bool isAttribute);
+        JSEventListener(JSC::JSObject* function, bool isAttribute, DOMWrapperWorld* isolatedWorld);
 
         mutable JSC::JSObject* m_jsFunction;
         bool m_isAttribute;
+        RefPtr<DOMWrapperWorld> m_isolatedWorld;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
index 00dfe12ff7..8f0dfb10a4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
@@ -49,7 +49,7 @@ JSValue JSEventSource::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -59,7 +59,7 @@ JSValue JSEventSource::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
index 0421d1044e..6ea11352d3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
@@ -128,7 +128,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
         return toJS(exec, globalObject, worker);
 
     if (DedicatedWorkerContext* workerContext = target->toDedicatedWorkerContext())
-        return toJSDOMGlobalObject(workerContext);
+        return toJSDOMGlobalObject(workerContext, exec);
 #endif
 
 #if ENABLE(SHARED_WORKERS)
@@ -136,7 +136,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
         return toJS(exec, globalObject, sharedWorker);
 
     if (SharedWorkerContext* workerContext = target->toSharedWorkerContext())
-        return toJSDOMGlobalObject(workerContext);
+        return toJSDOMGlobalObject(workerContext, exec);
 #endif
 
 #if ENABLE(NOTIFICATIONS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.cpp
index a588ab1b14..3749eed98d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.cpp
@@ -1,64 +1,64 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSExceptionBase.h"
-
-#include "JSDOMCoreException.h"
-#include "JSEventException.h"
-#include "JSRangeException.h"
-#include "JSXMLHttpRequestException.h"
-#if ENABLE(SVG)
-#include "JSSVGException.h"
-#endif
-#if ENABLE(XPATH)
-#include "JSXPathException.h"
-#endif
- 
-namespace WebCore {
- 
-ExceptionBase* toExceptionBase(JSC::JSValue value)
-{
-    if (DOMCoreException* domException = toDOMCoreException(value))
-        return reinterpret_cast<ExceptionBase*>(domException);
-    if (RangeException* rangeException = toRangeException(value))
-        return reinterpret_cast<ExceptionBase*>(rangeException);
-    if (EventException* eventException = toEventException(value))
-        return reinterpret_cast<ExceptionBase*>(eventException);
-    if (XMLHttpRequestException* xmlHttpException = toXMLHttpRequestException(value))
-        return reinterpret_cast<ExceptionBase*>(xmlHttpException);
-#if ENABLE(SVG)
-    if (SVGException* svgException = toSVGException(value))
-        return reinterpret_cast<ExceptionBase*>(svgException);
-#endif
-#if ENABLE(XPATH)
-    if (XPathException* pathException = toXPathException(value))
-        return reinterpret_cast<ExceptionBase*>(pathException);
-#endif
-    
-    return 0;
-}
-
-} // namespace WebCore
+/*

+ * Copyright (C) 2009 Apple Inc. All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#include "config.h"

+#include "JSExceptionBase.h"

+

+#include "JSDOMCoreException.h"

+#include "JSEventException.h"

+#include "JSRangeException.h"

+#include "JSXMLHttpRequestException.h"

+#if ENABLE(SVG)

+#include "JSSVGException.h"

+#endif

+#if ENABLE(XPATH)

+#include "JSXPathException.h"

+#endif

+ 

+namespace WebCore {

+ 

+ExceptionBase* toExceptionBase(JSC::JSValue value)

+{

+    if (DOMCoreException* domException = toDOMCoreException(value))

+        return reinterpret_cast<ExceptionBase*>(domException);

+    if (RangeException* rangeException = toRangeException(value))

+        return reinterpret_cast<ExceptionBase*>(rangeException);

+    if (EventException* eventException = toEventException(value))

+        return reinterpret_cast<ExceptionBase*>(eventException);

+    if (XMLHttpRequestException* xmlHttpException = toXMLHttpRequestException(value))

+        return reinterpret_cast<ExceptionBase*>(xmlHttpException);

+#if ENABLE(SVG)

+    if (SVGException* svgException = toSVGException(value))

+        return reinterpret_cast<ExceptionBase*>(svgException);

+#endif

+#if ENABLE(XPATH)

+    if (XPathException* pathException = toXPathException(value))

+        return reinterpret_cast<ExceptionBase*>(pathException);

+#endif

+    

+    return 0;

+}

+

+} // namespace WebCore

diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.h
index a9366ed704..01c6ac24e2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.h
@@ -1,43 +1,43 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef JSExceptionBase_h
-#define JSExceptionBase_h
-
-namespace JSC {
-    
-class JSValue;
-
-}   // namespace JSC
-
-namespace WebCore {
-
-class ExceptionBase;
-
-ExceptionBase* toExceptionBase(JSC::JSValue);
-
-} // namespace WebCore
-
-#endif // JSExceptionBase_h
+/*

+ * Copyright (C) 2009 Apple Inc. All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#ifndef JSExceptionBase_h

+#define JSExceptionBase_h

+

+namespace JSC {

+    

+class JSValue;

+

+}   // namespace JSC

+

+namespace WebCore {

+

+class ExceptionBase;

+

+ExceptionBase* toExceptionBase(JSC::JSValue);

+

+} // namespace WebCore

+

+#endif // JSExceptionBase_h

diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
new file mode 100644
index 0000000000..fd1dd11ee1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHTMLAllCollection.h"
+
+#include "AtomicString.h"
+#include "HTMLAllCollection.h"
+#include "JSDOMBinding.h"
+#include "JSHTMLAllCollection.h"
+#include "JSNode.h"
+#include "JSNodeList.h"
+#include "Node.h"
+#include "StaticNodeList.h"
+#include <wtf/Vector.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+static JSValue getNamedItems(ExecState* exec, JSHTMLAllCollection* collection, const Identifier& propertyName)
+{
+    Vector<RefPtr<Node> > namedItems;
+    collection->impl()->namedItems(propertyName, namedItems);
+
+    if (namedItems.isEmpty())
+        return jsUndefined();
+    if (namedItems.size() == 1)
+        return toJS(exec, collection->globalObject(), namedItems[0].get());
+
+    // FIXME: HTML5 specifies that this should be a DynamicNodeList.
+    // FIXME: HTML5 specifies that non-HTMLOptionsCollection collections should return
+    // the first matching item instead of a NodeList.
+    return toJS(exec, collection->globalObject(), StaticNodeList::adopt(namedItems).get());
+}
+
+// HTMLCollections are strange objects, they support both get and call,
+// so that document.forms.item(0) and document.forms(0) both work.
+static JSValue JSC_HOST_CALL callHTMLAllCollection(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    // Do not use thisObj here. It can be the JSHTMLDocument, in the document.forms(i) case.
+    JSHTMLAllCollection* jsCollection = static_cast<JSHTMLAllCollection*>(function);
+    HTMLAllCollection* collection = static_cast<HTMLAllCollection*>(jsCollection->impl());
+
+    // Also, do we need the TypeError test here ?
+
+    if (args.size() == 1) {
+        // Support for document.all(<index>) etc.
+        bool ok;
+        UString string = args.at(0).toString(exec);
+        unsigned index = string.toUInt32(&ok, false);
+        if (ok)
+            return toJS(exec, jsCollection->globalObject(), collection->item(index));
+
+        // Support for document.images('<name>') etc.
+        return getNamedItems(exec, jsCollection, Identifier(exec, string));
+    }
+
+    // The second arg, if set, is the index of the item we want
+    bool ok;
+    UString string = args.at(0).toString(exec);
+    unsigned index = args.at(1).toString(exec).toUInt32(&ok, false);
+    if (ok) {
+        String pstr = string;
+        Node* node = collection->namedItem(pstr);
+        while (node) {
+            if (!index)
+                return toJS(exec, jsCollection->globalObject(), node);
+            node = collection->nextNamedItem(pstr);
+            --index;
+        }
+    }
+
+    return jsUndefined();
+}
+
+CallType JSHTMLAllCollection::getCallData(CallData& callData)
+{
+    callData.native.function = callHTMLAllCollection;
+    return CallTypeHost;
+}
+
+bool JSHTMLAllCollection::canGetItemsForName(ExecState*, HTMLAllCollection* collection, const Identifier& propertyName)
+{
+    Vector<RefPtr<Node> > namedItems;
+    collection->namedItems(propertyName, namedItems);
+    return !namedItems.isEmpty();
+}
+
+JSValue JSHTMLAllCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSHTMLAllCollection* thisObj = static_cast<JSHTMLAllCollection*>(asObject(slot.slotBase()));
+    return getNamedItems(exec, thisObj, propertyName);
+}
+
+JSValue JSHTMLAllCollection::item(ExecState* exec, const ArgList& args)
+{
+    bool ok;
+    uint32_t index = args.at(0).toString(exec).toUInt32(&ok, false);
+    if (ok)
+        return toJS(exec, globalObject(), impl()->item(index));
+    return getNamedItems(exec, this, Identifier(exec, args.at(0).toString(exec)));
+}
+
+JSValue JSHTMLAllCollection::namedItem(ExecState* exec, const ArgList& args)
+{
+    return getNamedItems(exec, this, Identifier(exec, args.at(0).toString(exec)));
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index 8ffddf7320..dd4ceaa695 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -23,6 +23,7 @@
 #include "AtomicString.h"
 #include "HTMLCollection.h"
 #include "HTMLOptionsCollection.h"
+#include "HTMLAllCollection.h"
 #include "JSDOMBinding.h"
 #include "JSHTMLAllCollection.h"
 #include "JSHTMLOptionsCollection.h"
@@ -143,7 +144,6 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, HTMLCollection* c
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, HTMLOptionsCollection, collection);
             break;
         case DocAll:
-            typedef HTMLCollection HTMLAllCollection;
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, HTMLAllCollection, collection);
             break;
         default:
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index c113ec77dd..a65ca7cfbd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -28,6 +28,7 @@
 
 #include "CharacterNames.h"
 #include "Frame.h"
+#include "HTMLAllCollection.h"
 #include "HTMLBodyElement.h"
 #include "HTMLCollection.h"
 #include "HTMLDocument.h"
@@ -105,14 +106,14 @@ JSValue JSHTMLDocument::open(ExecState* exec, const ArgList& args)
     if (args.size() > 2) {
         Frame* frame = static_cast<HTMLDocument*>(impl())->frame();
         if (frame) {
-            JSDOMWindowShell* wrapper = toJSDOMWindowShell(frame);
+            JSDOMWindowShell* wrapper = toJSDOMWindowShell(frame, currentWorld(exec));
             if (wrapper) {
                 JSValue function = wrapper->get(exec, Identifier(exec, "open"));
                 CallData callData;
                 CallType callType = function.getCallData(callData);
                 if (callType == CallTypeNone)
                     return throwError(exec, TypeError);
-                return call(exec, function, callType, callData, wrapper, args);
+                return callInWorld(exec, function, callType, callData, wrapper, args, currentWorld(exec));
             }
         }
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
index 05972e6fb3..68769d6acc 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
@@ -47,14 +47,14 @@ bool JSHTMLFrameSetElement::canGetItemsForName(ExecState*, HTMLFrameSetElement*
     return frame && frame->hasTagName(frameTag);
 }
 
-JSValue JSHTMLFrameSetElement::nameGetter(ExecState*, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFrameSetElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
 
     Node* frame = element->children()->namedItem(propertyName);
     if (Document* doc = static_cast<HTMLFrameElement*>(frame)->contentDocument()) {
-        if (JSDOMWindowShell* window = toJSDOMWindowShell(doc->frame()))
+        if (JSDOMWindowShell* window = toJSDOMWindowShell(doc->frame(), currentWorld(exec)))
             return window;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
index 391caccf10..439f532825 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
@@ -131,7 +131,8 @@ JSValue JSInspectorBackend::databaseForId(ExecState* exec, const ArgList& args)
     Database* database = impl()->databaseForId(args.at(0).toInt32(exec));
     if (!database)
         return jsUndefined();
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    // Could use currentWorld(exec) ... but which exec!  The following mixed use of exec & inspectedWindow->globalExec() scares me!
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame(), debuggerWorld());
     return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, database));
 }
 #endif
@@ -141,7 +142,7 @@ JSValue JSInspectorBackend::inspectedWindow(ExecState*, const ArgList&)
     InspectorController* ic = impl()->inspectorController();
     if (!ic)
         return jsUndefined();
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame(), debuggerWorld());
     return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), inspectedWindow);
 }
 
@@ -266,7 +267,7 @@ JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
         return jsUndefined();
 
     JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame(), debuggerWorld());
     return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, deprecatedGlobalObjectForPrototype(inspectedWindow->globalExec()), node));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
index 0d6cb57283..6d75f4fbb7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -35,8 +35,8 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter eventListenerCounter("JSLazyEventListener");
 #endif
 
-JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber)
-    : JSEventListener(0, true)
+JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, DOMWrapperWorld* isolatedWorld)
+    : JSEventListener(0, true, isolatedWorld)
     , m_functionName(functionName)
     , m_eventParameterName(eventParameterName)
     , m_code(code)
@@ -92,7 +92,7 @@ void JSLazyEventListener::parseCode(ScriptExecutionContext* executionContext) co
     if (!scriptController->isEnabled())
         return;
 
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(executionContext);
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(executionContext, m_isolatedWorld.get());
     if (!globalObject)
         return;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
index e3137b8ca4..ba26ef6970 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
@@ -29,14 +29,14 @@ namespace WebCore {
 
     class JSLazyEventListener : public JSEventListener {
     public:
-        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber)
+        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, DOMWrapperWorld* isolatedWorld)
         {
-            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, node, sourceURL, lineNumber));
+            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, node, sourceURL, lineNumber, isolatedWorld));
         }
         virtual ~JSLazyEventListener();
 
     private:
-        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node*, const String& sourceURL, int lineNumber);
+        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node*, const String& sourceURL, int lineNumber, DOMWrapperWorld* isolatedWorld);
 
         virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
         virtual bool wasCreatedFromMarkup() const { return true; }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelCustom.cpp
index 574e28ac08..d28d49474a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelCustom.cpp
@@ -36,17 +36,11 @@ void JSMessageChannel::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    if (MessagePort* port = m_impl->port1()) {
-        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), port);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
+    if (MessagePort* port = m_impl->port1())
+        markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), port);
 
-    if (MessagePort* port = m_impl->port2()) {
-        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), port);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
+    if (MessagePort* port = m_impl->port2())
+        markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), port);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
index a0a92beedd..2c09620cd3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -46,11 +46,8 @@ void JSMessagePort::markChildren(MarkStack& markStack)
     Base::markChildren(markStack);
 
     // If we have a locally entangled port, we can directly mark it as reachable. Ports that are remotely entangled are marked in-use by markActiveObjectsForContext().
-    if (MessagePort* entangledPort = m_impl->locallyEntangledPort()) {
-        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), entangledPort);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
+    if (MessagePort* entangledPort = m_impl->locallyEntangledPort())
+        markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), entangledPort);
 
     m_impl->markEventListeners(markStack);
 }
@@ -61,7 +58,7 @@ JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -71,7 +68,7 @@ JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
index 4e7d6229c2..2a4aa80bff 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
@@ -114,7 +114,7 @@ JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -124,7 +124,7 @@ JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -143,10 +143,8 @@ void JSNode::markChildren(MarkStack& markStack)
     // the document, we need to mark the document, but we don't need to explicitly
     // mark any other nodes.
     if (node->inDocument()) {
-        if (Document* doc = node->ownerDocument()) {
-            if (DOMObject* docWrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), doc))
-                markStack.append(docWrapper);
-        }
+        if (Document* doc = node->ownerDocument())
+            markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), doc);
         return;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
index a199417d7a..54dc020037 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -66,7 +66,7 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
-    JSValue result = call(exec, m_filter, callType, callData, m_filter, args);
+    JSValue result = callInWorld(exec, m_filter, callType, callData, m_filter, args, currentWorld(exec));
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
index a0551a10e4..2ab2c003cd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSQuarantinedObjectWrapper.h"
 
+#include "JSDOMBinding.h"
+
 #include <runtime/JSGlobalObject.h>
 
 using namespace JSC;
@@ -243,7 +245,8 @@ JSObject* JSQuarantinedObjectWrapper::construct(ExecState* exec, JSObject* const
     ConstructType unwrappedConstructType = wrapper->m_unwrappedObject->getConstructData(unwrappedConstructData);
     ASSERT(unwrappedConstructType != ConstructTypeNone);
 
-    JSValue unwrappedResult = JSC::construct(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs);
+    // FIXME: Quarantined objects are all in the debuggerWorld(), for now. Instead, we should remove the quarantined objects, & replace them with an isolated world?
+    JSValue unwrappedResult = constructInWorld(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs, debuggerWorld());
 
     JSValue resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
     ASSERT(resultValue.isObject());
@@ -293,7 +296,8 @@ JSValue JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JS
     CallType unwrappedCallType = wrapper->m_unwrappedObject->getCallData(unwrappedCallData);
     ASSERT(unwrappedCallType != CallTypeNone);
 
-    JSValue unwrappedResult = JSC::call(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs);
+    // FIXME: Quarantined objects are all in the debuggerWorld(), for now. Instead, we should remove the quarantined objects, & replace them with an isolated world?
+    JSValue unwrappedResult = callInWorld(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs, debuggerWorld());
 
     JSValue result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index fd3742d12a..ba1cf22703 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -54,7 +54,7 @@ JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& a
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -64,7 +64,7 @@ JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerCustom.cpp
index f21f50c9e6..4617087ea0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerCustom.cpp
@@ -45,11 +45,8 @@ void JSSharedWorker::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    if (MessagePort* port = impl()->port()) {
-        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), port);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
+    if (MessagePort* port = impl()->port())
+        markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), port);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
index bea3563900..33c3fcd586 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -66,7 +66,7 @@ JSValue JSWebSocket::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -76,7 +76,7 @@ JSValue JSWebSocket::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
index e1c8a8c246..490d9b138a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -122,7 +122,7 @@ JSValue JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -132,13 +132,13 @@ JSValue JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& arg
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSWorkerContext::setTimeout(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args);
+    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
@@ -147,7 +147,7 @@ JSValue JSWorkerContext::setTimeout(ExecState* exec, const ArgList& args)
 
 JSValue JSWorkerContext::setInterval(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args);
+    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 7d3f8af14e..7ee2720180 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -53,11 +53,8 @@ void JSXMLHttpRequest::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    if (XMLHttpRequestUpload* upload = m_impl->optionalUpload()) {
-        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), upload);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
+    if (XMLHttpRequestUpload* upload = m_impl->optionalUpload())
+        markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), upload);
 
     m_impl->markEventListeners(markStack);
 }
@@ -156,7 +153,7 @@ JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -166,7 +163,7 @@ JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& ar
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index 275d1fbbc5..fa7cfec41c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -45,11 +45,8 @@ void JSXMLHttpRequestUpload::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    if (XMLHttpRequest* xmlHttpRequest = m_impl->associatedXMLHttpRequest()) {
-        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), xmlHttpRequest);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
+    if (XMLHttpRequest* xmlHttpRequest = m_impl->associatedXMLHttpRequest())
+        markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), xmlHttpRequest);
 
     m_impl->markEventListeners(markStack);
 }
@@ -60,7 +57,7 @@ JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList&
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -70,7 +67,7 @@ JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgLi
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
index 93155e1f61..9a21b6b99d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
@@ -47,7 +47,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScheduledAction* ScheduledAction::create(ExecState* exec, const ArgList& args)
+ScheduledAction* ScheduledAction::create(ExecState* exec, const ArgList& args, DOMWrapperWorld* isolatedWorld)
 {
     JSValue v = args.at(0);
     CallData callData;
@@ -55,15 +55,16 @@ ScheduledAction* ScheduledAction::create(ExecState* exec, const ArgList& args)
         UString string = v.toString(exec);
         if (exec->hadException())
             return 0;
-        return new ScheduledAction(string);
+        return new ScheduledAction(string, isolatedWorld);
     }
     ArgList argsTail;
     args.getSlice(2, argsTail);
-    return new ScheduledAction(v, argsTail);
+    return new ScheduledAction(v, argsTail, isolatedWorld);
 }
 
-ScheduledAction::ScheduledAction(JSValue function, const ArgList& args)
+ScheduledAction::ScheduledAction(JSValue function, const ArgList& args, DOMWrapperWorld* isolatedWorld)
     : m_function(function)
+    , m_isolatedWorld(isolatedWorld)
 {
     ArgList::const_iterator end = args.end();
     for (ArgList::const_iterator it = args.begin(); it != end; ++it)
@@ -102,7 +103,7 @@ void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSV
         args.append(m_args[i]);
 
     globalObject->globalData()->timeoutChecker.start();
-    call(exec, m_function, callType, callData, thisValue, args);
+    callInWorld(exec, m_function, callType, callData, thisValue, args, m_isolatedWorld.get());
     globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException())
@@ -111,7 +112,7 @@ void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSV
 
 void ScheduledAction::execute(Document* document)
 {
-    JSDOMWindow* window = toJSDOMWindow(document->frame());
+    JSDOMWindow* window = toJSDOMWindow(document->frame(), m_isolatedWorld.get());
     if (!window)
         return;
 
@@ -125,7 +126,7 @@ void ScheduledAction::execute(Document* document)
         executeFunctionInContext(window, window->shell());
         Document::updateStyleForAllDocuments();
     } else
-        frame->script()->executeScript(m_code);
+        frame->script()->executeScriptInIsolatedWorld(m_isolatedWorld.get(), m_code);
 
     frame->script()->setProcessingTimerCallback(false);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
index 2cd36ed541..4ea727d5f7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
@@ -21,6 +21,7 @@
 #define ScheduledAction_h
 
 #include "PlatformString.h"
+#include <JSDOMBinding.h>
 #include <runtime/JSCell.h>
 #include <runtime/Protect.h>
 #include <wtf/Vector.h>
@@ -41,14 +42,15 @@ namespace WebCore {
     */
     class ScheduledAction {
     public:
-        static ScheduledAction* create(JSC::ExecState*, const JSC::ArgList&);
+        static ScheduledAction* create(JSC::ExecState*, const JSC::ArgList&, DOMWrapperWorld* isolatedWorld);
 
         void execute(ScriptExecutionContext*);
 
     private:
-        ScheduledAction(JSC::JSValue function, const JSC::ArgList&);
-        ScheduledAction(const String& code)
+        ScheduledAction(JSC::JSValue function, const JSC::ArgList&, DOMWrapperWorld* isolatedWorld);
+        ScheduledAction(const String& code, DOMWrapperWorld* isolatedWorld)
             : m_code(code)
+            , m_isolatedWorld(isolatedWorld)
         {
         }
 
@@ -61,6 +63,7 @@ namespace WebCore {
         JSC::ProtectedJSValue m_function;
         Vector<JSC::ProtectedJSValue> m_args;
         String m_code;
+        RefPtr<DOMWrapperWorld> m_isolatedWorld;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
index 77b8ca48fe..e01324e178 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -48,8 +48,9 @@ ScriptCachedFrameData::ScriptCachedFrameData(Frame* frame)
     JSLock lock(SilenceAssertionsOnly);
 
     ScriptController* scriptController = frame->script();
-    if (scriptController->haveWindowShell()) {
-        m_window = scriptController->windowShell()->window();
+    // FIXME: explicitly save and restore isolated worlds' global objects when using the back/forward cache. <rdar://problem/7328111>
+    if (JSDOMWindowShell* windowShell = scriptController->existingWindowShell(mainThreadNormalWorld())) {
+        m_window = windowShell->window();
         scriptController->attachDebugger(0);
     }
 }
@@ -70,11 +71,11 @@ void ScriptCachedFrameData::restore(Frame* frame)
     JSLock lock(SilenceAssertionsOnly);
 
     ScriptController* scriptController = frame->script();
-    if (scriptController->haveWindowShell()) {
-        JSDOMWindowShell* windowShell = scriptController->windowShell();
-        if (m_window) {
+    // FIXME: explicitly save and restore isolated worlds' global objects when using the back/forward cache. <rdar://problem/7328111>
+    if (JSDOMWindowShell* windowShell = scriptController->existingWindowShell(mainThreadNormalWorld())) {
+        if (m_window)
             windowShell->setWindow(m_window.get());
-        } else {
+        else {
             windowShell->setWindow(frame->domWindow());
             scriptController->attachDebugger(page->debugger());
             windowShell->window()->setProfileGroup(page->group().identifier());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
index 54acc90b06..4a1d413bc5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "CString.h"
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
@@ -38,12 +39,18 @@
 #include "npruntime_impl.h"
 #include "runtime_root.h"
 #include <debugger/Debugger.h>
+#include <runtime/InitializeThreading.h>
 #include <runtime/JSLock.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
+void ScriptController::initializeThreading()
+{
+    JSC::initializeThreading();
+}
+
 ScriptController::ScriptController(Frame* frame)
     : m_frame(frame)
     , m_handlerLineNumber(0)
@@ -71,8 +78,11 @@ ScriptController::ScriptController(Frame* frame)
 
 ScriptController::~ScriptController()
 {
-    if (m_windowShell) {
-        m_windowShell = 0;
+    if (!m_windowShells.isEmpty()) {
+        for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
+            iter->first->forgetScriptController(this);
+
+        m_windowShells.clear();
     
         // It's likely that releasing the global object has created a lot of garbage.
         gcController().garbageCollectSoon();
@@ -81,7 +91,7 @@ ScriptController::~ScriptController()
     disconnectPlatformScriptObjects();
 }
 
-ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode) 
+ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode, DOMWrapperWorld* world)
 {
     const SourceCode& jsSourceCode = sourceCode.jsSourceCode();
     String sourceURL = jsSourceCode.provider()->url();
@@ -94,12 +104,12 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     // evaluate code. Returns the JS return value or 0
     // if there was none, an error occured or the type couldn't be converted.
 
-    initScriptIfNeeded();
     // inlineCode is true for <a href="javascript:doSomething()">
     // and false for <script>doSomething()</script>. Check if it has the
     // expected value in all cases.
     // See smart window.open policy for where this is used.
-    ExecState* exec = m_windowShell->window()->globalExec();
+    JSDOMWindowShell* shell = windowShell(world);
+    ExecState* exec = shell->window()->globalExec();
     const String* savedSourceURL = m_sourceURL;
     m_sourceURL = &sourceURL;
 
@@ -107,9 +117,9 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
 
     RefPtr<Frame> protect = m_frame;
 
-    m_windowShell->window()->globalData()->timeoutChecker.start();
-    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, m_windowShell);
-    m_windowShell->window()->globalData()->timeoutChecker.stop();
+    exec->globalData().timeoutChecker.start();
+    Completion comp = WebCore::evaluateInWorld(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, shell, world);
+    exec->globalData().timeoutChecker.stop();
 
     // Evaluating the JavaScript could cause the frame to be deallocated
     // so we start the keep alive timer here.
@@ -127,52 +137,114 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     return JSValue();
 }
 
-void ScriptController::evaluateInIsolatedWorld(unsigned /* worldID */, const Vector<ScriptSourceCode>& sourceCode) 
+ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode) 
+{
+    return evaluateInWorld(sourceCode, mainThreadNormalWorld());
+}
+
+// An DOMWrapperWorld other than the thread's normal world.
+class IsolatedWorld : public DOMWrapperWorld {
+public:
+    IsolatedWorld(JSGlobalData* globalData)
+        : DOMWrapperWorld(globalData)
+    {
+        JSGlobalData::ClientData* clientData = globalData->clientData;
+        ASSERT(clientData);
+        static_cast<WebCoreJSClientData*>(clientData)->rememberWorld(this);
+    }
+
+    static PassRefPtr<IsolatedWorld> create(JSGlobalData* globalData) { return adoptRef(new IsolatedWorld(globalData)); }
+};
+
+static PassRefPtr<IsolatedWorld> findWorld(unsigned worldID)
+{
+    if (!worldID)
+        return IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
+
+    typedef HashMap<unsigned, RefPtr<IsolatedWorld> > WorldMap;
+    DEFINE_STATIC_LOCAL(WorldMap, isolatedWorlds, ());
+
+    WorldMap::iterator iter = isolatedWorlds.find(worldID);
+    if (iter != isolatedWorlds.end())
+        return iter->second;
+
+    RefPtr<IsolatedWorld> newWorld = IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
+    isolatedWorlds.add(worldID, newWorld);
+    return newWorld;
+}
+
+JSDOMWindow* ScriptController::globalObject(unsigned worldID)
+{
+    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
+    return windowShell(world.get())->window();
+}
+
+ScriptValue ScriptController::evaluateInIsolatedWorld(unsigned worldID, const ScriptSourceCode& sourceCode) 
+{
+    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
+    return evaluateInWorld(sourceCode, world.get());
+}
+
+void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>& sourceCode) 
 {
-    // FIXME: Actually support isolated worlds!
+    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
+
     unsigned size = sourceCode.size();
     for (unsigned i = 0; i < size; ++i)
-        evaluate(sourceCode[i]);
+        evaluateInWorld(sourceCode[i], world.get());
 }
 
 void ScriptController::clearWindowShell()
 {
-    if (!m_windowShell)
+    if (m_windowShells.isEmpty())
         return;
 
     JSLock lock(SilenceAssertionsOnly);
 
     // Clear the debugger from the current window before setting the new window.
+    DOMWrapperWorld* debugWorld = debuggerWorld();
     attachDebugger(0);
 
-    m_windowShell->window()->willRemoveFromWindowShell();
-    m_windowShell->setWindow(m_frame->domWindow());
+    for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter) {
+        DOMWrapperWorld* world = iter->first;
+        JSDOMWindowShell* windowShell = iter->second;
+        windowShell->window()->willRemoveFromWindowShell();
+        windowShell->setWindow(m_frame->domWindow());
 
-    if (Page* page = m_frame->page()) {
-        attachDebugger(page->debugger());
-        m_windowShell->window()->setProfileGroup(page->group().identifier());
+        if (Page* page = m_frame->page()) {
+            if (world == debugWorld)
+                attachDebugger(page->debugger());
+            windowShell->window()->setProfileGroup(page->group().identifier());
+        }
     }
 
     // There is likely to be a lot of garbage now.
     gcController().garbageCollectSoon();
 }
 
-void ScriptController::initScript()
+JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld* world)
 {
-    if (m_windowShell)
-        return;
+    ASSERT(!m_windowShells.contains(world));
 
     JSLock lock(SilenceAssertionsOnly);
 
-    m_windowShell = new JSDOMWindowShell(m_frame->domWindow());
-    m_windowShell->window()->updateDocument();
+    JSDOMWindowShell* windowShell = new JSDOMWindowShell(m_frame->domWindow());
+    m_windowShells.add(world, windowShell);
+    world->rememberScriptController(this);
+    windowShell->window()->updateDocument(world);
 
     if (Page* page = m_frame->page()) {
-        attachDebugger(page->debugger());
-        m_windowShell->window()->setProfileGroup(page->group().identifier());
+        if (world == debuggerWorld())
+            attachDebugger(page->debugger());
+        windowShell->window()->setProfileGroup(page->group().identifier());
+    }
+
+    {
+        EnterDOMWrapperWorld worldEntry(*JSDOMWindow::commonJSGlobalData(), world);
+        m_frame->loader()->dispatchWindowObjectAvailable();
     }
 
-    m_frame->loader()->dispatchWindowObjectAvailable();
+    return windowShell;
 }
 
 bool ScriptController::processingUserGesture() const
@@ -182,10 +254,11 @@ bool ScriptController::processingUserGesture() const
 
 bool ScriptController::processingUserGestureEvent() const
 {
-    if (!m_windowShell)
+    JSDOMWindowShell* shell = existingWindowShell(mainThreadNormalWorld());
+    if (!shell)
         return false;
 
-    if (Event* event = m_windowShell->window()->currentEvent()) {
+    if (Event* event = shell->window()->currentEvent()) {
         if (event->createdByDOM())
             return false;
 
@@ -243,13 +316,16 @@ bool ScriptController::isEnabled()
 
 void ScriptController::attachDebugger(JSC::Debugger* debugger)
 {
-    if (!m_windowShell)
+    // FIXME: Should be able to debug isolated worlds.
+    JSDOMWindowShell* shell = existingWindowShell(debuggerWorld());
+    if (!shell)
         return;
 
+    JSDOMWindow* globalObject = shell->window();
     if (debugger)
-        debugger->attach(m_windowShell->window());
-    else if (JSC::Debugger* currentDebugger = m_windowShell->window()->debugger())
-        currentDebugger->detach(m_windowShell->window());
+        debugger->attach(globalObject);
+    else if (JSC::Debugger* currentDebugger = globalObject->debugger())
+        currentDebugger->detach(globalObject);
 }
 
 void ScriptController::updateDocument()
@@ -258,8 +334,8 @@ void ScriptController::updateDocument()
         return;
 
     JSLock lock(SilenceAssertionsOnly);
-    if (m_windowShell)
-        m_windowShell->window()->updateDocument();
+    for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
+        iter->second->window()->updateDocument(iter->first);
 }
 
 void ScriptController::updateSecurityOrigin()
@@ -274,7 +350,7 @@ Bindings::RootObject* ScriptController::bindingRootObject()
 
     if (!m_bindingRootObject) {
         JSLock lock(SilenceAssertionsOnly);
-        m_bindingRootObject = Bindings::RootObject::create(0, globalObject());
+        m_bindingRootObject = Bindings::RootObject::create(0, globalObject(pluginWorld()));
     }
     return m_bindingRootObject.get();
 }
@@ -285,7 +361,7 @@ PassRefPtr<Bindings::RootObject> ScriptController::createRootObject(void* native
     if (it != m_rootObjects.end())
         return it->second;
 
-    RefPtr<Bindings::RootObject> rootObject = Bindings::RootObject::create(nativeHandle, globalObject());
+    RefPtr<Bindings::RootObject> rootObject = Bindings::RootObject::create(nativeHandle, globalObject(pluginWorld()));
 
     m_rootObjects.set(nativeHandle, rootObject);
     return rootObject.release();
@@ -300,7 +376,7 @@ NPObject* ScriptController::windowScriptNPObject()
             // JavaScript is enabled, so there is a JavaScript window object.
             // Return an NPObject bound to the window object.
             JSC::JSLock lock(SilenceAssertionsOnly);
-            JSObject* win = windowShell()->window();
+            JSObject* win = windowShell(pluginWorld())->window();
             ASSERT(win);
             Bindings::RootObject* root = bindingRootObject();
             m_windowScriptNPObject = _NPN_CreateScriptObject(0, win, root);
@@ -334,8 +410,9 @@ JSObject* ScriptController::jsObjectForPluginElement(HTMLPlugInElement* plugin)
 
     // Create a JSObject bound to this element
     JSLock lock(SilenceAssertionsOnly);
-    ExecState* exec = globalObject()->globalExec();
-    JSValue jsElementValue = toJS(exec, globalObject(), plugin);
+    JSDOMWindow* globalObj = globalObject(pluginWorld());
+    // FIXME: is normal okay? - used for NP plugins?
+    JSValue jsElementValue = toJS(globalObj->globalExec(), globalObj, plugin);
     if (!jsElementValue || !jsElementValue.isObject())
         return 0;
     
@@ -391,4 +468,44 @@ void ScriptController::clearScriptObjects()
 #endif
 }
 
+ScriptValue ScriptController::executeScriptInIsolatedWorld(unsigned worldID, const String& script, bool forceUserGesture)
+{
+    ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());
+
+    if (!isEnabled() || isPaused())
+        return ScriptValue();
+
+    bool wasInExecuteScript = m_inExecuteScript;
+    m_inExecuteScript = true;
+
+    ScriptValue result = evaluateInIsolatedWorld(worldID, sourceCode);
+
+    if (!wasInExecuteScript) {
+        m_inExecuteScript = false;
+        Document::updateStyleForAllDocuments();
+    }
+
+    return result;
+}
+
+ScriptValue ScriptController::executeScriptInIsolatedWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture)
+{
+    ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());
+
+    if (!isEnabled() || isPaused())
+        return ScriptValue();
+
+    bool wasInExecuteScript = m_inExecuteScript;
+    m_inExecuteScript = true;
+
+    ScriptValue result = evaluateInWorld(sourceCode, world);
+
+    if (!wasInExecuteScript) {
+        m_inExecuteScript = false;
+        Document::updateStyleForAllDocuments();
+    }
+
+    return result;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
index bd4b65ef52..f2a497d191 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
@@ -63,31 +63,49 @@ class XSSAuditor;
 typedef HashMap<void*, RefPtr<JSC::Bindings::RootObject> > RootObjectMap;
 
 class ScriptController {
+    typedef WTF::HashMap<DOMWrapperWorld*, JSC::ProtectedPtr<JSDOMWindowShell> > ShellMap;
+
 public:
     ScriptController(Frame*);
     ~ScriptController();
 
-    bool haveWindowShell() const { return m_windowShell; }
-    JSDOMWindowShell* windowShell()
+    JSDOMWindowShell* windowShell(DOMWrapperWorld* world)
+    {
+        ShellMap::iterator iter = m_windowShells.find(world);
+        return (iter != m_windowShells.end()) ? iter->second.get() : initScript(world);
+    }
+    JSDOMWindowShell* existingWindowShell(DOMWrapperWorld* world) const
+    {
+        ShellMap::const_iterator iter = m_windowShells.find(world);
+        return (iter != m_windowShells.end()) ? iter->second.get() : 0;
+    }
+    JSDOMWindow* globalObject(DOMWrapperWorld* world)
     {
-        initScriptIfNeeded();
-        return m_windowShell;
+        return windowShell(world)->window();
     }
+    JSDOMWindow* globalObject(unsigned worldID);
 
-    JSDOMWindow* globalObject()
+    void forgetWorld(DOMWrapperWorld* world)
     {
-        initScriptIfNeeded();
-        return m_windowShell->window();
+        m_windowShells.remove(world);
     }
 
     ScriptValue executeScript(const ScriptSourceCode&);
     ScriptValue executeScript(const String& script, bool forceUserGesture = false);
+    ScriptValue executeScriptInIsolatedWorld(unsigned worldID, const String& script, bool forceUserGesture = false);
+    ScriptValue executeScriptInIsolatedWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture = false);
 
     // Returns true if argument is a JavaScript URL.
     bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
 
+    // This function must be called from the main thread. It is safe to call it repeatedly.
+    // Darwin is an exception to this rule: it is OK to call this function from any thread, even reentrantly.
+    static void initializeThreading();
+
     ScriptValue evaluate(const ScriptSourceCode&);
-    void evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>&);
+    ScriptValue evaluateInWorld(const ScriptSourceCode&, DOMWrapperWorld*);
+    ScriptValue evaluateInIsolatedWorld(unsigned /*worldID*/, const ScriptSourceCode&);
+    void evaluateInIsolatedWorld(unsigned /*worldID*/, const Vector<ScriptSourceCode>&);
 
     void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
     int eventHandlerLineNumber() { return m_handlerLineNumber; }
@@ -144,19 +162,14 @@ public:
     XSSAuditor* xssAuditor() { return m_XSSAuditor.get(); }
 
 private:
-    void initScriptIfNeeded()
-    {
-        if (!m_windowShell)
-            initScript();
-    }
-    void initScript();
+    JSDOMWindowShell* initScript(DOMWrapperWorld* world);
 
     void disconnectPlatformScriptObjects();
 
     bool processingUserGestureEvent() const;
     bool isJavaScriptAnchorNavigation() const;
 
-    JSC::ProtectedPtr<JSDOMWindowShell> m_windowShell;
+    ShellMap m_windowShells;
     Frame* m_frame;
     int m_handlerLineNumber;
     const String* m_sourceURL;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
index e6a654f06e..21ec0f2873 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
@@ -114,7 +114,7 @@ WebScriptObject* ScriptController::windowScriptObject()
     if (!m_windowScriptObject) {
         JSC::JSLock lock(JSC::SilenceAssertionsOnly);
         JSC::Bindings::RootObject* root = bindingRootObject();
-        m_windowScriptObject = [WebScriptObject scriptObjectForJSObject:toRef(windowShell()) originRootObject:root rootObject:root];
+        m_windowScriptObject = [WebScriptObject scriptObjectForJSObject:toRef(windowShell(pluginWorld())) originRootObject:root rootObject:root];
     }
 
     ASSERT([m_windowScriptObject.get() isKindOfClass:[DOMAbstractView class]]);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
index 0b0047b283..8399c7acb4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
@@ -71,7 +71,7 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribu
         sourceURL = node->document()->url().string();
     }
 
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, lineNumber);
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, lineNumber, mainThreadNormalWorld());
 }
 
 PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
@@ -93,7 +93,7 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
 
     lineNumber = scriptController->eventHandlerLineNumber();
     sourceURL = frame->document()->url().string();
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, lineNumber);
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, lineNumber, mainThreadNormalWorld());
 }
 
 String getEventListenerHandlerBody(ScriptExecutionContext* context, ScriptState* scriptState, EventListener* eventListener)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
index 46e80acf6c..91b2a57614 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -123,7 +123,8 @@ ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
     if (callType == CallTypeNone)
         return ScriptValue();
 
-    JSValue result = JSC::call(m_exec, function, callType, callData, thisObject, m_arguments);
+    // FIXME: Should this function take a worldID? - only used by inspector?
+    JSValue result = callInWorld(m_exec, function, callType, callData, thisObject, m_arguments, debuggerWorld());
     if (m_exec->hadException()) {
         if (reportExceptions)
             reportException(m_exec, m_exec->exception());
@@ -161,7 +162,8 @@ ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExcept
     if (constructType == ConstructTypeNone)
         return ScriptObject();
 
-    JSValue result = JSC::construct(m_exec, constructor, constructType, constructData, m_arguments);
+    // FIXME: Currently this method constructs objects in debuggerWorld().  We could use the current world, or pass a worldID to this function?
+    JSValue result = constructInWorld(m_exec, constructor, constructType, constructData, m_arguments, debuggerWorld());
     if (m_exec->hadException()) {
         if (reportExceptions)
             reportException(m_exec, m_exec->exception());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
index b48556e6de..313530feca 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
@@ -72,7 +72,7 @@ bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObj
     if (!frame)
         return false;
 
-    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame);
+    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame, debuggerWorld());
     ExecState* exec = globalObject->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
@@ -89,7 +89,7 @@ bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObjec
     Frame* frame = storage->frame();
     ASSERT(frame);
 
-    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame);
+    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame, debuggerWorld());
     ExecState* exec = globalObject->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
@@ -116,7 +116,7 @@ bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedO
 {
     ASSERT(domWindow);
 
-    JSDOMWindow* window = toJSDOMWindow(domWindow->frame());
+    JSDOMWindow* window = toJSDOMWindow(domWindow->frame(), debuggerWorld());
     ExecState* exec = window->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptSourceCode.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptSourceCode.h
index 1b05dedb6d..32d6298cdb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptSourceCode.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptSourceCode.h
@@ -44,6 +44,7 @@ public:
     ScriptSourceCode(const String& source, const KURL& url = KURL(), int startLine = 1)
         : m_provider(StringSourceProvider::create(source, url.isNull() ? String() : url.string()))
         , m_code(m_provider, startLine)
+        , m_url(url)
     {
     }
 
@@ -59,10 +60,17 @@ public:
 
     const String& source() const { return m_provider->source(); }
 
+    int startLine() const { return m_code.firstLine(); }
+
+    const KURL& url() const { return m_url; }
+    
 private:
     RefPtr<ScriptSourceProvider> m_provider;
     
     JSC::SourceCode m_code;
+    
+    KURL m_url;
+
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
index 8bfa33d15b..60ba2a05d7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
@@ -32,6 +32,7 @@
 #include "ScriptState.h"
 
 #include "Frame.h"
+#include "JSDOMWindowBase.h"
 #include "Node.h"
 #include "Page.h"
 
@@ -49,12 +50,12 @@ ScriptState* scriptStateFromNode(Node* node)
         return 0;
     if (!frame->script()->isEnabled())
         return 0;
-    return frame->script()->globalObject()->globalExec();
+    return frame->script()->globalObject(mainThreadCurrentWorld())->globalExec();
 }
 
 ScriptState* scriptStateFromPage(Page* page)
 {
-    return page->mainFrame()->script()->globalObject()->globalExec();
+    return page->mainFrame()->script()->globalObject(mainThreadCurrentWorld())->globalExec();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
index fa5c4a8576..279234e4a8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
@@ -35,6 +35,7 @@
 #include "JSDOMBinding.h"
 
 namespace WebCore {
+    class DOMWrapperWorld;
     class Node;
     class Page;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
index 3590dad5a9..b66b0e8151 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
@@ -52,6 +52,7 @@ WorkerScriptController::WorkerScriptController(WorkerContext* workerContext)
     , m_workerContext(workerContext)
     , m_executionForbidden(false)
 {
+    m_globalData->clientData = new WebCoreJSClientData(m_globalData.get());
 }
 
 WorkerScriptController::~WorkerScriptController()
@@ -122,7 +123,7 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode,
 
     ExecState* exec = m_workerContextWrapper->globalExec();
     m_workerContextWrapper->globalData()->timeoutChecker.start();
-    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper);
+    Completion comp = evaluateInWorld(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper, currentWorld(exec));
     m_workerContextWrapper->globalData()->timeoutChecker.stop();
 
     if (comp.complType() == Normal || comp.complType() == ReturnValue)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h
index bb33f6082c..c820cd936c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h
@@ -62,6 +62,9 @@ namespace WebCore {
         void setException(ScriptValue);
 
         void forbidExecution();
+
+        JSC::JSGlobalData* globalData() { return m_globalData.get(); }
+
     private:
         void initScriptIfNeeded()
         {
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
index ff7b52f9fe..d8367acb30 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -292,7 +292,7 @@ sub GenerateGetOwnPropertySlotBody
 
     my @getOwnPropertySlotImpl = ();
 
-    if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection") {
+    if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
         push(@getOwnPropertySlotImpl, "    ${namespaceMaybe}JSValue proto = prototype();\n");
         push(@getOwnPropertySlotImpl, "    if (proto.isObject() && static_cast<${namespaceMaybe}JSObject*>(asObject(proto))->hasProperty(exec, propertyName))\n");
         push(@getOwnPropertySlotImpl, "        return false;\n\n");
@@ -369,7 +369,7 @@ sub GenerateGetOwnPropertyDescriptorBody
     
     my @getOwnPropertyDescriptorImpl = ();
     
-    if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection") {
+    if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
         push(@getOwnPropertyDescriptorImpl, "    ${namespaceMaybe}JSValue proto = prototype();\n");
         push(@getOwnPropertyDescriptorImpl, "    if (proto.isObject() && static_cast<${namespaceMaybe}JSObject*>(asObject(proto))->hasProperty(exec, propertyName))\n");
         push(@getOwnPropertyDescriptorImpl, "        return false;\n\n");
@@ -658,6 +658,12 @@ sub GenerateHeader
     # Custom lookupSetter function
     push(@headerContent, "    virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupSetter"};
 
+    # Override toBoolean to return false for objects that want to 'MasqueradesAsUndefined'.
+    if ($dataNode->extendedAttributes->{"MasqueradesAsUndefined"}) {
+        push(@headerContent, "    virtual bool toBoolean(JSC::ExecState*) const { return false; };\n");
+        $structureFlags{"JSC::MasqueradesAsUndefined"} = 1;
+    }
+
     # Constructor object getter
     push(@headerContent, "    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);\n") if $dataNode->extendedAttributes->{"GenerateConstructor"};
 
@@ -1188,19 +1194,21 @@ sub GenerateImplementation
             push(@implContent, "    impl()->invalidateEventListeners();\n");
         }
 
-        if ($interfaceName eq "Node") {
-             push(@implContent, "    forgetDOMNode(impl()->document(), impl());\n");
-        } else {
-            if ($podType) {
-                my $animatedType = $implClassName;
-                $animatedType =~ s/SVG/SVGAnimated/;
+        if (!$dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
+            if ($interfaceName eq "Node") {
+                 push(@implContent, "    forgetDOMNode(this, impl(), impl()->document());\n");
+            } else {
+                if ($podType) {
+                    my $animatedType = $implClassName;
+                    $animatedType =~ s/SVG/SVGAnimated/;
 
-                # Special case for JSSVGNumber
-                if ($codeGenerator->IsSVGAnimatedType($animatedType) and $podType ne "float") {
-                    push(@implContent, "    JSSVGDynamicPODTypeWrapperCache<$podType, $animatedType>::forgetWrapper(m_impl.get());\n");
+                    # Special case for JSSVGNumber
+                    if ($codeGenerator->IsSVGAnimatedType($animatedType) and $podType ne "float") {
+                        push(@implContent, "    JSSVGDynamicPODTypeWrapperCache<$podType, $animatedType>::forgetWrapper(m_impl.get());\n");
+                    }
                 }
+                push(@implContent, "    forgetDOMObject(this, impl());\n");
             }
-            push(@implContent, "    forgetDOMObject(*Heap::heap(this)->globalData(), impl());\n");
         }
 
         push(@implContent, "}\n\n");
@@ -1210,7 +1218,7 @@ sub GenerateImplementation
     # its own special handling rather than relying on the caching that Node normally does.
     if ($interfaceName eq "Document") {
         push(@implContent, "${className}::~$className()\n");
-        push(@implContent, "{\n    forgetDOMObject(*Heap::heap(this)->globalData(), static_cast<${implClassName}*>(impl()));\n}\n\n");
+        push(@implContent, "{\n    forgetDOMObject(this, static_cast<${implClassName}*>(impl()));\n}\n\n");
     }
 
     if ($needsMarkChildren && !$dataNode->extendedAttributes->{"CustomMarkFunction"}) {
@@ -1476,7 +1484,7 @@ sub GenerateImplementation
                             } else {
                                 $implIncludes{"Frame.h"} = 1;
                                 $implIncludes{"JSDOMGlobalObject.h"} = 1;
-                                push(@implContent, "    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());\n");
+                                push(@implContent, "    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);\n");
                                 push(@implContent, "    if (!globalObject)\n");
                                 push(@implContent, "        return;\n");
                             }
@@ -1700,7 +1708,7 @@ sub GenerateImplementation
             push(@implContent, "    return toJS(exec, thisObj->globalObject(), static_cast<$implClassName*>(thisObj->impl())->item(slot.index()));\n");
         }
         push(@implContent, "}\n");
-        if ($interfaceName eq "HTMLCollection") {
+        if ($interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
             $implIncludes{"JSNode.h"} = 1;
             $implIncludes{"Node.h"} = 1;
         }
@@ -1711,7 +1719,7 @@ sub GenerateImplementation
         push(@implContent, "{\n");
         push(@implContent, "    return jsNumber(exec, static_cast<$implClassName*>(impl())->item(index));\n");
         push(@implContent, "}\n");
-        if ($interfaceName eq "HTMLCollection") {
+        if ($interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
             $implIncludes{"JSNode.h"} = 1;
             $implIncludes{"Node.h"} = 1;
         }
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 28562f1ab5..95b2aa2fb9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -215,7 +215,6 @@ sub AddClassForwardIfNeeded
 sub GetImplementationFileName
 {
     my $iface = shift;
-    return "HTMLCollection.h" if $iface eq "HTMLAllCollection";
     return "Event.h" if $iface eq "DOMTimeStamp";
     return "NamedAttrMap.h" if $iface eq "NamedNodeMap";
     return "NameNodeList.h" if $iface eq "NodeList";
@@ -307,7 +306,7 @@ sub GenerateSetDOMException
     my $indent = shift;
     my $result = "";
 
-    $result .= $indent . "if (ec) {\n";
+    $result .= $indent . "if (UNLIKELY(ec)) {\n";
     $result .= $indent . "    V8Proxy::setDOMException(ec);\n";
     $result .= $indent . "    return v8::Handle<v8::Value>();\n";
     $result .= $indent . "}\n";
@@ -622,15 +621,17 @@ END
             push(@implContentDecls, "    if (!imp->document())\n");
             push(@implContentDecls, "      return v8::Undefined();\n");
         }
-        push(@implContentDecls, "    $nativeType v = ");
-
-        push(@implContentDecls, "$getterString;\n");
 
         if ($useExceptions) {
+            push(@implContentDecls, "    $nativeType v = ");
+            push(@implContentDecls, "$getterString;\n");
             push(@implContentDecls, GenerateSetDOMException("    "));
+            $result = "v";
+            $result .= ".release()" if (IsRefPtrType($returnType));
+        } else {
+            # Can inline the function call into the return statement to avoid overhead of using a Ref<> temporary
+            $result = $getterString;
         }
-
-        $result = "v";
     }
 
     if (IsSVGTypeNeedingContextParameter($attrType) && !$skipContext) {
@@ -646,7 +647,6 @@ END
         my $classIndex = uc($attrType);
         push(@implContentDecls, "    return V8DOMWrapper::convertToV8Object(V8ClassIndex::$classIndex, wrapper.release());\n");
     } else {
-        $result .= ".release()" if (IsRefPtrType($attrType));
         push(@implContentDecls, "    " . ReturnNativeToJSValue($attribute->signature, $result, "    ").";\n");
     }
 
@@ -784,7 +784,8 @@ END
     }
 
     if ($useExceptions) {
-        push(@implContentDecls, "    V8Proxy::setDOMException(ec);\n");
+        push(@implContentDecls, "    if (UNLIKELY(ec))\n");
+        push(@implContentDecls, "        V8Proxy::setDOMException(ec);\n");
     }
 
     if ($isPodType) {
@@ -917,7 +918,7 @@ END
         if (TypeCanFailConversion($parameter)) {
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
-"    if (!$parameterName" . (BasicTypeCanFailConversion($parameter) ? "Ok" : "") . ") {\n" .
+"    if (UNLIKELY(!$parameterName" . (BasicTypeCanFailConversion($parameter) ? "Ok" : "") . ")) {\n" .
 "      V8Proxy::setDOMException(TYPE_MISMATCH_ERR);\n" .
 "      return v8::Handle<v8::Value>();\n" .
 "    }\n");
@@ -926,7 +927,7 @@ END
         if ($parameter->extendedAttributes->{"IsIndex"}) {
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
-"    if ($parameterName < 0) {\n" .
+"    if (UNLIKELY($parameterName < 0)) {\n" .
 "      V8Proxy::setDOMException(INDEX_SIZE_ERR);\n" .
 "      return v8::Handle<v8::Value>();\n" .
 "    }\n");
@@ -1322,6 +1323,13 @@ END
             $template = "instance";
         }
 
+        my $conditional = "";
+        if ($attrExt->{"EnabledAtRuntime"}) {
+            # Only call Set()/SetAccessor() if this method should be enabled
+            $enable_function = $interfaceName . $codeGenerator->WK_ucfirst($function->signature->name);
+            $conditional = "if (V8Custom::v8${enable_function}Enabled())\n";
+        }
+
         if ($attrExt->{"DoNotCheckDomainSecurity"} &&
             ($dataNode->extendedAttributes->{"CheckDomainSecurity"} || $interfaceName eq "DOMWindow")) {
             # Mark the accessor as ReadOnly and set it on the proto object so
@@ -1342,7 +1350,7 @@ END
             push(@implContent, <<END);
 
   // $commentInfo
-  $template->SetAccessor(
+  $conditional $template->SetAccessor(
       v8::String::New("$name"),
       ${interfaceName}Internal::${name}AttrGetter,
       0,
@@ -1370,7 +1378,7 @@ END
       push(@implContent, <<END);
 
   // $commentInfo
-  ${template}->Set(
+  $conditional ${template}->Set(
       v8::String::New("$name"),
       $templateFunction,
       static_cast<v8::PropertyAttribute>($property_attributes));
@@ -1388,7 +1396,7 @@ END
     }
 
     # Set the class name.  This is used when printing objects.
-    push(@implContent, "  desc->SetClassName(v8::String::New(\"" . GetClassName(${interfaceName}) . "\"));\n");
+    push(@implContent, "  desc->SetClassName(v8::String::New(\"${interfaceName}\"));\n");
 
     if ($has_constants) {
         push(@implContent, <<END);
@@ -1530,6 +1538,9 @@ sub GenerateFunctionCallString()
     }
     $functionString .= ")";
 
+    my $return = "result";
+    my $returnIsRef = IsRefPtrType($returnType);
+
     if ($nodeToReturn) {
         # Special case for insertBefore, replaceChild, removeChild and
         # appendChild functions from Node.
@@ -1550,16 +1561,18 @@ sub GenerateFunctionCallString()
             $indent . "$functionString;\n";
     } elsif ($returnsListItemPodType) {
         $result .= $indent . "RefPtr<SVGPODListItem<$nativeReturnType> > result = $functionString;\n";
-    } else {
+    } elsif (@{$function->raisesExceptions} or $returnsPodType or $isPodType or IsSVGTypeNeedingContextParameter($returnType)) {
         $result .= $indent . $nativeReturnType . " result = $functionString;\n";
+    } else {
+        # Can inline the function call into the return statement to avoid overhead of using a Ref<> temporary
+        $return = $functionString;
+        $returnIsRef = 0;
     }
 
     if (@{$function->raisesExceptions}) {
         $result .= GenerateSetDOMException($indent);
     }
 
-    my $return = "result";
-
     # If the return type is a POD type, separate out the wrapper generation
     if ($returnsListItemPodType) {
         $result .= $indent . "RefPtr<V8SVGPODTypeWrapper<" . $nativeReturnType . "> > wrapper = ";
@@ -1602,7 +1615,7 @@ sub GenerateFunctionCallString()
         my $classIndex = uc($returnType);
         $result .= $indent . "return V8DOMWrapper::convertToV8Object(V8ClassIndex::$classIndex, wrapper.release());\n";
     } else {
-        $return .= ".release()" if (IsRefPtrType($returnType));
+        $return .= ".release()" if ($returnIsRef);
         $result .= $indent . ReturnNativeToJSValue($function->signature, $return, $indent) . ";\n";
     }
 
@@ -1610,15 +1623,6 @@ sub GenerateFunctionCallString()
 }
 
 
-# Get the class name used for printing javascript DOM-object wrappers.
-sub GetClassName
-{
-    my $type = shift;
-    return "HTMLCollection" if $type eq "HTMLAllCollection";
-    return $type;
-}
-
-
 sub GetTypeFromSignature
 {
     my $signature = shift;
@@ -1696,6 +1700,7 @@ sub IsRefPtrType
     return 1 if $type eq "EventListener";
     return 1 if $type eq "FileList";
     return 1 if $type eq "HTMLCollection";
+    return 1 if $type eq "HTMLAllCollection";
     return 1 if $type eq "HTMLDocument";
     return 1 if $type eq "HTMLElement";
     return 1 if $type eq "HTMLOptionsCollection";
@@ -2147,7 +2152,11 @@ sub ReturnNativeToJSValue
 
     # special case for non-DOM node interfaces
     if (IsDOMNodeType($type)) {
-        return "return V8DOMWrapper::convertNodeToV8Object($value)";
+        if ($signature->extendedAttributes->{"ReturnsNew"}) {
+            return "return V8DOMWrapper::convertNewNodeToV8Object($value)";
+        } else {
+            return "return V8DOMWrapper::convertNodeToV8Object($value)";
+        }
     }
 
     if ($type eq "EventTarget" or $type eq "SVGElementInstance") {
@@ -2159,7 +2168,7 @@ sub ReturnNativeToJSValue
     }
 
     if ($type eq "EventListener") {
-        return "return V8DOMWrapper::convertEventListenerToV8Object($value)";
+        return "return V8DOMWrapper::convertEventListenerToV8Object(imp->scriptExecutionContext(), $value)";
     }
 
     if ($type eq "SerializedScriptValue") {
diff --git a/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp b/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
index 006f17f3a3..6a89652cdb 100644
--- a/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
@@ -34,6 +34,7 @@
 #include "c_utility.h"
 #include "c_instance.h"
 #include "IdentifierRep.h"
+#include "JSDOMBinding.h"
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
 #include "runtime_root.h"
@@ -123,7 +124,7 @@ bool _NPN_InvokeDefault(NPP, NPObject* o, const NPVariant* args, uint32_t argCou
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = call(exec, function, callType, callData, function, argList);
+        JSValue resultV = callInWorld(exec, function, callType, callData, function, argList, pluginWorld());
         globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
@@ -173,7 +174,7 @@ bool _NPN_Invoke(NPP npp, NPObject* o, NPIdentifier methodName, const NPVariant*
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = call(exec, function, callType, callData, obj->imp, argList);
+        JSValue resultV = callInWorld(exec, function, callType, callData, obj->imp, argList, pluginWorld());
         globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
@@ -203,7 +204,7 @@ bool _NPN_Evaluate(NPP, NPObject* o, NPString* s, NPVariant* variant)
         String scriptString = convertNPStringToUTF16(s);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        Completion completion = JSC::evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(scriptString));
+        Completion completion = evaluateInWorld(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(scriptString), JSC::JSValue(), pluginWorld());
         globalObject->globalData()->timeoutChecker.stop();
         ComplType type = completion.complType();
         
@@ -443,7 +444,7 @@ bool _NPN_Construct(NPP, NPObject* o, const NPVariant* args, uint32_t argCount,
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = construct(exec, constructor, constructType, constructData, argList);
+        JSValue resultV = constructInWorld(exec, constructor, constructType, constructData, argList, pluginWorld());
         globalObject->globalData()->timeoutChecker.stop();
         
         // Convert and return the result.
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
index eb4a6bd5a1..cc28a75774 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
@@ -29,6 +29,7 @@
 #if ENABLE(MAC_JAVA_BRIDGE)
 
 #include "Frame.h"
+#include "JSDOMBinding.h"
 #include "ScriptController.h"
 #include "StringSourceProvider.h"
 #include "WebCoreFrameView.h"
@@ -302,7 +303,7 @@ jobject JavaJSObject::call(jstring methodName, jobjectArray args) const
     MarkedArgumentBuffer argList;
     getListFromJArray(exec, args, argList);
     rootObject->globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = JSC::call(exec, function, callType, callData, _imp, argList);
+    JSValue result = WebCore::callInWorld(exec, function, callType, callData, _imp, argList, WebCore::pluginWorld());
     rootObject->globalObject()->globalData()->timeoutChecker.stop();
 
     return convertValueToJObject(result);
@@ -321,7 +322,7 @@ jobject JavaJSObject::eval(jstring script) const
         return 0;
 
     rootObject->globalObject()->globalData()->timeoutChecker.start();
-    Completion completion = JSC::evaluate(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script)));
+    Completion completion = WebCore::evaluateInWorld(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script)), JSC::JSValue(), WebCore::pluginWorld());
     rootObject->globalObject()->globalData()->timeoutChecker.stop();
     ComplType type = completion.complType();
     
diff --git a/src/3rdparty/webkit/WebCore/bridge/npapi.h b/src/3rdparty/webkit/WebCore/bridge/npapi.h
index 5d48b0dc54..c6cd557b4c 100644
--- a/src/3rdparty/webkit/WebCore/bridge/npapi.h
+++ b/src/3rdparty/webkit/WebCore/bridge/npapi.h
@@ -56,6 +56,12 @@
 #    endif /* XP_WIN */
 #endif /* _WIN32 */
 
+#ifdef __SYMBIAN32__
+#   ifndef XP_SYMBIAN
+#       define XP_SYMBIAN 1
+#   endif
+#endif  /* __SYMBIAN32__ */
+
 #ifdef __MWERKS__
 #    define _declspec __declspec
 #    ifdef macintosh
@@ -64,22 +70,15 @@
 #        endif /* XP_MAC */
 #    endif /* macintosh */
 #    ifdef __INTEL__
-#       ifndef __SYMBIAN32__
+#       ifndef XP_SYMBIAN
 #           undef NULL
-#       endif
-#        ifndef XP_WIN
-#            define XP_WIN 1
-#        endif /* __INTEL__ */
-#    endif /* XP_PC */
+#           ifndef XP_WIN
+#               define XP_WIN 1
+#           endif /* XP_WIN */
+#       endif /* XP_SYMBIAN */
+#    endif /* __INTEL__ */
 #endif /* __MWERKS__ */
 
-#ifdef __SYMBIAN32__
-#   ifndef XP_SYMBIAN
-#       define XP_SYMBIAN 1
-#       undef XP_WIN
-#   endif
-#endif  /* __SYMBIAN32__ */
-
 #if defined(__APPLE_CC__) && !defined(__MACOS_CLASSIC__) && !defined(XP_UNIX)
 #   define XP_MACOSX
 #endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
index 3cb215633e..688732536c 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
@@ -458,7 +458,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
             if (type == Date) {
                 DateInstance* date = static_cast<DateInstance*>(object);
                 WTF::GregorianDateTime gdt;
-                date->getUTCTime(gdt);
+                WTF::msToGregorianDateTime(date->internalNumber(), true, gdt);
                 if (hint == QMetaType::QDateTime) {
                     ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
                     dist = 0;
@@ -834,9 +834,7 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         dt.isDST = -1;
         double ms = WTF::gregorianDateTimeToMS(dt, time.msec(), /*inputIsUTC*/ false);
 
-        DateInstance* instance = new (exec) DateInstance(exec->lexicalGlobalObject()->dateStructure());
-        instance->setInternalValue(jsNumber(exec, trunc(ms)));
-        return instance;
+        return new (exec) DateInstance(exec, trunc(ms));
     }
 
     if (type == QMetaType::QByteArray) {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
index 4e067ce852..b8769f9a9a 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -157,6 +157,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitBackgroundClip,
     CSSPropertyWebkitBackgroundComposite,
     CSSPropertyWebkitBackgroundOrigin,
+    CSSPropertyWebkitBackgroundSize,
     CSSPropertyWebkitBorderFit,
     CSSPropertyWebkitBorderHorizontalSpacing,
     CSSPropertyWebkitBorderImage,
@@ -260,30 +261,13 @@ static const int computedProperties[] = {
     CSSPropertyTextAnchor,
     CSSPropertyWritingMode,
     CSSPropertyGlyphOrientationHorizontal,
-    CSSPropertyGlyphOrientationVertical
+    CSSPropertyGlyphOrientationVertical,
+    CSSPropertyWebkitShadow
 #endif
 };
 
 const unsigned numComputedProperties = sizeof(computedProperties) / sizeof(computedProperties[0]);
 
-static PassRefPtr<CSSValue> valueForShadow(const ShadowData* shadow, CSSPropertyID propertyID)
-{
-    if (!shadow)
-        return CSSPrimitiveValue::createIdentifier(CSSValueNone);
-
-    RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
-    for (const ShadowData* s = shadow; s; s = s->next) {
-        RefPtr<CSSPrimitiveValue> x = CSSPrimitiveValue::create(s->x, CSSPrimitiveValue::CSS_PX);
-        RefPtr<CSSPrimitiveValue> y = CSSPrimitiveValue::create(s->y, CSSPrimitiveValue::CSS_PX);
-        RefPtr<CSSPrimitiveValue> blur = CSSPrimitiveValue::create(s->blur, CSSPrimitiveValue::CSS_PX);
-        RefPtr<CSSPrimitiveValue> spread = propertyID == CSSPropertyTextShadow ? 0 : CSSPrimitiveValue::create(s->spread, CSSPrimitiveValue::CSS_PX);
-        RefPtr<CSSPrimitiveValue> style = propertyID == CSSPropertyTextShadow || s->style == Normal ? 0 : CSSPrimitiveValue::createIdentifier(CSSValueInset);
-        RefPtr<CSSPrimitiveValue> color = CSSPrimitiveValue::createColor(s->color.rgb());
-        list->prepend(ShadowValue::create(x.release(), y.release(), blur.release(), spread.release(), style.release(), color.release()));
-    }
-    return list.release();
-}
-
 static int valueForRepeatRule(int rule)
 {
     switch (rule) {
@@ -571,6 +555,26 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getFontSizeCSSValuePreferringK
     return CSSPrimitiveValue::create(style->fontDescription().computedPixelSize(), CSSPrimitiveValue::CSS_PX);
 }
 
+PassRefPtr<CSSValue> CSSComputedStyleDeclaration::valueForShadow(const ShadowData* shadow, int id) const
+{
+    if (!shadow)
+        return CSSPrimitiveValue::createIdentifier(CSSValueNone);
+
+    CSSPropertyID propertyID = static_cast<CSSPropertyID>(id);
+
+    RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
+    for (const ShadowData* s = shadow; s; s = s->next) {
+        RefPtr<CSSPrimitiveValue> x = CSSPrimitiveValue::create(s->x, CSSPrimitiveValue::CSS_PX);
+        RefPtr<CSSPrimitiveValue> y = CSSPrimitiveValue::create(s->y, CSSPrimitiveValue::CSS_PX);
+        RefPtr<CSSPrimitiveValue> blur = CSSPrimitiveValue::create(s->blur, CSSPrimitiveValue::CSS_PX);
+        RefPtr<CSSPrimitiveValue> spread = propertyID == CSSPropertyTextShadow ? 0 : CSSPrimitiveValue::create(s->spread, CSSPrimitiveValue::CSS_PX);
+        RefPtr<CSSPrimitiveValue> style = propertyID == CSSPropertyTextShadow || s->style == Normal ? 0 : CSSPrimitiveValue::createIdentifier(CSSValueInset);
+        RefPtr<CSSPrimitiveValue> color = CSSPrimitiveValue::createColor(s->color.rgb());
+        list->prepend(ShadowValue::create(x.release(), y.release(), blur.release(), spread.release(), style.release(), color.release()));
+    }
+    return list.release();
+}
+
 PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int propertyID) const
 {
     return getPropertyCSSValue(propertyID, UpdateLayout);
@@ -676,7 +680,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             if (style->backgroundImage())
                 return style->backgroundImage()->cssValue();
             return CSSPrimitiveValue::createIdentifier(CSSValueNone);
-        case CSSPropertyBackgroundSize: {
+        case CSSPropertyBackgroundSize:
+        case CSSPropertyWebkitBackgroundSize: {
             EFillSizeType size = style->backgroundSizeType();
             if (size == Contain)
                 return CSSPrimitiveValue::createIdentifier(CSSValueContain);
@@ -777,7 +782,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitBoxReflect:
             return valueForReflection(style->boxReflect());
         case CSSPropertyWebkitBoxShadow:
-            return valueForShadow(style->boxShadow(), static_cast<CSSPropertyID>(propertyID));
+            return valueForShadow(style->boxShadow(), propertyID);
         case CSSPropertyCaptionSide:
             return CSSPrimitiveValue::create(style->captionSide());
         case CSSPropertyClear:
@@ -1061,7 +1066,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyTextIndent:
             return CSSPrimitiveValue::create(style->textIndent());
         case CSSPropertyTextShadow:
-            return valueForShadow(style->textShadow(), static_cast<CSSPropertyID>(propertyID));
+            return valueForShadow(style->textShadow(), propertyID);
         case CSSPropertyTextRendering:
             return CSSPrimitiveValue::create(style->fontDescription().textRenderingMode());
         case CSSPropertyTextOverflow:
diff --git a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h
index c1f34c3ed0..842a9950a0 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h
@@ -27,6 +27,7 @@
 namespace WebCore {
 
 class CSSMutableStyleDeclaration;
+class ShadowData;
 
 enum EUpdateLayout { DoNotUpdateLayout = false, UpdateLayout = true };
 
@@ -66,6 +67,8 @@ private:
     virtual String removeProperty(int propertyID, ExceptionCode&);
     virtual void setProperty(int propertyId, const String& value, bool important, ExceptionCode&);
 
+    PassRefPtr<CSSValue> valueForShadow(const ShadowData*, int) const;
+
     RefPtr<Node> m_node;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
index 10949dd400..6024a5ba36 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
@@ -873,6 +873,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyBackgroundPositionX:
     case CSSPropertyBackgroundPositionY:
     case CSSPropertyBackgroundSize:
+    case CSSPropertyWebkitBackgroundSize:
     case CSSPropertyBackgroundRepeat:
     case CSSPropertyBackgroundRepeatX:
     case CSSPropertyBackgroundRepeatY:
@@ -1726,6 +1727,15 @@ void CSSParser::addFillValue(RefPtr<CSSValue>& lval, PassRefPtr<CSSValue> rval)
         lval = rval;
 }
 
+static bool parseBackgroundClip(CSSParserValue* parserValue, RefPtr<CSSValue>& cssValue)
+{
+    if (parserValue->id == CSSValueBorderBox || parserValue->id == CSSValuePaddingBox || parserValue->id == CSSValueWebkitText) {
+        cssValue = CSSPrimitiveValue::createIdentifier(parserValue->id);
+        return true;
+    }
+    return false;
+}
+
 const int cMaxFillProperties = 9;
 
 bool CSSParser::parseFillShorthand(int propId, const int* properties, int numProperties, bool important)
@@ -1777,6 +1787,7 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
                 RefPtr<CSSValue> val1;
                 RefPtr<CSSValue> val2;
                 int propId1, propId2;
+                CSSParserValue* parserValue = m_valueList->current();
                 if (parseFillProperty(properties[i], propId1, propId2, val1, val2)) {
                     parsedProperty[i] = found = true;
                     addFillValue(values[i], val1.release());
@@ -1786,7 +1797,7 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
                         addFillValue(repeatYValue, val2.release());
                     if (properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin) {
                         // Reparse the value as a clip, and see if we succeed.
-                        if (parseFillProperty(CSSPropertyBackgroundClip, propId1, propId2, val1, val2))
+                        if (parseBackgroundClip(parserValue, val1))
                             addFillValue(clipValue, val1.release()); // The property parsed successfully.
                         else
                             addFillValue(clipValue, CSSInitialValue::createImplicit()); // Some value was used for origin that is not supported by clip. Just reset clip instead.
@@ -2319,7 +2330,7 @@ void CSSParser::parseFillRepeat(RefPtr<CSSValue>& value1, RefPtr<CSSValue>& valu
     }
 }
 
-PassRefPtr<CSSValue> CSSParser::parseFillSize(bool& allowComma)
+PassRefPtr<CSSValue> CSSParser::parseFillSize(int propId, bool& allowComma)
 {
     allowComma = true;
     CSSParserValue* value = m_valueList->current();
@@ -2328,7 +2339,7 @@ PassRefPtr<CSSValue> CSSParser::parseFillSize(bool& allowComma)
         return CSSPrimitiveValue::createIdentifier(value->id);
 
     RefPtr<CSSPrimitiveValue> parsedValue1;
-    
+
     if (value->id == CSSValueAuto)
         parsedValue1 = CSSPrimitiveValue::create(0, CSSPrimitiveValue::CSS_UNKNOWN);
     else {
@@ -2336,8 +2347,9 @@ PassRefPtr<CSSValue> CSSParser::parseFillSize(bool& allowComma)
             return 0;
         parsedValue1 = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
     }
-    
-    RefPtr<CSSPrimitiveValue> parsedValue2 = parsedValue1;
+
+    CSSPropertyID property = static_cast<CSSPropertyID>(propId);
+    RefPtr<CSSPrimitiveValue> parsedValue2;
     if ((value = m_valueList->next())) {
         if (value->id == CSSValueAuto)
             parsedValue2 = CSSPrimitiveValue::create(0, CSSPrimitiveValue::CSS_UNKNOWN);
@@ -2349,7 +2361,13 @@ PassRefPtr<CSSValue> CSSParser::parseFillSize(bool& allowComma)
             parsedValue2 = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
         }
     }
-    
+    if (!parsedValue2) {
+        if (property == CSSPropertyWebkitBackgroundSize || property == CSSPropertyWebkitMaskSize)
+            parsedValue2 = parsedValue1;
+        else
+            parsedValue2 = CSSPrimitiveValue::create(0, CSSPrimitiveValue::CSS_UNKNOWN);
+    }
+
     return CSSPrimitiveValue::create(Pair::create(parsedValue1.release(), parsedValue2.release()));
 }
 
@@ -2425,10 +2443,8 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                     }
                     break;
                 case CSSPropertyBackgroundClip:
-                    if (val->id == CSSValueBorderBox || val->id == CSSValuePaddingBox || val->id == CSSValueWebkitText) {
-                        currValue = CSSPrimitiveValue::createIdentifier(val->id);
+                    if (parseBackgroundClip(val, currValue))
                         m_valueList->next();
-                    }
                     break;
                 case CSSPropertyBackgroundOrigin:
                     if (val->id == CSSValueBorderBox || val->id == CSSValuePaddingBox || val->id == CSSValueContentBox) {
@@ -2470,8 +2486,9 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                     // parseFillRepeat advances the m_valueList pointer
                     break;
                 case CSSPropertyBackgroundSize:
+                case CSSPropertyWebkitBackgroundSize:
                 case CSSPropertyWebkitMaskSize: {
-                    currValue = parseFillSize(allowComma);
+                    currValue = parseFillSize(propId, allowComma);
                     if (currValue)
                         m_valueList->next();
                     break;
@@ -3736,7 +3753,11 @@ bool CSSParser::parseShadow(int propId, bool important)
                 // Other operators aren't legal or we aren't done with the current shadow
                 // value.  Treat as invalid.
                 return false;
-            
+#if ENABLE(SVG)
+            // -webkit-shadow does not support multiple values.
+            if (static_cast<CSSPropertyID>(propId) == CSSPropertyWebkitShadow)
+                return false;
+#endif            
             // The value is good.  Commit it.
             context.commitValue();
         } else if (validUnit(val, FLength, true)) {
@@ -5182,11 +5203,6 @@ static int cssPropertyID(const UChar* propertyName, unsigned length)
                 const char* const opacity = "opacity";
                 name = opacity;
                 length = strlen(opacity);
-            } else if (strcmp(buffer, "-webkit-background-size") == 0) {
-                // CSS Backgrounds/Borders.  -webkit-background-size worked in Safari 4 and earlier.
-                const char* const backgroundSize = "background-size";
-                name = backgroundSize;
-                length = strlen(backgroundSize);
             } else if (hasPrefix(buffer + 7, length - 7, "-border-")) {
                 // -webkit-border-*-*-radius worked in Safari 4 and earlier. -webkit-border-radius syntax
                 // differs from border-radius, so it is remains as a distinct property.
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.h b/src/3rdparty/webkit/WebCore/css/CSSParser.h
index 1a156da605..6d1bb32cc8 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.h
@@ -83,7 +83,7 @@ namespace WebCore {
         PassRefPtr<CSSValue> parseFillPositionXY(bool& xFound, bool& yFound);
         void parseFillPosition(RefPtr<CSSValue>&, RefPtr<CSSValue>&);
         void parseFillRepeat(RefPtr<CSSValue>&, RefPtr<CSSValue>&);
-        PassRefPtr<CSSValue> parseFillSize(bool &allowComma);
+        PassRefPtr<CSSValue> parseFillSize(int propId, bool &allowComma);
         
         bool parseFillProperty(int propId, int& propId1, int& propId2, RefPtr<CSSValue>&, RefPtr<CSSValue>&);
         bool parseFillShorthand(int propId, const int* properties, int numProperties, bool important);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParserValues.h b/src/3rdparty/webkit/WebCore/css/CSSParserValues.h
index 242cda87f7..1e9767a20d 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParserValues.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSParserValues.h
@@ -88,7 +88,7 @@ private:
     unsigned m_variablesCount;
 };
 
-struct CSSParserFunction {
+struct CSSParserFunction : FastAllocBase {
     CSSParserString name;
     CSSParserValueList* args;
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
index 3616aa5d84..6f89df9df6 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
@@ -200,11 +200,11 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case ListboxPart:
             m_value.ident = CSSValueListbox;
             break;
-#if ENABLE(DATALIST)
         case ListButtonPart:
+#if ENABLE(DATALIST)
             m_value.ident = CSSValueListButton;
-            break;
 #endif
+            break;
         case ListItemPart:
             m_value.ident = CSSValueListitem;
             break;
@@ -378,6 +378,7 @@ template<> inline CSSPrimitiveValue::operator EFillBox() const
         case CSSValueContentBox:
             return ContentFillBox;
         case CSSValueText:
+        case CSSValueWebkitText:
             return TextFillBox;
         default:
             ASSERT_NOT_REACHED();
diff --git a/src/3rdparty/webkit/WebCore/css/CSSProperty.h b/src/3rdparty/webkit/WebCore/css/CSSProperty.h
index 7af8348402..b5635d05ea 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSProperty.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSProperty.h
@@ -29,7 +29,7 @@
 
 namespace WebCore {
 
-class CSSProperty {
+class CSSProperty : public FastAllocBase {
 public:
     CSSProperty(int propID, PassRefPtr<CSSValue> value, bool important = false, int shorthandID = 0, bool implicit = false)
         : m_id(propID)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
index 5ef660509f..48a18e7479 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
+++ b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
@@ -160,6 +160,10 @@ zoom
 -webkit-background-clip
 -webkit-background-composite
 -webkit-background-origin
+# -webkit-background-size differs from background-size only in the interpretation of
+# a single value: -webkit-background-size: l; is equivalent to background-size: l l;
+# whereas background-size: l; is equivalent to background-size: l auto;
+-webkit-background-size
 -webkit-binding
 -webkit-border-fit
 -webkit-border-horizontal-spacing
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
index 181e48024a..40627cfa76 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
@@ -2961,6 +2961,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         HANDLE_BACKGROUND_VALUE(origin, Origin, value)
         return;
     case CSSPropertyBackgroundSize:
+    case CSSPropertyWebkitBackgroundSize:
         HANDLE_BACKGROUND_VALUE(size, Size, value)
         return;
     case CSSPropertyWebkitMaskAttachment:
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
index e8492d408e..1f19983441 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
@@ -166,6 +166,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getSVGPropertyCSSValue(int pro
 
             return 0;
         }
+        case CSSPropertyWebkitShadow:
+            return valueForShadow(svgStyle->shadow(), propertyID);
         case CSSPropertyMarker:
         case CSSPropertyEnableBackground:
         case CSSPropertyColorProfile:
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
index 0ae9fbc496..8730e49a09 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
@@ -257,6 +257,11 @@ bool CSSParser::parseSVGValue(int propId, bool important)
                 m_valueList->next();
         }
         break;
+    case CSSPropertyWebkitShadow:
+        if (id == CSSValueNone)
+            valid_primitive = true;
+        else
+            return parseShadow(propId, important);
 
     /* shorthand properties */
     case CSSPropertyMarker:
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in b/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in
index e400ffe729..809eabec84 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in
@@ -46,3 +46,5 @@ glyph-orientation-vertical
 kerning
 text-anchor
 writing-mode
+
+-webkit-shadow
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
index b81b4f289a..7e4483f409 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
@@ -37,6 +37,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSValueList.h"
 #include "Document.h"
+#include "ShadowValue.h"
 #include "SVGColor.h"
 #include "SVGNames.h"
 #include "SVGPaint.h"
@@ -526,6 +527,35 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
             // Silently ignoring this property for now
             // http://bugs.webkit.org/show_bug.cgi?id=6022
             break;
+        case CSSPropertyWebkitShadow: {
+            if (isInherit)
+                return svgstyle->setShadow(m_parentStyle->svgStyle()->shadow() ? new ShadowData(*m_parentStyle->svgStyle()->shadow()) : 0);
+            if (isInitial || primitiveValue) // initial | none
+                return svgstyle->setShadow(0);
+
+            if (!value->isValueList())
+                return;
+
+            float zoomFactor = m_style->effectiveZoom();
+
+            CSSValueList *list = static_cast<CSSValueList*>(value);
+            ASSERT(list->length() == 1);
+            ShadowValue* item = static_cast<ShadowValue*>(list->itemWithoutBoundsCheck(0));
+            int x = item->x->computeLengthInt(style(), m_rootElementStyle, zoomFactor);
+            int y = item->y->computeLengthInt(style(), m_rootElementStyle, zoomFactor);
+            int blur = item->blur ? item->blur->computeLengthInt(style(), m_rootElementStyle, zoomFactor) : 0;
+            Color color;
+            if (item->color)
+                color = getColorFromPrimitiveValue(item->color.get());
+
+            // -webkit-shadow does should not have a spread or style
+            ASSERT(!item->spread);
+            ASSERT(!item->style);
+                
+            ShadowData* shadowData = new ShadowData(x, y, blur, 0, Normal, color.isValid() ? color : Color::transparent);
+            svgstyle->setShadow(shadowData);
+            return;
+        }
         default:
             // If you crash here, it's because you added a css property and are not handling it
             // in either this switch statement or the one in CSSStyleSelector::applyProperty
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index 475a8c1b92..4eb44f71ed 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -58,6 +58,7 @@
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "FrameView.h"
+#include "HTMLAllCollection.h"
 #include "HTMLAnchorElement.h"
 #include "HTMLBodyElement.h"
 #include "HTMLCanvasElement.h"
@@ -511,6 +512,16 @@ Document::~Document()
         m_styleSheets->documentDestroyed();
 }
 
+Document::JSWrapperCache* Document::createWrapperCache(DOMWrapperWorld* world)
+{
+    JSWrapperCache* wrapperCache = new JSWrapperCache();
+    m_wrapperCacheMap.set(world, wrapperCache);
+#if USE(JSC)
+    world->rememberDocument(this);
+#endif
+    return wrapperCache;
+}
+
 void Document::resetLinkColor()
 {
     m_linkColor = Color(0, 0, 238);
@@ -943,7 +954,7 @@ Element* Document::elementFromPoint(int x, int y) const
         return 0;
 
     float zoomFactor = frame->pageZoomFactor();
-    IntPoint point = roundedIntPoint(FloatPoint((x + view()->scrollX()) * zoomFactor, (y + view()->scrollY()) * zoomFactor));
+    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor  + view()->scrollX(), y * zoomFactor + view()->scrollY()));
 
     if (!frameView->visibleContentRect().contains(point))
         return 0;
@@ -973,7 +984,7 @@ PassRefPtr<Range> Document::caretRangeFromPoint(int x, int y)
         return 0;
 
     float zoomFactor = frame->pageZoomFactor();
-    IntPoint point = roundedIntPoint(FloatPoint((x + view()->scrollX()) * zoomFactor, (y + view()->scrollY()) * zoomFactor));
+    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor + view()->scrollX(), y * zoomFactor + view()->scrollY()));
 
     if (!frameView->visibleContentRect().contains(point))
         return 0;
@@ -3988,9 +3999,9 @@ PassRefPtr<HTMLCollection> Document::anchors()
     return HTMLCollection::create(this, DocAnchors);
 }
 
-PassRefPtr<HTMLCollection> Document::all()
+PassRefPtr<HTMLAllCollection> Document::all()
 {
-    return HTMLCollection::create(this, DocAll);
+    return HTMLAllCollection::create(this);
 }
 
 PassRefPtr<HTMLCollection> Document::windowNamedItems(const String &name)
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.h b/src/3rdparty/webkit/WebCore/dom/Document.h
index 09bba5879f..0632be1033 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.h
+++ b/src/3rdparty/webkit/WebCore/dom/Document.h
@@ -71,6 +71,7 @@ namespace WebCore {
     class HitTestRequest;
     class HTMLCanvasElement;
     class HTMLCollection;
+    class HTMLAllCollection;
     class HTMLDocument;
     class HTMLElement;
     class HTMLFormElement;
@@ -79,6 +80,7 @@ namespace WebCore {
     class HTMLMapElement;
     class InspectorTimelineAgent;
     class IntPoint;
+    class DOMWrapperWorld;
     class JSNode;
     class MouseEventWithHitTestResults;
     class NodeFilter;
@@ -315,12 +317,13 @@ public:
     PassRefPtr<HTMLCollection> links();
     PassRefPtr<HTMLCollection> forms();
     PassRefPtr<HTMLCollection> anchors();
-    PassRefPtr<HTMLCollection> all();
     PassRefPtr<HTMLCollection> objects();
     PassRefPtr<HTMLCollection> scripts();
     PassRefPtr<HTMLCollection> windowNamedItems(const String& name);
     PassRefPtr<HTMLCollection> documentNamedItems(const String& name);
 
+    PassRefPtr<HTMLAllCollection> all();
+
     // Find first anchor with the given name.
     // First searches for an element with the given ID, but if that fails, then looks
     // for an anchor with the given name. ID matching is always case sensitive, but
@@ -819,7 +822,15 @@ public:
     virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
 
     typedef HashMap<WebCore::Node*, JSNode*> JSWrapperCache;
-    JSWrapperCache& wrapperCache() { return m_wrapperCache; }
+    typedef HashMap<DOMWrapperWorld*, JSWrapperCache*> JSWrapperCacheMap;
+    JSWrapperCacheMap& wrapperCacheMap() { return m_wrapperCacheMap; }
+    JSWrapperCache* getWrapperCache(DOMWrapperWorld* world)
+    {
+        if (JSWrapperCache* wrapperCache = m_wrapperCacheMap.get(world))
+            return wrapperCache;
+        return createWrapperCache(world);
+    }
+    JSWrapperCache* createWrapperCache(DOMWrapperWorld*);
 
     virtual void finishedParsing();
 
@@ -1137,7 +1148,7 @@ private:
 
     unsigned m_numNodeListCaches;
 
-    JSWrapperCache m_wrapperCache;
+    JSWrapperCacheMap m_wrapperCacheMap;
 
 #if ENABLE(DATABASE)
     RefPtr<DatabaseThread> m_databaseThread;
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.cpp b/src/3rdparty/webkit/WebCore/dom/Element.cpp
index 621c63abfd..9edde25acf 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Element.cpp
@@ -1414,7 +1414,7 @@ KURL Element::getURLAttribute(const QualifiedName& name) const
             ASSERT(isURLAttribute(attribute));
     }
 #endif
-    return document()->completeURL(getAttribute(name));
+    return document()->completeURL(deprecatedParseURL(getAttribute(name)));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
index ceb5221a3e..694e78a618 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
@@ -192,9 +192,16 @@ bool EventTarget::removeEventListener(const AtomicString& eventType, EventListen
 
     // Notify firing events planning to invoke the listener at 'index' that
     // they have one less listener to invoke.
-    for (size_t i = 0; i < d->firingEventEndIterators.size(); ++i) {
-        if (eventType == *d->firingEventEndIterators[i].eventType && index < *d->firingEventEndIterators[i].value)
-            --*d->firingEventEndIterators[i].value;
+    for (size_t i = 0; i < d->firingEventIterators.size(); ++i) {
+        if (eventType != d->firingEventIterators[i].eventType)
+            continue;
+
+        if (index >= d->firingEventIterators[i].end)
+            continue;
+
+        --d->firingEventIterators[i].end;
+        if (index <= d->firingEventIterators[i].iterator)
+            --d->firingEventIterators[i].iterator;
     }
 
     return true;
@@ -232,6 +239,10 @@ bool EventTarget::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
         ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
         return false;
     }
+
+    if (!scriptExecutionContext())
+        return false;
+
     return dispatchEvent(event);
 }
 
@@ -259,9 +270,15 @@ bool EventTarget::fireEventListeners(Event* event)
 
     RefPtr<EventTarget> protect = this;
 
+    // Fire all listeners registered for this event. Don't fire listeners removed
+    // during event dispatch. Also, don't fire event listeners added during event
+    // dispatch. Conveniently, all new event listeners will be added after 'end',
+    // so iterating to 'end' naturally excludes new event listeners.
+
+    size_t i = 0;
     size_t end = entry.size();
-    d->firingEventEndIterators.append(FiringEventEndIterator(&event->type(), &end));
-    for (size_t i = 0; i < end; ++i) {
+    d->firingEventIterators.append(FiringEventIterator(event->type(), i, end));
+    for ( ; i < end; ++i) {
         RegisteredEventListener& registeredListener = entry[i];
         if (event->eventPhase() == Event::CAPTURING_PHASE && !registeredListener.useCapture)
             continue;
@@ -271,7 +288,7 @@ bool EventTarget::fireEventListeners(Event* event)
         // event listeners, even though that violates some versions of the DOM spec.
         registeredListener.listener->handleEvent(scriptExecutionContext(), event);
     }
-    d->firingEventEndIterators.removeLast();
+    d->firingEventIterators.removeLast();
 
     return !event->defaultPrevented();
 }
@@ -298,8 +315,10 @@ void EventTarget::removeAllEventListeners()
 
     // Notify firing events planning to invoke the listener at 'index' that
     // they have one less listener to invoke.
-    for (size_t i = 0; i < d->firingEventEndIterators.size(); ++i)
-        *d->firingEventEndIterators[i].value = 0;
+    for (size_t i = 0; i < d->firingEventIterators.size(); ++i) {
+        d->firingEventIterators[i].iterator = 0;
+        d->firingEventIterators[i].end = 0;
+    }
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.h b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
index 2d612e164d..9a1975c490 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
@@ -61,24 +61,26 @@ namespace WebCore {
 
     typedef int ExceptionCode;
 
-    struct FiringEventEndIterator {
-        FiringEventEndIterator(const AtomicString* eventType, size_t* value)
+    struct FiringEventIterator {
+        FiringEventIterator(const AtomicString& eventType, size_t& iterator, size_t& end)
             : eventType(eventType)
-            , value(value)
+            , iterator(iterator)
+            , end(end)
         {
         }
-        
-        const AtomicString* eventType;
-        size_t* value;
+
+        const AtomicString& eventType;
+        size_t& iterator;
+        size_t& end;
     };
-    typedef Vector<FiringEventEndIterator, 1> FiringEventEndIteratorVector;
+    typedef Vector<FiringEventIterator, 1> FiringEventIteratorVector;
 
     typedef Vector<RegisteredEventListener, 1> EventListenerVector;
     typedef HashMap<AtomicString, EventListenerVector> EventListenerMap;
 
     struct EventTargetData {
         EventListenerMap eventListenerMap;
-        FiringEventEndIteratorVector firingEventEndIterators;
+        FiringEventIteratorVector firingEventIterators;
     };
 
     class EventTarget {
@@ -209,7 +211,7 @@ namespace WebCore {
         EventTargetData* d = eventTargetData();
         if (!d)
             return false;
-        return d->firingEventEndIterators.size() != 0;
+        return d->firingEventIterators.size() != 0;
     }
 
     inline bool EventTarget::hasEventListeners()
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp
index 45d4e23342..f7046e3a4d 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp
@@ -36,6 +36,10 @@
 #include <wtf/MainThread.h>
 #include <wtf/PassRefPtr.h>
 
+#if USE(JSC)
+#include "JSDOMWindow.h"
+#endif
+
 namespace WebCore {
 
 class ProcessMessagesSoonTask : public ScriptExecutionContext::Task {
@@ -195,4 +199,20 @@ ScriptExecutionContext::Task::~Task()
 {
 }
 
+#if USE(JSC)
+JSC::JSGlobalData* ScriptExecutionContext::globalData()
+{
+     if (isDocument())
+        return JSDOMWindow::commonJSGlobalData();
+
+#if ENABLE(WORKERS)
+    if (isWorkerContext())
+        return static_cast<WorkerContext*>(this)->script()->globalData();
+#endif
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
index bb78b6fe4e..398afecb51 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
@@ -104,6 +104,10 @@ namespace WebCore {
         void removeTimeout(int timeoutId);
         DOMTimer* findTimeout(int timeoutId);
 
+#if USE(JSC)
+        JSC::JSGlobalData* globalData();
+#endif
+
     protected:
         // Explicitly override the security origin for this script context.
         // Note: It is dangerous to change the security origin of a script context
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
index 49713ba428..3d2a549cca 100644
--- a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
@@ -479,12 +479,14 @@ bool SelectElement::appendFormData(SelectElementData& data, Element* element, Fo
     // We return the first one if it was a combobox select
     if (!successful && !data.multiple() && data.size() <= 1 && items.size()) {
         OptionElement* optionElement = toOptionElement(items[0]);
-        const AtomicString& value = optionElement->value();
-        if (value.isNull())
-            list.appendData(name, optionElement->text().stripWhiteSpace());
-        else
-            list.appendData(name, value);
-        successful = true;
+        if (optionElement) {
+            const AtomicString& value = optionElement->value();
+            if (value.isNull())
+                list.appendData(name, optionElement->text().stripWhiteSpace());
+            else
+                list.appendData(name, value);
+            successful = true;
+        }
     }
 
     return successful;
@@ -874,13 +876,19 @@ void SelectElement::typeAheadFind(SelectElementData& data, Element* element, Key
     int index = (optionToListIndex(data, element, selected >= 0 ? selected : 0) + searchStartOffset) % itemCount;
     ASSERT(index >= 0);
 
+    // Compute a case-folded copy of the prefix string before beginning the search for
+    // a matching element. This code uses foldCase to work around the fact that
+    // String::startWith does not fold non-ASCII characters. This code can be changed
+    // to use startWith once that is fixed.
+    String prefixWithCaseFolded(prefix.foldCase());
     for (int i = 0; i < itemCount; ++i, index = (index + 1) % itemCount) {
         OptionElement* optionElement = toOptionElement(items[index]);
         if (!optionElement || items[index]->disabled())
             continue;
 
+        // Fold the option string and check if its prefix is equal to the folded prefix.
         String text = optionElement->textIndentedToRespectGroupLabel();
-        if (stripLeadingWhiteSpace(text).startsWith(prefix, false)) {
+        if (stripLeadingWhiteSpace(text).foldCase().startsWith(prefixWithCaseFolded)) {
             setSelectedIndex(data, element, listToOptionIndex(data, element, index));
             if (!data.usesMenuList())
                 listBoxOnChange(data, element);
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
index 543927dc30..30d39e0170 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
@@ -79,15 +79,41 @@ bool XMLTokenizer::isWMLDocument() const
 }
 #endif
 
-void XMLTokenizer::setCurrentNode(Node* n)
+void XMLTokenizer::pushCurrentNode(Node* n)
 {
-    bool nodeNeedsReference = n && n != m_doc;
-    if (nodeNeedsReference)
-        n->ref(); 
-    if (m_currentNodeIsReferenced) 
-        m_currentNode->deref(); 
+    ASSERT(n);
+    ASSERT(m_currentNode);
+    if (n != m_doc)
+        n->ref();
+    m_currentNodeStack.append(m_currentNode);
     m_currentNode = n;
-    m_currentNodeIsReferenced = nodeNeedsReference;
+}
+
+void XMLTokenizer::popCurrentNode()
+{
+    ASSERT(m_currentNode);
+    ASSERT(m_currentNodeStack.size());
+
+    if (m_currentNode != m_doc)
+        m_currentNode->deref();
+
+    m_currentNode = m_currentNodeStack.last();
+    m_currentNodeStack.removeLast();
+}
+
+void XMLTokenizer::clearCurrentNodeStack()
+{
+    if (m_currentNode && m_currentNode != m_doc)
+        m_currentNode->deref();
+    m_currentNode = 0;
+
+    if (m_currentNodeStack.size()) { // Aborted parsing.
+        for (size_t i = m_currentNodeStack.size() - 1; i != 0; --i)
+            m_currentNodeStack[i]->deref();
+        if (m_currentNodeStack[0] && m_currentNodeStack[0] != m_doc)
+            m_currentNodeStack[0]->deref();
+        m_currentNodeStack.clear();
+    }
 }
 
 void XMLTokenizer::write(const SegmentedString& s, bool /*appendData*/)
@@ -143,7 +169,7 @@ bool XMLTokenizer::enterText()
     RefPtr<Node> newNode = Text::create(m_doc, "");
     if (!m_currentNode->addChild(newNode.get()))
         return false;
-    setCurrentNode(newNode.get());
+    pushCurrentNode(newNode.get());
     return true;
 }
 
@@ -173,10 +199,7 @@ void XMLTokenizer::exitText()
     if (m_view && m_currentNode && !m_currentNode->attached())
         m_currentNode->attach();
 
-    // FIXME: What's the right thing to do if the parent is really 0?
-    // Just leaving the current node set to the text node doesn't make much sense.
-    if (Node* par = m_currentNode->parentNode())
-        setCurrentNode(par);
+    popCurrentNode();
 }
 
 void XMLTokenizer::end()
@@ -190,7 +213,7 @@ void XMLTokenizer::end()
         m_doc->updateStyleSelector();
     }
     
-    setCurrentNode(0);
+    clearCurrentNodeStack();
     if (!m_parsingFragment)
         m_doc->finishedParsing();    
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
index 019a831f17..e1ee09f047 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
@@ -124,7 +124,10 @@ public:
         friend bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent);
 
         void initializeParserContext(const char* chunk = 0);
-        void setCurrentNode(Node*);
+
+        void pushCurrentNode(Node*);
+        void popCurrentNode();
+        void clearCurrentNodeStack();
 
         void insertErrorMessageBlock();
 
@@ -148,7 +151,7 @@ public:
         Vector<xmlChar> m_bufferedText;
 #endif
         Node* m_currentNode;
-        bool m_currentNodeIsReferenced;
+        Vector<Node*> m_currentNodeStack;
 
         bool m_sawError;
         bool m_sawXSLTransform;
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
index 6cc0a0c76e..9aa0961a5e 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -530,7 +530,6 @@ XMLTokenizer::XMLTokenizer(Document* _doc, FrameView* _view)
     , m_context(0)
     , m_pendingCallbacks(new PendingCallbacks)
     , m_currentNode(_doc)
-    , m_currentNodeIsReferenced(false)
     , m_sawError(false)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
@@ -557,7 +556,6 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_context(0)
     , m_pendingCallbacks(new PendingCallbacks)
     , m_currentNode(fragment)
-    , m_currentNodeIsReferenced(fragment)
     , m_sawError(false)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
@@ -576,8 +574,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_scriptStartLine(0)
     , m_parsingFragment(true)
 {
-    if (fragment)
-        fragment->ref();
+    fragment->ref();
     if (m_doc)
         m_doc->ref();
           
@@ -614,7 +611,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
 
 XMLTokenizer::~XMLTokenizer()
 {
-    setCurrentNode(0);
+    clearCurrentNodeStack();
     if (m_parsingFragment && m_doc)
         m_doc->deref();
     if (m_pendingScript)
@@ -801,7 +798,7 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
         return;
     }
 
-    setCurrentNode(newElement.get());
+    pushCurrentNode(newElement.get());
     if (m_view && !newElement->attached())
         newElement->attach();
 
@@ -822,22 +819,29 @@ void XMLTokenizer::endElementNs()
     exitText();
 
     Node* n = m_currentNode;
-    RefPtr<Node> parent = n->parentNode();
     n->finishParsingChildren();
 
     if (!n->isElementNode() || !m_view) {
-        setCurrentNode(parent.get());
+        popCurrentNode();
         return;
     }
 
     Element* element = static_cast<Element*>(n);
+
+    // The element's parent may have already been removed from document.
+    // Parsing continues in this case, but scripts aren't executed.
+    if (!element->inDocument()) {
+        popCurrentNode();
+        return;
+    }
+
     ScriptElement* scriptElement = toScriptElement(element);
     if (!scriptElement) {
-        setCurrentNode(parent.get());
+        popCurrentNode();
         return;
     }
 
-    // don't load external scripts for standalone documents (for now)
+    // Don't load external scripts for standalone documents (for now).
     ASSERT(!m_pendingScript);
     m_requestingScript = true;
 
@@ -865,7 +869,7 @@ void XMLTokenizer::endElementNs()
             m_view->frame()->script()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
     }
     m_requestingScript = false;
-    setCurrentNode(parent.get());
+    popCurrentNode();
 }
 
 void XMLTokenizer::characters(const xmlChar* s, int len)
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
index 65cbc212bb..c6e73ba59c 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
@@ -85,7 +85,6 @@ XMLTokenizer::XMLTokenizer(Document* _doc, FrameView* _view)
     , m_view(_view)
     , m_wroteText(false)
     , m_currentNode(_doc)
-    , m_currentNodeIsReferenced(false)
     , m_sawError(false)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
@@ -114,7 +113,6 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_view(0)
     , m_wroteText(false)
     , m_currentNode(fragment)
-    , m_currentNodeIsReferenced(fragment)
     , m_sawError(false)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
@@ -133,8 +131,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_scriptStartLine(0)
     , m_parsingFragment(true)
 {
-    if (fragment)
-        fragment->ref();
+    fragment->ref();
     if (m_doc)
         m_doc->ref();
           
@@ -188,7 +185,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
 
 XMLTokenizer::~XMLTokenizer()
 {
-    setCurrentNode(0);
+    clearCurrentNodeStack();
     if (m_parsingFragment && m_doc)
         m_doc->deref();
     if (m_pendingScript)
@@ -569,7 +566,7 @@ void XMLTokenizer::parseStartElement()
         return;
     }
 
-    setCurrentNode(newElement.get());
+    pushCurrentNode(newElement.get());
     if (m_view && !newElement->attached())
         newElement->attach();
 
@@ -582,18 +579,26 @@ void XMLTokenizer::parseEndElement()
     exitText();
 
     Node* n = m_currentNode;
-    RefPtr<Node> parent = n->parentNode();
     n->finishParsingChildren();
 
     if (!n->isElementNode() || !m_view) {
-        setCurrentNode(parent.get());
+        if (!m_currentNodeStack.isEmpty())
+            popCurrentNode();
         return;
     }
 
     Element* element = static_cast<Element*>(n);
+
+    // The element's parent may have already been removed from document.
+    // Parsing continues in this case, but scripts aren't executed.
+    if (!element->inDocument()) {
+        popCurrentNode();
+        return;
+    }
+
     ScriptElement* scriptElement = toScriptElement(element);
     if (!scriptElement) {
-        setCurrentNode(parent.get());
+        popCurrentNode();
         return;
     }
 
@@ -625,7 +630,7 @@ void XMLTokenizer::parseEndElement()
             m_view->frame()->script()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
     }
     m_requestingScript = false;
-    setCurrentNode(parent.get());
+    popCurrentNode();
 }
 
 void XMLTokenizer::parseCharacters()
diff --git a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
index 89d862ffe6..7a8f02504c 100644
--- a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
@@ -334,6 +334,38 @@ static void diffTextDecorations(CSSMutableStyleDeclaration* style, int propertID
     setTextDecorationProperty(style, newTextDecoration.get(), propertID);
 }
 
+static bool fontWeightIsBold(CSSStyleDeclaration* style)
+{
+    ASSERT(style);
+    RefPtr<CSSValue> fontWeight = style->getPropertyCSSValue(CSSPropertyFontWeight);
+
+    if (!fontWeight)
+        return false;
+    if (!fontWeight->isPrimitiveValue())
+        return false;
+
+    // Because b tag can only bold text, there are only two states in plain html: bold and not bold.
+    // Collapse all other values to either one of these two states for editing purposes.
+    switch (static_cast<CSSPrimitiveValue*>(fontWeight.get())->getIdent()) {
+        case CSSValue100:
+        case CSSValue200:
+        case CSSValue300:
+        case CSSValue400:
+        case CSSValue500:
+        case CSSValueNormal:
+            return false;
+        case CSSValueBold:
+        case CSSValue600:
+        case CSSValue700:
+        case CSSValue800:
+        case CSSValue900:
+            return true;
+    }
+
+    ASSERT_NOT_REACHED(); // For CSSValueBolder and CSSValueLighter
+    return false; // Make compiler happy
+}
+
 RefPtr<CSSMutableStyleDeclaration> getPropertiesNotInComputedStyle(CSSStyleDeclaration* style, CSSComputedStyleDeclaration* computedStyle)
 {
     ASSERT(style);
@@ -345,6 +377,9 @@ RefPtr<CSSMutableStyleDeclaration> getPropertiesNotInComputedStyle(CSSStyleDecla
     diffTextDecorations(result.get(), CSSPropertyTextDecoration, computedTextDecorationsInEffect.get());
     diffTextDecorations(result.get(), CSSPropertyWebkitTextDecorationsInEffect, computedTextDecorationsInEffect.get());
 
+    if (fontWeightIsBold(result.get()) == fontWeightIsBold(computedStyle))
+        result->removeProperty(CSSPropertyFontWeight);
+
     return result;
 }
 
@@ -352,7 +387,6 @@ RefPtr<CSSMutableStyleDeclaration> getPropertiesNotInComputedStyle(CSSStyleDecla
 // e.g. when a user inserts a new paragraph, all properties listed here must be copied to the new paragraph.
 // FIXME: The current editingStyleProperties contains all inheritableProperties but we may not need to preserve all inheritable properties
 static const int editingStyleProperties[] = {
-    CSSPropertyBackgroundColor,
     // CSS inheritable properties
     CSSPropertyBorderCollapse,
     CSSPropertyColor,
diff --git a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
index 0496a8fee5..1617be8eca 100644
--- a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -71,7 +71,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-CompositeEditCommand::CompositeEditCommand(Document *document) 
+CompositeEditCommand::CompositeEditCommand(Document *document)
     : EditCommand(document)
 {
 }
@@ -396,7 +396,7 @@ void CompositeEditCommand::rebalanceWhitespaceAt(const Position& position)
     Node* node = position.node();
     if (!node || !node->isTextNode())
         return;
-    Text* textNode = static_cast<Text*>(node);    
+    Text* textNode = static_cast<Text*>(node);
     
     if (textNode->length() == 0)
         return;
@@ -739,6 +739,129 @@ void CompositeEditCommand::pushPartiallySelectedAnchorElementsDown()
     setEndingSelection(originalSelection);
 }
 
+// Clone the paragraph between start and end under blockElement,
+// preserving the hierarchy up to outerNode. 
+
+void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Position& end, Node* outerNode, Element* blockElement)
+{
+    // First we clone the outerNode
+    
+    RefPtr<Node> lastNode = outerNode->cloneNode(isTableElement(outerNode));
+    appendNode(lastNode, blockElement);
+
+    if (start.node() != outerNode) {
+        Vector<RefPtr<Node> > ancestors;
+        
+        // Insert each node from innerNode to outerNode (excluded) in a list.
+        for (Node* n = start.node(); n && n != outerNode; n = n->parentNode())
+            ancestors.append(n);
+
+        // Clone every node between start.node() and outerBlock.
+
+        for (size_t i = ancestors.size(); i != 0; --i) {
+            Node* item = ancestors[i - 1].get();
+            RefPtr<Node> child = item->cloneNode(isTableElement(item));
+            appendNode(child, static_cast<Element *>(lastNode.get()));
+            lastNode = child.release();
+        }
+    }
+
+    // Handle the case of paragraphs with more than one node,
+    // cloning all the siblings until end.node() is reached.
+    
+    if (start.node() != end.node()) {
+        for (Node* n = start.node()->nextSibling(); n != NULL; n = n->nextSibling()) {
+            RefPtr<Node> clonedNode = n->cloneNode(true);
+            insertNodeAfter(clonedNode, lastNode);
+            lastNode = clonedNode.release();
+            if (n == end.node())
+                break;
+        }
+    }
+}
+
+    
+// There are bugs in deletion when it removes a fully selected table/list.
+// It expands and removes the entire table/list, but will let content
+// before and after the table/list collapse onto one line.   
+// Deleting a paragraph will leave a placeholder. Remove it (and prune
+// empty or unrendered parents).
+
+void CompositeEditCommand::cleanupAfterDeletion()
+{
+    VisiblePosition caretAfterDelete = endingSelection().visibleStart();
+    if (isStartOfParagraph(caretAfterDelete) && isEndOfParagraph(caretAfterDelete)) {
+        // Note: We want the rightmost candidate.
+        Position position = caretAfterDelete.deepEquivalent().downstream();
+        Node* node = position.node();
+        // Normally deletion will leave a br as a placeholder.
+        if (node->hasTagName(brTag))
+            removeNodeAndPruneAncestors(node);
+        // If the selection to move was empty and in an empty block that 
+        // doesn't require a placeholder to prop itself open (like a bordered
+        // div or an li), remove it during the move (the list removal code
+        // expects this behavior).
+        else if (isBlock(node))
+            removeNodeAndPruneAncestors(node);
+        else if (lineBreakExistsAtPosition(position)) {
+            // There is a preserved '\n' at caretAfterDelete.
+            // We can safely assume this is a text node.
+            Text* textNode = static_cast<Text*>(node);
+            if (textNode->length() == 1)
+                removeNodeAndPruneAncestors(node);
+            else
+                deleteTextFromNode(textNode, position.deprecatedEditingOffset(), 1);
+        }
+    }
+}
+    
+// This is a version of moveParagraph that preserves style by keeping the original markup
+// It is currently used only by IndentOutdentCommand but it is meant to be used in the
+// future by several other commands such as InsertList and the align commands.
+// The blockElement parameter is the element to move the paragraph to,
+// outerNode is the top element of the paragraph hierarchy. 
+
+void CompositeEditCommand::moveParagraphWithClones(const VisiblePosition& startOfParagraphToMove, const VisiblePosition& endOfParagraphToMove, Element* blockElement, Node* outerNode)
+{
+    ASSERT(outerNode);
+    ASSERT(blockElement);
+
+    VisiblePosition beforeParagraph = startOfParagraphToMove.previous();
+    VisiblePosition afterParagraph(endOfParagraphToMove.next());
+    
+    // We upstream() the end and downstream() the start so that we don't include collapsed whitespace in the move.
+    // When we paste a fragment, spaces after the end and before the start are treated as though they were rendered.
+    Position start = startOfParagraphToMove.deepEquivalent().downstream();
+    Position end = endOfParagraphToMove.deepEquivalent().upstream();
+
+    cloneParagraphUnderNewElement(start, end, outerNode, blockElement);
+      
+    setEndingSelection(VisibleSelection(start, end, DOWNSTREAM));
+    deleteSelection(false, false, false, false);
+    
+    // There are bugs in deletion when it removes a fully selected table/list.
+    // It expands and removes the entire table/list, but will let content
+    // before and after the table/list collapse onto one line.
+       
+    cleanupAfterDeletion();
+    
+    // Add a br if pruning an empty block level element caused a collapse.  For example:
+    // foo^
+    // <div>bar</div>
+    // baz
+    // Imagine moving 'bar' to ^.  'bar' will be deleted and its div pruned.  That would
+    // cause 'baz' to collapse onto the line with 'foobar' unless we insert a br.
+    // Must recononicalize these two VisiblePositions after the pruning above.
+    beforeParagraph = VisiblePosition(beforeParagraph.deepEquivalent());
+    afterParagraph = VisiblePosition(afterParagraph.deepEquivalent());
+
+    if (beforeParagraph.isNotNull() && !isTableElement(beforeParagraph.deepEquivalent().node()) && (!isEndOfParagraph(beforeParagraph) || beforeParagraph == afterParagraph)) {
+        // FIXME: Trim text between beforeParagraph and afterParagraph if they aren't equal.
+        insertNodeAt(createBreakElement(document()), beforeParagraph.deepEquivalent());
+    }
+}
+    
+    
 // This moves a paragraph preserving its style.
 void CompositeEditCommand::moveParagraph(const VisiblePosition& startOfParagraphToMove, const VisiblePosition& endOfParagraphToMove, const VisiblePosition& destination, bool preserveSelection, bool preserveStyle)
 {
@@ -784,7 +907,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     VisiblePosition afterParagraph(endOfParagraphToMove.next());
 
     // We upstream() the end and downstream() the start so that we don't include collapsed whitespace in the move.
-    // When we paste a fragment, spaces after the end and before the start are treated as though they were rendered.    
+    // When we paste a fragment, spaces after the end and before the start are treated as though they were rendered.
     Position start = startOfParagraphToMove.deepEquivalent().downstream();
     Position end = endOfParagraphToMove.deepEquivalent().upstream();
     
@@ -793,7 +916,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     Position endRangeCompliant = rangeCompliantEquivalent(end);
     RefPtr<Range> range = Range::create(document(), startRangeCompliant.node(), startRangeCompliant.deprecatedEditingOffset(), endRangeCompliant.node(), endRangeCompliant.deprecatedEditingOffset());
 
-    // FIXME: This is an inefficient way to preserve style on nodes in the paragraph to move.  It 
+    // FIXME: This is an inefficient way to preserve style on nodes in the paragraph to move. It
     // shouldn't matter though, since moved paragraphs will usually be quite small.
     RefPtr<DocumentFragment> fragment = startOfParagraphToMove != endOfParagraphToMove ? createFragmentFromMarkup(document(), createMarkup(range.get(), 0, DoNotAnnotateForInterchange, true), "") : 0;
     
@@ -813,42 +936,14 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     deleteSelection(false, false, false, false);
 
     ASSERT(destination.deepEquivalent().node()->inDocument());
-    
-    // There are bugs in deletion when it removes a fully selected table/list.  
-    // It expands and removes the entire table/list, but will let content
-    // before and after the table/list collapse onto one line.
-    
-    // Deleting a paragraph will leave a placeholder.  Remove it (and prune
-    // empty or unrendered parents).
-    VisiblePosition caretAfterDelete = endingSelection().visibleStart();
-    if (isStartOfParagraph(caretAfterDelete) && isEndOfParagraph(caretAfterDelete)) {
-        // Note: We want the rightmost candidate.
-        Position position = caretAfterDelete.deepEquivalent().downstream();
-        Node* node = position.node();
-        // Normally deletion will leave a br as a placeholder.
-        if (node->hasTagName(brTag))
-            removeNodeAndPruneAncestors(node);
-        // If the selection to move was empty and in an empty block that 
-        // doesn't require a placeholder to prop itself open (like a bordered 
-        // div or an li), remove it during the move (the list removal code 
-        // expects this behavior).
-        else if (isBlock(node))
-            removeNodeAndPruneAncestors(node);
-        else if (lineBreakExistsAtVisiblePosition(caretAfterDelete)) {
-            // There is a preserved '\n' at caretAfterDelete.
-            Text* textNode = static_cast<Text*>(node);
-            if (textNode->length() == 1)
-                removeNodeAndPruneAncestors(node);
-            else 
-                deleteTextFromNode(textNode, position.deprecatedEditingOffset(), 1);
-        }
-    }
 
-    // Add a br if pruning an empty block level element caused a collapse.  For example:
+    cleanupAfterDeletion();
+
+    // Add a br if pruning an empty block level element caused a collapse. For example:
     // foo^
     // <div>bar</div>
     // baz
-    // Imagine moving 'bar' to ^.  'bar' will be deleted and its div pruned.  That would
+    // Imagine moving 'bar' to ^. 'bar' will be deleted and its div pruned. That would
     // cause 'baz' to collapse onto the line with 'foobar' unless we insert a br.
     // Must recononicalize these two VisiblePositions after the pruning above.
     beforeParagraph = VisiblePosition(beforeParagraph.deepEquivalent());
@@ -912,7 +1007,7 @@ bool CompositeEditCommand::breakOutOfEmptyListItem()
                 removeNodePreservingChildren(listNode->parentNode());
                 newBlock = createListItemElement(document());
             }
-            // If listNode does NOT appear at the end of the outer list item, then behave as if in a regular paragraph. 
+            // If listNode does NOT appear at the end of the outer list item, then behave as if in a regular paragraph.
         } else if (blockEnclosingList->hasTagName(olTag) || blockEnclosingList->hasTagName(ulTag))
             newBlock = createListItemElement(document());
     }
@@ -971,7 +1066,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     // to hold the caret before the highest blockquote.
     insertNodeBefore(br, highestBlockquote);
     VisiblePosition atBR(Position(br.get(), 0));
-    // If the br we inserted collapsed, for example foo<br><blockquote>...</blockquote>, insert 
+    // If the br we inserted collapsed, for example foo<br><blockquote>...</blockquote>, insert
     // a second one.
     if (!isStartOfParagraph(atBR))
         insertNodeBefore(createBreakElement(document()), br);
@@ -1002,7 +1097,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     return true;
 }
 
-// Operations use this function to avoid inserting content into an anchor when at the start or the end of 
+// Operations use this function to avoid inserting content into an anchor when at the start or the end of
 // that anchor, as in NSTextView.
 // FIXME: This is only an approximation of NSTextViews insertion behavior, which varies depending on how
 // the caret was made. 
@@ -1022,7 +1117,7 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
     if (enclosingAnchor && !isBlock(enclosingAnchor)) {
         VisiblePosition firstInAnchor(firstDeepEditingPositionForNode(enclosingAnchor));
         VisiblePosition lastInAnchor(lastDeepEditingPositionForNode(enclosingAnchor));
-        // If visually just after the anchor, insert *inside* the anchor unless it's the last 
+        // If visually just after the anchor, insert *inside* the anchor unless it's the last
         // VisiblePosition in the document, to match NSTextView.
         if (visiblePos == lastInAnchor) {
             // Make sure anchors are pushed down before avoiding them so that we don't
diff --git a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h
index 2c6403e79a..0cceaaad2d 100644
--- a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h
@@ -102,6 +102,9 @@ protected:
     
     void moveParagraph(const VisiblePosition&, const VisiblePosition&, const VisiblePosition&, bool preserveSelection = false, bool preserveStyle = true);
     void moveParagraphs(const VisiblePosition&, const VisiblePosition&, const VisiblePosition&, bool preserveSelection = false, bool preserveStyle = true);
+    void moveParagraphWithClones(const VisiblePosition& startOfParagraphToMove, const VisiblePosition& endOfParagraphToMove, Element* blockElement, Node* outerNode);
+    void cloneParagraphUnderNewElement(Position& start, Position& end, Node* outerNode, Element* blockElement);
+    void cleanupAfterDeletion();
     
     bool breakOutOfEmptyListItem();
     bool breakOutOfEmptyMailBlockquotedParagraph();
diff --git a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
index abd0174ac5..3379b3c12f 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
@@ -1291,10 +1291,10 @@ static String valueForeColor(Frame* frame, Event*)
 
 // Map of functions
 
+struct CommandEntry { const char* name; EditorInternalCommand command; };
+
 static const CommandMap& createCommandMap()
 {
-    struct CommandEntry { const char* name; EditorInternalCommand command; };
-    
     static const CommandEntry commands[] = {
         { "AlignCenter", { executeJustifyCenter, supportedFromMenuOrKeyBinding, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "AlignJustified", { executeJustifyFull, supportedFromMenuOrKeyBinding, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
index 84fa147d2b..808a2f8ef3 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
@@ -67,37 +67,6 @@ IndentOutdentCommand::IndentOutdentCommand(Document* document, EIndentType typeO
 {
 }
 
-// This function is a workaround for moveParagraph's tendency to strip blockquotes. It updates lastBlockquote to point to the
-// correct level for the current paragraph, and returns a pointer to a placeholder br where the insertion should be performed.
-PassRefPtr<Element> IndentOutdentCommand::prepareBlockquoteLevelForInsertion(const VisiblePosition& currentParagraph, RefPtr<Element>& lastBlockquote)
-{
-    int currentBlockquoteLevel = 0;
-    int lastBlockquoteLevel = 0;
-    Node* node = currentParagraph.deepEquivalent().node();
-    while ((node = enclosingNodeWithTag(Position(node->parentNode(), 0), blockquoteTag)))
-        currentBlockquoteLevel++;
-    node = lastBlockquote.get();
-    while ((node = enclosingNodeWithTag(Position(node->parentNode(), 0), blockquoteTag)))
-        lastBlockquoteLevel++;
-    while (currentBlockquoteLevel > lastBlockquoteLevel) {
-        RefPtr<Element> newBlockquote = createIndentBlockquoteElement(document());
-        appendNode(newBlockquote, lastBlockquote);
-        lastBlockquote = newBlockquote;
-        lastBlockquoteLevel++;
-    }
-    while (currentBlockquoteLevel < lastBlockquoteLevel) {
-        lastBlockquote = static_cast<Element*>(enclosingNodeWithTag(Position(lastBlockquote->parentNode(), 0), blockquoteTag));
-        lastBlockquoteLevel--;
-    }
-    RefPtr<Element> placeholder = createBreakElement(document());
-    appendNode(placeholder, lastBlockquote);
-    // Add another br before the placeholder if it collapsed.
-    VisiblePosition visiblePos(Position(placeholder.get(), 0));
-    if (!isStartOfParagraph(visiblePos))
-        insertNodeBefore(createBreakElement(document()), placeholder);
-    return placeholder.release();
-}
-
 bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCurrentParagraph)
 {
     // If our selection is not inside a list, bail out.
@@ -117,13 +86,9 @@ bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCu
     Element* nextList = selectedListItem->nextElementSibling();
 
     RefPtr<Element> newList = document()->createElement(listNode->tagQName(), false);
-    RefPtr<Element> newListItem = selectedListItem->cloneElementWithoutChildren();
-    RefPtr<Element> placeholder = createBreakElement(document());
     insertNodeBefore(newList, selectedListItem);
-    appendNode(newListItem, newList);
-    appendNode(placeholder, newListItem);
 
-    moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(placeholder, 0)), true);
+    moveParagraphWithClones(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, newList.get(), selectedListItem);
 
     if (canMergeLists(previousList, newList.get()))
         mergeIdenticalElements(previousList, newList);
@@ -137,25 +102,31 @@ void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& endOfCurr
 {
     Node* enclosingCell = 0;
 
+    Position start = startOfParagraph(endOfCurrentParagraph).deepEquivalent();
+    enclosingCell = enclosingNodeOfType(start, &isTableCell);
+    Node* nodeToSplitTo;
+    if (enclosingCell)
+        nodeToSplitTo = enclosingCell;
+    else if (enclosingList(start.node()))
+        nodeToSplitTo = enclosingBlock(start.node());
+    else
+        nodeToSplitTo = editableRootForPosition(start);
+
+    RefPtr<Node> outerBlock = splitTreeToNode(start.node(), nodeToSplitTo);
+
     if (!targetBlockquote) {
         // Create a new blockquote and insert it as a child of the root editable element. We accomplish
         // this by splitting all parents of the current paragraph up to that point.
         targetBlockquote = createIndentBlockquoteElement(document());
-        Position start = startOfParagraph(endOfCurrentParagraph).deepEquivalent();
-        enclosingCell = enclosingNodeOfType(start, &isTableCell);
-        Node* nodeToSplitTo = enclosingCell ? enclosingCell : editableRootForPosition(start);
-        RefPtr<Node> startOfNewBlock = splitTreeToNode(start.node(), nodeToSplitTo);
-        insertNodeBefore(targetBlockquote, startOfNewBlock);
+        insertNodeBefore(targetBlockquote, outerBlock);
     }
 
-    RefPtr<Element> insertionPoint = prepareBlockquoteLevelForInsertion(endOfCurrentParagraph, targetBlockquote);
-
+    moveParagraphWithClones(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, targetBlockquote.get(), outerBlock.get());
+    
     // Don't put the next paragraph in the blockquote we just created for this paragraph unless 
     // the next paragraph is in the same cell.
     if (enclosingCell && enclosingCell != enclosingNodeOfType(endOfNextParagraph.deepEquivalent(), &isTableCell))
         targetBlockquote = 0;
-
-    moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(insertionPoint, 0)), true);
 }
 
 void IndentOutdentCommand::indentRegion()
@@ -191,8 +162,6 @@ void IndentOutdentCommand::indentRegion()
             blockquoteForNextIndent = 0;
         else
             indentIntoBlockquote(endOfCurrentParagraph, endOfNextParagraph, blockquoteForNextIndent);
-            // blockquoteForNextIndent maybe updated
-            // this is due to the way prepareBlockquoteLevelForInsertion was designed.
         // Sanity check: Make sure our moveParagraph calls didn't remove endOfNextParagraph.deepEquivalent().node()
         // If somehow we did, return to prevent crashes.
         if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
index 419f832f0d..817b4c80da 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
@@ -49,7 +49,6 @@ private:
     void indentRegion();
     void outdentRegion();
     void outdentParagraph();
-    PassRefPtr<Element> prepareBlockquoteLevelForInsertion(const VisiblePosition&, RefPtr<Element>&);
     bool tryIndentingAsListItem(const VisiblePosition&);
     void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>&);
 
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
index 21ca924629..0874201df2 100644
--- a/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
@@ -57,7 +57,9 @@ static void swapInNodePreservingAttributesAndChildren(Node* newNode, Node* nodeT
     parentNode->insertBefore(newNode, nodeToReplace, ec);
     ASSERT(!ec);
 
-    for (Node* child = nodeToReplace->firstChild(); child; child = child->nextSibling()) {
+    Node* nextChild;
+    for (Node* child = nodeToReplace->firstChild(); child; child = nextChild) {
+        nextChild = child->nextSibling();
         newNode->appendChild(child, ec);
         ASSERT(!ec);
     }
diff --git a/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp b/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
index 7d9991686f..00672f225c 100644
--- a/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
@@ -725,6 +725,8 @@ bool SelectionController::modify(EAlteration alter, int verticalDistance, bool u
     if (userTriggered)
         m_frame->setSelectionGranularity(CharacterGranularity);
 
+    m_lastChangeWasHorizontalExtension = alter == EXTEND;
+
     return true;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
index 8780c3684f..919eb24850 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
@@ -226,7 +226,7 @@ findProp (register const char *str, register unsigned int len)
 {
   enum
     {
-      TOTAL_KEYWORDS = 278,
+      TOTAL_KEYWORDS = 280,
       MIN_WORD_LENGTH = 3,
       MAX_WORD_LENGTH = 43,
       MIN_HASH_VALUE = 6,
@@ -241,67 +241,67 @@ findProp (register const char *str, register unsigned int len)
       {"zoom", CSSPropertyZoom},
 #line 23 "CSSPropertyNames.gperf"
       {"border", CSSPropertyBorder},
-#line 267 "CSSPropertyNames.gperf"
+#line 268 "CSSPropertyNames.gperf"
       {"marker", CSSPropertyMarker},
 #line 24 "CSSPropertyNames.gperf"
       {"border-bottom", CSSPropertyBorderBottom},
-#line 269 "CSSPropertyNames.gperf"
+#line 270 "CSSPropertyNames.gperf"
       {"marker-mid", CSSPropertyMarkerMid},
 #line 78 "CSSPropertyNames.gperf"
       {"margin", CSSPropertyMargin},
-#line 285 "CSSPropertyNames.gperf"
+#line 286 "CSSPropertyNames.gperf"
       {"kerning", CSSPropertyKerning},
-#line 268 "CSSPropertyNames.gperf"
+#line 269 "CSSPropertyNames.gperf"
       {"marker-end", CSSPropertyMarkerEnd},
 #line 79 "CSSPropertyNames.gperf"
       {"margin-bottom", CSSPropertyMarginBottom},
-#line 251 "CSSPropertyNames.gperf"
+#line 252 "CSSPropertyNames.gperf"
       {"mask", CSSPropertyMask},
-#line 272 "CSSPropertyNames.gperf"
+#line 273 "CSSPropertyNames.gperf"
       {"stroke", CSSPropertyStroke},
 #line 111 "CSSPropertyNames.gperf"
       {"size", CSSPropertySize},
 #line 144 "CSSPropertyNames.gperf"
       {"word-break", CSSPropertyWordBreak},
-#line 287 "CSSPropertyNames.gperf"
+#line 288 "CSSPropertyNames.gperf"
       {"writing-mode", CSSPropertyWritingMode},
-#line 162 "CSSPropertyNames.gperf"
+#line 163 "CSSPropertyNames.gperf"
       {"-webkit-binding", CSSPropertyWebkitBinding},
 #line 109 "CSSPropertyNames.gperf"
       {"resize", CSSPropertyResize},
-#line 266 "CSSPropertyNames.gperf"
+#line 267 "CSSPropertyNames.gperf"
       {"image-rendering", CSSPropertyImageRendering},
 #line 149 "CSSPropertyNames.gperf"
       {"-webkit-animation", CSSPropertyWebkitAnimation},
-#line 165 "CSSPropertyNames.gperf"
+#line 166 "CSSPropertyNames.gperf"
       {"-webkit-border-image", CSSPropertyWebkitBorderImage},
-#line 205 "CSSPropertyNames.gperf"
+#line 206 "CSSPropertyNames.gperf"
       {"-webkit-mask", CSSPropertyWebkitMask},
 #line 136 "CSSPropertyNames.gperf"
       {"top", CSSPropertyTop},
 #line 142 "CSSPropertyNames.gperf"
       {"widows", CSSPropertyWidows},
-#line 270 "CSSPropertyNames.gperf"
+#line 271 "CSSPropertyNames.gperf"
       {"marker-start", CSSPropertyMarkerStart},
 #line 154 "CSSPropertyNames.gperf"
       {"-webkit-animation-name", CSSPropertyWebkitAnimationName},
 #line 102 "CSSPropertyNames.gperf"
       {"page", CSSPropertyPage},
-#line 210 "CSSPropertyNames.gperf"
+#line 211 "CSSPropertyNames.gperf"
       {"-webkit-mask-image", CSSPropertyWebkitMaskImage},
 #line 43 "CSSPropertyNames.gperf"
       {"border-top", CSSPropertyBorderTop},
 #line 97 "CSSPropertyNames.gperf"
       {"padding", CSSPropertyPadding},
-#line 240 "CSSPropertyNames.gperf"
+#line 241 "CSSPropertyNames.gperf"
       {"-webkit-transition", CSSPropertyWebkitTransition},
-#line 211 "CSSPropertyNames.gperf"
+#line 212 "CSSPropertyNames.gperf"
       {"-webkit-mask-origin", CSSPropertyWebkitMaskOrigin},
 #line 98 "CSSPropertyNames.gperf"
       {"padding-bottom", CSSPropertyPaddingBottom},
 #line 82 "CSSPropertyNames.gperf"
       {"margin-top", CSSPropertyMarginTop},
-#line 197 "CSSPropertyNames.gperf"
+#line 198 "CSSPropertyNames.gperf"
       {"-webkit-margin-start", CSSPropertyWebkitMarginStart},
 #line 55 "CSSPropertyNames.gperf"
       {"content", CSSPropertyContent},
@@ -309,35 +309,35 @@ findProp (register const char *str, register unsigned int len)
       {"position", CSSPropertyPosition},
 #line 59 "CSSPropertyNames.gperf"
       {"direction", CSSPropertyDirection},
-#line 218 "CSSPropertyNames.gperf"
+#line 219 "CSSPropertyNames.gperf"
       {"-webkit-mask-size", CSSPropertyWebkitMaskSize},
 #line 112 "CSSPropertyNames.gperf"
       {"src", CSSPropertySrc},
 #line 146 "CSSPropertyNames.gperf"
       {"word-wrap", CSSPropertyWordWrap},
-#line 220 "CSSPropertyNames.gperf"
+#line 221 "CSSPropertyNames.gperf"
       {"-webkit-nbsp-mode", CSSPropertyWebkitNbspMode},
 #line 105 "CSSPropertyNames.gperf"
       {"page-break-inside", CSSPropertyPageBreakInside},
-#line 215 "CSSPropertyNames.gperf"
+#line 216 "CSSPropertyNames.gperf"
       {"-webkit-mask-repeat", CSSPropertyWebkitMaskRepeat},
 #line 101 "CSSPropertyNames.gperf"
       {"padding-top", CSSPropertyPaddingTop},
-#line 221 "CSSPropertyNames.gperf"
+#line 222 "CSSPropertyNames.gperf"
       {"-webkit-padding-start", CSSPropertyWebkitPaddingStart},
 #line 151 "CSSPropertyNames.gperf"
       {"-webkit-animation-direction", CSSPropertyWebkitAnimationDirection},
-#line 212 "CSSPropertyNames.gperf"
+#line 213 "CSSPropertyNames.gperf"
       {"-webkit-mask-position", CSSPropertyWebkitMaskPosition},
-#line 193 "CSSPropertyNames.gperf"
+#line 194 "CSSPropertyNames.gperf"
       {"-webkit-line-break", CSSPropertyWebkitLineBreak},
-#line 277 "CSSPropertyNames.gperf"
+#line 278 "CSSPropertyNames.gperf"
       {"stroke-miterlimit", CSSPropertyStrokeMiterlimit},
-#line 226 "CSSPropertyNames.gperf"
+#line 227 "CSSPropertyNames.gperf"
       {"-webkit-rtl-ordering", CSSPropertyWebkitRtlOrdering},
-#line 276 "CSSPropertyNames.gperf"
+#line 277 "CSSPropertyNames.gperf"
       {"stroke-linejoin", CSSPropertyStrokeLinejoin},
-#line 282 "CSSPropertyNames.gperf"
+#line 283 "CSSPropertyNames.gperf"
       {"dominant-baseline", CSSPropertyDominantBaseline},
 #line 51 "CSSPropertyNames.gperf"
       {"caption-side", CSSPropertyCaptionSide},
@@ -357,25 +357,25 @@ findProp (register const char *str, register unsigned int len)
       {"word-spacing", CSSPropertyWordSpacing},
 #line 31 "CSSPropertyNames.gperf"
       {"border-color", CSSPropertyBorderColor},
-#line 199 "CSSPropertyNames.gperf"
+#line 200 "CSSPropertyNames.gperf"
       {"-webkit-marquee", CSSPropertyWebkitMarquee},
 #line 25 "CSSPropertyNames.gperf"
       {"border-bottom-color", CSSPropertyBorderBottomColor},
 #line 152 "CSSPropertyNames.gperf"
       {"-webkit-animation-duration", CSSPropertyWebkitAnimationDuration},
-#line 245 "CSSPropertyNames.gperf"
+#line 246 "CSSPropertyNames.gperf"
       {"-webkit-user-drag", CSSPropertyWebkitUserDrag},
-#line 166 "CSSPropertyNames.gperf"
+#line 167 "CSSPropertyNames.gperf"
       {"-webkit-border-radius", CSSPropertyWebkitBorderRadius},
-#line 209 "CSSPropertyNames.gperf"
+#line 210 "CSSPropertyNames.gperf"
       {"-webkit-mask-composite", CSSPropertyWebkitMaskComposite},
-#line 262 "CSSPropertyNames.gperf"
+#line 263 "CSSPropertyNames.gperf"
       {"color-rendering", CSSPropertyColorRendering},
 #line 137 "CSSPropertyNames.gperf"
       {"unicode-bidi", CSSPropertyUnicodeBidi},
 #line 53 "CSSPropertyNames.gperf"
       {"clip", CSSPropertyClip},
-#line 242 "CSSPropertyNames.gperf"
+#line 243 "CSSPropertyNames.gperf"
       {"-webkit-transition-duration", CSSPropertyWebkitTransitionDuration},
 #line 157 "CSSPropertyNames.gperf"
       {"-webkit-appearance", CSSPropertyWebkitAppearance},
@@ -395,33 +395,35 @@ findProp (register const char *str, register unsigned int len)
       {"background-origin", CSSPropertyBackgroundOrigin},
 #line 57 "CSSPropertyNames.gperf"
       {"counter-reset", CSSPropertyCounterReset},
-#line 257 "CSSPropertyNames.gperf"
+#line 258 "CSSPropertyNames.gperf"
       {"stop-color", CSSPropertyStopColor},
-#line 280 "CSSPropertyNames.gperf"
+#line 281 "CSSPropertyNames.gperf"
       {"alignment-baseline", CSSPropertyAlignmentBaseline},
 #line 22 "CSSPropertyNames.gperf"
       {"background-size", CSSPropertyBackgroundSize},
-#line 202 "CSSPropertyNames.gperf"
+#line 203 "CSSPropertyNames.gperf"
       {"-webkit-marquee-repetition", CSSPropertyWebkitMarqueeRepetition},
-#line 275 "CSSPropertyNames.gperf"
+#line 276 "CSSPropertyNames.gperf"
       {"stroke-linecap", CSSPropertyStrokeLinecap},
 #line 161 "CSSPropertyNames.gperf"
       {"-webkit-background-origin", CSSPropertyWebkitBackgroundOrigin},
 #line 72 "CSSPropertyNames.gperf"
       {"letter-spacing", CSSPropertyLetterSpacing},
-#line 203 "CSSPropertyNames.gperf"
+#line 204 "CSSPropertyNames.gperf"
       {"-webkit-marquee-speed", CSSPropertyWebkitMarqueeSpeed},
-#line 208 "CSSPropertyNames.gperf"
+#line 209 "CSSPropertyNames.gperf"
       {"-webkit-mask-clip", CSSPropertyWebkitMaskClip},
 #line 153 "CSSPropertyNames.gperf"
       {"-webkit-animation-iteration-count", CSSPropertyWebkitAnimationIterationCount},
-#line 200 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-direction", CSSPropertyWebkitMarqueeDirection},
 #line 201 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-direction", CSSPropertyWebkitMarqueeDirection},
+#line 162 "CSSPropertyNames.gperf"
+      {"-webkit-background-size", CSSPropertyWebkitBackgroundSize},
+#line 202 "CSSPropertyNames.gperf"
       {"-webkit-marquee-increment", CSSPropertyWebkitMarqueeIncrement},
 #line 19 "CSSPropertyNames.gperf"
       {"background-repeat", CSSPropertyBackgroundRepeat},
-#line 222 "CSSPropertyNames.gperf"
+#line 223 "CSSPropertyNames.gperf"
       {"-webkit-perspective", CSSPropertyWebkitPerspective},
 #line 110 "CSSPropertyNames.gperf"
       {"right", CSSPropertyRight},
@@ -433,7 +435,7 @@ findProp (register const char *str, register unsigned int len)
       {"background-position", CSSPropertyBackgroundPosition},
 #line 86 "CSSPropertyNames.gperf"
       {"min-width", CSSPropertyMinWidth},
-#line 223 "CSSPropertyNames.gperf"
+#line 224 "CSSPropertyNames.gperf"
       {"-webkit-perspective-origin", CSSPropertyWebkitPerspectiveOrigin},
 #line 37 "CSSPropertyNames.gperf"
       {"border-right", CSSPropertyBorderRight},
@@ -445,18 +447,20 @@ findProp (register const char *str, register unsigned int len)
       {"margin-right", CSSPropertyMarginRight},
 #line 29 "CSSPropertyNames.gperf"
       {"border-bottom-width", CSSPropertyBorderBottomWidth},
-#line 252 "CSSPropertyNames.gperf"
+#line 253 "CSSPropertyNames.gperf"
       {"enable-background", CSSPropertyEnableBackground},
-#line 279 "CSSPropertyNames.gperf"
+#line 280 "CSSPropertyNames.gperf"
       {"stroke-width", CSSPropertyStrokeWidth},
-#line 189 "CSSPropertyNames.gperf"
+#line 190 "CSSPropertyNames.gperf"
       {"-webkit-columns", CSSPropertyWebkitColumns},
-#line 194 "CSSPropertyNames.gperf"
+#line 195 "CSSPropertyNames.gperf"
       {"-webkit-line-clamp", CSSPropertyWebkitLineClamp},
-#line 259 "CSSPropertyNames.gperf"
+#line 260 "CSSPropertyNames.gperf"
       {"color-interpolation", CSSPropertyColorInterpolation},
-#line 163 "CSSPropertyNames.gperf"
+#line 164 "CSSPropertyNames.gperf"
       {"-webkit-border-fit", CSSPropertyWebkitBorderFit},
+#line 289 "CSSPropertyNames.gperf"
+      {"-webkit-shadow", CSSPropertyWebkitShadow},
 #line 65 "CSSPropertyNames.gperf"
       {"font-size", CSSPropertyFontSize},
 #line 30 "CSSPropertyNames.gperf"
@@ -467,11 +471,11 @@ findProp (register const char *str, register unsigned int len)
       {"z-index", CSSPropertyZIndex},
 #line 139 "CSSPropertyNames.gperf"
       {"vertical-align", CSSPropertyVerticalAlign},
-#line 181 "CSSPropertyNames.gperf"
+#line 182 "CSSPropertyNames.gperf"
       {"-webkit-column-break-inside", CSSPropertyWebkitColumnBreakInside},
 #line 100 "CSSPropertyNames.gperf"
       {"padding-right", CSSPropertyPaddingRight},
-#line 247 "CSSPropertyNames.gperf"
+#line 248 "CSSPropertyNames.gperf"
       {"-webkit-user-select", CSSPropertyWebkitUserSelect},
 #line 48 "CSSPropertyNames.gperf"
       {"border-top-width", CSSPropertyBorderTopWidth},
@@ -479,49 +483,49 @@ findProp (register const char *str, register unsigned int len)
       {"text-rendering", CSSPropertyTextRendering},
 #line 88 "CSSPropertyNames.gperf"
       {"orphans", CSSPropertyOrphans},
-#line 174 "CSSPropertyNames.gperf"
+#line 175 "CSSPropertyNames.gperf"
       {"-webkit-box-orient", CSSPropertyWebkitBoxOrient},
-#line 234 "CSSPropertyNames.gperf"
+#line 235 "CSSPropertyNames.gperf"
       {"-webkit-transform", CSSPropertyWebkitTransform},
-#line 183 "CSSPropertyNames.gperf"
+#line 184 "CSSPropertyNames.gperf"
       {"-webkit-column-gap", CSSPropertyWebkitColumnGap},
-#line 196 "CSSPropertyNames.gperf"
+#line 197 "CSSPropertyNames.gperf"
       {"-webkit-margin-collapse", CSSPropertyWebkitMarginCollapse},
 #line 160 "CSSPropertyNames.gperf"
       {"-webkit-background-composite", CSSPropertyWebkitBackgroundComposite},
-#line 195 "CSSPropertyNames.gperf"
+#line 196 "CSSPropertyNames.gperf"
       {"-webkit-margin-bottom-collapse", CSSPropertyWebkitMarginBottomCollapse},
 #line 13 "CSSPropertyNames.gperf"
       {"background-color", CSSPropertyBackgroundColor},
-#line 231 "CSSPropertyNames.gperf"
+#line 232 "CSSPropertyNames.gperf"
       {"-webkit-text-stroke", CSSPropertyWebkitTextStroke},
-#line 271 "CSSPropertyNames.gperf"
+#line 272 "CSSPropertyNames.gperf"
       {"shape-rendering", CSSPropertyShapeRendering},
 #line 104 "CSSPropertyNames.gperf"
       {"page-break-before", CSSPropertyPageBreakBefore},
-#line 235 "CSSPropertyNames.gperf"
+#line 236 "CSSPropertyNames.gperf"
       {"-webkit-transform-origin", CSSPropertyWebkitTransformOrigin},
 #line 103 "CSSPropertyNames.gperf"
       {"page-break-after", CSSPropertyPageBreakAfter},
 #line 90 "CSSPropertyNames.gperf"
       {"outline-color", CSSPropertyOutlineColor},
-#line 207 "CSSPropertyNames.gperf"
+#line 208 "CSSPropertyNames.gperf"
       {"-webkit-mask-box-image", CSSPropertyWebkitMaskBoxImage},
-#line 178 "CSSPropertyNames.gperf"
+#line 179 "CSSPropertyNames.gperf"
       {"-webkit-box-sizing", CSSPropertyWebkitBoxSizing},
 #line 71 "CSSPropertyNames.gperf"
       {"left", CSSPropertyLeft},
-#line 238 "CSSPropertyNames.gperf"
+#line 239 "CSSPropertyNames.gperf"
       {"-webkit-transform-origin-z", CSSPropertyWebkitTransformOriginZ},
 #line 68 "CSSPropertyNames.gperf"
       {"font-variant", CSSPropertyFontVariant},
 #line 62 "CSSPropertyNames.gperf"
       {"float", CSSPropertyFloat},
-#line 253 "CSSPropertyNames.gperf"
+#line 254 "CSSPropertyNames.gperf"
       {"filter", CSSPropertyFilter},
 #line 32 "CSSPropertyNames.gperf"
       {"border-left", CSSPropertyBorderLeft},
-#line 206 "CSSPropertyNames.gperf"
+#line 207 "CSSPropertyNames.gperf"
       {"-webkit-mask-attachment", CSSPropertyWebkitMaskAttachment},
 #line 115 "CSSPropertyNames.gperf"
       {"text-decoration", CSSPropertyTextDecoration},
@@ -529,31 +533,31 @@ findProp (register const char *str, register unsigned int len)
       {"margin-left", CSSPropertyMarginLeft},
 #line 12 "CSSPropertyNames.gperf"
       {"background-clip", CSSPropertyBackgroundClip},
-#line 198 "CSSPropertyNames.gperf"
+#line 199 "CSSPropertyNames.gperf"
       {"-webkit-margin-top-collapse", CSSPropertyWebkitMarginTopCollapse},
-#line 167 "CSSPropertyNames.gperf"
+#line 168 "CSSPropertyNames.gperf"
       {"-webkit-border-vertical-spacing", CSSPropertyWebkitBorderVerticalSpacing},
-#line 250 "CSSPropertyNames.gperf"
+#line 251 "CSSPropertyNames.gperf"
       {"clip-rule", CSSPropertyClipRule},
-#line 169 "CSSPropertyNames.gperf"
+#line 170 "CSSPropertyNames.gperf"
       {"-webkit-box-direction", CSSPropertyWebkitBoxDirection},
 #line 141 "CSSPropertyNames.gperf"
       {"white-space", CSSPropertyWhiteSpace},
 #line 114 "CSSPropertyNames.gperf"
       {"text-align", CSSPropertyTextAlign},
-#line 216 "CSSPropertyNames.gperf"
+#line 217 "CSSPropertyNames.gperf"
       {"-webkit-mask-repeat-x", CSSPropertyWebkitMaskRepeatX},
 #line 159 "CSSPropertyNames.gperf"
       {"-webkit-background-clip", CSSPropertyWebkitBackgroundClip},
-#line 217 "CSSPropertyNames.gperf"
+#line 218 "CSSPropertyNames.gperf"
       {"-webkit-mask-repeat-y", CSSPropertyWebkitMaskRepeatY},
-#line 168 "CSSPropertyNames.gperf"
+#line 169 "CSSPropertyNames.gperf"
       {"-webkit-box-align", CSSPropertyWebkitBoxAlign},
-#line 213 "CSSPropertyNames.gperf"
+#line 214 "CSSPropertyNames.gperf"
       {"-webkit-mask-position-x", CSSPropertyWebkitMaskPositionX},
 #line 99 "CSSPropertyNames.gperf"
       {"padding-left", CSSPropertyPaddingLeft},
-#line 190 "CSSPropertyNames.gperf"
+#line 191 "CSSPropertyNames.gperf"
       {"-webkit-font-size-delta", CSSPropertyWebkitFontSizeDelta},
 #line 27 "CSSPropertyNames.gperf"
       {"border-bottom-right-radius", CSSPropertyBorderBottomRightRadius},
@@ -561,61 +565,61 @@ findProp (register const char *str, register unsigned int len)
       {"opacity", CSSPropertyOpacity},
 #line 38 "CSSPropertyNames.gperf"
       {"border-right-color", CSSPropertyBorderRightColor},
-#line 175 "CSSPropertyNames.gperf"
+#line 176 "CSSPropertyNames.gperf"
       {"-webkit-box-pack", CSSPropertyWebkitBoxPack},
-#line 172 "CSSPropertyNames.gperf"
+#line 173 "CSSPropertyNames.gperf"
       {"-webkit-box-lines", CSSPropertyWebkitBoxLines},
 #line 42 "CSSPropertyNames.gperf"
       {"border-style", CSSPropertyBorderStyle},
-#line 214 "CSSPropertyNames.gperf"
+#line 215 "CSSPropertyNames.gperf"
       {"-webkit-mask-position-y", CSSPropertyWebkitMaskPositionY},
 #line 94 "CSSPropertyNames.gperf"
       {"overflow", CSSPropertyOverflow},
 #line 28 "CSSPropertyNames.gperf"
       {"border-bottom-style", CSSPropertyBorderBottomStyle},
-#line 263 "CSSPropertyNames.gperf"
+#line 264 "CSSPropertyNames.gperf"
       {"fill", CSSPropertyFill},
 #line 150 "CSSPropertyNames.gperf"
       {"-webkit-animation-delay", CSSPropertyWebkitAnimationDelay},
-#line 278 "CSSPropertyNames.gperf"
+#line 279 "CSSPropertyNames.gperf"
       {"stroke-opacity", CSSPropertyStrokeOpacity},
 #line 123 "CSSPropertyNames.gperf"
       {"text-overline", CSSPropertyTextOverline},
-#line 182 "CSSPropertyNames.gperf"
+#line 183 "CSSPropertyNames.gperf"
       {"-webkit-column-count", CSSPropertyWebkitColumnCount},
 #line 125 "CSSPropertyNames.gperf"
       {"text-overline-mode", CSSPropertyTextOverlineMode},
 #line 46 "CSSPropertyNames.gperf"
       {"border-top-right-radius", CSSPropertyBorderTopRightRadius},
-#line 241 "CSSPropertyNames.gperf"
+#line 242 "CSSPropertyNames.gperf"
       {"-webkit-transition-delay", CSSPropertyWebkitTransitionDelay},
 #line 60 "CSSPropertyNames.gperf"
       {"display", CSSPropertyDisplay},
 #line 93 "CSSPropertyNames.gperf"
       {"outline-width", CSSPropertyOutlineWidth},
-#line 243 "CSSPropertyNames.gperf"
+#line 244 "CSSPropertyNames.gperf"
       {"-webkit-transition-property", CSSPropertyWebkitTransitionProperty},
 #line 47 "CSSPropertyNames.gperf"
       {"border-top-style", CSSPropertyBorderTopStyle},
-#line 184 "CSSPropertyNames.gperf"
+#line 185 "CSSPropertyNames.gperf"
       {"-webkit-column-rule", CSSPropertyWebkitColumnRule},
 #line 140 "CSSPropertyNames.gperf"
       {"visibility", CSSPropertyVisibility},
-#line 249 "CSSPropertyNames.gperf"
+#line 250 "CSSPropertyNames.gperf"
       {"clip-path", CSSPropertyClipPath},
-#line 258 "CSSPropertyNames.gperf"
+#line 259 "CSSPropertyNames.gperf"
       {"stop-opacity", CSSPropertyStopOpacity},
-#line 248 "CSSPropertyNames.gperf"
+#line 249 "CSSPropertyNames.gperf"
       {"-webkit-variable-declaration-block", CSSPropertyWebkitVariableDeclarationBlock},
-#line 230 "CSSPropertyNames.gperf"
+#line 231 "CSSPropertyNames.gperf"
       {"-webkit-text-size-adjust", CSSPropertyWebkitTextSizeAdjust},
-#line 232 "CSSPropertyNames.gperf"
+#line 233 "CSSPropertyNames.gperf"
       {"-webkit-text-stroke-color", CSSPropertyWebkitTextStrokeColor},
-#line 256 "CSSPropertyNames.gperf"
+#line 257 "CSSPropertyNames.gperf"
       {"lighting-color", CSSPropertyLightingColor},
 #line 70 "CSSPropertyNames.gperf"
       {"height", CSSPropertyHeight},
-#line 254 "CSSPropertyNames.gperf"
+#line 255 "CSSPropertyNames.gperf"
       {"flood-color", CSSPropertyFloodColor},
 #line 156 "CSSPropertyNames.gperf"
       {"-webkit-animation-timing-function", CSSPropertyWebkitAnimationTimingFunction},
@@ -635,21 +639,21 @@ findProp (register const char *str, register unsigned int len)
       {"border-left-color", CSSPropertyBorderLeftColor},
 #line 74 "CSSPropertyNames.gperf"
       {"list-style", CSSPropertyListStyle},
-#line 164 "CSSPropertyNames.gperf"
+#line 165 "CSSPropertyNames.gperf"
       {"-webkit-border-horizontal-spacing", CSSPropertyWebkitBorderHorizontalSpacing},
-#line 244 "CSSPropertyNames.gperf"
+#line 245 "CSSPropertyNames.gperf"
       {"-webkit-transition-timing-function", CSSPropertyWebkitTransitionTimingFunction},
 #line 75 "CSSPropertyNames.gperf"
       {"list-style-image", CSSPropertyListStyleImage},
 #line 40 "CSSPropertyNames.gperf"
       {"border-right-width", CSSPropertyBorderRightWidth},
-#line 188 "CSSPropertyNames.gperf"
+#line 189 "CSSPropertyNames.gperf"
       {"-webkit-column-width", CSSPropertyWebkitColumnWidth},
 #line 20 "CSSPropertyNames.gperf"
       {"background-repeat-x", CSSPropertyBackgroundRepeatX},
 #line 69 "CSSPropertyNames.gperf"
       {"font-weight", CSSPropertyFontWeight},
-#line 261 "CSSPropertyNames.gperf"
+#line 262 "CSSPropertyNames.gperf"
       {"color-profile", CSSPropertyColorProfile},
 #line 45 "CSSPropertyNames.gperf"
       {"border-top-left-radius", CSSPropertyBorderTopLeftRadius},
@@ -659,21 +663,21 @@ findProp (register const char *str, register unsigned int len)
       {"background-position-x", CSSPropertyBackgroundPositionX},
 #line 84 "CSSPropertyNames.gperf"
       {"max-width", CSSPropertyMaxWidth},
-#line 224 "CSSPropertyNames.gperf"
+#line 225 "CSSPropertyNames.gperf"
       {"-webkit-perspective-origin-x", CSSPropertyWebkitPerspectiveOriginX},
-#line 180 "CSSPropertyNames.gperf"
+#line 181 "CSSPropertyNames.gperf"
       {"-webkit-column-break-before", CSSPropertyWebkitColumnBreakBefore},
-#line 179 "CSSPropertyNames.gperf"
+#line 180 "CSSPropertyNames.gperf"
       {"-webkit-column-break-after", CSSPropertyWebkitColumnBreakAfter},
 #line 18 "CSSPropertyNames.gperf"
       {"background-position-y", CSSPropertyBackgroundPositionY},
-#line 191 "CSSPropertyNames.gperf"
+#line 192 "CSSPropertyNames.gperf"
       {"-webkit-font-smoothing", CSSPropertyWebkitFontSmoothing},
-#line 173 "CSSPropertyNames.gperf"
+#line 174 "CSSPropertyNames.gperf"
       {"-webkit-box-ordinal-group", CSSPropertyWebkitBoxOrdinalGroup},
-#line 204 "CSSPropertyNames.gperf"
+#line 205 "CSSPropertyNames.gperf"
       {"-webkit-marquee-style", CSSPropertyWebkitMarqueeStyle},
-#line 225 "CSSPropertyNames.gperf"
+#line 226 "CSSPropertyNames.gperf"
       {"-webkit-perspective-origin-y", CSSPropertyWebkitPerspectiveOriginY},
 #line 129 "CSSPropertyNames.gperf"
       {"text-shadow", CSSPropertyTextShadow},
@@ -683,13 +687,13 @@ findProp (register const char *str, register unsigned int len)
       {"list-style-position", CSSPropertyListStylePosition},
 #line 113 "CSSPropertyNames.gperf"
       {"table-layout", CSSPropertyTableLayout},
-#line 177 "CSSPropertyNames.gperf"
+#line 178 "CSSPropertyNames.gperf"
       {"-webkit-box-shadow", CSSPropertyWebkitBoxShadow},
 #line 124 "CSSPropertyNames.gperf"
       {"text-overline-color", CSSPropertyTextOverlineColor},
 #line 61 "CSSPropertyNames.gperf"
       {"empty-cells", CSSPropertyEmptyCells},
-#line 233 "CSSPropertyNames.gperf"
+#line 234 "CSSPropertyNames.gperf"
       {"-webkit-text-stroke-width", CSSPropertyWebkitTextStrokeWidth},
 #line 130 "CSSPropertyNames.gperf"
       {"text-transform", CSSPropertyTextTransform},
@@ -697,25 +701,25 @@ findProp (register const char *str, register unsigned int len)
       {"font-stretch", CSSPropertyFontStretch},
 #line 92 "CSSPropertyNames.gperf"
       {"outline-style", CSSPropertyOutlineStyle},
-#line 286 "CSSPropertyNames.gperf"
+#line 287 "CSSPropertyNames.gperf"
       {"text-anchor", CSSPropertyTextAnchor},
-#line 185 "CSSPropertyNames.gperf"
+#line 186 "CSSPropertyNames.gperf"
       {"-webkit-column-rule-color", CSSPropertyWebkitColumnRuleColor},
-#line 273 "CSSPropertyNames.gperf"
+#line 274 "CSSPropertyNames.gperf"
       {"stroke-dasharray", CSSPropertyStrokeDasharray},
 #line 35 "CSSPropertyNames.gperf"
       {"border-left-width", CSSPropertyBorderLeftWidth},
-#line 265 "CSSPropertyNames.gperf"
+#line 266 "CSSPropertyNames.gperf"
       {"fill-rule", CSSPropertyFillRule},
-#line 236 "CSSPropertyNames.gperf"
+#line 237 "CSSPropertyNames.gperf"
       {"-webkit-transform-origin-x", CSSPropertyWebkitTransformOriginX},
-#line 281 "CSSPropertyNames.gperf"
+#line 282 "CSSPropertyNames.gperf"
       {"baseline-shift", CSSPropertyBaselineShift},
 #line 132 "CSSPropertyNames.gperf"
       {"text-underline-color", CSSPropertyTextUnderlineColor},
-#line 237 "CSSPropertyNames.gperf"
+#line 238 "CSSPropertyNames.gperf"
       {"-webkit-transform-origin-y", CSSPropertyWebkitTransformOriginY},
-#line 260 "CSSPropertyNames.gperf"
+#line 261 "CSSPropertyNames.gperf"
       {"color-interpolation-filters", CSSPropertyColorInterpolationFilters},
 #line 39 "CSSPropertyNames.gperf"
       {"border-right-style", CSSPropertyBorderRightStyle},
@@ -727,63 +731,63 @@ findProp (register const char *str, register unsigned int len)
       {"overflow-x", CSSPropertyOverflowX},
 #line 122 "CSSPropertyNames.gperf"
       {"text-overflow", CSSPropertyTextOverflow},
-#line 176 "CSSPropertyNames.gperf"
+#line 177 "CSSPropertyNames.gperf"
       {"-webkit-box-reflect", CSSPropertyWebkitBoxReflect},
-#line 246 "CSSPropertyNames.gperf"
+#line 247 "CSSPropertyNames.gperf"
       {"-webkit-user-modify", CSSPropertyWebkitUserModify},
-#line 187 "CSSPropertyNames.gperf"
+#line 188 "CSSPropertyNames.gperf"
       {"-webkit-column-rule-width", CSSPropertyWebkitColumnRuleWidth},
 #line 96 "CSSPropertyNames.gperf"
       {"overflow-y", CSSPropertyOverflowY},
-#line 239 "CSSPropertyNames.gperf"
+#line 240 "CSSPropertyNames.gperf"
       {"-webkit-transform-style", CSSPropertyWebkitTransformStyle},
 #line 91 "CSSPropertyNames.gperf"
       {"outline-offset", CSSPropertyOutlineOffset},
 #line 135 "CSSPropertyNames.gperf"
       {"text-underline-width", CSSPropertyTextUnderlineWidth},
-#line 255 "CSSPropertyNames.gperf"
+#line 256 "CSSPropertyNames.gperf"
       {"flood-opacity", CSSPropertyFloodOpacity},
 #line 34 "CSSPropertyNames.gperf"
       {"border-left-style", CSSPropertyBorderLeftStyle},
 #line 83 "CSSPropertyNames.gperf"
       {"max-height", CSSPropertyMaxHeight},
-#line 229 "CSSPropertyNames.gperf"
+#line 230 "CSSPropertyNames.gperf"
       {"-webkit-text-security", CSSPropertyWebkitTextSecurity},
-#line 192 "CSSPropertyNames.gperf"
+#line 193 "CSSPropertyNames.gperf"
       {"-webkit-highlight", CSSPropertyWebkitHighlight},
-#line 264 "CSSPropertyNames.gperf"
+#line 265 "CSSPropertyNames.gperf"
       {"fill-opacity", CSSPropertyFillOpacity},
-#line 274 "CSSPropertyNames.gperf"
+#line 275 "CSSPropertyNames.gperf"
       {"stroke-dashoffset", CSSPropertyStrokeDashoffset},
 #line 126 "CSSPropertyNames.gperf"
       {"text-overline-style", CSSPropertyTextOverlineStyle},
 #line 77 "CSSPropertyNames.gperf"
       {"list-style-type", CSSPropertyListStyleType},
-#line 219 "CSSPropertyNames.gperf"
+#line 220 "CSSPropertyNames.gperf"
       {"-webkit-match-nearest-mail-blockquote-color", CSSPropertyWebkitMatchNearestMailBlockquoteColor},
-#line 186 "CSSPropertyNames.gperf"
+#line 187 "CSSPropertyNames.gperf"
       {"-webkit-column-rule-style", CSSPropertyWebkitColumnRuleStyle},
 #line 158 "CSSPropertyNames.gperf"
       {"-webkit-backface-visibility", CSSPropertyWebkitBackfaceVisibility},
-#line 228 "CSSPropertyNames.gperf"
+#line 229 "CSSPropertyNames.gperf"
       {"-webkit-text-fill-color", CSSPropertyWebkitTextFillColor},
 #line 134 "CSSPropertyNames.gperf"
       {"text-underline-style", CSSPropertyTextUnderlineStyle},
-#line 284 "CSSPropertyNames.gperf"
+#line 285 "CSSPropertyNames.gperf"
       {"glyph-orientation-vertical", CSSPropertyGlyphOrientationVertical},
 #line 64 "CSSPropertyNames.gperf"
       {"font-family", CSSPropertyFontFamily},
-#line 170 "CSSPropertyNames.gperf"
+#line 171 "CSSPropertyNames.gperf"
       {"-webkit-box-flex", CSSPropertyWebkitBoxFlex},
 #line 117 "CSSPropertyNames.gperf"
       {"text-line-through", CSSPropertyTextLineThrough},
 #line 119 "CSSPropertyNames.gperf"
       {"text-line-through-mode", CSSPropertyTextLineThroughMode},
-#line 227 "CSSPropertyNames.gperf"
+#line 228 "CSSPropertyNames.gperf"
       {"-webkit-text-decorations-in-effect", CSSPropertyWebkitTextDecorationsInEffect},
-#line 283 "CSSPropertyNames.gperf"
+#line 284 "CSSPropertyNames.gperf"
       {"glyph-orientation-horizontal", CSSPropertyGlyphOrientationHorizontal},
-#line 171 "CSSPropertyNames.gperf"
+#line 172 "CSSPropertyNames.gperf"
       {"-webkit-box-flex-group", CSSPropertyWebkitBoxFlexGroup},
 #line 118 "CSSPropertyNames.gperf"
       {"text-line-through-color", CSSPropertyTextLineThroughColor},
@@ -825,113 +829,113 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  80,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  81,  -1,  82,  83,  -1,  -1,  84,
        85,  -1,  -1,  -1,  86,  -1,  87,  88,  -1,  -1,
-       -1,  -1,  -1,  89,  -1,  90,  -1,  -1,  -1,  -1,
-       91,  -1,  -1,  -1,  -1,  -1,  -1,  92,  -1,  -1,
-       -1,  -1,  -1,  -1,  93,  -1,  -1,  -1,  -1,  -1,
-       94,  -1,  95,  -1,  -1,  96,  -1,  -1,  -1,  97,
-       -1,  -1,  -1,  -1,  98,  -1,  99, 100,  -1,  -1,
-       -1,  -1, 101,  -1, 102,  -1,  -1, 103,  -1, 104,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 105,  -1,  -1,
-       -1,  -1, 106,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      107,  -1,  -1, 108, 109,  -1,  -1,  -1, 110,  -1,
-       -1,  -1,  -1,  -1, 111, 112, 113, 114,  -1, 115,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 116, 117, 118,
-       -1, 119,  -1,  -1, 120,  -1,  -1, 121, 122,  -1,
-       -1,  -1, 123, 124,  -1,  -1,  -1,  -1, 125,  -1,
-       -1,  -1,  -1, 126,  -1, 127, 128,  -1,  -1, 129,
-      130,  -1, 131,  -1, 132,  -1, 133,  -1, 134,  -1,
-       -1,  -1, 135, 136, 137,  -1, 138, 139,  -1,  -1,
-      140, 141,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 142,  -1, 143,  -1,  -1,  -1,  -1,  -1,  -1,
-      144, 145,  -1,  -1,  -1, 146,  -1, 147,  -1,  -1,
-       -1, 148,  -1,  -1, 149,  -1, 150,  -1,  -1,  -1,
-       -1, 151,  -1,  -1,  -1, 152, 153,  -1, 154,  -1,
+       -1,  -1,  -1,  89,  -1,  90,  -1,  -1,  91,  -1,
+       92,  -1,  -1,  -1,  -1,  -1,  -1,  93,  -1,  -1,
+       -1,  -1,  -1,  -1,  94,  -1,  -1,  -1,  -1,  -1,
+       95,  -1,  96,  -1,  -1,  97,  -1,  -1,  -1,  98,
+       -1,  -1,  -1,  -1,  99,  -1, 100, 101,  -1,  -1,
+       -1,  -1, 102,  -1, 103,  -1,  -1, 104,  -1, 105,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 106,  -1,  -1,
+       -1,  -1, 107,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      108,  -1,  -1, 109, 110,  -1,  -1,  -1, 111, 112,
+       -1,  -1,  -1,  -1, 113, 114, 115, 116,  -1, 117,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 118, 119, 120,
+       -1, 121,  -1,  -1, 122,  -1,  -1, 123, 124,  -1,
+       -1,  -1, 125, 126,  -1,  -1,  -1,  -1, 127,  -1,
+       -1,  -1,  -1, 128,  -1, 129, 130,  -1,  -1, 131,
+      132,  -1, 133,  -1, 134,  -1, 135,  -1, 136,  -1,
+       -1,  -1, 137, 138, 139,  -1, 140, 141,  -1,  -1,
+      142, 143,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 144,  -1, 145,  -1,  -1,  -1,  -1,  -1,  -1,
+      146, 147,  -1,  -1,  -1, 148,  -1, 149,  -1,  -1,
+       -1, 150,  -1,  -1, 151,  -1, 152,  -1,  -1,  -1,
+       -1, 153,  -1,  -1,  -1, 154, 155,  -1, 156,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 155, 156, 157,  -1,
-       -1,  -1, 158, 159,  -1,  -1, 160, 161, 162,  -1,
-       -1, 163, 164,  -1,  -1,  -1,  -1, 165, 166,  -1,
-       -1,  -1,  -1, 167, 168,  -1,  -1,  -1,  -1, 169,
-       -1,  -1,  -1, 170,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 171,  -1,  -1,  -1, 172,  -1,
-      173,  -1,  -1, 174,  -1,  -1,  -1,  -1, 175, 176,
-       -1,  -1, 177, 178,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 179,  -1,  -1,  -1, 180,  -1,  -1, 181,
-      182,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 183,
-       -1,  -1, 184,  -1, 185,  -1,  -1,  -1,  -1, 186,
-      187,  -1,  -1,  -1, 188,  -1,  -1,  -1,  -1,  -1,
-       -1, 189,  -1,  -1,  -1,  -1, 190,  -1, 191, 192,
-      193,  -1,  -1, 194, 195,  -1,  -1,  -1,  -1,  -1,
-      196, 197, 198,  -1,  -1, 199,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 200, 201,  -1,  -1,  -1,  -1,  -1,
-       -1, 202,  -1, 203,  -1,  -1,  -1,  -1,  -1,  -1,
-      204,  -1,  -1,  -1, 205,  -1, 206,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 207,  -1,
-       -1,  -1, 208,  -1, 209,  -1, 210,  -1,  -1, 211,
-       -1,  -1,  -1, 212,  -1,  -1,  -1, 213,  -1,  -1,
-       -1, 214,  -1,  -1,  -1,  -1, 215, 216,  -1,  -1,
-      217, 218,  -1, 219,  -1,  -1, 220,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 221,  -1,  -1, 222,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 223, 224, 225,
-       -1, 226,  -1,  -1,  -1, 227,  -1,  -1,  -1, 228,
-       -1,  -1, 229,  -1,  -1,  -1,  -1,  -1, 230,  -1,
-       -1, 231,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      232,  -1,  -1,  -1,  -1,  -1, 233, 234,  -1,  -1,
-       -1,  -1,  -1,  -1, 235,  -1,  -1,  -1,  -1,  -1,
-       -1, 236,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 237,
-      238, 239,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 157, 158, 159,  -1,
+       -1,  -1, 160, 161,  -1,  -1, 162, 163, 164,  -1,
+       -1, 165, 166,  -1,  -1,  -1,  -1, 167, 168,  -1,
+       -1,  -1,  -1, 169, 170,  -1,  -1,  -1,  -1, 171,
+       -1,  -1,  -1, 172,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 173,  -1,  -1,  -1, 174,  -1,
+      175,  -1,  -1, 176,  -1,  -1,  -1,  -1, 177, 178,
+       -1,  -1, 179, 180,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 181,  -1,  -1,  -1, 182,  -1,  -1, 183,
+      184,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 185,
+       -1,  -1, 186,  -1, 187,  -1,  -1,  -1,  -1, 188,
+      189,  -1,  -1,  -1, 190,  -1,  -1,  -1,  -1,  -1,
+       -1, 191,  -1,  -1,  -1,  -1, 192,  -1, 193, 194,
+      195,  -1,  -1, 196, 197,  -1,  -1,  -1,  -1,  -1,
+      198, 199, 200,  -1,  -1, 201,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 202, 203,  -1,  -1,  -1,  -1,  -1,
+       -1, 204,  -1, 205,  -1,  -1,  -1,  -1,  -1,  -1,
+      206,  -1,  -1,  -1, 207,  -1, 208,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 209,  -1,
+       -1,  -1, 210,  -1, 211,  -1, 212,  -1,  -1, 213,
+       -1,  -1,  -1, 214,  -1,  -1,  -1, 215,  -1,  -1,
+       -1, 216,  -1,  -1,  -1,  -1, 217, 218,  -1,  -1,
+      219, 220,  -1, 221,  -1,  -1, 222,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 223,  -1,  -1, 224,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 225, 226, 227,
+       -1, 228,  -1,  -1,  -1, 229,  -1,  -1,  -1, 230,
+       -1,  -1, 231,  -1,  -1,  -1,  -1,  -1, 232,  -1,
+       -1, 233,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      234,  -1,  -1,  -1,  -1,  -1, 235, 236,  -1,  -1,
+       -1,  -1,  -1,  -1, 237,  -1,  -1,  -1,  -1,  -1,
+       -1, 238,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 239,
+      240, 241,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 240,  -1,  -1,  -1,  -1,  -1, 241,  -1,
-       -1,  -1,  -1,  -1,  -1, 242,  -1,  -1,  -1,  -1,
+       -1,  -1, 242,  -1,  -1,  -1,  -1,  -1, 243,  -1,
+       -1,  -1,  -1,  -1,  -1, 244,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 243,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 245,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      244,  -1,  -1, 245,  -1,  -1,  -1,  -1,  -1, 246,
-       -1,  -1,  -1,  -1, 247, 248,  -1,  -1,  -1,  -1,
-      249,  -1,  -1, 250,  -1,  -1,  -1,  -1,  -1,  -1,
+      246,  -1,  -1, 247,  -1,  -1,  -1,  -1,  -1, 248,
+       -1,  -1,  -1,  -1, 249, 250,  -1,  -1,  -1,  -1,
+      251,  -1,  -1, 252,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 251,
-       -1,  -1,  -1,  -1,  -1, 252,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 253,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 254,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 253,
+       -1,  -1,  -1,  -1,  -1, 254,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 255,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 256,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 255,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 257,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 256,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 258,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 257,  -1,  -1,  -1,  -1, 258,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 259,  -1, 260,
+       -1,  -1, 259,  -1,  -1,  -1,  -1, 260,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 261,  -1, 262,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      261,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 262,  -1,
-      263,  -1,  -1,  -1,  -1,  -1,  -1, 264,  -1,  -1,
-       -1,  -1,  -1, 265,  -1,  -1,  -1,  -1,  -1,  -1,
+      263,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 264,  -1,
+      265,  -1,  -1,  -1,  -1,  -1,  -1, 266,  -1,  -1,
+       -1,  -1,  -1, 267,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      266,  -1,  -1,  -1,  -1,  -1, 267,  -1,  -1,  -1,
+      268,  -1,  -1,  -1,  -1,  -1, 269,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 268,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 270,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 269,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 271,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 270,  -1,  -1,  -1,  -1, 271,  -1,  -1,
+       -1,  -1, 272,  -1,  -1,  -1,  -1, 273,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 272,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 274,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 273,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 275,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -939,10 +943,10 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 274,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 276,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 275,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 277,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -956,7 +960,7 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 276,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 278,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -976,7 +980,7 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 277
+       -1,  -1,  -1, 279
     };
 
   if (len <= MAX_WORD_LENGTH && len >= MIN_WORD_LENGTH)
@@ -998,9 +1002,9 @@ findProp (register const char *str, register unsigned int len)
     }
   return 0;
 }
-#line 288 "CSSPropertyNames.gperf"
+#line 290 "CSSPropertyNames.gperf"
 
-static const char * const propertyNameStrings[278] = {
+static const char * const propertyNameStrings[280] = {
 "background",
 "background-attachment",
 "background-clip",
@@ -1153,6 +1157,7 @@ static const char * const propertyNameStrings[278] = {
 "-webkit-background-clip",
 "-webkit-background-composite",
 "-webkit-background-origin",
+"-webkit-background-size",
 "-webkit-binding",
 "-webkit-border-fit",
 "-webkit-border-horizontal-spacing",
@@ -1279,6 +1284,7 @@ static const char * const propertyNameStrings[278] = {
 "kerning",
 "text-anchor",
 "writing-mode",
+"-webkit-shadow",
 };
 const char* getPropertyName(CSSPropertyID id)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
index f1332e39c8..8957af8f2b 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
@@ -157,136 +157,138 @@ enum CSSPropertyID {
     CSSPropertyWebkitBackgroundClip = 1150,
     CSSPropertyWebkitBackgroundComposite = 1151,
     CSSPropertyWebkitBackgroundOrigin = 1152,
-    CSSPropertyWebkitBinding = 1153,
-    CSSPropertyWebkitBorderFit = 1154,
-    CSSPropertyWebkitBorderHorizontalSpacing = 1155,
-    CSSPropertyWebkitBorderImage = 1156,
-    CSSPropertyWebkitBorderRadius = 1157,
-    CSSPropertyWebkitBorderVerticalSpacing = 1158,
-    CSSPropertyWebkitBoxAlign = 1159,
-    CSSPropertyWebkitBoxDirection = 1160,
-    CSSPropertyWebkitBoxFlex = 1161,
-    CSSPropertyWebkitBoxFlexGroup = 1162,
-    CSSPropertyWebkitBoxLines = 1163,
-    CSSPropertyWebkitBoxOrdinalGroup = 1164,
-    CSSPropertyWebkitBoxOrient = 1165,
-    CSSPropertyWebkitBoxPack = 1166,
-    CSSPropertyWebkitBoxReflect = 1167,
-    CSSPropertyWebkitBoxShadow = 1168,
-    CSSPropertyWebkitBoxSizing = 1169,
-    CSSPropertyWebkitColumnBreakAfter = 1170,
-    CSSPropertyWebkitColumnBreakBefore = 1171,
-    CSSPropertyWebkitColumnBreakInside = 1172,
-    CSSPropertyWebkitColumnCount = 1173,
-    CSSPropertyWebkitColumnGap = 1174,
-    CSSPropertyWebkitColumnRule = 1175,
-    CSSPropertyWebkitColumnRuleColor = 1176,
-    CSSPropertyWebkitColumnRuleStyle = 1177,
-    CSSPropertyWebkitColumnRuleWidth = 1178,
-    CSSPropertyWebkitColumnWidth = 1179,
-    CSSPropertyWebkitColumns = 1180,
-    CSSPropertyWebkitFontSizeDelta = 1181,
-    CSSPropertyWebkitFontSmoothing = 1182,
-    CSSPropertyWebkitHighlight = 1183,
-    CSSPropertyWebkitLineBreak = 1184,
-    CSSPropertyWebkitLineClamp = 1185,
-    CSSPropertyWebkitMarginBottomCollapse = 1186,
-    CSSPropertyWebkitMarginCollapse = 1187,
-    CSSPropertyWebkitMarginStart = 1188,
-    CSSPropertyWebkitMarginTopCollapse = 1189,
-    CSSPropertyWebkitMarquee = 1190,
-    CSSPropertyWebkitMarqueeDirection = 1191,
-    CSSPropertyWebkitMarqueeIncrement = 1192,
-    CSSPropertyWebkitMarqueeRepetition = 1193,
-    CSSPropertyWebkitMarqueeSpeed = 1194,
-    CSSPropertyWebkitMarqueeStyle = 1195,
-    CSSPropertyWebkitMask = 1196,
-    CSSPropertyWebkitMaskAttachment = 1197,
-    CSSPropertyWebkitMaskBoxImage = 1198,
-    CSSPropertyWebkitMaskClip = 1199,
-    CSSPropertyWebkitMaskComposite = 1200,
-    CSSPropertyWebkitMaskImage = 1201,
-    CSSPropertyWebkitMaskOrigin = 1202,
-    CSSPropertyWebkitMaskPosition = 1203,
-    CSSPropertyWebkitMaskPositionX = 1204,
-    CSSPropertyWebkitMaskPositionY = 1205,
-    CSSPropertyWebkitMaskRepeat = 1206,
-    CSSPropertyWebkitMaskRepeatX = 1207,
-    CSSPropertyWebkitMaskRepeatY = 1208,
-    CSSPropertyWebkitMaskSize = 1209,
-    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1210,
-    CSSPropertyWebkitNbspMode = 1211,
-    CSSPropertyWebkitPaddingStart = 1212,
-    CSSPropertyWebkitPerspective = 1213,
-    CSSPropertyWebkitPerspectiveOrigin = 1214,
-    CSSPropertyWebkitPerspectiveOriginX = 1215,
-    CSSPropertyWebkitPerspectiveOriginY = 1216,
-    CSSPropertyWebkitRtlOrdering = 1217,
-    CSSPropertyWebkitTextDecorationsInEffect = 1218,
-    CSSPropertyWebkitTextFillColor = 1219,
-    CSSPropertyWebkitTextSecurity = 1220,
-    CSSPropertyWebkitTextSizeAdjust = 1221,
-    CSSPropertyWebkitTextStroke = 1222,
-    CSSPropertyWebkitTextStrokeColor = 1223,
-    CSSPropertyWebkitTextStrokeWidth = 1224,
-    CSSPropertyWebkitTransform = 1225,
-    CSSPropertyWebkitTransformOrigin = 1226,
-    CSSPropertyWebkitTransformOriginX = 1227,
-    CSSPropertyWebkitTransformOriginY = 1228,
-    CSSPropertyWebkitTransformOriginZ = 1229,
-    CSSPropertyWebkitTransformStyle = 1230,
-    CSSPropertyWebkitTransition = 1231,
-    CSSPropertyWebkitTransitionDelay = 1232,
-    CSSPropertyWebkitTransitionDuration = 1233,
-    CSSPropertyWebkitTransitionProperty = 1234,
-    CSSPropertyWebkitTransitionTimingFunction = 1235,
-    CSSPropertyWebkitUserDrag = 1236,
-    CSSPropertyWebkitUserModify = 1237,
-    CSSPropertyWebkitUserSelect = 1238,
-    CSSPropertyWebkitVariableDeclarationBlock = 1239,
-    CSSPropertyClipPath = 1240,
-    CSSPropertyClipRule = 1241,
-    CSSPropertyMask = 1242,
-    CSSPropertyEnableBackground = 1243,
-    CSSPropertyFilter = 1244,
-    CSSPropertyFloodColor = 1245,
-    CSSPropertyFloodOpacity = 1246,
-    CSSPropertyLightingColor = 1247,
-    CSSPropertyStopColor = 1248,
-    CSSPropertyStopOpacity = 1249,
-    CSSPropertyColorInterpolation = 1250,
-    CSSPropertyColorInterpolationFilters = 1251,
-    CSSPropertyColorProfile = 1252,
-    CSSPropertyColorRendering = 1253,
-    CSSPropertyFill = 1254,
-    CSSPropertyFillOpacity = 1255,
-    CSSPropertyFillRule = 1256,
-    CSSPropertyImageRendering = 1257,
-    CSSPropertyMarker = 1258,
-    CSSPropertyMarkerEnd = 1259,
-    CSSPropertyMarkerMid = 1260,
-    CSSPropertyMarkerStart = 1261,
-    CSSPropertyShapeRendering = 1262,
-    CSSPropertyStroke = 1263,
-    CSSPropertyStrokeDasharray = 1264,
-    CSSPropertyStrokeDashoffset = 1265,
-    CSSPropertyStrokeLinecap = 1266,
-    CSSPropertyStrokeLinejoin = 1267,
-    CSSPropertyStrokeMiterlimit = 1268,
-    CSSPropertyStrokeOpacity = 1269,
-    CSSPropertyStrokeWidth = 1270,
-    CSSPropertyAlignmentBaseline = 1271,
-    CSSPropertyBaselineShift = 1272,
-    CSSPropertyDominantBaseline = 1273,
-    CSSPropertyGlyphOrientationHorizontal = 1274,
-    CSSPropertyGlyphOrientationVertical = 1275,
-    CSSPropertyKerning = 1276,
-    CSSPropertyTextAnchor = 1277,
-    CSSPropertyWritingMode = 1278,
+    CSSPropertyWebkitBackgroundSize = 1153,
+    CSSPropertyWebkitBinding = 1154,
+    CSSPropertyWebkitBorderFit = 1155,
+    CSSPropertyWebkitBorderHorizontalSpacing = 1156,
+    CSSPropertyWebkitBorderImage = 1157,
+    CSSPropertyWebkitBorderRadius = 1158,
+    CSSPropertyWebkitBorderVerticalSpacing = 1159,
+    CSSPropertyWebkitBoxAlign = 1160,
+    CSSPropertyWebkitBoxDirection = 1161,
+    CSSPropertyWebkitBoxFlex = 1162,
+    CSSPropertyWebkitBoxFlexGroup = 1163,
+    CSSPropertyWebkitBoxLines = 1164,
+    CSSPropertyWebkitBoxOrdinalGroup = 1165,
+    CSSPropertyWebkitBoxOrient = 1166,
+    CSSPropertyWebkitBoxPack = 1167,
+    CSSPropertyWebkitBoxReflect = 1168,
+    CSSPropertyWebkitBoxShadow = 1169,
+    CSSPropertyWebkitBoxSizing = 1170,
+    CSSPropertyWebkitColumnBreakAfter = 1171,
+    CSSPropertyWebkitColumnBreakBefore = 1172,
+    CSSPropertyWebkitColumnBreakInside = 1173,
+    CSSPropertyWebkitColumnCount = 1174,
+    CSSPropertyWebkitColumnGap = 1175,
+    CSSPropertyWebkitColumnRule = 1176,
+    CSSPropertyWebkitColumnRuleColor = 1177,
+    CSSPropertyWebkitColumnRuleStyle = 1178,
+    CSSPropertyWebkitColumnRuleWidth = 1179,
+    CSSPropertyWebkitColumnWidth = 1180,
+    CSSPropertyWebkitColumns = 1181,
+    CSSPropertyWebkitFontSizeDelta = 1182,
+    CSSPropertyWebkitFontSmoothing = 1183,
+    CSSPropertyWebkitHighlight = 1184,
+    CSSPropertyWebkitLineBreak = 1185,
+    CSSPropertyWebkitLineClamp = 1186,
+    CSSPropertyWebkitMarginBottomCollapse = 1187,
+    CSSPropertyWebkitMarginCollapse = 1188,
+    CSSPropertyWebkitMarginStart = 1189,
+    CSSPropertyWebkitMarginTopCollapse = 1190,
+    CSSPropertyWebkitMarquee = 1191,
+    CSSPropertyWebkitMarqueeDirection = 1192,
+    CSSPropertyWebkitMarqueeIncrement = 1193,
+    CSSPropertyWebkitMarqueeRepetition = 1194,
+    CSSPropertyWebkitMarqueeSpeed = 1195,
+    CSSPropertyWebkitMarqueeStyle = 1196,
+    CSSPropertyWebkitMask = 1197,
+    CSSPropertyWebkitMaskAttachment = 1198,
+    CSSPropertyWebkitMaskBoxImage = 1199,
+    CSSPropertyWebkitMaskClip = 1200,
+    CSSPropertyWebkitMaskComposite = 1201,
+    CSSPropertyWebkitMaskImage = 1202,
+    CSSPropertyWebkitMaskOrigin = 1203,
+    CSSPropertyWebkitMaskPosition = 1204,
+    CSSPropertyWebkitMaskPositionX = 1205,
+    CSSPropertyWebkitMaskPositionY = 1206,
+    CSSPropertyWebkitMaskRepeat = 1207,
+    CSSPropertyWebkitMaskRepeatX = 1208,
+    CSSPropertyWebkitMaskRepeatY = 1209,
+    CSSPropertyWebkitMaskSize = 1210,
+    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1211,
+    CSSPropertyWebkitNbspMode = 1212,
+    CSSPropertyWebkitPaddingStart = 1213,
+    CSSPropertyWebkitPerspective = 1214,
+    CSSPropertyWebkitPerspectiveOrigin = 1215,
+    CSSPropertyWebkitPerspectiveOriginX = 1216,
+    CSSPropertyWebkitPerspectiveOriginY = 1217,
+    CSSPropertyWebkitRtlOrdering = 1218,
+    CSSPropertyWebkitTextDecorationsInEffect = 1219,
+    CSSPropertyWebkitTextFillColor = 1220,
+    CSSPropertyWebkitTextSecurity = 1221,
+    CSSPropertyWebkitTextSizeAdjust = 1222,
+    CSSPropertyWebkitTextStroke = 1223,
+    CSSPropertyWebkitTextStrokeColor = 1224,
+    CSSPropertyWebkitTextStrokeWidth = 1225,
+    CSSPropertyWebkitTransform = 1226,
+    CSSPropertyWebkitTransformOrigin = 1227,
+    CSSPropertyWebkitTransformOriginX = 1228,
+    CSSPropertyWebkitTransformOriginY = 1229,
+    CSSPropertyWebkitTransformOriginZ = 1230,
+    CSSPropertyWebkitTransformStyle = 1231,
+    CSSPropertyWebkitTransition = 1232,
+    CSSPropertyWebkitTransitionDelay = 1233,
+    CSSPropertyWebkitTransitionDuration = 1234,
+    CSSPropertyWebkitTransitionProperty = 1235,
+    CSSPropertyWebkitTransitionTimingFunction = 1236,
+    CSSPropertyWebkitUserDrag = 1237,
+    CSSPropertyWebkitUserModify = 1238,
+    CSSPropertyWebkitUserSelect = 1239,
+    CSSPropertyWebkitVariableDeclarationBlock = 1240,
+    CSSPropertyClipPath = 1241,
+    CSSPropertyClipRule = 1242,
+    CSSPropertyMask = 1243,
+    CSSPropertyEnableBackground = 1244,
+    CSSPropertyFilter = 1245,
+    CSSPropertyFloodColor = 1246,
+    CSSPropertyFloodOpacity = 1247,
+    CSSPropertyLightingColor = 1248,
+    CSSPropertyStopColor = 1249,
+    CSSPropertyStopOpacity = 1250,
+    CSSPropertyColorInterpolation = 1251,
+    CSSPropertyColorInterpolationFilters = 1252,
+    CSSPropertyColorProfile = 1253,
+    CSSPropertyColorRendering = 1254,
+    CSSPropertyFill = 1255,
+    CSSPropertyFillOpacity = 1256,
+    CSSPropertyFillRule = 1257,
+    CSSPropertyImageRendering = 1258,
+    CSSPropertyMarker = 1259,
+    CSSPropertyMarkerEnd = 1260,
+    CSSPropertyMarkerMid = 1261,
+    CSSPropertyMarkerStart = 1262,
+    CSSPropertyShapeRendering = 1263,
+    CSSPropertyStroke = 1264,
+    CSSPropertyStrokeDasharray = 1265,
+    CSSPropertyStrokeDashoffset = 1266,
+    CSSPropertyStrokeLinecap = 1267,
+    CSSPropertyStrokeLinejoin = 1268,
+    CSSPropertyStrokeMiterlimit = 1269,
+    CSSPropertyStrokeOpacity = 1270,
+    CSSPropertyStrokeWidth = 1271,
+    CSSPropertyAlignmentBaseline = 1272,
+    CSSPropertyBaselineShift = 1273,
+    CSSPropertyDominantBaseline = 1274,
+    CSSPropertyGlyphOrientationHorizontal = 1275,
+    CSSPropertyGlyphOrientationVertical = 1276,
+    CSSPropertyKerning = 1277,
+    CSSPropertyTextAnchor = 1278,
+    CSSPropertyWritingMode = 1279,
+    CSSPropertyWebkitShadow = 1280,
 };
 
 const int firstCSSProperty = 1001;
-const int numCSSProperties = 278;
+const int numCSSProperties = 280;
 const size_t maxCSSPropertyNameLength = 43;
 
 const char* getPropertyName(CSSPropertyID);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
index d4723406c5..bee17acaf0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
@@ -149,7 +149,7 @@ JSAbstractWorker::JSAbstractWorker(NonNullPassRefPtr<Structure> structure, JSDOM
 JSAbstractWorker::~JSAbstractWorker()
 {
     impl()->invalidateEventListeners();
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 void JSAbstractWorker::markChildren(MarkStack& markStack)
@@ -199,7 +199,7 @@ void setJSAbstractWorkerOnerror(ExecState* exec, JSObject* thisObject, JSValue v
 {
     UNUSED_PARAM(exec);
     AbstractWorker* imp = static_cast<AbstractWorker*>(static_cast<JSAbstractWorker*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnerror(globalObject->createJSAttributeEventListener(value));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
index 2f02580e46..348c086f99 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
@@ -76,7 +76,7 @@ JSBarInfo::JSBarInfo(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSBarInfo::~JSBarInfo()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSBarInfo::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
index 307b17ae9d..8d9905610e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
@@ -162,7 +162,7 @@ JSCSSRule::JSCSSRule(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSCSSRule::~JSCSSRule()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSCSSRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
index e02a6ce88a..0bb58c2212 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
@@ -140,7 +140,7 @@ JSCSSRuleList::JSCSSRuleList(NonNullPassRefPtr<Structure> structure, JSDOMGlobal
 
 JSCSSRuleList::~JSCSSRuleList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSCSSRuleList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
index 6292b6461e..5fbf98695d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
@@ -154,7 +154,7 @@ JSCSSStyleDeclaration::JSCSSStyleDeclaration(NonNullPassRefPtr<Structure> struct
 
 JSCSSStyleDeclaration::~JSCSSStyleDeclaration()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSCSSStyleDeclaration::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
index 22f6c30c83..1cb1b7582c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
@@ -145,7 +145,7 @@ JSCSSValue::JSCSSValue(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject
 
 JSCSSValue::~JSCSSValue()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSCSSValue::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
index ef1d726e74..975d56dce6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
@@ -147,7 +147,7 @@ JSCSSVariablesDeclaration::JSCSSVariablesDeclaration(NonNullPassRefPtr<Structure
 
 JSCSSVariablesDeclaration::~JSCSSVariablesDeclaration()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSCSSVariablesDeclaration::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
index aeeeb4f403..05be08c335 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
@@ -93,7 +93,7 @@ JSCanvasArray::JSCanvasArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobal
 
 JSCanvasArray::~JSCanvasArray()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSCanvasArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp
index cf1c0fe861..7099ce9efc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp
@@ -80,7 +80,7 @@ JSCanvasArrayBuffer::JSCanvasArrayBuffer(NonNullPassRefPtr<Structure> structure,
 
 JSCanvasArrayBuffer::~JSCanvasArrayBuffer()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSCanvasArrayBuffer::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
index 22de482856..4d2bfa3345 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
@@ -74,7 +74,7 @@ JSCanvasGradient::JSCanvasGradient(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSCanvasGradient::~JSCanvasGradient()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSCanvasGradient::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp
index 7356770986..cfb521be63 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp
@@ -61,7 +61,7 @@ JSCanvasPattern::JSCanvasPattern(NonNullPassRefPtr<Structure> structure, JSDOMGl
 
 JSCanvasPattern::~JSCanvasPattern()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSCanvasPattern::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
index 1d06dfeaed..07710a1935 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
@@ -126,7 +126,7 @@ JSCanvasRenderingContext::JSCanvasRenderingContext(NonNullPassRefPtr<Structure>
 
 JSCanvasRenderingContext::~JSCanvasRenderingContext()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSCanvasRenderingContext::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
index 175d6604b0..48dccd3dfc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
@@ -130,7 +130,7 @@ JSClientRect::JSClientRect(NonNullPassRefPtr<Structure> structure, JSDOMGlobalOb
 
 JSClientRect::~JSClientRect()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSClientRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
index 143ee8cd68..ff9d96308e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
@@ -141,7 +141,7 @@ JSClientRectList::JSClientRectList(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSClientRectList::~JSClientRectList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSClientRectList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
index f72e341b77..8f4a7d4715 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
@@ -145,7 +145,7 @@ JSClipboard::JSClipboard(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObje
 
 JSClipboard::~JSClipboard()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSClipboard::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp b/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
index 4bb40c61a0..06578909b1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
@@ -104,7 +104,7 @@ JSConsole::JSConsole(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSConsole::~JSConsole()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSConsole::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
index 6919ad26a4..348bcc60b0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
@@ -83,7 +83,7 @@ JSCoordinates::JSCoordinates(NonNullPassRefPtr<Structure> structure, JSDOMGlobal
 
 JSCoordinates::~JSCoordinates()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSCoordinates::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
index d17a3683f7..7c22959905 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
@@ -128,7 +128,7 @@ JSCounter::JSCounter(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSCounter::~JSCounter()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSCounter::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
index 2b65699ba4..17a527ee98 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
@@ -118,7 +118,7 @@ JSDOMApplicationCache::JSDOMApplicationCache(NonNullPassRefPtr<Structure> struct
 JSDOMApplicationCache::~JSDOMApplicationCache()
 {
     impl()->invalidateEventListeners();
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 void JSDOMApplicationCache::markChildren(MarkStack& markStack)
@@ -255,7 +255,7 @@ void setJSDOMApplicationCacheOnchecking(ExecState* exec, JSObject* thisObject, J
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnchecking(globalObject->createJSAttributeEventListener(value));
@@ -265,7 +265,7 @@ void setJSDOMApplicationCacheOnerror(ExecState* exec, JSObject* thisObject, JSVa
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnerror(globalObject->createJSAttributeEventListener(value));
@@ -275,7 +275,7 @@ void setJSDOMApplicationCacheOnnoupdate(ExecState* exec, JSObject* thisObject, J
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnnoupdate(globalObject->createJSAttributeEventListener(value));
@@ -285,7 +285,7 @@ void setJSDOMApplicationCacheOndownloading(ExecState* exec, JSObject* thisObject
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndownloading(globalObject->createJSAttributeEventListener(value));
@@ -295,7 +295,7 @@ void setJSDOMApplicationCacheOnprogress(ExecState* exec, JSObject* thisObject, J
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
@@ -305,7 +305,7 @@ void setJSDOMApplicationCacheOnupdateready(ExecState* exec, JSObject* thisObject
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnupdateready(globalObject->createJSAttributeEventListener(value));
@@ -315,7 +315,7 @@ void setJSDOMApplicationCacheOncached(ExecState* exec, JSObject* thisObject, JSV
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOncached(globalObject->createJSAttributeEventListener(value));
@@ -325,7 +325,7 @@ void setJSDOMApplicationCacheOnobsolete(ExecState* exec, JSObject* thisObject, J
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnobsolete(globalObject->createJSAttributeEventListener(value));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
index d625e2b6bf..ff889051a8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
@@ -185,7 +185,7 @@ JSDOMCoreException::JSDOMCoreException(NonNullPassRefPtr<Structure> structure, J
 
 JSDOMCoreException::~JSDOMCoreException()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSDOMCoreException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
index 62eef6c463..268647b033 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
@@ -148,7 +148,7 @@ JSDOMImplementation::JSDOMImplementation(NonNullPassRefPtr<Structure> structure,
 
 JSDOMImplementation::~JSDOMImplementation()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSDOMImplementation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
index 4af88cb62a..ecd336a369 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
@@ -147,7 +147,7 @@ JSDOMParser::JSDOMParser(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObje
 
 JSDOMParser::~JSDOMParser()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSDOMParser::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
index 45ec248632..e3a69b0d39 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
@@ -119,7 +119,7 @@ JSDOMSelection::JSDOMSelection(NonNullPassRefPtr<Structure> structure, JSDOMGlob
 
 JSDOMSelection::~JSDOMSelection()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSDOMSelection::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
index dc53217992..12edc4258c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
@@ -92,6 +92,7 @@
 #include "JSEventSource.h"
 #include "JSFile.h"
 #include "JSFileList.h"
+#include "JSHTMLAllCollection.h"
 #include "JSHTMLAnchorElement.h"
 #include "JSHTMLAppletElement.h"
 #include "JSHTMLAreaElement.h"
@@ -246,7 +247,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindow);
 
 /* Hash table */
 
-static const HashTableValue JSDOMWindowTableValues[296] =
+static const HashTableValue JSDOMWindowTableValues[297] =
 {
     { "screen", DontDelete|ReadOnly, (intptr_t)jsDOMWindowScreen, (intptr_t)0 },
     { "history", DontDelete|ReadOnly, (intptr_t)jsDOMWindowHistory, (intptr_t)0 },
@@ -468,6 +469,7 @@ static const HashTableValue JSDOMWindowTableValues[296] =
     { "HTMLTitleElement", DontDelete, (intptr_t)jsDOMWindowHTMLTitleElementConstructor, (intptr_t)setJSDOMWindowHTMLTitleElementConstructor },
     { "HTMLUListElement", DontDelete, (intptr_t)jsDOMWindowHTMLUListElementConstructor, (intptr_t)setJSDOMWindowHTMLUListElementConstructor },
     { "HTMLCollection", DontDelete, (intptr_t)jsDOMWindowHTMLCollectionConstructor, (intptr_t)setJSDOMWindowHTMLCollectionConstructor },
+    { "HTMLAllCollection", DontDelete, (intptr_t)jsDOMWindowHTMLAllCollectionConstructor, (intptr_t)setJSDOMWindowHTMLAllCollectionConstructor },
     { "Image", DontDelete, (intptr_t)jsDOMWindowImageConstructor, (intptr_t)setJSDOMWindowImageConstructor },
     { "Option", DontDelete, (intptr_t)jsDOMWindowOptionConstructor, (intptr_t)setJSDOMWindowOptionConstructor },
     { "CanvasRenderingContext2D", DontDelete, (intptr_t)jsDOMWindowCanvasRenderingContext2DConstructor, (intptr_t)setJSDOMWindowCanvasRenderingContext2DConstructor },
@@ -666,7 +668,6 @@ JSDOMWindow::JSDOMWindow(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMW
 JSDOMWindow::~JSDOMWindow()
 {
     impl()->invalidateEventListeners();
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 JSValue jsDOMWindowScreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -2846,6 +2847,14 @@ JSValue jsDOMWindowHTMLCollectionConstructor(ExecState* exec, const Identifier&,
     return JSHTMLCollection::getConstructor(exec, castedThis);
 }
 
+JSValue jsDOMWindowHTMLAllCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSHTMLAllCollection::getConstructor(exec, castedThis);
+}
+
 JSValue jsDOMWindowImageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
@@ -5261,6 +5270,14 @@ void setJSDOMWindowHTMLCollectionConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLCollection"), value);
 }
 
+void setJSDOMWindowHTMLAllCollectionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLAllCollection"), value);
+}
+
 void setJSDOMWindowImageConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
index 232c8eb81e..afc8106723 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
@@ -577,6 +577,8 @@ JSC::JSValue jsDOMWindowHTMLUListElementConstructor(JSC::ExecState*, const JSC::
 void setJSDOMWindowHTMLUListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowHTMLCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowHTMLCollectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLAllCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLAllCollectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowImageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowImageConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowOptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
index 586edd1b77..42b91d171e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
@@ -157,7 +157,7 @@ JSDataGridColumn::JSDataGridColumn(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSDataGridColumn::~JSDataGridColumn()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSDataGridColumn::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
index 08585fed18..945c257d0f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
@@ -151,7 +151,7 @@ JSDataGridColumnList::JSDataGridColumnList(NonNullPassRefPtr<Structure> structur
 
 JSDataGridColumnList::~JSDataGridColumnList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSDataGridColumnList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp b/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
index 5acd5b1d56..c5ac44db90 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
@@ -95,7 +95,7 @@ JSDatabase::JSDatabase(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject
 
 JSDatabase::~JSDatabase()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSDatabase::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
index 47a2936855..1fb3b467ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
@@ -304,7 +304,7 @@ JSDocument::JSDocument(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject
 
 JSDocument::~JSDocument()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), static_cast<Document*>(impl()));
+    forgetDOMObject(this, static_cast<Document*>(impl()));
 }
 
 JSObject* JSDocument::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -1099,7 +1099,7 @@ void setJSDocumentOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnabort(globalObject->createJSAttributeEventListener(value));
@@ -1109,7 +1109,7 @@ void setJSDocumentOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnblur(globalObject->createJSAttributeEventListener(value));
@@ -1119,7 +1119,7 @@ void setJSDocumentOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnchange(globalObject->createJSAttributeEventListener(value));
@@ -1129,7 +1129,7 @@ void setJSDocumentOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnclick(globalObject->createJSAttributeEventListener(value));
@@ -1139,7 +1139,7 @@ void setJSDocumentOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue v
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
@@ -1149,7 +1149,7 @@ void setJSDocumentOndblclick(ExecState* exec, JSObject* thisObject, JSValue valu
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
@@ -1159,7 +1159,7 @@ void setJSDocumentOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndrag(globalObject->createJSAttributeEventListener(value));
@@ -1169,7 +1169,7 @@ void setJSDocumentOndragend(ExecState* exec, JSObject* thisObject, JSValue value
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndragend(globalObject->createJSAttributeEventListener(value));
@@ -1179,7 +1179,7 @@ void setJSDocumentOndragenter(ExecState* exec, JSObject* thisObject, JSValue val
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
@@ -1189,7 +1189,7 @@ void setJSDocumentOndragleave(ExecState* exec, JSObject* thisObject, JSValue val
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
@@ -1199,7 +1199,7 @@ void setJSDocumentOndragover(ExecState* exec, JSObject* thisObject, JSValue valu
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndragover(globalObject->createJSAttributeEventListener(value));
@@ -1209,7 +1209,7 @@ void setJSDocumentOndragstart(ExecState* exec, JSObject* thisObject, JSValue val
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
@@ -1219,7 +1219,7 @@ void setJSDocumentOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndrop(globalObject->createJSAttributeEventListener(value));
@@ -1229,7 +1229,7 @@ void setJSDocumentOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnerror(globalObject->createJSAttributeEventListener(value));
@@ -1239,7 +1239,7 @@ void setJSDocumentOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
@@ -1249,7 +1249,7 @@ void setJSDocumentOninput(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOninput(globalObject->createJSAttributeEventListener(value));
@@ -1259,7 +1259,7 @@ void setJSDocumentOninvalid(ExecState* exec, JSObject* thisObject, JSValue value
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOninvalid(globalObject->createJSAttributeEventListener(value));
@@ -1269,7 +1269,7 @@ void setJSDocumentOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
@@ -1279,7 +1279,7 @@ void setJSDocumentOnkeypress(ExecState* exec, JSObject* thisObject, JSValue valu
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
@@ -1289,7 +1289,7 @@ void setJSDocumentOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
@@ -1299,7 +1299,7 @@ void setJSDocumentOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnload(globalObject->createJSAttributeEventListener(value));
@@ -1309,7 +1309,7 @@ void setJSDocumentOnmousedown(ExecState* exec, JSObject* thisObject, JSValue val
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
@@ -1319,7 +1319,7 @@ void setJSDocumentOnmousemove(ExecState* exec, JSObject* thisObject, JSValue val
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
@@ -1329,7 +1329,7 @@ void setJSDocumentOnmouseout(ExecState* exec, JSObject* thisObject, JSValue valu
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
@@ -1339,7 +1339,7 @@ void setJSDocumentOnmouseover(ExecState* exec, JSObject* thisObject, JSValue val
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
@@ -1349,7 +1349,7 @@ void setJSDocumentOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
@@ -1359,7 +1359,7 @@ void setJSDocumentOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue va
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
@@ -1369,7 +1369,7 @@ void setJSDocumentOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
@@ -1379,7 +1379,7 @@ void setJSDocumentOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnselect(globalObject->createJSAttributeEventListener(value));
@@ -1389,7 +1389,7 @@ void setJSDocumentOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
@@ -1399,7 +1399,7 @@ void setJSDocumentOnbeforecut(ExecState* exec, JSObject* thisObject, JSValue val
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnbeforecut(globalObject->createJSAttributeEventListener(value));
@@ -1409,7 +1409,7 @@ void setJSDocumentOncut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOncut(globalObject->createJSAttributeEventListener(value));
@@ -1419,7 +1419,7 @@ void setJSDocumentOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValue va
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnbeforecopy(globalObject->createJSAttributeEventListener(value));
@@ -1429,7 +1429,7 @@ void setJSDocumentOncopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOncopy(globalObject->createJSAttributeEventListener(value));
@@ -1439,7 +1439,7 @@ void setJSDocumentOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValue v
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnbeforepaste(globalObject->createJSAttributeEventListener(value));
@@ -1449,7 +1449,7 @@ void setJSDocumentOnpaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnpaste(globalObject->createJSAttributeEventListener(value));
@@ -1459,7 +1459,7 @@ void setJSDocumentOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnreset(globalObject->createJSAttributeEventListener(value));
@@ -1469,7 +1469,7 @@ void setJSDocumentOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
@@ -1479,7 +1479,7 @@ void setJSDocumentOnselectstart(ExecState* exec, JSObject* thisObject, JSValue v
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnselectstart(globalObject->createJSAttributeEventListener(value));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
index 869c23f5ed..3d3187f6d9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
@@ -897,7 +897,7 @@ void setJSElementOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnabort(globalObject->createJSAttributeEventListener(value));
@@ -907,7 +907,7 @@ void setJSElementOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnblur(globalObject->createJSAttributeEventListener(value));
@@ -917,7 +917,7 @@ void setJSElementOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnchange(globalObject->createJSAttributeEventListener(value));
@@ -927,7 +927,7 @@ void setJSElementOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnclick(globalObject->createJSAttributeEventListener(value));
@@ -937,7 +937,7 @@ void setJSElementOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue va
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
@@ -947,7 +947,7 @@ void setJSElementOndblclick(ExecState* exec, JSObject* thisObject, JSValue value
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
@@ -957,7 +957,7 @@ void setJSElementOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndrag(globalObject->createJSAttributeEventListener(value));
@@ -967,7 +967,7 @@ void setJSElementOndragend(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndragend(globalObject->createJSAttributeEventListener(value));
@@ -977,7 +977,7 @@ void setJSElementOndragenter(ExecState* exec, JSObject* thisObject, JSValue valu
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
@@ -987,7 +987,7 @@ void setJSElementOndragleave(ExecState* exec, JSObject* thisObject, JSValue valu
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
@@ -997,7 +997,7 @@ void setJSElementOndragover(ExecState* exec, JSObject* thisObject, JSValue value
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndragover(globalObject->createJSAttributeEventListener(value));
@@ -1007,7 +1007,7 @@ void setJSElementOndragstart(ExecState* exec, JSObject* thisObject, JSValue valu
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
@@ -1017,7 +1017,7 @@ void setJSElementOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndrop(globalObject->createJSAttributeEventListener(value));
@@ -1027,7 +1027,7 @@ void setJSElementOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnerror(globalObject->createJSAttributeEventListener(value));
@@ -1037,7 +1037,7 @@ void setJSElementOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
@@ -1047,7 +1047,7 @@ void setJSElementOninput(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOninput(globalObject->createJSAttributeEventListener(value));
@@ -1057,7 +1057,7 @@ void setJSElementOninvalid(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOninvalid(globalObject->createJSAttributeEventListener(value));
@@ -1067,7 +1067,7 @@ void setJSElementOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
@@ -1077,7 +1077,7 @@ void setJSElementOnkeypress(ExecState* exec, JSObject* thisObject, JSValue value
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
@@ -1087,7 +1087,7 @@ void setJSElementOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
@@ -1097,7 +1097,7 @@ void setJSElementOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnload(globalObject->createJSAttributeEventListener(value));
@@ -1107,7 +1107,7 @@ void setJSElementOnmousedown(ExecState* exec, JSObject* thisObject, JSValue valu
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
@@ -1117,7 +1117,7 @@ void setJSElementOnmousemove(ExecState* exec, JSObject* thisObject, JSValue valu
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
@@ -1127,7 +1127,7 @@ void setJSElementOnmouseout(ExecState* exec, JSObject* thisObject, JSValue value
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
@@ -1137,7 +1137,7 @@ void setJSElementOnmouseover(ExecState* exec, JSObject* thisObject, JSValue valu
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
@@ -1147,7 +1147,7 @@ void setJSElementOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
@@ -1157,7 +1157,7 @@ void setJSElementOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue val
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
@@ -1167,7 +1167,7 @@ void setJSElementOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
@@ -1177,7 +1177,7 @@ void setJSElementOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnselect(globalObject->createJSAttributeEventListener(value));
@@ -1187,7 +1187,7 @@ void setJSElementOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
@@ -1197,7 +1197,7 @@ void setJSElementOnbeforecut(ExecState* exec, JSObject* thisObject, JSValue valu
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnbeforecut(globalObject->createJSAttributeEventListener(value));
@@ -1207,7 +1207,7 @@ void setJSElementOncut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOncut(globalObject->createJSAttributeEventListener(value));
@@ -1217,7 +1217,7 @@ void setJSElementOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValue val
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnbeforecopy(globalObject->createJSAttributeEventListener(value));
@@ -1227,7 +1227,7 @@ void setJSElementOncopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOncopy(globalObject->createJSAttributeEventListener(value));
@@ -1237,7 +1237,7 @@ void setJSElementOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValue va
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnbeforepaste(globalObject->createJSAttributeEventListener(value));
@@ -1247,7 +1247,7 @@ void setJSElementOnpaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnpaste(globalObject->createJSAttributeEventListener(value));
@@ -1257,7 +1257,7 @@ void setJSElementOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnreset(globalObject->createJSAttributeEventListener(value));
@@ -1267,7 +1267,7 @@ void setJSElementOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
@@ -1277,7 +1277,7 @@ void setJSElementOnselectstart(ExecState* exec, JSObject* thisObject, JSValue va
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnselectstart(globalObject->createJSAttributeEventListener(value));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
index acd952f7c3..67eefd0076 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
@@ -199,7 +199,7 @@ JSEvent::JSEvent(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* glob
 
 JSEvent::~JSEvent()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
index 2246c8fa84..bd25734f55 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
@@ -151,7 +151,7 @@ JSEventException::JSEventException(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSEventException::~JSEventException()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSEventException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp
index dcec14e82c..526d8af573 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp
@@ -120,7 +120,7 @@ JSEventSource::JSEventSource(NonNullPassRefPtr<Structure> structure, JSDOMGlobal
 JSEventSource::~JSEventSource()
 {
     impl()->invalidateEventListeners();
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 void JSEventSource::markChildren(MarkStack& markStack)
@@ -205,7 +205,7 @@ void setJSEventSourceOnopen(ExecState* exec, JSObject* thisObject, JSValue value
 {
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(static_cast<JSEventSource*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnopen(globalObject->createJSAttributeEventListener(value));
@@ -215,7 +215,7 @@ void setJSEventSourceOnmessage(ExecState* exec, JSObject* thisObject, JSValue va
 {
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(static_cast<JSEventSource*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
@@ -225,7 +225,7 @@ void setJSEventSourceOnerror(ExecState* exec, JSObject* thisObject, JSValue valu
 {
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(static_cast<JSEventSource*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnerror(globalObject->createJSAttributeEventListener(value));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
index 2ee62aef1c..59192af6d2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
@@ -128,7 +128,7 @@ JSFile::JSFile(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* global
 
 JSFile::~JSFile()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSFile::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
index 931aae4e83..50e1f0aba3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
@@ -141,7 +141,7 @@ JSFileList::JSFileList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject
 
 JSFileList::~JSFileList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSFileList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
index 17a05096d3..be50fac15d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
@@ -92,7 +92,7 @@ JSGeolocation::JSGeolocation(NonNullPassRefPtr<Structure> structure, JSDOMGlobal
 
 JSGeolocation::~JSGeolocation()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSGeolocation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
index a77413b397..ab42d2b185 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
@@ -80,7 +80,7 @@ JSGeoposition::JSGeoposition(NonNullPassRefPtr<Structure> structure, JSDOMGlobal
 
 JSGeoposition::~JSGeoposition()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSGeoposition::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAllCollection.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAllCollection.cpp
new file mode 100644
index 0000000000..4a8fc83920
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAllCollection.cpp
@@ -0,0 +1,292 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSHTMLAllCollection.h"
+
+#include "AtomicString.h"
+#include "HTMLAllCollection.h"
+#include "JSNode.h"
+#include "JSNodeList.h"
+#include "NameNodeList.h"
+#include "Node.h"
+#include "NodeList.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLAllCollection);
+
+/* Hash table */
+
+static const HashTableValue JSHTMLAllCollectionTableValues[3] =
+{
+    { "length", DontDelete|ReadOnly, (intptr_t)jsHTMLAllCollectionLength, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLAllCollectionConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSHTMLAllCollectionTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 15, JSHTMLAllCollectionTableValues, 0 };
+#else
+    { 5, 3, JSHTMLAllCollectionTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSHTMLAllCollectionConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSHTMLAllCollectionConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSHTMLAllCollectionConstructorTableValues, 0 };
+#else
+    { 1, 0, JSHTMLAllCollectionConstructorTableValues, 0 };
+#endif
+
+class JSHTMLAllCollectionConstructor : public DOMConstructorObject {
+public:
+    JSHTMLAllCollectionConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSHTMLAllCollectionConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSHTMLAllCollectionPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSHTMLAllCollectionConstructor::s_info = { "HTMLAllCollectionConstructor", 0, &JSHTMLAllCollectionConstructorTable, 0 };
+
+bool JSHTMLAllCollectionConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSHTMLAllCollectionConstructor, DOMObject>(exec, &JSHTMLAllCollectionConstructorTable, this, propertyName, slot);
+}
+
+bool JSHTMLAllCollectionConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLAllCollectionConstructor, DOMObject>(exec, &JSHTMLAllCollectionConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSHTMLAllCollectionPrototypeTableValues[4] =
+{
+    { "item", DontDelete|Function, (intptr_t)jsHTMLAllCollectionPrototypeFunctionItem, (intptr_t)1 },
+    { "namedItem", DontDelete|Function, (intptr_t)jsHTMLAllCollectionPrototypeFunctionNamedItem, (intptr_t)1 },
+    { "tags", DontDelete|Function, (intptr_t)jsHTMLAllCollectionPrototypeFunctionTags, (intptr_t)1 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSHTMLAllCollectionPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 7, JSHTMLAllCollectionPrototypeTableValues, 0 };
+#else
+    { 8, 7, JSHTMLAllCollectionPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSHTMLAllCollectionPrototype::s_info = { "HTMLAllCollectionPrototype", 0, &JSHTMLAllCollectionPrototypeTable, 0 };
+
+JSObject* JSHTMLAllCollectionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSHTMLAllCollection>(exec, globalObject);
+}
+
+bool JSHTMLAllCollectionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSHTMLAllCollectionPrototypeTable, this, propertyName, slot);
+}
+
+bool JSHTMLAllCollectionPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLAllCollectionPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSHTMLAllCollection::s_info = { "HTMLAllCollection", 0, &JSHTMLAllCollectionTable, 0 };
+
+JSHTMLAllCollection::JSHTMLAllCollection(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLAllCollection> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSHTMLAllCollection::~JSHTMLAllCollection()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSHTMLAllCollection::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSHTMLAllCollectionPrototype(JSHTMLAllCollectionPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSHTMLAllCollection::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    JSValue proto = prototype();
+    if (proto.isObject() && static_cast<JSObject*>(asObject(proto))->hasProperty(exec, propertyName))
+        return false;
+
+    const HashEntry* entry = JSHTMLAllCollectionTable.entry(exec, propertyName);
+    if (entry) {
+        slot.setCustom(this, entry->propertyGetter());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<HTMLAllCollection*>(impl())->length()) {
+        slot.setCustomIndex(this, index, indexGetter);
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<HTMLAllCollection*>(impl()), propertyName)) {
+        slot.setCustom(this, nameGetter);
+        return true;
+    }
+    return getStaticValueSlot<JSHTMLAllCollection, Base>(exec, &JSHTMLAllCollectionTable, this, propertyName, slot);
+}
+
+bool JSHTMLAllCollection::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    JSValue proto = prototype();
+    if (proto.isObject() && static_cast<JSObject*>(asObject(proto))->hasProperty(exec, propertyName))
+        return false;
+
+    const HashEntry* entry = JSHTMLAllCollectionTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<HTMLAllCollection*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<HTMLAllCollection*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    return getStaticValueDescriptor<JSHTMLAllCollection, Base>(exec, &JSHTMLAllCollectionTable, this, propertyName, descriptor);
+}
+
+bool JSHTMLAllCollection::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<HTMLAllCollection*>(impl())->length()) {
+        slot.setCustomIndex(this, propertyName, indexGetter);
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+JSValue jsHTMLAllCollectionLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLAllCollection* castedThis = static_cast<JSHTMLAllCollection*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    HTMLAllCollection* imp = static_cast<HTMLAllCollection*>(castedThis->impl());
+    return jsNumber(exec, imp->length());
+}
+
+JSValue jsHTMLAllCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLAllCollection* domObject = static_cast<JSHTMLAllCollection*>(asObject(slot.slotBase()));
+    return JSHTMLAllCollection::getConstructor(exec, domObject->globalObject());
+}
+void JSHTMLAllCollection::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    for (unsigned i = 0; i < static_cast<HTMLAllCollection*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames);
+}
+
+JSValue JSHTMLAllCollection::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSHTMLAllCollectionConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsHTMLAllCollectionPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLAllCollection::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLAllCollection* castedThisObj = static_cast<JSHTMLAllCollection*>(asObject(thisValue));
+    return castedThisObj->item(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsHTMLAllCollectionPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLAllCollection::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLAllCollection* castedThisObj = static_cast<JSHTMLAllCollection*>(asObject(thisValue));
+    return castedThisObj->namedItem(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsHTMLAllCollectionPrototypeFunctionTags(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLAllCollection::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLAllCollection* castedThisObj = static_cast<JSHTMLAllCollection*>(asObject(thisValue));
+    HTMLAllCollection* imp = static_cast<HTMLAllCollection*>(castedThisObj->impl());
+    const UString& name = args.at(0).toString(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->tags(name)));
+    return result;
+}
+
+
+JSValue JSHTMLAllCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLAllCollection* thisObj = static_cast<JSHTMLAllCollection*>(asObject(slot.slotBase()));
+    return toJS(exec, thisObj->globalObject(), static_cast<HTMLAllCollection*>(thisObj->impl())->item(slot.index()));
+}
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, HTMLAllCollection* object)
+{
+    return getDOMObjectWrapper<JSHTMLAllCollection>(exec, globalObject, object);
+}
+HTMLAllCollection* toHTMLAllCollection(JSC::JSValue value)
+{
+    return value.inherits(&JSHTMLAllCollection::s_info) ? static_cast<JSHTMLAllCollection*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAllCollection.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAllCollection.h
new file mode 100644
index 0000000000..000986e68a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAllCollection.h
@@ -0,0 +1,104 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSHTMLAllCollection_h
+#define JSHTMLAllCollection_h
+
+#include "DOMObjectWithSVGContext.h"
+#include "JSDOMBinding.h"
+#include <runtime/CallData.h>
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class HTMLAllCollection;
+
+class JSHTMLAllCollection : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSHTMLAllCollection(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLAllCollection>);
+    virtual ~JSHTMLAllCollection();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+    virtual JSC::CallType getCallData(JSC::CallData&);
+
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual bool toBoolean(JSC::ExecState*) const { return false; };
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+
+    // Custom functions
+    JSC::JSValue item(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue namedItem(JSC::ExecState*, const JSC::ArgList&);
+    HTMLAllCollection* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<HTMLAllCollection> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | JSC::MasqueradesAsUndefined | Base::StructureFlags;
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+private:
+    static bool canGetItemsForName(JSC::ExecState*, HTMLAllCollection*, const JSC::Identifier&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, HTMLAllCollection*);
+HTMLAllCollection* toHTMLAllCollection(JSC::JSValue);
+
+class JSHTMLAllCollectionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+    JSHTMLAllCollectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsHTMLAllCollectionPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLAllCollectionPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLAllCollectionPrototypeFunctionTags(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsHTMLAllCollectionLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAllCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
index 920f152760..5e817991a1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
@@ -350,7 +350,7 @@ void setJSHTMLBodyElementOnbeforeunload(ExecState* exec, JSObject* thisObject, J
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnbeforeunload(globalObject->createJSAttributeEventListener(value));
@@ -360,7 +360,7 @@ void setJSHTMLBodyElementOnhashchange(ExecState* exec, JSObject* thisObject, JSV
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnhashchange(globalObject->createJSAttributeEventListener(value));
@@ -370,7 +370,7 @@ void setJSHTMLBodyElementOnmessage(ExecState* exec, JSObject* thisObject, JSValu
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
@@ -380,7 +380,7 @@ void setJSHTMLBodyElementOnoffline(ExecState* exec, JSObject* thisObject, JSValu
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnoffline(globalObject->createJSAttributeEventListener(value));
@@ -390,7 +390,7 @@ void setJSHTMLBodyElementOnonline(ExecState* exec, JSObject* thisObject, JSValue
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnonline(globalObject->createJSAttributeEventListener(value));
@@ -400,7 +400,7 @@ void setJSHTMLBodyElementOnresize(ExecState* exec, JSObject* thisObject, JSValue
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnresize(globalObject->createJSAttributeEventListener(value));
@@ -410,7 +410,7 @@ void setJSHTMLBodyElementOnstorage(ExecState* exec, JSObject* thisObject, JSValu
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnstorage(globalObject->createJSAttributeEventListener(value));
@@ -420,7 +420,7 @@ void setJSHTMLBodyElementOnunload(ExecState* exec, JSObject* thisObject, JSValue
 {
     UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnunload(globalObject->createJSAttributeEventListener(value));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
index 63c0d93f54..213b3c5868 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
@@ -24,10 +24,7 @@
 #include "AtomicString.h"
 #include "HTMLCollection.h"
 #include "JSNode.h"
-#include "JSNodeList.h"
-#include "NameNodeList.h"
 #include "Node.h"
-#include "NodeList.h"
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/PropertyNameArray.h>
@@ -104,11 +101,10 @@ bool JSHTMLCollectionConstructor::getOwnPropertyDescriptor(ExecState* exec, cons
 
 /* Hash table for prototype */
 
-static const HashTableValue JSHTMLCollectionPrototypeTableValues[4] =
+static const HashTableValue JSHTMLCollectionPrototypeTableValues[3] =
 {
     { "item", DontDelete|Function, (intptr_t)jsHTMLCollectionPrototypeFunctionItem, (intptr_t)1 },
     { "namedItem", DontDelete|Function, (intptr_t)jsHTMLCollectionPrototypeFunctionNamedItem, (intptr_t)1 },
-    { "tags", DontDelete|Function, (intptr_t)jsHTMLCollectionPrototypeFunctionTags, (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -116,7 +112,7 @@ static JSC_CONST_HASHTABLE HashTable JSHTMLCollectionPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 7, JSHTMLCollectionPrototypeTableValues, 0 };
 #else
-    { 8, 7, JSHTMLCollectionPrototypeTableValues, 0 };
+    { 5, 3, JSHTMLCollectionPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSHTMLCollectionPrototype::s_info = { "HTMLCollectionPrototype", 0, &JSHTMLCollectionPrototypeTable, 0 };
@@ -146,7 +142,7 @@ JSHTMLCollection::JSHTMLCollection(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSHTMLCollection::~JSHTMLCollection()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSHTMLCollection::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -260,20 +256,6 @@ JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionNamedItem(ExecState* exec
     return castedThisObj->namedItem(exec, args);
 }
 
-JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionTags(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSHTMLCollection::s_info))
-        return throwError(exec, TypeError);
-    JSHTMLCollection* castedThisObj = static_cast<JSHTMLCollection*>(asObject(thisValue));
-    HTMLCollection* imp = static_cast<HTMLCollection*>(castedThisObj->impl());
-    const UString& name = args.at(0).toString(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->tags(name)));
-    return result;
-}
-
 
 JSValue JSHTMLCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
index 447f620843..e14a2c2109 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
@@ -92,7 +92,6 @@ protected:
 
 JSC::JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionTags(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
 JSC::JSValue jsHTMLCollectionLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
index f336c76066..9e506a006d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
@@ -300,7 +300,7 @@ void setJSHTMLFrameSetElementOnbeforeunload(ExecState* exec, JSObject* thisObjec
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnbeforeunload(globalObject->createJSAttributeEventListener(value));
@@ -310,7 +310,7 @@ void setJSHTMLFrameSetElementOnhashchange(ExecState* exec, JSObject* thisObject,
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnhashchange(globalObject->createJSAttributeEventListener(value));
@@ -320,7 +320,7 @@ void setJSHTMLFrameSetElementOnmessage(ExecState* exec, JSObject* thisObject, JS
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
@@ -330,7 +330,7 @@ void setJSHTMLFrameSetElementOnoffline(ExecState* exec, JSObject* thisObject, JS
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnoffline(globalObject->createJSAttributeEventListener(value));
@@ -340,7 +340,7 @@ void setJSHTMLFrameSetElementOnonline(ExecState* exec, JSObject* thisObject, JSV
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnonline(globalObject->createJSAttributeEventListener(value));
@@ -350,7 +350,7 @@ void setJSHTMLFrameSetElementOnresize(ExecState* exec, JSObject* thisObject, JSV
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnresize(globalObject->createJSAttributeEventListener(value));
@@ -360,7 +360,7 @@ void setJSHTMLFrameSetElementOnstorage(ExecState* exec, JSObject* thisObject, JS
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnstorage(globalObject->createJSAttributeEventListener(value));
@@ -370,7 +370,7 @@ void setJSHTMLFrameSetElementOnunload(ExecState* exec, JSObject* thisObject, JSV
 {
     UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnunload(globalObject->createJSAttributeEventListener(value));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp b/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
index 5331441a67..02be6baaf4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
@@ -92,7 +92,7 @@ JSHistory::JSHistory(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSHistory::~JSHistory()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSHistory::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
index a21fb876fd..1de3c43b60 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
@@ -126,7 +126,7 @@ JSImageData::JSImageData(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObje
 
 JSImageData::~JSImageData()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSImageData::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
index 8da82ccbd7..f72baaafc7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
@@ -214,7 +214,7 @@ JSInspectorBackend::JSInspectorBackend(NonNullPassRefPtr<Structure> structure, J
 
 JSInspectorBackend::~JSInspectorBackend()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSInspectorBackend::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
index 798d5409c5..2acd1afcfb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
@@ -101,7 +101,7 @@ JSJavaScriptCallFrame::JSJavaScriptCallFrame(NonNullPassRefPtr<Structure> struct
 
 JSJavaScriptCallFrame::~JSJavaScriptCallFrame()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSJavaScriptCallFrame::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
index ca2120512b..bb4d56cf05 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
@@ -108,7 +108,7 @@ JSLocation::JSLocation(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject
 
 JSLocation::~JSLocation()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSLocation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp b/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
index b7d4c19d72..93cde9f624 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
@@ -138,7 +138,7 @@ JSMedia::JSMedia(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* glob
 
 JSMedia::~JSMedia()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSMedia::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
index 97e35e0195..534a585dc0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
@@ -146,7 +146,7 @@ JSMediaError::JSMediaError(NonNullPassRefPtr<Structure> structure, JSDOMGlobalOb
 
 JSMediaError::~JSMediaError()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSMediaError::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
index 93a17b494d..e7b758edf3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
@@ -142,7 +142,7 @@ JSMediaList::JSMediaList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObje
 
 JSMediaList::~JSMediaList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSMediaList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
index 4fdac64a85..8ba6f014d0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
@@ -87,7 +87,7 @@ JSMessageChannel::JSMessageChannel(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSMessageChannel::~JSMessageChannel()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSMessageChannel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
index 28e1492d6e..a65091c441 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
@@ -158,7 +158,7 @@ JSMessagePort::JSMessagePort(NonNullPassRefPtr<Structure> structure, JSDOMGlobal
 JSMessagePort::~JSMessagePort()
 {
     impl()->invalidateEventListeners();
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSMessagePort::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -202,7 +202,7 @@ void setJSMessagePortOnmessage(ExecState* exec, JSObject* thisObject, JSValue va
 {
     UNUSED_PARAM(exec);
     MessagePort* imp = static_cast<MessagePort*>(static_cast<JSMessagePort*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
index f797df23c5..c91aaebc00 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
@@ -131,7 +131,7 @@ JSMimeType::JSMimeType(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject
 
 JSMimeType::~JSMimeType()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSMimeType::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
index 0384539580..3c7b7404ab 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
@@ -142,7 +142,7 @@ JSMimeTypeArray::JSMimeTypeArray(NonNullPassRefPtr<Structure> structure, JSDOMGl
 
 JSMimeTypeArray::~JSMimeTypeArray()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSMimeTypeArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
index e3cc8d2998..e9c79a1e28 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
@@ -147,7 +147,7 @@ JSNamedNodeMap::JSNamedNodeMap(NonNullPassRefPtr<Structure> structure, JSDOMGlob
 
 JSNamedNodeMap::~JSNamedNodeMap()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSNamedNodeMap::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp b/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
index 6dcda620f2..1c8e190b27 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
@@ -108,7 +108,7 @@ JSNavigator::JSNavigator(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObje
 
 JSNavigator::~JSNavigator()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSNavigator::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
index e1328292ea..e3a20067a9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
@@ -221,7 +221,7 @@ JSNode::JSNode(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* global
 JSNode::~JSNode()
 {
     impl()->invalidateEventListeners();
-    forgetDOMNode(impl()->document(), impl());
+    forgetDOMNode(this, impl(), impl()->document());
 }
 
 JSObject* JSNode::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
index 141a060741..22726f68d0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
@@ -167,7 +167,7 @@ JSNodeFilter::JSNodeFilter(NonNullPassRefPtr<Structure> structure, JSDOMGlobalOb
 
 JSNodeFilter::~JSNodeFilter()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSNodeFilter::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
index cf85e40073..8570d246fe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
@@ -148,7 +148,7 @@ JSNodeIterator::JSNodeIterator(NonNullPassRefPtr<Structure> structure, JSDOMGlob
 
 JSNodeIterator::~JSNodeIterator()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSNodeIterator::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
index 01ee9acff8..3f3131e24e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
@@ -142,7 +142,7 @@ JSNodeList::JSNodeList(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject
 
 JSNodeList::~JSNodeList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSNodeList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
index 035a352f54..1c7b6ec608 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
@@ -147,7 +147,7 @@ JSPlugin::JSPlugin(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* gl
 
 JSPlugin::~JSPlugin()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSPlugin::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
index bd0b579891..38a9346107 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
@@ -143,7 +143,7 @@ JSPluginArray::JSPluginArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobal
 
 JSPluginArray::~JSPluginArray()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSPluginArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
index e178bd9b9a..fffa0c1efb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
@@ -146,7 +146,7 @@ JSPositionError::JSPositionError(NonNullPassRefPtr<Structure> structure, JSDOMGl
 
 JSPositionError::~JSPositionError()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSPositionError::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
index 0dff99a114..e45ce667a9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
@@ -128,7 +128,7 @@ JSRGBColor::JSRGBColor(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject
 
 JSRGBColor::~JSRGBColor()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSRGBColor::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
index cc59119bb9..bc9979b249 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
@@ -194,7 +194,7 @@ JSRange::JSRange(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* glob
 
 JSRange::~JSRange()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSRange::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
index 2f8e618b50..bbb172d09c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
@@ -145,7 +145,7 @@ JSRangeException::JSRangeException(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSRangeException::~JSRangeException()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSRangeException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
index 37c4669407..e57d6882ba 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
@@ -129,7 +129,7 @@ JSRect::JSRect(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* global
 
 JSRect::~JSRect()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
index a318e1d047..79fdc893f9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
@@ -83,7 +83,7 @@ JSSQLError::JSSQLError(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject
 
 JSSQLError::~JSSQLError()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSQLError::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
index 223de95440..fa85ad64d6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
@@ -84,7 +84,7 @@ JSSQLResultSet::JSSQLResultSet(NonNullPassRefPtr<Structure> structure, JSDOMGlob
 
 JSSQLResultSet::~JSSQLResultSet()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSQLResultSet::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp
index dddf0c494c..090e4f7323 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp
@@ -92,7 +92,7 @@ JSSQLResultSetRowList::JSSQLResultSetRowList(NonNullPassRefPtr<Structure> struct
 
 JSSQLResultSetRowList::~JSSQLResultSetRowList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSQLResultSetRowList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp
index c2c0e542d5..e165dad4f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp
@@ -76,7 +76,7 @@ JSSQLTransaction::JSSQLTransaction(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSSQLTransaction::~JSSQLTransaction()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSQLTransaction::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
index 220f4a6846..e6d47956d2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
@@ -156,7 +156,7 @@ JSSVGAngle::JSSVGAngle(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject
 
 JSSVGAngle::~JSSVGAngle()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGAngle::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp
index c09ce1cf20..599f5ca287 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp
@@ -81,7 +81,7 @@ JSSVGAnimatedAngle::JSSVGAnimatedAngle(NonNullPassRefPtr<Structure> structure, J
 
 JSSVGAnimatedAngle::~JSSVGAnimatedAngle()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGAnimatedAngle::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp
index fb3f4c83d9..131b358697 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp
@@ -79,7 +79,7 @@ JSSVGAnimatedBoolean::JSSVGAnimatedBoolean(NonNullPassRefPtr<Structure> structur
 
 JSSVGAnimatedBoolean::~JSSVGAnimatedBoolean()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGAnimatedBoolean::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp
index 8fbe43e782..6a27988b32 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp
@@ -80,7 +80,7 @@ JSSVGAnimatedEnumeration::JSSVGAnimatedEnumeration(NonNullPassRefPtr<Structure>
 
 JSSVGAnimatedEnumeration::~JSSVGAnimatedEnumeration()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGAnimatedEnumeration::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp
index f52a51be72..86c388b660 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp
@@ -80,7 +80,7 @@ JSSVGAnimatedInteger::JSSVGAnimatedInteger(NonNullPassRefPtr<Structure> structur
 
 JSSVGAnimatedInteger::~JSSVGAnimatedInteger()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGAnimatedInteger::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp
index 50826a7092..f5fff5eff6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp
@@ -80,7 +80,7 @@ JSSVGAnimatedLength::JSSVGAnimatedLength(NonNullPassRefPtr<Structure> structure,
 
 JSSVGAnimatedLength::~JSSVGAnimatedLength()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGAnimatedLength::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp
index b0c37439b3..5525640c01 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp
@@ -81,7 +81,7 @@ JSSVGAnimatedLengthList::JSSVGAnimatedLengthList(NonNullPassRefPtr<Structure> st
 
 JSSVGAnimatedLengthList::~JSSVGAnimatedLengthList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGAnimatedLengthList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp
index ef16117c8e..69f1490fe9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp
@@ -80,7 +80,7 @@ JSSVGAnimatedNumber::JSSVGAnimatedNumber(NonNullPassRefPtr<Structure> structure,
 
 JSSVGAnimatedNumber::~JSSVGAnimatedNumber()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGAnimatedNumber::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp
index af11dbdf6e..0fa8afa3d0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp
@@ -81,7 +81,7 @@ JSSVGAnimatedNumberList::JSSVGAnimatedNumberList(NonNullPassRefPtr<Structure> st
 
 JSSVGAnimatedNumberList::~JSSVGAnimatedNumberList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGAnimatedNumberList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp
index 53f0b60034..b64ee3ac69 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp
@@ -81,7 +81,7 @@ JSSVGAnimatedPreserveAspectRatio::JSSVGAnimatedPreserveAspectRatio(NonNullPassRe
 
 JSSVGAnimatedPreserveAspectRatio::~JSSVGAnimatedPreserveAspectRatio()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGAnimatedPreserveAspectRatio::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp
index 432a4d5844..0db579b5e0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp
@@ -81,7 +81,7 @@ JSSVGAnimatedRect::JSSVGAnimatedRect(NonNullPassRefPtr<Structure> structure, JSD
 
 JSSVGAnimatedRect::~JSSVGAnimatedRect()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGAnimatedRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp
index c3ccd926c0..a26a070781 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp
@@ -82,7 +82,7 @@ JSSVGAnimatedString::JSSVGAnimatedString(NonNullPassRefPtr<Structure> structure,
 
 JSSVGAnimatedString::~JSSVGAnimatedString()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGAnimatedString::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp
index 52b239518c..62c3121455 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp
@@ -81,7 +81,7 @@ JSSVGAnimatedTransformList::JSSVGAnimatedTransformList(NonNullPassRefPtr<Structu
 
 JSSVGAnimatedTransformList::~JSSVGAnimatedTransformList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGAnimatedTransformList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp
index 10d375d2c7..1bb0736acb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp
@@ -153,7 +153,7 @@ JSSVGElementInstance::JSSVGElementInstance(NonNullPassRefPtr<Structure> structur
 
 JSSVGElementInstance::~JSSVGElementInstance()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGElementInstance::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -724,7 +724,7 @@ void setJSSVGElementInstanceOnabort(ExecState* exec, JSObject* thisObject, JSVal
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnabort(globalObject->createJSAttributeEventListener(value));
@@ -734,7 +734,7 @@ void setJSSVGElementInstanceOnblur(ExecState* exec, JSObject* thisObject, JSValu
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnblur(globalObject->createJSAttributeEventListener(value));
@@ -744,7 +744,7 @@ void setJSSVGElementInstanceOnchange(ExecState* exec, JSObject* thisObject, JSVa
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnchange(globalObject->createJSAttributeEventListener(value));
@@ -754,7 +754,7 @@ void setJSSVGElementInstanceOnclick(ExecState* exec, JSObject* thisObject, JSVal
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnclick(globalObject->createJSAttributeEventListener(value));
@@ -764,7 +764,7 @@ void setJSSVGElementInstanceOncontextmenu(ExecState* exec, JSObject* thisObject,
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
@@ -774,7 +774,7 @@ void setJSSVGElementInstanceOndblclick(ExecState* exec, JSObject* thisObject, JS
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
@@ -784,7 +784,7 @@ void setJSSVGElementInstanceOnerror(ExecState* exec, JSObject* thisObject, JSVal
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnerror(globalObject->createJSAttributeEventListener(value));
@@ -794,7 +794,7 @@ void setJSSVGElementInstanceOnfocus(ExecState* exec, JSObject* thisObject, JSVal
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
@@ -804,7 +804,7 @@ void setJSSVGElementInstanceOninput(ExecState* exec, JSObject* thisObject, JSVal
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOninput(globalObject->createJSAttributeEventListener(value));
@@ -814,7 +814,7 @@ void setJSSVGElementInstanceOnkeydown(ExecState* exec, JSObject* thisObject, JSV
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
@@ -824,7 +824,7 @@ void setJSSVGElementInstanceOnkeypress(ExecState* exec, JSObject* thisObject, JS
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
@@ -834,7 +834,7 @@ void setJSSVGElementInstanceOnkeyup(ExecState* exec, JSObject* thisObject, JSVal
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
@@ -844,7 +844,7 @@ void setJSSVGElementInstanceOnload(ExecState* exec, JSObject* thisObject, JSValu
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnload(globalObject->createJSAttributeEventListener(value));
@@ -854,7 +854,7 @@ void setJSSVGElementInstanceOnmousedown(ExecState* exec, JSObject* thisObject, J
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
@@ -864,7 +864,7 @@ void setJSSVGElementInstanceOnmousemove(ExecState* exec, JSObject* thisObject, J
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
@@ -874,7 +874,7 @@ void setJSSVGElementInstanceOnmouseout(ExecState* exec, JSObject* thisObject, JS
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
@@ -884,7 +884,7 @@ void setJSSVGElementInstanceOnmouseover(ExecState* exec, JSObject* thisObject, J
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
@@ -894,7 +894,7 @@ void setJSSVGElementInstanceOnmouseup(ExecState* exec, JSObject* thisObject, JSV
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
@@ -904,7 +904,7 @@ void setJSSVGElementInstanceOnmousewheel(ExecState* exec, JSObject* thisObject,
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
@@ -914,7 +914,7 @@ void setJSSVGElementInstanceOnbeforecut(ExecState* exec, JSObject* thisObject, J
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnbeforecut(globalObject->createJSAttributeEventListener(value));
@@ -924,7 +924,7 @@ void setJSSVGElementInstanceOncut(ExecState* exec, JSObject* thisObject, JSValue
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOncut(globalObject->createJSAttributeEventListener(value));
@@ -934,7 +934,7 @@ void setJSSVGElementInstanceOnbeforecopy(ExecState* exec, JSObject* thisObject,
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnbeforecopy(globalObject->createJSAttributeEventListener(value));
@@ -944,7 +944,7 @@ void setJSSVGElementInstanceOncopy(ExecState* exec, JSObject* thisObject, JSValu
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOncopy(globalObject->createJSAttributeEventListener(value));
@@ -954,7 +954,7 @@ void setJSSVGElementInstanceOnbeforepaste(ExecState* exec, JSObject* thisObject,
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnbeforepaste(globalObject->createJSAttributeEventListener(value));
@@ -964,7 +964,7 @@ void setJSSVGElementInstanceOnpaste(ExecState* exec, JSObject* thisObject, JSVal
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnpaste(globalObject->createJSAttributeEventListener(value));
@@ -974,7 +974,7 @@ void setJSSVGElementInstanceOndragenter(ExecState* exec, JSObject* thisObject, J
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
@@ -984,7 +984,7 @@ void setJSSVGElementInstanceOndragover(ExecState* exec, JSObject* thisObject, JS
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndragover(globalObject->createJSAttributeEventListener(value));
@@ -994,7 +994,7 @@ void setJSSVGElementInstanceOndragleave(ExecState* exec, JSObject* thisObject, J
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
@@ -1004,7 +1004,7 @@ void setJSSVGElementInstanceOndrop(ExecState* exec, JSObject* thisObject, JSValu
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndrop(globalObject->createJSAttributeEventListener(value));
@@ -1014,7 +1014,7 @@ void setJSSVGElementInstanceOndragstart(ExecState* exec, JSObject* thisObject, J
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
@@ -1024,7 +1024,7 @@ void setJSSVGElementInstanceOndrag(ExecState* exec, JSObject* thisObject, JSValu
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndrag(globalObject->createJSAttributeEventListener(value));
@@ -1034,7 +1034,7 @@ void setJSSVGElementInstanceOndragend(ExecState* exec, JSObject* thisObject, JSV
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOndragend(globalObject->createJSAttributeEventListener(value));
@@ -1044,7 +1044,7 @@ void setJSSVGElementInstanceOnreset(ExecState* exec, JSObject* thisObject, JSVal
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnreset(globalObject->createJSAttributeEventListener(value));
@@ -1054,7 +1054,7 @@ void setJSSVGElementInstanceOnresize(ExecState* exec, JSObject* thisObject, JSVa
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnresize(globalObject->createJSAttributeEventListener(value));
@@ -1064,7 +1064,7 @@ void setJSSVGElementInstanceOnscroll(ExecState* exec, JSObject* thisObject, JSVa
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
@@ -1074,7 +1074,7 @@ void setJSSVGElementInstanceOnsearch(ExecState* exec, JSObject* thisObject, JSVa
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
@@ -1084,7 +1084,7 @@ void setJSSVGElementInstanceOnselect(ExecState* exec, JSObject* thisObject, JSVa
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnselect(globalObject->createJSAttributeEventListener(value));
@@ -1094,7 +1094,7 @@ void setJSSVGElementInstanceOnselectstart(ExecState* exec, JSObject* thisObject,
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnselectstart(globalObject->createJSAttributeEventListener(value));
@@ -1104,7 +1104,7 @@ void setJSSVGElementInstanceOnsubmit(ExecState* exec, JSObject* thisObject, JSVa
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
@@ -1114,7 +1114,7 @@ void setJSSVGElementInstanceOnunload(ExecState* exec, JSObject* thisObject, JSVa
 {
     UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnunload(globalObject->createJSAttributeEventListener(value));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp
index 8bc5bc0464..893cc760ec 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp
@@ -94,7 +94,7 @@ JSSVGElementInstanceList::JSSVGElementInstanceList(NonNullPassRefPtr<Structure>
 
 JSSVGElementInstanceList::~JSSVGElementInstanceList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGElementInstanceList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
index 039182f4bf..8906774565 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
@@ -150,7 +150,7 @@ JSSVGException::JSSVGException(NonNullPassRefPtr<Structure> structure, JSDOMGlob
 
 JSSVGException::~JSSVGException()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
index f97df8939c..0bcf836878 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
@@ -169,7 +169,7 @@ JSSVGLength::JSSVGLength(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObje
 JSSVGLength::~JSSVGLength()
 {
     JSSVGDynamicPODTypeWrapperCache<SVGLength, SVGAnimatedLength>::forgetWrapper(m_impl.get());
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGLength::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp
index 952a5f009e..a984bd19ba 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp
@@ -100,7 +100,7 @@ JSSVGLengthList::JSSVGLengthList(NonNullPassRefPtr<Structure> structure, JSDOMGl
 
 JSSVGLengthList::~JSSVGLengthList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGLengthList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp
index ba8dfe85b1..d46ce6f745 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp
@@ -107,7 +107,7 @@ JSSVGMatrix::JSSVGMatrix(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObje
 
 JSSVGMatrix::~JSSVGMatrix()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGMatrix::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp
index 2bfe6589c7..8ba2042b6a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp
@@ -79,7 +79,7 @@ JSSVGNumber::JSSVGNumber(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObje
 
 JSSVGNumber::~JSSVGNumber()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGNumber::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp
index dc6f5a41d8..fa0e3cf6cb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp
@@ -99,7 +99,7 @@ JSSVGNumberList::JSSVGNumberList(NonNullPassRefPtr<Structure> structure, JSDOMGl
 
 JSSVGNumberList::~JSSVGNumberList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGNumberList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
index 2f1ecbd61f..767098b124 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
@@ -181,7 +181,7 @@ JSSVGPathSeg::JSSVGPathSeg(NonNullPassRefPtr<Structure> structure, JSDOMGlobalOb
 
 JSSVGPathSeg::~JSSVGPathSeg()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGPathSeg::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp
index 0043533617..9a35c1ba1d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp
@@ -99,7 +99,7 @@ JSSVGPathSegList::JSSVGPathSegList(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSSVGPathSegList::~JSSVGPathSegList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGPathSegList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp
index e4c241562a..67c35e22fe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp
@@ -94,7 +94,7 @@ JSSVGPoint::JSSVGPoint(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject
 
 JSSVGPoint::~JSSVGPoint()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGPoint::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp
index 4a22ff9a55..6968c80cd9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp
@@ -98,7 +98,7 @@ JSSVGPointList::JSSVGPointList(NonNullPassRefPtr<Structure> structure, JSDOMGlob
 
 JSSVGPointList::~JSSVGPointList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGPointList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
index 0f3329c24e..578cd3405f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
@@ -167,7 +167,7 @@ JSSVGPreserveAspectRatio::JSSVGPreserveAspectRatio(NonNullPassRefPtr<Structure>
 
 JSSVGPreserveAspectRatio::~JSSVGPreserveAspectRatio()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGPreserveAspectRatio::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp
index 8360b4b93c..e60a309ef9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp
@@ -83,7 +83,7 @@ JSSVGRect::JSSVGRect(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject*
 JSSVGRect::~JSSVGRect()
 {
     JSSVGDynamicPODTypeWrapperCache<FloatRect, SVGAnimatedRect>::forgetWrapper(m_impl.get());
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
index b484fbfe92..1793c23455 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
@@ -148,7 +148,7 @@ JSSVGRenderingIntent::JSSVGRenderingIntent(NonNullPassRefPtr<Structure> structur
 
 JSSVGRenderingIntent::~JSSVGRenderingIntent()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGRenderingIntent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp
index d4a69351a4..591ca64c33 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp
@@ -100,7 +100,7 @@ JSSVGStringList::JSSVGStringList(NonNullPassRefPtr<Structure> structure, JSDOMGl
 
 JSSVGStringList::~JSSVGStringList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGStringList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
index 82cddb625f..2f51e56086 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
@@ -162,7 +162,7 @@ JSSVGTransform::JSSVGTransform(NonNullPassRefPtr<Structure> structure, JSDOMGlob
 
 JSSVGTransform::~JSSVGTransform()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGTransform::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp
index 51c0cca31c..8ce9342a16 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp
@@ -103,7 +103,7 @@ JSSVGTransformList::JSSVGTransformList(NonNullPassRefPtr<Structure> structure, J
 
 JSSVGTransformList::~JSSVGTransformList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGTransformList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
index 452fc9cd1b..fb3321a7ec 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
@@ -142,7 +142,7 @@ JSSVGUnitTypes::JSSVGUnitTypes(NonNullPassRefPtr<Structure> structure, JSDOMGlob
 
 JSSVGUnitTypes::~JSSVGUnitTypes()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSSVGUnitTypes::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp b/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp
index 574f44c666..7ccffa398f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp
@@ -84,7 +84,7 @@ JSScreen::JSScreen(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* gl
 
 JSScreen::~JSScreen()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSScreen::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp b/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
index 998b8cf979..e0ae01b4b4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
@@ -147,7 +147,7 @@ JSStorage::JSStorage(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSStorage::~JSStorage()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSStorage::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
index ae7011dd70..b84ab6bd4d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
@@ -136,7 +136,7 @@ JSStyleSheet::JSStyleSheet(NonNullPassRefPtr<Structure> structure, JSDOMGlobalOb
 
 JSStyleSheet::~JSStyleSheet()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSStyleSheet::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
index 5d07cc13a2..db3d083609 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
@@ -141,7 +141,7 @@ JSStyleSheetList::JSStyleSheetList(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSStyleSheetList::~JSStyleSheetList()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSStyleSheetList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
index 627ad3b8d0..940498a887 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
@@ -125,7 +125,7 @@ JSTextMetrics::JSTextMetrics(NonNullPassRefPtr<Structure> structure, JSDOMGlobal
 
 JSTextMetrics::~JSTextMetrics()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSTextMetrics::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp
index 825ca1bf13..1306ccb887 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp
@@ -93,7 +93,7 @@ JSTimeRanges::JSTimeRanges(NonNullPassRefPtr<Structure> structure, JSDOMGlobalOb
 
 JSTimeRanges::~JSTimeRanges()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSTimeRanges::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
index a26425efe5..10645dbd21 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
@@ -151,7 +151,7 @@ JSTreeWalker::JSTreeWalker(NonNullPassRefPtr<Structure> structure, JSDOMGlobalOb
 
 JSTreeWalker::~JSTreeWalker()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSTreeWalker::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSValidityState.cpp b/src/3rdparty/webkit/WebCore/generated/JSValidityState.cpp
index b355874d48..7616c5805e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSValidityState.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSValidityState.cpp
@@ -84,7 +84,7 @@ JSValidityState::JSValidityState(NonNullPassRefPtr<Structure> structure, JSDOMGl
 
 JSValidityState::~JSValidityState()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSValidityState::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp
index a084949cc0..94ad1c5052 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp
@@ -73,7 +73,7 @@ JSVoidCallback::JSVoidCallback(NonNullPassRefPtr<Structure> structure, JSDOMGlob
 
 JSVoidCallback::~JSVoidCallback()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSVoidCallback::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp
index bcf8286173..0bb22679e3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp
@@ -120,7 +120,7 @@ JSWebKitCSSMatrix::JSWebKitCSSMatrix(NonNullPassRefPtr<Structure> structure, JSD
 
 JSWebKitCSSMatrix::~JSWebKitCSSMatrix()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSWebKitCSSMatrix::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp
index 255df0a736..ea88682926 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp
@@ -78,7 +78,7 @@ JSWebKitPoint::JSWebKitPoint(NonNullPassRefPtr<Structure> structure, JSDOMGlobal
 
 JSWebKitPoint::~JSWebKitPoint()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSWebKitPoint::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp
index ea8ff3d05d..7e48815d4c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp
@@ -122,7 +122,7 @@ JSWebSocket::JSWebSocket(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObje
 JSWebSocket::~JSWebSocket()
 {
     impl()->invalidateEventListeners();
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 void JSWebSocket::markChildren(MarkStack& markStack)
@@ -215,7 +215,7 @@ void setJSWebSocketOnopen(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     WebSocket* imp = static_cast<WebSocket*>(static_cast<JSWebSocket*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnopen(globalObject->createJSAttributeEventListener(value));
@@ -225,7 +225,7 @@ void setJSWebSocketOnmessage(ExecState* exec, JSObject* thisObject, JSValue valu
 {
     UNUSED_PARAM(exec);
     WebSocket* imp = static_cast<WebSocket*>(static_cast<JSWebSocket*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
@@ -235,7 +235,7 @@ void setJSWebSocketOnclose(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     WebSocket* imp = static_cast<WebSocket*>(static_cast<JSWebSocket*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnclose(globalObject->createJSAttributeEventListener(value));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp
index 42cc502e0d..14153e2139 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp
@@ -129,7 +129,7 @@ void setJSWorkerOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Worker* imp = static_cast<Worker*>(static_cast<JSWorker*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp
index e29cb322cb..5b7b1057bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp
@@ -129,7 +129,6 @@ JSWorkerContext::JSWorkerContext(NonNullPassRefPtr<Structure> structure, PassRef
 JSWorkerContext::~JSWorkerContext()
 {
     impl()->invalidateEventListeners();
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
 }
 
 bool JSWorkerContext::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
index e24d0d6c87..6046aa6648 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
@@ -156,7 +156,7 @@ JSWorkerLocation::JSWorkerLocation(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSWorkerLocation::~JSWorkerLocation()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSWorkerLocation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp
index 8efab1e50e..29c2364c99 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp
@@ -93,7 +93,7 @@ JSWorkerNavigator::JSWorkerNavigator(NonNullPassRefPtr<Structure> structure, JSD
 
 JSWorkerNavigator::~JSWorkerNavigator()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSWorkerNavigator::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp
index 9927f5e73b..d81c689448 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp
@@ -137,7 +137,7 @@ JSXMLHttpRequest::JSXMLHttpRequest(NonNullPassRefPtr<Structure> structure, JSDOM
 JSXMLHttpRequest::~JSXMLHttpRequest()
 {
     impl()->invalidateEventListeners();
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSXMLHttpRequest::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -294,7 +294,7 @@ void setJSXMLHttpRequestOnabort(ExecState* exec, JSObject* thisObject, JSValue v
 {
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnabort(globalObject->createJSAttributeEventListener(value));
@@ -304,7 +304,7 @@ void setJSXMLHttpRequestOnerror(ExecState* exec, JSObject* thisObject, JSValue v
 {
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnerror(globalObject->createJSAttributeEventListener(value));
@@ -314,7 +314,7 @@ void setJSXMLHttpRequestOnload(ExecState* exec, JSObject* thisObject, JSValue va
 {
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnload(globalObject->createJSAttributeEventListener(value));
@@ -324,7 +324,7 @@ void setJSXMLHttpRequestOnloadstart(ExecState* exec, JSObject* thisObject, JSVal
 {
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnloadstart(globalObject->createJSAttributeEventListener(value));
@@ -334,7 +334,7 @@ void setJSXMLHttpRequestOnprogress(ExecState* exec, JSObject* thisObject, JSValu
 {
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
@@ -344,7 +344,7 @@ void setJSXMLHttpRequestOnreadystatechange(ExecState* exec, JSObject* thisObject
 {
     UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnreadystatechange(globalObject->createJSAttributeEventListener(value));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
index 30e0d726cf..6de17c7ac3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
@@ -153,7 +153,7 @@ JSXMLHttpRequestException::JSXMLHttpRequestException(NonNullPassRefPtr<Structure
 
 JSXMLHttpRequestException::~JSXMLHttpRequestException()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSXMLHttpRequestException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
index bc5fff94a3..9ca797293d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
@@ -158,7 +158,7 @@ JSXMLHttpRequestUpload::JSXMLHttpRequestUpload(NonNullPassRefPtr<Structure> stru
 JSXMLHttpRequestUpload::~JSXMLHttpRequestUpload()
 {
     impl()->invalidateEventListeners();
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSXMLHttpRequestUpload::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -250,7 +250,7 @@ void setJSXMLHttpRequestUploadOnabort(ExecState* exec, JSObject* thisObject, JSV
 {
     UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnabort(globalObject->createJSAttributeEventListener(value));
@@ -260,7 +260,7 @@ void setJSXMLHttpRequestUploadOnerror(ExecState* exec, JSObject* thisObject, JSV
 {
     UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnerror(globalObject->createJSAttributeEventListener(value));
@@ -270,7 +270,7 @@ void setJSXMLHttpRequestUploadOnload(ExecState* exec, JSObject* thisObject, JSVa
 {
     UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnload(globalObject->createJSAttributeEventListener(value));
@@ -280,7 +280,7 @@ void setJSXMLHttpRequestUploadOnloadstart(ExecState* exec, JSObject* thisObject,
 {
     UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnloadstart(globalObject->createJSAttributeEventListener(value));
@@ -290,7 +290,7 @@ void setJSXMLHttpRequestUploadOnprogress(ExecState* exec, JSObject* thisObject,
 {
     UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
     if (!globalObject)
         return;
     imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
index e6cdd6bcda..2fd7e29867 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
@@ -147,7 +147,7 @@ JSXMLSerializer::JSXMLSerializer(NonNullPassRefPtr<Structure> structure, JSDOMGl
 
 JSXMLSerializer::~JSXMLSerializer()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSXMLSerializer::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
index e25be26a44..aa8840abef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
@@ -158,7 +158,7 @@ JSXPathEvaluator::JSXPathEvaluator(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSXPathEvaluator::~JSXPathEvaluator()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSXPathEvaluator::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
index 3894ac2795..fb6a00a570 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
@@ -148,7 +148,7 @@ JSXPathException::JSXPathException(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSXPathException::~JSXPathException()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSXPathException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
index 9464146e6b..af059df662 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
@@ -141,7 +141,7 @@ JSXPathExpression::JSXPathExpression(NonNullPassRefPtr<Structure> structure, JSD
 
 JSXPathExpression::~JSXPathExpression()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSXPathExpression::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp
index c3bdef1cbe..7ba29c0d7c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp
@@ -79,7 +79,7 @@ JSXPathNSResolver::JSXPathNSResolver(NonNullPassRefPtr<Structure> structure, JSD
 
 JSXPathNSResolver::~JSXPathNSResolver()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSXPathNSResolver::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
index 337f473f80..d70ad290ae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
@@ -171,7 +171,7 @@ JSXPathResult::JSXPathResult(NonNullPassRefPtr<Structure> structure, JSDOMGlobal
 
 JSXPathResult::~JSXPathResult()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSXPathResult::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp
index 7dcd9c9cc2..add8a8497f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp
@@ -86,7 +86,7 @@ JSXSLTProcessor::JSXSLTProcessor(NonNullPassRefPtr<Structure> structure, JSDOMGl
 
 JSXSLTProcessor::~JSXSLTProcessor()
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), impl());
+    forgetDOMObject(this, impl());
 }
 
 JSObject* JSXSLTProcessor::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h b/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h
index 11e6af241b..568670b26e 100644
--- a/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h
+++ b/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h
@@ -31,6 +31,6 @@
 #define WebKitVersion_h
 
 #define WEBKIT_MAJOR_VERSION 532
-#define WEBKIT_MINOR_VERSION 3
+#define WEBKIT_MINOR_VERSION 4
 
 #endif //WebKitVersion_h
diff --git a/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp b/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp
index 098a7863b4..c5fb069ad3 100644
--- a/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp
+++ b/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp
@@ -23,10 +23,13 @@
 #include "CString.h"
 #include "FormData.h"
 
-bool WebCore::HistoryItem::restoreState(QDataStream& in, int /*version*/)
+bool WebCore::HistoryItem::restoreState(QDataStream& in, int version)
 {
-    // there is no different version right now
-    // switch  (version) {
+    // we only support version 1 for now
+
+    if (version != 1)
+        return false;
+
     WebCore::String url;
     WebCore::String title;
     WebCore::String altTitle;
@@ -87,10 +90,12 @@ bool WebCore::HistoryItem::restoreState(QDataStream& in, int /*version*/)
     return in.status() == QDataStream::Ok;
 }
 
-QDataStream& WebCore::HistoryItem::saveState(QDataStream& out, int /*version*/) const
+QDataStream& WebCore::HistoryItem::saveState(QDataStream& out, int version) const
 {
-    // there is no different version right now
-    // switch  (version) {
+    // we only support version 1 for now.
+    if (version != 1)
+        return out;
+
     out << urlString() << title() << alternateTitle() << lastVisitedTime();
     out << originalURLString() << referrer() << target() << parent();
     out << lastVisitWasHTTPNonGet() << lastVisitWasFailure() << isTargetItem();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAllCollection.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAllCollection.cpp
new file mode 100644
index 0000000000..dbfed280b4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAllCollection.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HTMLAllCollection.h"
+
+#include "Node.h"
+
+namespace WebCore {
+
+PassRefPtr<HTMLAllCollection> HTMLAllCollection::create(PassRefPtr<Node> base)
+{
+    return adoptRef(new HTMLAllCollection(base));
+}
+
+HTMLAllCollection::HTMLAllCollection(PassRefPtr<Node> base)
+    : HTMLCollection(base, DocAll)
+{
+}
+
+HTMLAllCollection::~HTMLAllCollection()
+{
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h b/src/3rdparty/webkit/WebCore/html/HTMLAllCollection.h
index da3a758b26..1dd3ede374 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAllCollection.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,49 +10,35 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSHTMLAllCollection_h
-#define JSHTMLAllCollection_h
+#ifndef HTMLAllCollection_h
+#define HTMLAllCollection_h
 
 #include "HTMLCollection.h"
-#include "JSHTMLCollection.h"
 
 namespace WebCore {
 
-    class HTMLCollection;
+class HTMLAllCollection : public HTMLCollection {
+public:
+    static PassRefPtr<HTMLAllCollection> create(PassRefPtr<Node>);
+    virtual ~HTMLAllCollection();
 
-    class JSHTMLAllCollection : public JSHTMLCollection {
-    public:
-        JSHTMLAllCollection(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLCollection> collection)
-            : JSHTMLCollection(structure, globalObject, collection)
-        {
-        }
-
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
-        { 
-            return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
-        }
-
-        static const JSC::ClassInfo s_info;
-    protected:
-        static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::MasqueradesAsUndefined | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSHTMLCollection::StructureFlags;
-
-    private:
-        virtual bool toBoolean(JSC::ExecState*) const { return false; }
-    };
+private:
+    HTMLAllCollection(PassRefPtr<Node>);
+};
 
 } // namespace WebCore
 
-#endif // JSHTMLAllCollection_h
+#endif // HTMLAllCollection_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAllCollection.idl b/src/3rdparty/webkit/WebCore/html/HTMLAllCollection.idl
new file mode 100644
index 0000000000..d36f41e375
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAllCollection.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        GenerateConstructor,
+        HasIndexGetter,
+        HasNameGetter,
+        CustomCall,
+        MasqueradesAsUndefined
+    ] HTMLAllCollection {
+        readonly attribute unsigned long length;
+        [Custom] Node item(in unsigned long index);
+        [Custom] Node namedItem(in DOMString name);
+
+        // FIXME: This should return an HTMLAllCollection.
+        NodeList tags(in DOMString name);
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
index 335b20ff00..7bae6e3fa3 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
@@ -172,10 +172,11 @@ CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type)
             if (m_context && !m_context->is3d())
                 return 0;
             if (!m_context) {
-                m_context = new CanvasRenderingContext3D(this);
-
-                // Need to make sure a RenderLayer and compositing layer get created for the Canvas
-                setNeedsStyleRecalc(SyntheticStyleChange);
+                m_context = CanvasRenderingContext3D::create(this);
+                if (m_context) {
+                    // Need to make sure a RenderLayer and compositing layer get created for the Canvas
+                    setNeedsStyleRecalc(SyntheticStyleChange);
+                }
             }
             return m_context.get();
         }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCollection.h b/src/3rdparty/webkit/WebCore/html/HTMLCollection.h
index b04bcbc881..eea177798e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCollection.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCollection.h
@@ -64,6 +64,7 @@ public:
 
 protected:
     HTMLCollection(PassRefPtr<Node> base, CollectionType, CollectionCache*);
+    HTMLCollection(PassRefPtr<Node> base, CollectionType);
 
     CollectionCache* info() const { return m_info; }
     void resetCollectionInfo() const;
@@ -71,8 +72,6 @@ protected:
     mutable bool m_idsDone; // for nextNamedItem()
 
 private:
-    HTMLCollection(PassRefPtr<Node> base, CollectionType);
-
     virtual Element* itemAfter(Element*) const;
     virtual unsigned calcLength() const;
     virtual void updateNameCache() const;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl b/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl
index 1ba5ec778f..45d1127a2e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl
@@ -34,8 +34,9 @@ module html {
         [Custom] Node item(in unsigned long index);
         [Custom] Node namedItem(in DOMString name);
 
-        // Extensions
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         NodeList tags(in DOMString name);
+#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl b/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl
index 3dd7a073f7..d2507415df 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl
@@ -39,7 +39,7 @@ module html {
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // FIXME: This should eventually be available (if they are wanted) for all languages.
-                 attribute [Custom, Deletable] HTMLCollection all;
+                 attribute [Custom, Deletable] HTMLAllCollection all;
 #endif
 
         void clear();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
index ed3405a040..f25c9080b9 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
@@ -1549,9 +1549,16 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
             if (r && r->isTextField())
                 toRenderTextControl(r)->setEdited(false);
         }
-        // Form may never have been present, or may have been destroyed by the change event.
-        if (form())
-            form()->submitClick(evt);
+
+        RefPtr<HTMLFormElement> formForSubmission = form();
+        // If there is no form and the element is an <isindex>, then create a temporary form just to be used for submission.
+        if (!formForSubmission && inputType() == ISINDEX)
+            formForSubmission = createTemporaryFormForIsIndex();
+
+        // Form may never have been present, or may have been destroyed by code responding to the change event.
+        if (formForSubmission)
+            formForSubmission->submitClick(evt);
+
         evt->setDefaultHandled();
         return;
     }
@@ -1569,6 +1576,19 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         HTMLFormControlElementWithState::defaultEventHandler(evt);
 }
 
+PassRefPtr<HTMLFormElement> HTMLInputElement::createTemporaryFormForIsIndex()
+{
+    RefPtr<HTMLFormElement> form = new HTMLFormElement(formTag, document());
+    form->registerFormElement(this);
+    form->setMethod("GET");
+    if (!document()->baseURL().isEmpty()) {
+        // We treat the href property of the <base> element as the form action, as per section 7.5 
+        // "Queries and Indexes" of the HTML 2.0 spec. <http://www.w3.org/MarkUp/html-spec/html-spec_7.html#SEC7.5>.
+        form->setAction(document()->baseURL().string());
+    }
+    return form.release();
+}
+
 bool HTMLInputElement::isURLAttribute(Attribute *attr) const
 {
     return (attr->name() == srcAttr);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
index 799d92c850..0e2da32949 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
@@ -256,6 +256,8 @@ private:
     virtual bool isOptionalFormControl() const { return !isRequiredFormControl(); }
     virtual bool isRequiredFormControl() const;
 
+    PassRefPtr<HTMLFormElement> createTemporaryFormForIsIndex();
+
 #if ENABLE(DATALIST)
     HTMLDataListElement* dataList() const;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
index 11ca3bad8b..729aceb209 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
@@ -247,16 +247,12 @@ void HTMLMediaElement::insertedIntoDocument()
         scheduleLoad();
 }
 
-void HTMLMediaElement::willRemove()
-{
-    if (m_isFullscreen)
-        exitFullscreen();
-    HTMLElement::willRemove();
-}
 void HTMLMediaElement::removedFromDocument()
 {
     if (m_networkState > NETWORK_EMPTY)
         pause();
+    if (m_isFullscreen)
+        exitFullscreen();
     HTMLElement::removedFromDocument();
 }
 
@@ -1678,6 +1674,9 @@ void HTMLMediaElement::userCancelledLoad()
 
 void HTMLMediaElement::documentWillBecomeInactive()
 {
+    if (m_isFullscreen)
+        exitFullscreen();
+
     m_inActiveDocument = false;
     userCancelledLoad();
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
index 0005e07dcd..405f013350 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
@@ -57,7 +57,6 @@ public:
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void insertedIntoDocument();
-    virtual void willRemove();
     virtual void removedFromDocument();
     virtual void attach();
     virtual void recalcStyle(StyleChange);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl b/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl
index 5f85fcbf2b..a7e191a42a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl
@@ -21,7 +21,6 @@
 module html {
 
     // FIXME: The W3C spec says that HTMLOptionsCollection should not have a parent class.
-
     interface [
         GenerateNativeConverter,
         HasCustomIndexSetter,
@@ -36,9 +35,9 @@ module html {
              raises (DOMException);
         [Custom] void remove(in unsigned long index);
 
-#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
-        Node item(in unsigned long index);
-        Node namedItem(in DOMString name);
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        Node item(in unsigned long index); 
+        Node namedItem(in DOMString name); 
 #endif
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
index 33af9971b0..91285d948f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
@@ -416,13 +416,13 @@ HTMLTokenizer::State HTMLTokenizer::parseNonHTMLText(SegmentedString& src, State
 
     return state;
 }
-
+    
 HTMLTokenizer::State HTMLTokenizer::scriptHandler(State state)
 {
     // We are inside a <script>
     bool doScriptExec = false;
     int startLine = m_currentScriptTagStartLineNumber + 1; // Script line numbers are 1 based, HTMLTokenzier line numbers are 0 based
-
+    
     // Reset m_currentScriptTagStartLineNumber to indicate that we've finished parsing the current script element
     m_currentScriptTagStartLineNumber = 0;
 
@@ -551,7 +551,13 @@ HTMLTokenizer::State HTMLTokenizer::scriptExecution(const ScriptSourceCode& sour
     if (m_fragment || !m_doc->frame())
         return state;
     m_executingScript++;
-
+    
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willEvaluateScriptTag(sourceCode.url().isNull() ? String() : sourceCode.url().string(), sourceCode.startLine());
+#endif
+    
     SegmentedString* savedPrependingSrc = m_currentPrependingSrc;
     SegmentedString prependingSrc;
     m_currentPrependingSrc = &prependingSrc;
@@ -608,7 +614,12 @@ HTMLTokenizer::State HTMLTokenizer::scriptExecution(const ScriptSourceCode& sour
     }
 
     m_currentPrependingSrc = savedPrependingSrc;
-
+    
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didEvaluateScriptTag();
+#endif
+    
     return state;
 }
 
@@ -1613,7 +1624,7 @@ inline bool HTMLTokenizer::continueProcessing(int& processedCount, double startT
     processedCount++;
     return true;
 }
-
+    
 void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 {
     if (!m_buffer)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.h
index 9ac9e57b97..f75237772d 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.h
@@ -38,6 +38,7 @@ namespace WebCore {
         CanvasRenderingContext(HTMLCanvasElement*);
         virtual ~CanvasRenderingContext() { }
         
+        // Ref and deref the m_canvas
         void ref();
         void deref();
         
@@ -46,7 +47,7 @@ namespace WebCore {
         virtual bool is2d() const { return false; }
         virtual bool is3d() const { return false; }
 
-    protected:
+    private:
         HTMLCanvasElement* m_canvas;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 5e25b93e61..334190179f 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -165,10 +165,10 @@ void CanvasRenderingContext2D::setStrokeStyle(PassRefPtr<CanvasStyle> style)
     if (!style)
         return;
 
-    if (m_canvas->originClean()) {
+    if (canvas()->originClean()) {
         if (CanvasPattern* pattern = style->canvasPattern()) {
             if (!pattern->originClean())
-                m_canvas->setOriginTainted();
+                canvas()->setOriginTainted();
         }
     }
 
@@ -189,10 +189,10 @@ void CanvasRenderingContext2D::setFillStyle(PassRefPtr<CanvasStyle> style)
     if (!style)
         return;
  
-    if (m_canvas->originClean()) {
+    if (canvas()->originClean()) {
         if (CanvasPattern* pattern = style->canvasPattern()) {
             if (!pattern->originClean())
-                m_canvas->setOriginTainted();
+                canvas()->setOriginTainted();
         }
     }
 
@@ -447,7 +447,7 @@ void CanvasRenderingContext2D::setTransform(float m11, float m12, float m21, flo
     if (!ctm.isInvertible())
         return;
     c->concatCTM(c->getCTM().inverse());
-    c->concatCTM(m_canvas->baseTransform());
+    c->concatCTM(canvas()->baseTransform());
     state().m_transform.multiply(ctm.inverse());
     m_path.transform(ctm);
 
@@ -630,7 +630,7 @@ void CanvasRenderingContext2D::rect(float x, float y, float width, float height)
 #if ENABLE(DASHBOARD_SUPPORT)
 void CanvasRenderingContext2D::clearPathForDashboardBackwardCompatibilityMode()
 {
-    if (Settings* settings = m_canvas->document()->settings())
+    if (Settings* settings = canvas()->document()->settings())
         if (settings->usesDashboardBackwardCompatibilityMode())
             m_path.clear();
 }
@@ -935,8 +935,8 @@ static inline FloatRect normalizeRect(const FloatRect& rect)
 
 void CanvasRenderingContext2D::checkOrigin(const KURL& url)
 {
-    if (m_canvas->document()->securityOrigin()->taintsCanvas(url))
-        m_canvas->setOriginTainted();
+    if (canvas()->document()->securityOrigin()->taintsCanvas(url))
+        canvas()->setOriginTainted();
 }
 
 void CanvasRenderingContext2D::checkOrigin(const String& url)
@@ -986,11 +986,11 @@ void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, const FloatRec
     if (!cachedImage)
         return;
 
-    if (m_canvas->originClean())
+    if (canvas()->originClean())
         checkOrigin(cachedImage->response().url());
 
-    if (m_canvas->originClean() && !cachedImage->image()->hasSingleSecurityOrigin())
-        m_canvas->setOriginTainted();
+    if (canvas()->originClean() && !cachedImage->image()->hasSingleSecurityOrigin())
+        canvas()->setOriginTainted();
 
     FloatRect sourceRect = c->roundToDevicePixels(srcRect);
     FloatRect destRect = c->roundToDevicePixels(dstRect);
@@ -1012,14 +1012,14 @@ void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* canvas,
     drawImage(canvas, FloatRect(0, 0, canvas->width(), canvas->height()), FloatRect(x, y, width, height), ec);
 }
 
-void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* canvas, const FloatRect& srcRect,
+void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* sourceCanvas, const FloatRect& srcRect,
     const FloatRect& dstRect, ExceptionCode& ec)
 {
-    ASSERT(canvas);
+    ASSERT(sourceCanvas);
 
     ec = 0;
 
-    FloatRect srcCanvasRect = FloatRect(FloatPoint(), canvas->size());
+    FloatRect srcCanvasRect = FloatRect(FloatPoint(), sourceCanvas->size());
     if (!srcCanvasRect.contains(normalizeRect(srcRect)) || srcRect.width() == 0 || srcRect.height() == 0) {
         ec = INDEX_SIZE_ERR;
         return;
@@ -1038,12 +1038,12 @@ void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* canvas, const FloatR
     FloatRect destRect = c->roundToDevicePixels(dstRect);
         
     // FIXME: Do this through platform-independent GraphicsContext API.
-    ImageBuffer* buffer = canvas->buffer();
+    ImageBuffer* buffer = sourceCanvas->buffer();
     if (!buffer)
         return;
 
-    if (!canvas->originClean())
-        m_canvas->setOriginTainted();
+    if (!sourceCanvas->originClean())
+        canvas()->setOriginTainted();
 
     c->drawImage(buffer->image(), destRect, sourceRect, state().m_globalComposite);
     willDraw(destRect); // This call comes after drawImage, since the buffer we draw into may be our own, and we need to make sure it is dirty.
@@ -1088,11 +1088,11 @@ void CanvasRenderingContext2D::drawImage(HTMLVideoElement* video, const FloatRec
     if (!state().m_invertibleCTM)
         return;
 
-    if (m_canvas->originClean())
+    if (canvas()->originClean())
         checkOrigin(video->currentSrc());
 
-    if (m_canvas->originClean() && !video->hasSingleSecurityOrigin())
-        m_canvas->setOriginTainted();
+    if (canvas()->originClean() && !video->hasSingleSecurityOrigin())
+        canvas()->setOriginTainted();
 
     FloatRect sourceRect = c->roundToDevicePixels(srcRect);
     FloatRect destRect = c->roundToDevicePixels(dstRect);
@@ -1121,11 +1121,11 @@ void CanvasRenderingContext2D::drawImageFromRect(HTMLImageElement* image,
     if (!cachedImage)
         return;
 
-    if (m_canvas->originClean())
+    if (canvas()->originClean())
         checkOrigin(cachedImage->response().url());
 
-    if (m_canvas->originClean() && !cachedImage->image()->hasSingleSecurityOrigin())
-        m_canvas->setOriginTainted();
+    if (canvas()->originClean() && !cachedImage->image()->hasSingleSecurityOrigin())
+        canvas()->setOriginTainted();
 
     GraphicsContext* c = drawingContext();
     if (!c)
@@ -1155,7 +1155,7 @@ void CanvasRenderingContext2D::setCompositeOperation(const String& operation)
 void CanvasRenderingContext2D::prepareGradientForDashboard(CanvasGradient* gradient) const
 {
 #if ENABLE(DASHBOARD_SUPPORT)
-    if (Settings* settings = m_canvas->document()->settings())
+    if (Settings* settings = canvas()->document()->settings())
         if (settings->usesDashboardBackwardCompatibilityMode())
             gradient->setDashboardCompatibilityMode();
 #else
@@ -1205,7 +1205,7 @@ PassRefPtr<CanvasPattern> CanvasRenderingContext2D::createPattern(HTMLImageEleme
     if (!cachedImage || !image->cachedImage()->image())
         return CanvasPattern::create(Image::nullImage(), repeatX, repeatY, true);
 
-    bool originClean = !m_canvas->document()->securityOrigin()->taintsCanvas(KURL(KURL(), cachedImage->url()));
+    bool originClean = !canvas()->document()->securityOrigin()->taintsCanvas(KURL(KURL(), cachedImage->url()));
     return CanvasPattern::create(cachedImage->image(), repeatX, repeatY, originClean);
 }
 
@@ -1253,12 +1253,12 @@ void CanvasRenderingContext2D::willDraw(const FloatRect& r, unsigned options)
         // we'd have to keep the clip path around.
     }
     
-    m_canvas->willDraw(dirtyRect);
+    canvas()->willDraw(dirtyRect);
 }
 
 GraphicsContext* CanvasRenderingContext2D::drawingContext() const
 {
-    return m_canvas->drawingContext();
+    return canvas()->drawingContext();
 }
 
 static PassRefPtr<ImageData> createEmptyImageData(const IntSize& size)
@@ -1276,7 +1276,7 @@ PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(float sw, float
         return 0;
     }
     FloatSize unscaledSize(sw, sh);
-    IntSize scaledSize = m_canvas->convertLogicalToDevice(unscaledSize);
+    IntSize scaledSize = canvas()->convertLogicalToDevice(unscaledSize);
     if (scaledSize.width() < 1)
         scaledSize.setWidth(1);
     if (scaledSize.height() < 1)
@@ -1287,18 +1287,18 @@ PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(float sw, float
 
 PassRefPtr<ImageData> CanvasRenderingContext2D::getImageData(float sx, float sy, float sw, float sh, ExceptionCode& ec) const
 {
-    if (!m_canvas->originClean()) {
+    if (!canvas()->originClean()) {
         ec = SECURITY_ERR;
         return 0;
     }
     
     FloatRect unscaledRect(sx, sy, sw, sh);
-    IntRect scaledRect = m_canvas->convertLogicalToDevice(unscaledRect);
+    IntRect scaledRect = canvas()->convertLogicalToDevice(unscaledRect);
     if (scaledRect.width() < 1)
         scaledRect.setWidth(1);
     if (scaledRect.height() < 1)
         scaledRect.setHeight(1);
-    ImageBuffer* buffer = m_canvas ? m_canvas->buffer() : 0;
+    ImageBuffer* buffer = canvas() ? canvas()->buffer() : 0;
     if (!buffer)
         return createEmptyImageData(scaledRect.size());
     return buffer->getUnmultipliedImageData(scaledRect);
@@ -1326,7 +1326,7 @@ void CanvasRenderingContext2D::putImageData(ImageData* data, float dx, float dy,
         return;
     }
 
-    ImageBuffer* buffer = m_canvas->buffer();
+    ImageBuffer* buffer = canvas()->buffer();
     if (!buffer)
         return;
 
@@ -1363,7 +1363,7 @@ String CanvasRenderingContext2D::font() const
 void CanvasRenderingContext2D::setFont(const String& newFont)
 {
     RefPtr<CSSMutableStyleDeclaration> tempDecl = CSSMutableStyleDeclaration::create();
-    CSSParser parser(!m_canvas->document()->inCompatMode()); // Use the parse mode of the canvas' document when parsing CSS.
+    CSSParser parser(!canvas()->document()->inCompatMode()); // Use the parse mode of the canvas' document when parsing CSS.
         
     String declarationText("font: ");
     declarationText += newFont;
@@ -1377,11 +1377,11 @@ void CanvasRenderingContext2D::setFont(const String& newFont)
     // Map the <canvas> font into the text style. If the font uses keywords like larger/smaller, these will work
     // relative to the canvas.
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
-    if (m_canvas->computedStyle())
-        newStyle->setFontDescription(m_canvas->computedStyle()->fontDescription());
+    if (canvas()->computedStyle())
+        newStyle->setFontDescription(canvas()->computedStyle()->fontDescription());
 
     // Now map the font property into the style.
-    CSSStyleSelector* styleSelector = m_canvas->document()->styleSelector();
+    CSSStyleSelector* styleSelector = canvas()->document()->styleSelector();
     styleSelector->applyPropertyToStyle(CSSPropertyFont, tempDecl->getPropertyCSSValue(CSSPropertyFont).get(), newStyle.get());
     
     state().m_font = newStyle->font();
@@ -1455,8 +1455,8 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
     // FIXME: Handle maxWidth.
     // FIXME: Need to turn off font smoothing.
 
-    bool rtl = m_canvas->computedStyle() ? m_canvas->computedStyle()->direction() == RTL : false;
-    bool override = m_canvas->computedStyle() ? m_canvas->computedStyle()->unicodeBidi() == Override : false;
+    bool rtl = canvas()->computedStyle() ? canvas()->computedStyle()->direction() == RTL : false;
+    bool override = canvas()->computedStyle() ? canvas()->computedStyle()->unicodeBidi() == Override : false;
 
     unsigned length = text.length();
     const UChar* string = text.characters();
@@ -1508,11 +1508,11 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
         textRect.inflate(c->strokeThickness() / 2);
 
     if (fill)
-        m_canvas->willDraw(textRect);
+        canvas()->willDraw(textRect);
     else {
         // When stroking text, pointy miters can extend outside of textRect, so we
         // punt and dirty the whole canvas.
-        m_canvas->willDraw(FloatRect(0, 0, m_canvas->width(), m_canvas->height()));
+        canvas()->willDraw(FloatRect(0, 0, canvas()->width(), canvas()->height()));
     }
     
 #if PLATFORM(CG)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp
index 9cca57b811..612b4c3429 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp
@@ -42,12 +42,23 @@
 
 namespace WebCore {
 
-CanvasRenderingContext3D::CanvasRenderingContext3D(HTMLCanvasElement* canvas)
-    : CanvasRenderingContext(canvas)
+PassOwnPtr<CanvasRenderingContext3D> CanvasRenderingContext3D::create(HTMLCanvasElement* canvas)
+{
+    OwnPtr<GraphicsContext3D> context(GraphicsContext3D::create());
+    if (!context)
+        return 0;
+        
+    return new CanvasRenderingContext3D(canvas, context.release());
+}
+
+CanvasRenderingContext3D::CanvasRenderingContext3D(HTMLCanvasElement* passedCanvas, PassOwnPtr<GraphicsContext3D> context)
+    : CanvasRenderingContext(passedCanvas)
+    , m_context(context)
     , m_needsUpdate(true)
     , m_markedCanvasDirty(false)
 {
-    m_context.reshape(m_canvas->width(), m_canvas->height());
+    ASSERT(m_context);
+    m_context->reshape(canvas()->width(), canvas()->height());
 }
 
 CanvasRenderingContext3D::~CanvasRenderingContext3D()
@@ -58,14 +69,14 @@ CanvasRenderingContext3D::~CanvasRenderingContext3D()
 void CanvasRenderingContext3D::markContextChanged()
 {
 #if USE(ACCELERATED_COMPOSITING)
-    if (m_canvas->renderBox() && m_canvas->renderBox()->hasLayer()) {
-        m_canvas->renderBox()->layer()->rendererContentChanged();
+    if (canvas()->renderBox() && canvas()->renderBox()->hasLayer()) {
+        canvas()->renderBox()->layer()->rendererContentChanged();
     } else {
 #endif
         if (!m_markedCanvasDirty) {
             // Make sure the canvas's image buffer is allocated.
-            m_canvas->buffer();
-            m_canvas->willDraw(FloatRect(0, 0, m_canvas->width(), m_canvas->height()));
+            canvas()->buffer();
+            canvas()->willDraw(FloatRect(0, 0, canvas()->width(), canvas()->height()));
             m_markedCanvasDirty = true;
         }
 #if USE(ACCELERATED_COMPOSITING)
@@ -76,7 +87,7 @@ void CanvasRenderingContext3D::markContextChanged()
 void CanvasRenderingContext3D::beginPaint()
 {
     if (m_markedCanvasDirty) {
-        m_context.beginPaint(this);
+        m_context->beginPaint(this);
     }
 }
 
@@ -84,7 +95,7 @@ void CanvasRenderingContext3D::endPaint()
 {
     if (m_markedCanvasDirty) {
         m_markedCanvasDirty = false;
-        m_context.endPaint();
+        m_context->endPaint();
     }
 }
 
@@ -92,18 +103,18 @@ void CanvasRenderingContext3D::reshape(int width, int height)
 {
     if (m_needsUpdate) {
 #if USE(ACCELERATED_COMPOSITING)
-        if (m_canvas->renderBox() && m_canvas->renderBox()->hasLayer())
-            m_canvas->renderBox()->layer()->rendererContentChanged();
+        if (canvas()->renderBox() && canvas()->renderBox()->hasLayer())
+            canvas()->renderBox()->layer()->rendererContentChanged();
 #endif
         m_needsUpdate = false;
     }
     
-    m_context.reshape(width, height);
+    m_context->reshape(width, height);
 }
 
 int CanvasRenderingContext3D::sizeInBytes(int type, ExceptionCode& ec)
 {
-    int result = m_context.sizeInBytes(type);
+    int result = m_context->sizeInBytes(type);
     if (result <= 0) {
         ec = SYNTAX_ERR;
     }
@@ -112,7 +123,7 @@ int CanvasRenderingContext3D::sizeInBytes(int type, ExceptionCode& ec)
 
 void CanvasRenderingContext3D::activeTexture(unsigned long texture)
 {
-    m_context.activeTexture(texture);
+    m_context->activeTexture(texture);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -120,7 +131,7 @@ void CanvasRenderingContext3D::attachShader(CanvasProgram* program, CanvasShader
 {
     if (!program || !shader)
         return;
-    m_context.attachShader(program, shader);
+    m_context->attachShader(program, shader);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -128,94 +139,94 @@ void CanvasRenderingContext3D::bindAttribLocation(CanvasProgram* program, unsign
 {
     if (!program)
         return;
-    m_context.bindAttribLocation(program, index, name);
+    m_context->bindAttribLocation(program, index, name);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::bindBuffer(unsigned long target, CanvasBuffer* buffer)
 {
-    m_context.bindBuffer(target, buffer);
+    m_context->bindBuffer(target, buffer);
     cleanupAfterGraphicsCall(false);
 }
 
 
 void CanvasRenderingContext3D::bindFramebuffer(unsigned long target, CanvasFramebuffer* buffer)
 {
-    m_context.bindFramebuffer(target, buffer);
+    m_context->bindFramebuffer(target, buffer);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::bindRenderbuffer(unsigned long target, CanvasRenderbuffer* renderbuffer)
 {
-    m_context.bindRenderbuffer(target, renderbuffer);
+    m_context->bindRenderbuffer(target, renderbuffer);
     cleanupAfterGraphicsCall(false);
 }
 
 
 void CanvasRenderingContext3D::bindTexture(unsigned long target, CanvasTexture* texture)
 {
-    m_context.bindTexture(target, texture);
+    m_context->bindTexture(target, texture);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::blendColor(double red, double green, double blue, double alpha)
 {
-    m_context.blendColor(red, green, blue, alpha);
+    m_context->blendColor(red, green, blue, alpha);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::blendEquation( unsigned long mode )
 {
-    m_context.blendEquation(mode);
+    m_context->blendEquation(mode);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha)
 {
-    m_context.blendEquationSeparate(modeRGB, modeAlpha);
+    m_context->blendEquationSeparate(modeRGB, modeAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
 
 void CanvasRenderingContext3D::blendFunc(unsigned long sfactor, unsigned long dfactor)
 {
-    m_context.blendFunc(sfactor, dfactor);
+    m_context->blendFunc(sfactor, dfactor);
     cleanupAfterGraphicsCall(false);
 }       
 
 void CanvasRenderingContext3D::blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha)
 {
-    m_context.blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+    m_context->blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::bufferData(unsigned long target, int size, unsigned long usage)
 {
-    m_context.bufferData(target, size, usage);
+    m_context->bufferData(target, size, usage);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::bufferData(unsigned long target, CanvasArray* data, unsigned long usage)
 {
-    m_context.bufferData(target, data, usage);
+    m_context->bufferData(target, data, usage);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::bufferSubData(unsigned long target, long offset, CanvasArray* data)
 {
-    m_context.bufferSubData(target, offset, data);
+    m_context->bufferSubData(target, offset, data);
     cleanupAfterGraphicsCall(false);
 }
 
 unsigned long CanvasRenderingContext3D::checkFramebufferStatus(unsigned long target)
 {
-    return m_context.checkFramebufferStatus(target);
+    return m_context->checkFramebufferStatus(target);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::clear(unsigned long mask)
 {
-    m_context.clear(mask);
+    m_context->clear(mask);
     cleanupAfterGraphicsCall(true);
 }
 
@@ -229,43 +240,43 @@ void CanvasRenderingContext3D::clearColor(double r, double g, double b, double a
         b = 0;
     if (isnan(a))
         a = 1;
-    m_context.clearColor(r, g, b, a);
+    m_context->clearColor(r, g, b, a);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::clearDepth(double depth)
 {
-    m_context.clearDepth(depth);
+    m_context->clearDepth(depth);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::clearStencil(long s)
 {
-    m_context.clearStencil(s);
+    m_context->clearStencil(s);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::colorMask(bool red, bool green, bool blue, bool alpha)
 {
-    m_context.colorMask(red, green, blue, alpha);
+    m_context->colorMask(red, green, blue, alpha);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::compileShader(CanvasShader* shader)
 {
-    m_context.compileShader(shader);
+    m_context->compileShader(shader);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border)
 {
-    m_context.copyTexImage2D(target, level, internalformat, x, y, width, height, border);
+    m_context->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height)
 {
-    m_context.copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
+    m_context->copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -319,7 +330,7 @@ PassRefPtr<CanvasShader> CanvasRenderingContext3D::createShader(unsigned long ty
 
 void CanvasRenderingContext3D::cullFace(unsigned long mode)
 {
-    m_context.cullFace(mode);
+    m_context->cullFace(mode);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -373,19 +384,19 @@ void CanvasRenderingContext3D::deleteTexture(CanvasTexture* texture)
 
 void CanvasRenderingContext3D::depthFunc(unsigned long func)
 {
-    m_context.depthFunc(func);
+    m_context->depthFunc(func);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::depthMask(bool flag)
 {
-    m_context.depthMask(flag);
+    m_context->depthMask(flag);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::depthRange(double zNear, double zFar)
 {
-    m_context.depthRange(zNear, zFar);
+    m_context->depthRange(zNear, zFar);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -394,58 +405,58 @@ void CanvasRenderingContext3D::detachShader(CanvasProgram* program, CanvasShader
     if (!program || !shader)
         return;
 
-    m_context.detachShader(program, shader);
+    m_context->detachShader(program, shader);
     cleanupAfterGraphicsCall(false);
 }
 
 
 void CanvasRenderingContext3D::disable(unsigned long cap)
 {
-    m_context.disable(cap);
+    m_context->disable(cap);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::disableVertexAttribArray(unsigned long index)
 {
-    m_context.disableVertexAttribArray(index);
+    m_context->disableVertexAttribArray(index);
     cleanupAfterGraphicsCall(false);
 }
 
 
 void CanvasRenderingContext3D::drawArrays(unsigned long mode, long first, long count)
 {
-    m_context.drawArrays(mode, first, count);
+    m_context->drawArrays(mode, first, count);
     cleanupAfterGraphicsCall(true);
 }
 
 void CanvasRenderingContext3D::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset)
 {
-    m_context.drawElements(mode, count, type, offset);
+    m_context->drawElements(mode, count, type, offset);
     cleanupAfterGraphicsCall(true);
 }
 
 void CanvasRenderingContext3D::enable(unsigned long cap)
 {
-    m_context.enable(cap);
+    m_context->enable(cap);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::enableVertexAttribArray(unsigned long index)
 {
-    m_context.enableVertexAttribArray(index);
+    m_context->enableVertexAttribArray(index);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::finish()
 {
-    m_context.finish();
+    m_context->finish();
     cleanupAfterGraphicsCall(true);
 }
 
 
 void CanvasRenderingContext3D::flush()
 {
-    m_context.flush();
+    m_context->flush();
     cleanupAfterGraphicsCall(true);
 }
 
@@ -454,7 +465,7 @@ void CanvasRenderingContext3D::framebufferRenderbuffer(unsigned long target, uns
     if (!buffer)
         return;
         
-    m_context.framebufferRenderbuffer(target, attachment, renderbuffertarget, buffer);
+    m_context->framebufferRenderbuffer(target, attachment, renderbuffertarget, buffer);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -463,26 +474,26 @@ void CanvasRenderingContext3D::framebufferTexture2D(unsigned long target, unsign
     if (!texture)
         return;
         
-    m_context.framebufferTexture2D(target, attachment, textarget, texture, level);
+    m_context->framebufferTexture2D(target, attachment, textarget, texture, level);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::frontFace(unsigned long mode)
 {
-    m_context.frontFace(mode);
+    m_context->frontFace(mode);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::generateMipmap(unsigned long target)
 {
-    m_context.generateMipmap(target);
+    m_context->generateMipmap(target);
     cleanupAfterGraphicsCall(false);
 }
 
 PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveAttrib(CanvasProgram* program, unsigned long index, ExceptionCode& ec)
 {
     ActiveInfo info;
-    if (!program || program->context() != this || !m_context.getActiveAttrib(program, index, info)) {
+    if (!program || program->context() != this || !m_context->getActiveAttrib(program, index, info)) {
         ec = INDEX_SIZE_ERR;
         return 0;
     }
@@ -492,7 +503,7 @@ PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveAttrib(CanvasPro
 PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveUniform(CanvasProgram* program, unsigned long index, ExceptionCode& ec)
 {
     ActiveInfo info;
-    if (!program || program->context() != this || !m_context.getActiveUniform(program, index, info)) {
+    if (!program || program->context() != this || !m_context->getActiveUniform(program, index, info)) {
         ec = INDEX_SIZE_ERR;
         return 0;
     }
@@ -501,251 +512,251 @@ PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveUniform(CanvasPr
 
 int CanvasRenderingContext3D::getAttribLocation(CanvasProgram* program, const String& name)
 {
-    return m_context.getAttribLocation(program, name);
+    return m_context->getAttribLocation(program, name);
 }
 
 bool CanvasRenderingContext3D::getBoolean(unsigned long pname)
 {
-    bool result = m_context.getBoolean(pname);
+    bool result = m_context->getBoolean(pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasUnsignedByteArray> CanvasRenderingContext3D::getBooleanv(unsigned long pname)
 {
-    RefPtr<CanvasUnsignedByteArray> array = m_context.getBooleanv(pname);
+    RefPtr<CanvasUnsignedByteArray> array = m_context->getBooleanv(pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 int CanvasRenderingContext3D::getBufferParameteri(unsigned long target, unsigned long pname)
 {
-    int result = m_context.getBufferParameteri(target, pname);
+    int result = m_context->getBufferParameteri(target, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getBufferParameteriv(unsigned long target, unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getBufferParameteriv(target, pname);
+    RefPtr<CanvasIntArray> array = m_context->getBufferParameteriv(target, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 unsigned long CanvasRenderingContext3D::getError()
 {
-    return m_context.getError();
+    return m_context->getError();
 }
 
 float CanvasRenderingContext3D::getFloat(unsigned long pname)
 {
-    float result = m_context.getFloat(pname);
+    float result = m_context->getFloat(pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getFloatv(unsigned long pname)
 {
-    RefPtr<CanvasFloatArray> array = m_context.getFloatv(pname);
+    RefPtr<CanvasFloatArray> array = m_context->getFloatv(pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 int CanvasRenderingContext3D::getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname)
 {
-    int result = m_context.getFramebufferAttachmentParameteri(target, attachment, pname);
+    int result = m_context->getFramebufferAttachmentParameteri(target, attachment, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getFramebufferAttachmentParameteriv(target, attachment, pname);
+    RefPtr<CanvasIntArray> array = m_context->getFramebufferAttachmentParameteriv(target, attachment, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 int CanvasRenderingContext3D::getInteger(unsigned long pname)
 {
-    float result = m_context.getInteger(pname);
+    float result = m_context->getInteger(pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getIntegerv(unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getIntegerv(pname);
+    RefPtr<CanvasIntArray> array = m_context->getIntegerv(pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 int CanvasRenderingContext3D::getProgrami(CanvasProgram* program, unsigned long pname)
 {
-    int result = m_context.getProgrami(program, pname);
+    int result = m_context->getProgrami(program, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getProgramiv(CanvasProgram* program, unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getProgramiv(program, pname);
+    RefPtr<CanvasIntArray> array = m_context->getProgramiv(program, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 String CanvasRenderingContext3D::getProgramInfoLog(CanvasProgram* program)
 {
-    String s = m_context.getProgramInfoLog(program);
+    String s = m_context->getProgramInfoLog(program);
     cleanupAfterGraphicsCall(false);
     return s;
 }
 
 int CanvasRenderingContext3D::getRenderbufferParameteri(unsigned long target, unsigned long pname)
 {
-    int result = m_context.getRenderbufferParameteri(target, pname);
+    int result = m_context->getRenderbufferParameteri(target, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getRenderbufferParameteriv(unsigned long target, unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getRenderbufferParameteriv(target, pname);
+    RefPtr<CanvasIntArray> array = m_context->getRenderbufferParameteriv(target, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 int CanvasRenderingContext3D::getShaderi(CanvasShader* shader, unsigned long pname)
 {
-    int result = m_context.getShaderi(shader, pname);
+    int result = m_context->getShaderi(shader, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getShaderiv(CanvasShader* shader, unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getShaderiv(shader, pname);
+    RefPtr<CanvasIntArray> array = m_context->getShaderiv(shader, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 String CanvasRenderingContext3D::getShaderInfoLog(CanvasShader* shader)
 {
-    String s = m_context.getShaderInfoLog(shader);
+    String s = m_context->getShaderInfoLog(shader);
     cleanupAfterGraphicsCall(false);
     return s;
 }
 
 String CanvasRenderingContext3D::getShaderSource(CanvasShader* shader)
 {
-    String s = m_context.getShaderSource(shader);
+    String s = m_context->getShaderSource(shader);
     cleanupAfterGraphicsCall(false);
     return s;
 }
 
 String CanvasRenderingContext3D::getString(unsigned long name)
 {
-    return m_context.getString(name);
+    return m_context->getString(name);
 }
 
 float CanvasRenderingContext3D::getTexParameterf(unsigned long target, unsigned long pname)
 {
-    float result = m_context.getTexParameterf(target, pname);
+    float result = m_context->getTexParameterf(target, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getTexParameterfv(unsigned long target, unsigned long pname)
 {
-    RefPtr<CanvasFloatArray> array = m_context.getTexParameterfv(target, pname);
+    RefPtr<CanvasFloatArray> array = m_context->getTexParameterfv(target, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 int CanvasRenderingContext3D::getTexParameteri(unsigned long target, unsigned long pname)
 {
-    int result = m_context.getTexParameteri(target, pname);
+    int result = m_context->getTexParameteri(target, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getTexParameteriv(unsigned long target, unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getTexParameteriv(target, pname);
+    RefPtr<CanvasIntArray> array = m_context->getTexParameteriv(target, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 float CanvasRenderingContext3D::getUniformf(CanvasProgram* program, long location)
 {
-    float result = m_context.getUniformf(program, location);
+    float result = m_context->getUniformf(program, location);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getUniformfv(CanvasProgram* program, long location)
 {
-    RefPtr<CanvasFloatArray> array = m_context.getUniformfv(program, location);
+    RefPtr<CanvasFloatArray> array = m_context->getUniformfv(program, location);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 long CanvasRenderingContext3D::getUniformi(CanvasProgram* program, long location)
 {
-    long result = m_context.getUniformi(program, location);
+    long result = m_context->getUniformi(program, location);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getUniformiv(CanvasProgram* program, long location)
 {
-    RefPtr<CanvasIntArray> array = m_context.getUniformiv(program, location);
+    RefPtr<CanvasIntArray> array = m_context->getUniformiv(program, location);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 long CanvasRenderingContext3D::getUniformLocation(CanvasProgram* program, const String& name)
 {
-    return m_context.getUniformLocation(program, name);
+    return m_context->getUniformLocation(program, name);
 }
 
 float CanvasRenderingContext3D::getVertexAttribf(unsigned long index, unsigned long pname)
 {
-    float result = m_context.getVertexAttribf(index, pname);
+    float result = m_context->getVertexAttribf(index, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getVertexAttribfv(unsigned long index, unsigned long pname)
 {
-    RefPtr<CanvasFloatArray> array = m_context.getVertexAttribfv(index, pname);
+    RefPtr<CanvasFloatArray> array = m_context->getVertexAttribfv(index, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 long CanvasRenderingContext3D::getVertexAttribi(unsigned long index, unsigned long pname)
 {
-    long result = m_context.getVertexAttribi(index, pname);
+    long result = m_context->getVertexAttribi(index, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getVertexAttribiv(unsigned long index, unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getVertexAttribiv(index, pname);
+    RefPtr<CanvasIntArray> array = m_context->getVertexAttribiv(index, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 long CanvasRenderingContext3D::getVertexAttribOffset(unsigned long index, unsigned long pname)
 {
-    long result = m_context.getVertexAttribOffset(index, pname);
+    long result = m_context->getVertexAttribOffset(index, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 void CanvasRenderingContext3D::hint(unsigned long target, unsigned long mode)
 {
-    m_context.hint(target, mode);
+    m_context->hint(target, mode);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -754,42 +765,42 @@ bool CanvasRenderingContext3D::isBuffer(CanvasBuffer* buffer)
     if (!buffer)
         return false;
         
-    return m_context.isBuffer(buffer);
+    return m_context->isBuffer(buffer);
 }
 
 bool CanvasRenderingContext3D::isEnabled(unsigned long cap)
 {
-    return m_context.isEnabled(cap);
+    return m_context->isEnabled(cap);
 }
 
 bool CanvasRenderingContext3D::isFramebuffer(CanvasFramebuffer* framebuffer)
 {
-    return m_context.isFramebuffer(framebuffer);
+    return m_context->isFramebuffer(framebuffer);
 }
 
 bool CanvasRenderingContext3D::isProgram(CanvasProgram* program)
 {
-    return m_context.isProgram(program);
+    return m_context->isProgram(program);
 }
 
 bool CanvasRenderingContext3D::isRenderbuffer(CanvasRenderbuffer* renderbuffer)
 {
-    return m_context.isRenderbuffer(renderbuffer);
+    return m_context->isRenderbuffer(renderbuffer);
 }
 
 bool CanvasRenderingContext3D::isShader(CanvasShader* shader)
 {
-    return m_context.isShader(shader);
+    return m_context->isShader(shader);
 }
 
 bool CanvasRenderingContext3D::isTexture(CanvasTexture* texture)
 {
-    return m_context.isTexture(texture);
+    return m_context->isTexture(texture);
 }
 
 void CanvasRenderingContext3D::lineWidth(double width)
 {
-    m_context.lineWidth((float) width);
+    m_context->lineWidth((float) width);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -798,92 +809,92 @@ void CanvasRenderingContext3D::linkProgram(CanvasProgram* program)
     if (!program)
         return;
         
-    m_context.linkProgram(program);
+    m_context->linkProgram(program);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::pixelStorei(unsigned long pname, long param)
 {
-    m_context.pixelStorei(pname, param);
+    m_context->pixelStorei(pname, param);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::polygonOffset(double factor, double units)
 {
-    m_context.polygonOffset((float) factor, (float) units);
+    m_context->polygonOffset((float) factor, (float) units);
     cleanupAfterGraphicsCall(false);
 }
 
 PassRefPtr<CanvasArray> CanvasRenderingContext3D::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
 {
-    RefPtr<CanvasArray> array = m_context.readPixels(x, y, width, height, format, type);
+    RefPtr<CanvasArray> array = m_context->readPixels(x, y, width, height, format, type);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 void CanvasRenderingContext3D::releaseShaderCompiler()
 {
-    m_context.releaseShaderCompiler();
+    m_context->releaseShaderCompiler();
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height)
 {
-    m_context.renderbufferStorage(target, internalformat, width, height);
+    m_context->renderbufferStorage(target, internalformat, width, height);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::sampleCoverage(double value, bool invert)
 {
-    m_context.sampleCoverage((float) value, invert);
+    m_context->sampleCoverage((float) value, invert);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::scissor(long x, long y, unsigned long width, unsigned long height)
 {
-    m_context.scissor(x, y, width, height);
+    m_context->scissor(x, y, width, height);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::shaderSource(CanvasShader* shader, const String& string)
 {
-    m_context.shaderSource(shader, string);
+    m_context->shaderSource(shader, string);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::stencilFunc(unsigned long func, long ref, unsigned long mask)
 {
-    m_context.stencilFunc(func, ref, mask);
+    m_context->stencilFunc(func, ref, mask);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask)
 {
-    m_context.stencilFuncSeparate(face, func, ref, mask);
+    m_context->stencilFuncSeparate(face, func, ref, mask);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::stencilMask(unsigned long mask)
 {
-    m_context.stencilMask(mask);
+    m_context->stencilMask(mask);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::stencilMaskSeparate(unsigned long face, unsigned long mask)
 {
-    m_context.stencilMaskSeparate(face, mask);
+    m_context->stencilMaskSeparate(face, mask);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass)
 {
-    m_context.stencilOp(fail, zfail, zpass);
+    m_context->stencilOp(fail, zfail, zpass);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass)
 {
-    m_context.stencilOpSeparate(face, fail, zfail, zpass);
+    m_context->stencilOpSeparate(face, fail, zfail, zpass);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -893,7 +904,7 @@ void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsig
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texImage2D(target, level, internalformat, width, height,
+    m_context->texImage2D(target, level, internalformat, width, height,
                          border, format, type, pixels);
     cleanupAfterGraphicsCall(false);
 }
@@ -904,7 +915,7 @@ void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsig
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texImage2D(target, level, internalformat, width, height,
+    m_context->texImage2D(target, level, internalformat, width, height,
                          border, format, type, pixels);
     cleanupAfterGraphicsCall(false);
 }
@@ -914,7 +925,7 @@ void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLI
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texImage2D(target, level, image, flipY, premultiplyAlpha);
+    m_context->texImage2D(target, level, image, flipY, premultiplyAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -923,7 +934,7 @@ void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLC
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texImage2D(target, level, canvas, flipY, premultiplyAlpha);
+    m_context->texImage2D(target, level, canvas, flipY, premultiplyAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -932,19 +943,19 @@ void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLV
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texImage2D(target, level, video, flipY, premultiplyAlpha);
+    m_context->texImage2D(target, level, video, flipY, premultiplyAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::texParameterf(unsigned target, unsigned pname, float param)
 {
-    m_context.texParameterf(target, pname, param);
+    m_context->texParameterf(target, pname, param);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::texParameteri(unsigned target, unsigned pname, int param)
 {
-    m_context.texParameteri(target, pname, param);
+    m_context->texParameteri(target, pname, param);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -954,7 +965,7 @@ void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, un
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -964,7 +975,7 @@ void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, un
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -974,7 +985,7 @@ void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, un
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, image, flipY, premultiplyAlpha);
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, image, flipY, premultiplyAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -984,7 +995,7 @@ void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, un
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, canvas, flipY, premultiplyAlpha);
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, canvas, flipY, premultiplyAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -994,13 +1005,13 @@ void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, un
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, video, flipY, premultiplyAlpha);
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, video, flipY, premultiplyAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform1f(long location, float x)
 {
-    m_context.uniform1f(location, x);
+    m_context->uniform1f(location, x);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1010,7 +1021,7 @@ void CanvasRenderingContext3D::uniform1fv(long location, CanvasFloatArray* v)
     if (!v)
         return;
         
-    m_context.uniform1fv(location, v->data(), v->length());
+    m_context->uniform1fv(location, v->data(), v->length());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1020,13 +1031,13 @@ void CanvasRenderingContext3D::uniform1fv(long location, float* v, int size)
     if (!v)
         return;
         
-    m_context.uniform1fv(location, v, size);
+    m_context->uniform1fv(location, v, size);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform1i(long location, int x)
 {
-    m_context.uniform1i(location, x);
+    m_context->uniform1i(location, x);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1036,7 +1047,7 @@ void CanvasRenderingContext3D::uniform1iv(long location, CanvasIntArray* v)
     if (!v)
         return;
         
-    m_context.uniform1iv(location, v->data(), v->length());
+    m_context->uniform1iv(location, v->data(), v->length());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1046,13 +1057,13 @@ void CanvasRenderingContext3D::uniform1iv(long location, int* v, int size)
     if (!v)
         return;
         
-    m_context.uniform1iv(location, v, size);
+    m_context->uniform1iv(location, v, size);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform2f(long location, float x, float y)
 {
-    m_context.uniform2f(location, x, y);
+    m_context->uniform2f(location, x, y);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1063,7 +1074,7 @@ void CanvasRenderingContext3D::uniform2fv(long location, CanvasFloatArray* v)
         return;
         
     // FIXME: length needs to be a multiple of 2
-    m_context.uniform2fv(location, v->data(), v->length() / 2);
+    m_context->uniform2fv(location, v->data(), v->length() / 2);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1074,13 +1085,13 @@ void CanvasRenderingContext3D::uniform2fv(long location, float* v, int size)
         return;
         
     // FIXME: length needs to be a multiple of 2
-    m_context.uniform2fv(location, v, size / 2);
+    m_context->uniform2fv(location, v, size / 2);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform2i(long location, int x, int y)
 {
-    m_context.uniform2i(location, x, y);
+    m_context->uniform2i(location, x, y);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1091,7 +1102,7 @@ void CanvasRenderingContext3D::uniform2iv(long location, CanvasIntArray* v)
         return;
         
     // FIXME: length needs to be a multiple of 2
-    m_context.uniform2iv(location, v->data(), v->length() / 2);
+    m_context->uniform2iv(location, v->data(), v->length() / 2);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1102,13 +1113,13 @@ void CanvasRenderingContext3D::uniform2iv(long location, int* v, int size)
         return;
         
     // FIXME: length needs to be a multiple of 2
-    m_context.uniform2iv(location, v, size / 2);
+    m_context->uniform2iv(location, v, size / 2);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform3f(long location, float x, float y, float z)
 {
-    m_context.uniform3f(location, x, y, z);
+    m_context->uniform3f(location, x, y, z);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1119,7 +1130,7 @@ void CanvasRenderingContext3D::uniform3fv(long location, CanvasFloatArray* v)
         return;
         
     // FIXME: length needs to be a multiple of 3
-    m_context.uniform3fv(location, v->data(), v->length() / 3);
+    m_context->uniform3fv(location, v->data(), v->length() / 3);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1130,13 +1141,13 @@ void CanvasRenderingContext3D::uniform3fv(long location, float* v, int size)
         return;
         
     // FIXME: length needs to be a multiple of 3
-    m_context.uniform3fv(location, v, size / 3);
+    m_context->uniform3fv(location, v, size / 3);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform3i(long location, int x, int y, int z)
 {
-    m_context.uniform3i(location, x, y, z);
+    m_context->uniform3i(location, x, y, z);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1147,7 +1158,7 @@ void CanvasRenderingContext3D::uniform3iv(long location, CanvasIntArray* v)
         return;
         
     // FIXME: length needs to be a multiple of 3
-    m_context.uniform3iv(location, v->data(), v->length() / 3);
+    m_context->uniform3iv(location, v->data(), v->length() / 3);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1158,13 +1169,13 @@ void CanvasRenderingContext3D::uniform3iv(long location, int* v, int size)
         return;
         
     // FIXME: length needs to be a multiple of 3
-    m_context.uniform3iv(location, v, size / 3);
+    m_context->uniform3iv(location, v, size / 3);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform4f(long location, float x, float y, float z, float w)
 {
-    m_context.uniform4f(location, x, y, z, w);
+    m_context->uniform4f(location, x, y, z, w);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1175,7 +1186,7 @@ void CanvasRenderingContext3D::uniform4fv(long location, CanvasFloatArray* v)
         return;
         
     // FIXME: length needs to be a multiple of 4
-    m_context.uniform4fv(location, v->data(), v->length() / 4);
+    m_context->uniform4fv(location, v->data(), v->length() / 4);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1186,13 +1197,13 @@ void CanvasRenderingContext3D::uniform4fv(long location, float* v, int size)
         return;
         
     // FIXME: length needs to be a multiple of 4
-    m_context.uniform4fv(location, v, size / 4);
+    m_context->uniform4fv(location, v, size / 4);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform4i(long location, int x, int y, int z, int w)
 {
-    m_context.uniform4i(location, x, y, z, w);
+    m_context->uniform4i(location, x, y, z, w);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1203,7 +1214,7 @@ void CanvasRenderingContext3D::uniform4iv(long location, CanvasIntArray* v)
         return;
         
     // FIXME: length needs to be a multiple of 4
-    m_context.uniform4iv(location, v->data(), v->length() / 4);
+    m_context->uniform4iv(location, v->data(), v->length() / 4);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1214,7 +1225,7 @@ void CanvasRenderingContext3D::uniform4iv(long location, int* v, int size)
         return;
         
     // FIXME: length needs to be a multiple of 4
-    m_context.uniform4iv(location, v, size / 4);
+    m_context->uniform4iv(location, v, size / 4);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1225,7 +1236,7 @@ void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, C
         return;
         
     // FIXME: length needs to be a multiple of 4
-    m_context.uniformMatrix2fv(location, transpose, v->data(), v->length() / 4);
+    m_context->uniformMatrix2fv(location, transpose, v->data(), v->length() / 4);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1236,7 +1247,7 @@ void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, f
         return;
         
     // FIXME: length needs to be a multiple of 4
-    m_context.uniformMatrix2fv(location, transpose, v, size / 4);
+    m_context->uniformMatrix2fv(location, transpose, v, size / 4);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1247,7 +1258,7 @@ void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, C
         return;
         
     // FIXME: length needs to be a multiple of 9
-    m_context.uniformMatrix3fv(location, transpose, v->data(), v->length() / 9);
+    m_context->uniformMatrix3fv(location, transpose, v->data(), v->length() / 9);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1258,7 +1269,7 @@ void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, f
         return;
         
     // FIXME: length needs to be a multiple of 9
-    m_context.uniformMatrix3fv(location, transpose, v, size / 9);
+    m_context->uniformMatrix3fv(location, transpose, v, size / 9);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1269,7 +1280,7 @@ void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, C
         return;
         
     // FIXME: length needs to be a multiple of 16
-    m_context.uniformMatrix4fv(location, transpose, v->data(), v->length() / 16);
+    m_context->uniformMatrix4fv(location, transpose, v->data(), v->length() / 16);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1280,32 +1291,32 @@ void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, f
         return;
         
     // FIXME: length needs to be a multiple of 16
-    m_context.uniformMatrix4fv(location, transpose, v, size / 16);
+    m_context->uniformMatrix4fv(location, transpose, v, size / 16);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::useProgram(CanvasProgram* program)
 {
-    m_context.useProgram(program);
+    m_context->useProgram(program);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::validateProgram(CanvasProgram* program)
 {
-    m_context.validateProgram(program);
+    m_context->validateProgram(program);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib1f(unsigned long indx, float v0)
 {
-    m_context.vertexAttrib1f(indx, v0);
+    m_context->vertexAttrib1f(indx, v0);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, CanvasFloatArray* v)
 {
     // FIXME: Need to make sure array is big enough for attribute being set
-    m_context.vertexAttrib1fv(indx, v->data());
+    m_context->vertexAttrib1fv(indx, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1314,20 +1325,20 @@ void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, float* v, int
     // FIXME: Need to make sure array is big enough for attribute being set
     UNUSED_PARAM(size);
     
-    m_context.vertexAttrib1fv(indx, v);
+    m_context->vertexAttrib1fv(indx, v);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib2f(unsigned long indx, float v0, float v1)
 {
-    m_context.vertexAttrib2f(indx, v0, v1);
+    m_context->vertexAttrib2f(indx, v0, v1);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, CanvasFloatArray* v)
 {
     // FIXME: Need to make sure array is big enough for attribute being set
-    m_context.vertexAttrib2fv(indx, v->data());
+    m_context->vertexAttrib2fv(indx, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1336,20 +1347,20 @@ void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, float* v, int
     // FIXME: Need to make sure array is big enough for attribute being set
     UNUSED_PARAM(size);
     
-    m_context.vertexAttrib2fv(indx, v);
+    m_context->vertexAttrib2fv(indx, v);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib3f(unsigned long indx, float v0, float v1, float v2)
 {
-    m_context.vertexAttrib3f(indx, v0, v1, v2);
+    m_context->vertexAttrib3f(indx, v0, v1, v2);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, CanvasFloatArray* v)
 {
     // FIXME: Need to make sure array is big enough for attribute being set
-    m_context.vertexAttrib3fv(indx, v->data());
+    m_context->vertexAttrib3fv(indx, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1358,20 +1369,20 @@ void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, float* v, int
     // FIXME: Need to make sure array is big enough for attribute being set
     UNUSED_PARAM(size);
     
-    m_context.vertexAttrib3fv(indx, v);
+    m_context->vertexAttrib3fv(indx, v);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib4f(unsigned long indx, float v0, float v1, float v2, float v3)
 {
-    m_context.vertexAttrib4f(indx, v0, v1, v2, v3);
+    m_context->vertexAttrib4f(indx, v0, v1, v2, v3);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, CanvasFloatArray* v)
 {
     // FIXME: Need to make sure array is big enough for attribute being set
-    m_context.vertexAttrib4fv(indx, v->data());
+    m_context->vertexAttrib4fv(indx, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1380,13 +1391,13 @@ void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, float* v, int
     // FIXME: Need to make sure array is big enough for attribute being set
     UNUSED_PARAM(size);
     
-    m_context.vertexAttrib4fv(indx, v);
+    m_context->vertexAttrib4fv(indx, v);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized, unsigned long stride, unsigned long offset)
 {
-    m_context.vertexAttribPointer(indx, size, type, normalized, stride, offset);
+    m_context->vertexAttribPointer(indx, size, type, normalized, stride, offset);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1400,7 +1411,7 @@ void CanvasRenderingContext3D::viewport(long x, long y, unsigned long width, uns
         width = 100;
     if (isnan(height))
         height = 100;
-    m_context.viewport(x, y, width, height);
+    m_context->viewport(x, y, width, height);
     cleanupAfterGraphicsCall(false);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h
index 526281bc05..70d9b95b12 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h
@@ -51,8 +51,8 @@ class WebKitCSSMatrix;
 
     class CanvasRenderingContext3D : public CanvasRenderingContext {
     public:
-        CanvasRenderingContext3D(HTMLCanvasElement*);
-        ~CanvasRenderingContext3D();
+        static PassOwnPtr<CanvasRenderingContext3D> create(HTMLCanvasElement*);
+        virtual ~CanvasRenderingContext3D();
 
         virtual bool is3d() const { return true; }
 
@@ -288,7 +288,7 @@ class WebKitCSSMatrix;
 
         void viewport(long x, long y, unsigned long width, unsigned long height);
 
-        GraphicsContext3D* graphicsContext3D() { return &m_context; }
+        GraphicsContext3D* graphicsContext3D() const { return m_context.get(); }
     
         void reshape(int width, int height);
 
@@ -300,18 +300,21 @@ class WebKitCSSMatrix;
         
     private:
         friend class CanvasObject;
+
+        CanvasRenderingContext3D(HTMLCanvasElement*, PassOwnPtr<GraphicsContext3D>);
+
         void addObject(CanvasObject*);
         void detachAndRemoveAllObjects();
 
         void markContextChanged();
         void cleanupAfterGraphicsCall(bool changed)
         {
-            m_context.checkError();
+            m_context->checkError();
             if (changed)
                 markContextChanged();
         }
         
-        GraphicsContext3D m_context;
+        OwnPtr<GraphicsContext3D> m_context;
         bool m_needsUpdate;
         bool m_markedCanvasDirty;
         // FIXME: I think this is broken -- it does not increment any
diff --git a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp
index 6cfb75eba7..eb8d49aca9 100644
--- a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp
@@ -90,7 +90,12 @@ void ConsoleMessage::addToConsole(InspectorFrontend* frontend)
     jsonObj.set("url", m_url);
     jsonObj.set("groupLevel", static_cast<int>(m_groupLevel));
     jsonObj.set("repeatCount", static_cast<int>(m_repeatCount));
-    frontend->addMessageToConsole(jsonObj, m_frames, m_wrappedArguments,  m_message);
+    frontend->addConsoleMessage(jsonObj, m_frames, m_wrappedArguments,  m_message);
+}
+
+void ConsoleMessage::updateRepeatCountInConsole(InspectorFrontend* frontend)
+{
+    frontend->updateConsoleMessageRepeatCount(m_repeatCount);
 }
 #endif // ENABLE(INSPECTOR)
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h
index d03f2b7638..8ed6660e17 100644
--- a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h
+++ b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h
@@ -49,6 +49,7 @@ namespace WebCore {
 
 #if ENABLE(INSPECTOR)
         void addToConsole(InspectorFrontend* frontend);
+        void updateRepeatCountInConsole(InspectorFrontend* frontend);
 #endif
         void incrementCount() { ++m_repeatCount; };
         bool isEqual(ScriptState*, ConsoleMessage* msg) const;
diff --git a/src/3rdparty/webkit/WebCore/inspector/DOMDispatchTimelineItem.cpp b/src/3rdparty/webkit/WebCore/inspector/DOMDispatchTimelineItem.cpp
deleted file mode 100644
index acff513fa6..0000000000
--- a/src/3rdparty/webkit/WebCore/inspector/DOMDispatchTimelineItem.cpp
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
-* Copyright (C) 2009 Google Inc. All rights reserved.
-*
-* Redistribution and use in source and binary forms, with or without
-* modification, are permitted provided that the following conditions are
-* met:
-*
-*     * Redistributions of source code must retain the above copyright
-* notice, this list of conditions and the following disclaimer.
-*     * Redistributions in binary form must reproduce the above
-* copyright notice, this list of conditions and the following disclaimer
-* in the documentation and/or other materials provided with the
-* distribution.
-*     * Neither the name of Google Inc. nor the names of its
-* contributors may be used to endorse or promote products derived from
-* this software without specific prior written permission.
-*
-* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-
-#include "config.h"
-#include "DOMDispatchTimelineItem.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "Event.h"
-#include "InspectorFrontend.h"
-
-namespace WebCore {
-
-DOMDispatchTimelineItem::DOMDispatchTimelineItem(PassOwnPtr<TimelineItem> previous, double startTime, const Event& event)
-    : TimelineItem(previous, startTime, DOMDispatchTimelineItemType)
-    , m_eventType(event.type().string())
-{
-}
-
-ScriptObject DOMDispatchTimelineItem::convertToScriptObject(InspectorFrontend* frontend)
-{
-    ScriptObject selfObj = TimelineItem::convertToScriptObject(frontend);
-    ScriptObject dataObj = frontend->newScriptObject();
-    dataObj.set("type", m_eventType);
-    selfObj.set("data", dataObj);
-    return selfObj;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/DOMDispatchTimelineItem.h b/src/3rdparty/webkit/WebCore/inspector/DOMDispatchTimelineItem.h
deleted file mode 100644
index 384ce25fc3..0000000000
--- a/src/3rdparty/webkit/WebCore/inspector/DOMDispatchTimelineItem.h
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
-* Copyright (C) 2009 Google Inc. All rights reserved.
-*
-* Redistribution and use in source and binary forms, with or without
-* modification, are permitted provided that the following conditions are
-* met:
-*
-*     * Redistributions of source code must retain the above copyright
-* notice, this list of conditions and the following disclaimer.
-*     * Redistributions in binary form must reproduce the above
-* copyright notice, this list of conditions and the following disclaimer
-* in the documentation and/or other materials provided with the
-* distribution.
-*     * Neither the name of Google Inc. nor the names of its
-* contributors may be used to endorse or promote products derived from
-* this software without specific prior written permission.
-*
-* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-
-#ifndef DOMDispatchTimelineItem_h
-#define DOMDispatchTimelineItem_h
-
-#include "TimelineItem.h"
-#include "PlatformString.h"
-
-namespace WebCore {
-
-    class Event;
-    class InspectorFrontend;
-
-    class DOMDispatchTimelineItem : public TimelineItem {
-    public:
-        DOMDispatchTimelineItem(PassOwnPtr<TimelineItem> previous, double startTime, const Event&);
-
-        virtual ~DOMDispatchTimelineItem() { }
-
-    protected:
-        virtual ScriptObject convertToScriptObject(InspectorFrontend*);
-
-    private:
-        String m_eventType;
-    };
-
-} // namespace WebCore
-
-#endif // !defined(DOMDispatchTimelineItem_h)
-
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
index a5b8cbfe0b..a6628cd9f0 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
@@ -171,6 +171,8 @@ InspectorController::~InspectorController()
         s_settingCache = 0;
     }
     
+    releaseDOMAgent();
+
     m_inspectorBackend->disconnectController();
 }
 
@@ -372,13 +374,14 @@ void InspectorController::addConsoleMessage(ScriptState* scriptState, ConsoleMes
     if (m_previousMessage && m_previousMessage->isEqual(scriptState, consoleMessage)) {
         m_previousMessage->incrementCount();
         delete consoleMessage;
+        if (windowVisible())
+            m_previousMessage->updateRepeatCountInConsole(m_frontend.get());
     } else {
         m_previousMessage = consoleMessage;
         m_consoleMessages.append(consoleMessage);
+        if (windowVisible())
+            m_previousMessage->addToConsole(m_frontend.get());
     }
-
-    if (windowVisible())
-        m_previousMessage->addToConsole(m_frontend.get());
 }
 
 void InspectorController::clearConsoleMessages(bool clearUI)
@@ -552,8 +555,10 @@ void InspectorController::setFrontendProxyObject(ScriptState* scriptState, Scrip
     m_scriptState = scriptState;
     m_injectedScriptObj = injectedScriptObj;
     m_frontend.set(new InspectorFrontend(this, scriptState, webInspectorObj));
-    m_domAgent = new InspectorDOMAgent(m_frontend.get());
-    m_timelineAgent = 0;
+    releaseDOMAgent();
+    m_domAgent = InspectorDOMAgent::create(m_frontend.get());
+    if (m_timelineAgent)
+        m_timelineAgent->resetFrontendProxyObject(m_frontend.get());
 }
 
 void InspectorController::show()
@@ -608,11 +613,7 @@ void InspectorController::close()
 
     m_frontend.set(0);
     m_injectedScriptObj = ScriptObject();
-    // m_domAgent is RefPtr. Remove DOM listeners first to ensure that there are
-    // no references to the DOM agent from the DOM tree.
-    if (m_domAgent)
-        m_domAgent->setDocument(0);
-    m_domAgent = 0;
+    releaseDOMAgent();
     m_timelineAgent = 0;
     m_scriptState = 0;
     if (m_page)
@@ -642,6 +643,15 @@ void InspectorController::closeWindow()
     m_client->closeWindow();
 }
 
+void InspectorController::releaseDOMAgent()
+{
+    // m_domAgent is RefPtr. Remove DOM listeners first to ensure that there are
+    // no references to the DOM agent from the DOM tree.
+    if (m_domAgent)
+        m_domAgent->setDocument(0);
+    m_domAgent = 0;
+}
+
 void InspectorController::populateScriptObjects()
 {
     ASSERT(m_frontend);
@@ -653,7 +663,9 @@ void InspectorController::populateScriptObjects()
     ResourcesMap::iterator resourcesEnd = m_resources.end();
     for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
         it->second->createScriptObject(m_frontend.get());
-        m_frontend->addCookieDomain(it->second->frame()->document()->url().host());
+        KURL resourceURL = it->second->frame()->document()->url();
+        if (resourceURL.protocolInHTTPFamily() || resourceURL.protocolIs("file"))
+            m_frontend->addCookieDomain(resourceURL.host());
     }
 
     unsigned messageCount = m_consoleMessages.size();
@@ -982,7 +994,9 @@ void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identi
 
     if (windowVisible()) {
         resource->updateScriptObject(m_frontend.get());
-        m_frontend->addCookieDomain(resource->frame()->document()->url().host());
+        KURL resourceURL = resource->frame()->document()->url();
+        if (resourceURL.protocolInHTTPFamily() || resourceURL.protocolIs("file"))
+            m_frontend->addCookieDomain(resourceURL.host());
     }
 }
 
@@ -1035,7 +1049,7 @@ void InspectorController::scriptImported(unsigned long identifier, const String&
         resource->updateScriptObject(m_frontend.get());
 }
 
-void InspectorController::enableResourceTracking(bool always)
+void InspectorController::enableResourceTracking(bool always, bool reload)
 {
     if (!enabled())
         return;
@@ -1051,7 +1065,8 @@ void InspectorController::enableResourceTracking(bool always)
     if (m_frontend)
         m_frontend->resourceTrackingWasEnabled();
 
-    m_inspectedPage->mainFrame()->loader()->reload();
+    if (reload)
+        m_inspectedPage->mainFrame()->loader()->reload();
 }
 
 void InspectorController::disableResourceTracking(bool always)
@@ -1431,7 +1446,7 @@ void InspectorController::startUserInitiatedProfiling(Timer<InspectorController>
 
     UString title = getCurrentUserInitiatedProfileName(true);
 
-    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
+    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame(), debuggerWorld())->globalExec();
     Profiler::profiler()->startProfiling(scriptState, title);
 
     addStartProfilingMessageToConsole(title, 0, UString());
@@ -1448,7 +1463,7 @@ void InspectorController::stopUserInitiatedProfiling()
 
     UString title = getCurrentUserInitiatedProfileName();
 
-    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
+    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame(), debuggerWorld())->globalExec();
     RefPtr<Profile> profile = Profiler::profiler()->stopProfiling(scriptState, title);
     if (profile)
         addProfile(profile, 0, UString());
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
index 8c1453200e..382d887c62 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
@@ -223,7 +223,7 @@ public:
     void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
     void scriptImported(unsigned long identifier, const String& sourceString);
 
-    void enableResourceTracking(bool always = false);
+    void enableResourceTracking(bool always = false, bool reload = true);
     void disableResourceTracking(bool always = false);
     bool resourceTrackingEnabled() const { return m_resourceTrackingEnabled; }
     void ensureResourceTrackingSettingsLoaded();
@@ -300,6 +300,7 @@ private:
     void storeLastActivePanel(const String& panelName);
     void closeWindow();
     InspectorDOMAgent* domAgent() { return m_domAgent.get(); }
+    void releaseDOMAgent();
 
     friend class InspectorFrontend;
     // Following are used from InspectorFrontend only. We don't want to expose them to the
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
index b9bdb6b888..3f736f7005 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
@@ -68,6 +68,11 @@ namespace WebCore {
 
     class InspectorDOMAgent : public EventListener {
     public:
+        static PassRefPtr<InspectorDOMAgent> create(InspectorFrontend* frontend)
+        {
+            return adoptRef(new InspectorDOMAgent(frontend));
+        }
+
         static const InspectorDOMAgent* cast(const EventListener* listener)
         {
             return listener->type() == InspectorDOMAgentType
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
index 2e6dc2baf3..2c422aceb2 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
@@ -78,9 +78,9 @@ void InspectorFrontend::didCommitLoad()
     callSimpleFunction("didCommitLoad");
 }
 
-void InspectorFrontend::addMessageToConsole(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message)
+void InspectorFrontend::addConsoleMessage(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addMessageToConsole"));
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addConsoleMessage"));
     function->appendArgument(messageObj);
     if (!frames.isEmpty()) {
         for (unsigned i = 0; i < frames.size(); ++i)
@@ -93,6 +93,13 @@ void InspectorFrontend::addMessageToConsole(const ScriptObject& messageObj, cons
     function->call();
 }
 
+void InspectorFrontend::updateConsoleMessageRepeatCount(const int count)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateConsoleMessageRepeatCount"));
+    function->appendArgument(count);
+    function->call();
+}
+
 void InspectorFrontend::clearConsoleMessages()
 {
     callSimpleFunction("clearConsoleMessages");
@@ -207,10 +214,10 @@ void InspectorFrontend::timelineProfilerWasStopped()
     callSimpleFunction("timelineProfilerWasStopped");
 }
 
-void InspectorFrontend::addItemToTimeline(const ScriptObject& itemObj)
+void InspectorFrontend::addRecordToTimeline(const ScriptObject& record)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addItemToTimeline"));
-    function->appendArgument(itemObj);
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addRecordToTimeline"));
+    function->appendArgument(record);
     function->call();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
index 0883ac2fff..3cb9b8c79c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
@@ -63,7 +63,8 @@ namespace WebCore {
         ScriptObject newScriptObject();
 
         void didCommitLoad();
-        void addMessageToConsole(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message);
+        void addConsoleMessage(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message);
+        void updateConsoleMessageRepeatCount(const int count);
         void clearConsoleMessages();
 
         bool addResource(long long identifier, const ScriptObject& resourceObj);
@@ -126,7 +127,7 @@ namespace WebCore {
 
         void timelineProfilerWasStarted();
         void timelineProfilerWasStopped();
-        void addItemToTimeline(const ScriptObject& itemObj);
+        void addRecordToTimeline(const ScriptObject&);
 
         void didGetCookies(int callId, const ScriptArray& cookies, const String& cookiesString);
         void didDispatchOnInjectedScript(int callId, const String& result, bool isException);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
index 69ab39b755..b8bb22b8d6 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
@@ -33,6 +33,7 @@
 
 #if ENABLE(INSPECTOR)
 
+#include "Cache.h"
 #include "CachedResource.h"
 #include "DocLoader.h"
 #include "DocumentLoader.h"
@@ -227,6 +228,18 @@ void InspectorResource::releaseScriptObject(InspectorFrontend* frontend, bool ca
     frontend->removeResource(m_identifier);
 }
 
+CachedResource* InspectorResource::cachedResource() const
+{
+    // Try hard to find a corresponding CachedResource. During preloading, DocLoader may not have the resource in document resources set yet,
+    // but Inspector will already try to fetch data that is only available via CachedResource (and it won't update once the resource is added,
+    // because m_changes will not have the appropriate bits set).
+    const String& url = requestURL();
+    CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(url);
+    if (!cachedResource)
+        cachedResource = cache()->resourceForURL(url);
+    return cachedResource;
+}
+
 InspectorResource::Type InspectorResource::type() const
 {
     if (!m_xmlHttpResponseText.isNull())
@@ -238,7 +251,7 @@ InspectorResource::Type InspectorResource::type() const
     if (m_loader->frameLoader() && m_requestURL == m_loader->frameLoader()->iconURL())
         return Image;
 
-    CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(requestURL());
+    CachedResource* cachedResource = this->cachedResource();
     if (!cachedResource)
         return Other;
 
@@ -281,13 +294,14 @@ String InspectorResource::sourceString() const
     return encoding.decode(buffer->data(), buffer->size());
 }
 
-PassRefPtr<SharedBuffer> InspectorResource::resourceData(String* textEncodingName) const {
+PassRefPtr<SharedBuffer> InspectorResource::resourceData(String* textEncodingName) const
+{
     if (m_requestURL == m_loader->requestURL()) {
         *textEncodingName = m_frame->document()->inputEncoding();
         return m_loader->mainResourceData();
     }
 
-    CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(requestURL());
+    CachedResource* cachedResource = this->cachedResource();
     if (!cachedResource)
         return 0;
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
index 880eab73f9..0335586ad9 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
@@ -145,6 +145,8 @@ namespace WebCore {
         InspectorResource(long long identifier, DocumentLoader*);
         Type type() const;
 
+        CachedResource* cachedResource() const;
+
         long long m_identifier;
         RefPtr<DocumentLoader> m_loader;
         RefPtr<Frame> m_frame;
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.cpp
index c3ad075a49..4f7b736d67 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -33,19 +33,16 @@
 
 #if ENABLE(INSPECTOR)
 
-#include "DOMDispatchTimelineItem.h"
 #include "Event.h"
 #include "InspectorFrontend.h"
-#include "TimelineItem.h"
+#include "TimelineRecordFactory.h"
 
 #include <wtf/CurrentTime.h>
 
 namespace WebCore {
 
 InspectorTimelineAgent::InspectorTimelineAgent(InspectorFrontend* frontend)
-    : m_sessionStartTime(currentTimeInMilliseconds())
-    , m_frontend(frontend)
-    , m_currentTimelineItem(0)
+    : m_frontend(frontend)
 {
     ASSERT(m_frontend);
 }
@@ -56,75 +53,140 @@ InspectorTimelineAgent::~InspectorTimelineAgent()
 
 void InspectorTimelineAgent::willDispatchDOMEvent(const Event& event)
 {
-    m_currentTimelineItem = new DOMDispatchTimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), event);
+    pushCurrentRecord(TimelineRecordFactory::createDOMDispatchRecord(m_frontend, currentTimeInMilliseconds(), event), DOMDispatchTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didDispatchDOMEvent()
 {
-    ASSERT(m_currentTimelineItem->type() == DOMDispatchTimelineItemType);
-    didCompleteCurrentRecord();
+    didCompleteCurrentRecord(DOMDispatchTimelineRecordType);
 }
 
 void InspectorTimelineAgent::willLayout()
 {
-    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), LayoutTimelineItemType);
+    pushCurrentRecord(TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds()), LayoutTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didLayout()
 {
-    ASSERT(m_currentTimelineItem->type() == LayoutTimelineItemType);
-    didCompleteCurrentRecord();
+    didCompleteCurrentRecord(LayoutTimelineRecordType);
 }
 
 void InspectorTimelineAgent::willRecalculateStyle()
 {
-    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), RecalculateStylesTimelineItemType);
+    pushCurrentRecord(TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds()), RecalculateStylesTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didRecalculateStyle()
 {
-    ASSERT(m_currentTimelineItem->type() == RecalculateStylesTimelineItemType);
-    didCompleteCurrentRecord();
+    didCompleteCurrentRecord(RecalculateStylesTimelineRecordType);
 }
 
 void InspectorTimelineAgent::willPaint()
 {
-    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), PaintTimelineItemType);
+    pushCurrentRecord(TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds()), PaintTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didPaint()
 {
-    ASSERT(m_currentTimelineItem->type() == PaintTimelineItemType);
-    didCompleteCurrentRecord();
+    didCompleteCurrentRecord(PaintTimelineRecordType);
 }
 
 void InspectorTimelineAgent::willWriteHTML()
 {
-    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), ParseHTMLTimelineItemType);
+    pushCurrentRecord(TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds()), ParseHTMLTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didWriteHTML()
 {
-    ASSERT(m_currentTimelineItem->type() == ParseHTMLTimelineItemType);
-    didCompleteCurrentRecord();
+    didCompleteCurrentRecord(ParseHTMLTimelineRecordType);
+}
+   
+void InspectorTimelineAgent::didInstallTimer(int timerId, int timeout, bool singleShot)
+{
+    addRecordToTimeline(TimelineRecordFactory::createTimerInstallRecord(m_frontend, currentTimeInMilliseconds(), timerId,
+        timeout, singleShot), TimerInstallTimelineRecordType);
+}
+
+void InspectorTimelineAgent::didRemoveTimer(int timerId)
+{
+    addRecordToTimeline(TimelineRecordFactory::createGenericTimerRecord(m_frontend, currentTimeInMilliseconds(), timerId),
+        TimerRemoveTimelineRecordType);
+}
+
+void InspectorTimelineAgent::willFireTimer(int timerId)
+{
+    pushCurrentRecord(TimelineRecordFactory::createGenericTimerRecord(m_frontend, currentTimeInMilliseconds(), timerId),
+        TimerFireTimelineRecordType); 
+}
+
+void InspectorTimelineAgent::didFireTimer()
+{
+    didCompleteCurrentRecord(TimerFireTimelineRecordType);
+}
+
+void InspectorTimelineAgent::willChangeXHRReadyState(const String& url, int readyState)
+{
+    pushCurrentRecord(TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord(m_frontend, currentTimeInMilliseconds(), url, readyState),
+        XHRReadyStateChangeRecordType);
+}
+
+void InspectorTimelineAgent::didChangeXHRReadyState()
+{
+    didCompleteCurrentRecord(XHRReadyStateChangeRecordType);
+}
+
+void InspectorTimelineAgent::willLoadXHR(const String& url) 
+{
+    pushCurrentRecord(TimelineRecordFactory::createXHRLoadTimelineRecord(m_frontend, currentTimeInMilliseconds(), url), XHRLoadRecordType);
+}
+
+void InspectorTimelineAgent::didLoadXHR()
+{
+    didCompleteCurrentRecord(XHRLoadRecordType);
+}
+
+void InspectorTimelineAgent::willEvaluateScriptTag(const String& url, int lineNumber)
+{
+    pushCurrentRecord(TimelineRecordFactory::createEvaluateScriptTagTimelineRecord(m_frontend, currentTimeInMilliseconds(), url, lineNumber), EvaluateScriptTagTimelineRecordType);
+}
+    
+void InspectorTimelineAgent::didEvaluateScriptTag()
+{
+    didCompleteCurrentRecord(EvaluateScriptTagTimelineRecordType);
 }
 
 void InspectorTimelineAgent::reset()
 {
-    m_sessionStartTime = currentTimeInMilliseconds();
-    m_currentTimelineItem.set(0);
+    m_recordStack.clear();
+}
+
+void InspectorTimelineAgent::resetFrontendProxyObject(InspectorFrontend* frontend)
+{
+    ASSERT(frontend);
+    reset();
+    m_frontend = frontend;
 }
 
-void InspectorTimelineAgent::didCompleteCurrentRecord()
+void InspectorTimelineAgent::addRecordToTimeline(ScriptObject record, TimelineRecordType type)
 {
-    OwnPtr<TimelineItem> item(m_currentTimelineItem.release());
-    m_currentTimelineItem = item->releasePrevious();
+    record.set("type", type);
+    if (m_recordStack.isEmpty())
+        m_frontend->addRecordToTimeline(record);
+    else {
+        TimelineRecordEntry parent = m_recordStack.last();
+        parent.children.set(parent.children.length(), record);
+    }
+}
 
-    item->setEndTime(sessionTimeInMilliseconds());
-    if (m_currentTimelineItem.get())
-        m_currentTimelineItem->addChildItem(item.release());
-    else
-        item->addToTimeline(m_frontend);
+void InspectorTimelineAgent::didCompleteCurrentRecord(TimelineRecordType type)
+{
+    ASSERT(!m_recordStack.isEmpty());
+    TimelineRecordEntry entry = m_recordStack.last();
+    m_recordStack.removeLast();
+    ASSERT(entry.type == type);
+    entry.record.set("children", entry.children);
+    entry.record.set("endTime", currentTimeInMilliseconds());
+    addRecordToTimeline(entry.record, type);
 }
 
 double InspectorTimelineAgent::currentTimeInMilliseconds()
@@ -132,9 +194,9 @@ double InspectorTimelineAgent::currentTimeInMilliseconds()
     return currentTime() * 1000.0;
 }
 
-double InspectorTimelineAgent::sessionTimeInMilliseconds()
+void InspectorTimelineAgent::pushCurrentRecord(ScriptObject record, TimelineRecordType type)
 {
-    return currentTimeInMilliseconds() - m_sessionStartTime;
+    m_recordStack.append(TimelineRecordEntry(record, m_frontend->newScriptArray(), type));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.h b/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.h
index 4095fed6fa..0401977b8d 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.h
@@ -31,16 +31,30 @@
 #ifndef InspectorTimelineAgent_h
 #define InspectorTimelineAgent_h
 
+#include "Document.h"
+#include "ScriptExecutionContext.h"
 #include "ScriptObject.h"
 #include "ScriptArray.h"
-
-#include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
     class Event;
     class InspectorFrontend;
-    class TimelineItem;
+
+    // Must be kept in sync with TimelineAgent.js
+    enum TimelineRecordType {
+        DOMDispatchTimelineRecordType = 0,
+        LayoutTimelineRecordType = 1,
+        RecalculateStylesTimelineRecordType = 2,
+        PaintTimelineRecordType = 3,
+        ParseHTMLTimelineRecordType = 4,
+        TimerInstallTimelineRecordType = 5,
+        TimerRemoveTimelineRecordType = 6,
+        TimerFireTimelineRecordType = 7,
+        XHRReadyStateChangeRecordType = 8,
+        XHRLoadRecordType = 9,
+        EvaluateScriptTagTimelineRecordType = 10,
+    };
 
     class InspectorTimelineAgent {
     public:
@@ -48,30 +62,66 @@ namespace WebCore {
         ~InspectorTimelineAgent();
 
         void reset();
+        void resetFrontendProxyObject(InspectorFrontend*);
 
         // Methods called from WebCore.
         void willDispatchDOMEvent(const Event&);
         void didDispatchDOMEvent();
+
         void willLayout();
         void didLayout();
+
         void willRecalculateStyle();
         void didRecalculateStyle();
+
         void willPaint();
         void didPaint();
-        void didWriteHTML();
+
         void willWriteHTML();
-    private:
-        double sessionTimeInMilliseconds();
+        void didWriteHTML();
+        
+        void didInstallTimer(int timerId, int timeout, bool singleShot);
+        void didRemoveTimer(int timerId);
+        void willFireTimer(int timerId);
+        void didFireTimer();
+
+        void willChangeXHRReadyState(const String&, int);
+        void didChangeXHRReadyState();
+        void willLoadXHR(const String&);
+        void didLoadXHR();
 
+        void willEvaluateScriptTag(const String&, int);
+        void didEvaluateScriptTag();
+
+        static InspectorTimelineAgent* retrieve(ScriptExecutionContext*);
+    private:
+        struct TimelineRecordEntry {
+            TimelineRecordEntry(ScriptObject record, ScriptArray children, TimelineRecordType type) : record(record), children(children), type(type) { }
+            ScriptObject record;
+            ScriptArray children;
+            TimelineRecordType type;
+        };
+        
+        void pushCurrentRecord(ScriptObject, TimelineRecordType);
+        
         static double currentTimeInMilliseconds();
 
-        void didCompleteCurrentRecord();
+        void didCompleteCurrentRecord(TimelineRecordType);
+        
+        void addRecordToTimeline(ScriptObject, TimelineRecordType);
 
-        double m_sessionStartTime;
         InspectorFrontend* m_frontend;
-        OwnPtr<TimelineItem> m_currentTimelineItem;
+        
+        Vector< TimelineRecordEntry > m_recordStack;
     };
 
+inline InspectorTimelineAgent* InspectorTimelineAgent::retrieve(ScriptExecutionContext* context)
+{
+    if (context->isDocument())
+        return static_cast<Document*>(context)->inspectorTimelineAgent();
+    return 0;
+}
+
 } // namespace WebCore
 
 #endif // !defined(InspectorTimelineAgent_h)
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp
index 9225a03921..1559d8297b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp
@@ -25,6 +25,7 @@
 
 #include "config.h"
 #include "JavaScriptCallFrame.h"
+#include "JSDOMBinding.h"
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
@@ -105,7 +106,7 @@ JSValue JavaScriptCallFrame::evaluate(const UString& script, JSValue& exception)
         return jsNull();
 
     JSLock lock(SilenceAssertionsOnly);
-    return m_debuggerCallFrame.evaluate(script, exception);
+    return DebuggerCallFrame_evaluateInWorld(m_debuggerCallFrame, script, exception);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/TimelineItem.cpp b/src/3rdparty/webkit/WebCore/inspector/TimelineItem.cpp
deleted file mode 100644
index b368c49d6d..0000000000
--- a/src/3rdparty/webkit/WebCore/inspector/TimelineItem.cpp
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
-* Copyright (C) 2009 Google Inc. All rights reserved.
-*
-* Redistribution and use in source and binary forms, with or without
-* modification, are permitted provided that the following conditions are
-* met:
-*
-*     * Redistributions of source code must retain the above copyright
-* notice, this list of conditions and the following disclaimer.
-*     * Redistributions in binary form must reproduce the above
-* copyright notice, this list of conditions and the following disclaimer
-* in the documentation and/or other materials provided with the
-* distribution.
-*     * Neither the name of Google Inc. nor the names of its
-* contributors may be used to endorse or promote products derived from
-* this software without specific prior written permission.
-*
-* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-
-#include "config.h"
-#include "TimelineItem.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "InspectorFrontend.h"
-#include "ScriptArray.h"
-#include "ScriptObject.h"
-
-namespace WebCore {
-
-TimelineItem::TimelineItem(PassOwnPtr<TimelineItem> previous, double startTime, TimelineItemType itemType)
-    : m_startTime(startTime)
-    , m_endTime(0.0)
-    , m_itemType(itemType)
-    , m_previous(previous)
-{
-}
-
-void TimelineItem::addToTimeline(InspectorFrontend* frontend)
-{
-    frontend->addItemToTimeline(convertToScriptObject(frontend));
-}
-
-ScriptObject TimelineItem::convertToScriptObject(InspectorFrontend* frontend)
-{
-    ScriptObject selfObj = frontend->newScriptObject();
-    selfObj.set("time", m_startTime);
-    selfObj.set("type", static_cast<int>(m_itemType));
-    selfObj.set("duration", m_endTime - m_startTime);
-    ScriptArray children = convertChildrenToScriptArray(frontend);
-    selfObj.set("children", children);
-    return selfObj;
-}
-
-ScriptArray TimelineItem::convertChildrenToScriptArray(InspectorFrontend* frontend)
-{
-    ScriptArray children = frontend->newScriptArray();
-    for (unsigned i = 0; i < m_children.size(); ++i)
-        children.set(i, m_children[i]->convertToScriptObject(frontend));
-    return children;
-}
-
-void TimelineItem::addChildItem(PassOwnPtr<TimelineItem> timelineItem)
-{
-    m_children.append(timelineItem);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/TimelineItem.h b/src/3rdparty/webkit/WebCore/inspector/TimelineItem.h
deleted file mode 100644
index 19092304b7..0000000000
--- a/src/3rdparty/webkit/WebCore/inspector/TimelineItem.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
-* Copyright (C) 2009 Google Inc. All rights reserved.
-*
-* Redistribution and use in source and binary forms, with or without
-* modification, are permitted provided that the following conditions are
-* met:
-*
-*     * Redistributions of source code must retain the above copyright
-* notice, this list of conditions and the following disclaimer.
-*     * Redistributions in binary form must reproduce the above
-* copyright notice, this list of conditions and the following disclaimer
-* in the documentation and/or other materials provided with the
-* distribution.
-*     * Neither the name of Google Inc. nor the names of its
-* contributors may be used to endorse or promote products derived from
-* this software without specific prior written permission.
-*
-* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-
-#ifndef TimelineItem_h
-#define TimelineItem_h
-
-#include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-    class InspectorFrontend;
-    class TimelineItem;
-    class ScriptArray;
-    class ScriptObject;
-
-    typedef Vector<OwnPtr<TimelineItem> > TimelineItems;
-
-    // Must be kept in sync with TimelineAgent.js
-    enum TimelineItemType {
-        DOMDispatchTimelineItemType = 0,
-        LayoutTimelineItemType = 1,
-        RecalculateStylesTimelineItemType = 2,
-        PaintTimelineItemType = 3,
-        ParseHTMLTimelineItemType = 4,
-    };
-
-    class TimelineItem {
-    public:
-        TimelineItem(PassOwnPtr<TimelineItem>, double startTime, TimelineItemType);
-
-        virtual ~TimelineItem() { }
-
-        TimelineItem* previous() const { return m_previous.get(); }
-
-        PassOwnPtr<TimelineItem*> releasePrevious() { return m_previous.release(); }
-
-        void addToTimeline(InspectorFrontend*);
-
-        void addChildItem(PassOwnPtr<TimelineItem>);
-
-        void setEndTime(double endTime) { m_endTime = endTime; }
-
-        TimelineItemType type() { return m_itemType; }
-    protected:
-        virtual ScriptObject convertToScriptObject(InspectorFrontend*);
-
-        ScriptArray convertChildrenToScriptArray(InspectorFrontend*);
-      
-    private:
-        double m_startTime;
-        double m_endTime;
-        TimelineItemType m_itemType;
-        OwnPtr<TimelineItem> m_previous;
-        TimelineItems m_children;
-    };
-
-} // namespace WebCore
-
-#endif // !defined(TimelineItem_h)
diff --git a/src/3rdparty/webkit/WebCore/inspector/TimelineRecordFactory.cpp b/src/3rdparty/webkit/WebCore/inspector/TimelineRecordFactory.cpp
new file mode 100644
index 0000000000..085bcd9ab6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/TimelineRecordFactory.cpp
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TimelineRecordFactory.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "Event.h"
+#include "InspectorFrontend.h"
+#include "ScriptArray.h"
+#include "ScriptObject.h"
+namespace WebCore {
+
+// static
+ScriptObject TimelineRecordFactory::createGenericRecord(InspectorFrontend* frontend, double startTime)
+{
+    ScriptObject record = frontend->newScriptObject();
+    record.set("startTime", startTime);
+    return record;
+}
+
+// static
+ScriptObject TimelineRecordFactory::createDOMDispatchRecord(InspectorFrontend* frontend, double startTime, const Event& event)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("type", event.type().string());
+    record.set("data", data);
+    return record;
+}
+
+// static
+ScriptObject TimelineRecordFactory::createGenericTimerRecord(InspectorFrontend* frontend, double startTime, int timerId)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("timerId", timerId);
+    record.set("data", data);
+    return record;
+}
+
+// static
+ScriptObject TimelineRecordFactory::createTimerInstallRecord(InspectorFrontend* frontend, double startTime, int timerId, int timeout, bool singleShot)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("timerId", timerId);
+    data.set("timeout", timeout);
+    data.set("singleShot", singleShot);
+    record.set("data", data);
+    return record;
+}
+
+// static
+ScriptObject TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord(InspectorFrontend* frontend, double startTime, const String& url, int readyState)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("url", url);
+    data.set("readyState", readyState);
+    record.set("data", data);
+    return record;
+}
+
+// static
+ScriptObject TimelineRecordFactory::createXHRLoadTimelineRecord(InspectorFrontend* frontend, double startTime, const String& url)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("url", url);
+    record.set("data", data);
+    return record;
+}
+
+// static
+ScriptObject TimelineRecordFactory::createEvaluateScriptTagTimelineRecord(InspectorFrontend* frontend, double startTime, const String& url, double lineNumber) 
+{
+    ScriptObject item = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("url", url);
+    data.set("lineNumber", lineNumber);
+    item.set("data", data);
+    return item;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/dom/HTMLAllCollection.idl b/src/3rdparty/webkit/WebCore/inspector/TimelineRecordFactory.h
index dee365f01f..3d36649f2d 100644
--- a/src/3rdparty/webkit/WebCore/dom/HTMLAllCollection.idl
+++ b/src/3rdparty/webkit/WebCore/inspector/TimelineRecordFactory.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -27,14 +27,37 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
+ 
+#ifndef TimelineRecordFactory_h
+#define TimelineRecordFactory_h
 
-module html {
+#include "PlatformString.h"
 
-    // This interface is used for undetectable HTMLCollections.
-    // An undetectable HTMLCollection behaves like an HTMLCollection
-    // when used, but the 'typeof' operator returns undefined and
-    // ToBoolean returns false.
-    interface HTMLAllCollection : HTMLCollection {
+namespace WebCore {
+
+    class Event;
+    class InspectorFrontend;
+    class ScriptObject;
+
+    class TimelineRecordFactory {
+    public:
+        static ScriptObject createGenericRecord(InspectorFrontend*, double startTime);
+
+        static ScriptObject createDOMDispatchRecord(InspectorFrontend*, double startTime, const Event&);
+
+        static ScriptObject createGenericTimerRecord(InspectorFrontend*, double startTime, int timerId);
+
+        static ScriptObject createTimerInstallRecord(InspectorFrontend*, double startTime, int timerId, int timeout, bool singleShot);
+
+        static ScriptObject createXHRReadyStateChangeTimelineRecord(InspectorFrontend*, double startTime, const String& url, int readyState);
+        static ScriptObject createXHRLoadTimelineRecord(InspectorFrontend*, double startTime, const String& url);
+        
+        static ScriptObject createEvaluateScriptTagTimelineRecord(InspectorFrontend*, double startTime, const String&, double lineNumber);
+
+    private:
+        TimelineRecordFactory() { }
     };
 
-}
+} // namespace WebCore
+
+#endif // !defined(TimelineRecordFactory_h)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/AbstractTimelinePanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/AbstractTimelinePanel.js
new file mode 100644
index 0000000000..75e4062898
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/AbstractTimelinePanel.js
@@ -0,0 +1,548 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Anthony Ricaud <rik@webkit.org>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.AbstractTimelinePanel = function()
+{
+    WebInspector.Panel.call(this);
+    this._items = [];
+    this._staleItems = [];
+}
+
+WebInspector.AbstractTimelinePanel.prototype = {
+    get categories()
+    {
+        // Should be implemented by the concrete subclasses.
+        return {};
+    },
+
+    populateSidebar: function()
+    {
+        // Should be implemented by the concrete subclasses.
+    },
+
+    createItemTreeElement: function(item)
+    {
+        // Should be implemented by the concrete subclasses.
+    },
+
+    createItemGraph: function(item)
+    {
+        // Should be implemented by the concrete subclasses.
+    },
+
+    createInterface: function()
+    {
+        this._createFilterPanel();
+
+        this.containerElement = document.createElement("div");
+        this.containerElement.id = "resources-container";
+        this.containerElement.addEventListener("scroll", this._updateDividersLabelBarPosition.bind(this), false);
+        this.element.appendChild(this.containerElement);
+
+        this.createSidebar(this.containerElement, this.element);
+        this.sidebarElement.id = "resources-sidebar";
+        this.populateSidebar();
+
+        this._createGraph();
+    },
+
+    _createFilterPanel: function()
+    {
+        this.filterBarElement = document.createElement("div");
+        this.filterBarElement.id = "resources-filter";
+        this.filterBarElement.className = "scope-bar";
+        this.element.appendChild(this.filterBarElement);
+
+        function createFilterElement(category)
+        {
+            if (category === "all")
+                var label = WebInspector.UIString("All");
+            else if (this.categories[category])
+                var label = this.categories[category].title;
+
+            var categoryElement = document.createElement("li");
+            categoryElement.category = category;
+            categoryElement.addStyleClass(category);
+            categoryElement.appendChild(document.createTextNode(label));
+            categoryElement.addEventListener("click", this._updateFilter.bind(this), false);
+            this.filterBarElement.appendChild(categoryElement);
+
+            return categoryElement;
+        }
+
+        this.filterAllElement = createFilterElement.call(this, "all");
+
+        // Add a divider
+        var dividerElement = document.createElement("div");
+        dividerElement.addStyleClass("divider");
+        this.filterBarElement.appendChild(dividerElement);
+
+        for (var category in this.categories)
+            createFilterElement.call(this, category);
+    },
+
+    _showCategory: function(category)
+    {
+        var filterClass = "filter-" + category.toLowerCase();
+        this.itemsGraphsElement.addStyleClass(filterClass);
+        this.itemsTreeElement.childrenListElement.addStyleClass(filterClass);
+    },
+
+    _hideCategory: function(category)
+    {
+        var filterClass = "filter-" + category.toLowerCase();
+        this.itemsGraphsElement.removeStyleClass(filterClass);
+        this.itemsTreeElement.childrenListElement.removeStyleClass(filterClass);
+    },
+
+    filter: function(target, selectMultiple)
+    {
+        function unselectAll()
+        {
+            for (var i = 0; i < this.filterBarElement.childNodes.length; ++i) {
+                var child = this.filterBarElement.childNodes[i];
+                if (!child.category)
+                    continue;
+
+                child.removeStyleClass("selected");
+                this._hideCategory(child.category);
+            }
+        }
+
+        if (target === this.filterAllElement) {
+            if (target.hasStyleClass("selected")) {
+                // We can't unselect All, so we break early here
+                return;
+            }
+
+            // If All wasn't selected, and now is, unselect everything else.
+            unselectAll.call(this);
+        } else {
+            // Something other than All is being selected, so we want to unselect All.
+            if (this.filterAllElement.hasStyleClass("selected")) {
+                this.filterAllElement.removeStyleClass("selected");
+                this._hideCategory("all");
+            }
+        }
+
+        if (!selectMultiple) {
+            // If multiple selection is off, we want to unselect everything else
+            // and just select ourselves.
+            unselectAll.call(this);
+
+            target.addStyleClass("selected");
+            this._showCategory(target.category);
+            return;
+        }
+
+        if (target.hasStyleClass("selected")) {
+            // If selectMultiple is turned on, and we were selected, we just
+            // want to unselect ourselves.
+            target.removeStyleClass("selected");
+            this._hideCategory(target.category);
+        } else {
+            // If selectMultiple is turned on, and we weren't selected, we just
+            // want to select ourselves.
+            target.addStyleClass("selected");
+            this._showCategory(target.category);
+        }
+    },
+
+    _updateFilter: function(e)
+    {
+        var isMac = InspectorController.platform().indexOf("mac-") === 0;
+        var selectMultiple = false;
+        if (isMac && e.metaKey && !e.ctrlKey && !e.altKey && !e.shiftKey)
+            selectMultiple = true;
+        if (!isMac && e.ctrlKey && !e.metaKey && !e.altKey && !e.shiftKey)
+            selectMultiple = true;
+
+        this.filter(e.target, selectMultiple);
+
+        // When we are updating our filtering, scroll to the top so we don't end up
+        // in blank graph under all the resources.
+        this.containerElement.scrollTop = 0;
+    },
+
+    _createGraph: function()
+    {
+        this._containerContentElement = document.createElement("div");
+        this._containerContentElement.id = "resources-container-content";
+        this.containerElement.appendChild(this._containerContentElement);
+
+        this.summaryBar = new WebInspector.SummaryBar(this.categories);
+        this.summaryBar.element.id = "resources-summary";
+        this._containerContentElement.appendChild(this.summaryBar.element);
+
+        this.itemsGraphsElement = document.createElement("div");
+        this.itemsGraphsElement.id = "resources-graphs";
+        this._containerContentElement.appendChild(this.itemsGraphsElement);
+
+        this.dividersElement = document.createElement("div");
+        this.dividersElement.id = "resources-dividers";
+        this._containerContentElement.appendChild(this.dividersElement);
+
+        this.eventDividersElement = document.createElement("div");
+        this.eventDividersElement.id = "resources-event-dividers";
+        this._containerContentElement.appendChild(this.eventDividersElement);
+
+        this.dividersLabelBarElement = document.createElement("div");
+        this.dividersLabelBarElement.id = "resources-dividers-label-bar";
+        this._containerContentElement.appendChild(this.dividersLabelBarElement);
+    },
+
+    updateGraphDividersIfNeeded: function(force)
+    {
+        if (!this.visible) {
+            this.needsRefresh = true;
+            return false;
+        }
+
+        if (document.body.offsetWidth <= 0) {
+            // The stylesheet hasn't loaded yet or the window is closed,
+            // so we can't calculate what is need. Return early.
+            return false;
+        }
+
+        var dividerCount = Math.round(this.dividersElement.offsetWidth / 64);
+        var slice = this.calculator.boundarySpan / dividerCount;
+        if (!force && this._currentDividerSlice === slice)
+            return false;
+
+        this._currentDividerSlice = slice;
+
+        this.dividersElement.removeChildren();
+        this.eventDividersElement.removeChildren();
+        this.dividersLabelBarElement.removeChildren();
+
+        for (var i = 1; i <= dividerCount; ++i) {
+            var divider = document.createElement("div");
+            divider.className = "resources-divider";
+            if (i === dividerCount)
+                divider.addStyleClass("last");
+            divider.style.left = ((i / dividerCount) * 100) + "%";
+
+            this.dividersElement.appendChild(divider.cloneNode());
+
+            var label = document.createElement("div");
+            label.className = "resources-divider-label";
+            if (!isNaN(slice))
+                label.textContent = this.calculator.formatValue(slice * i);
+            divider.appendChild(label);
+
+            this.dividersLabelBarElement.appendChild(divider);
+        }
+    },
+
+    _updateDividersLabelBarPosition: function()
+    {
+        var scrollTop = this.containerElement.scrollTop;
+        var dividersTop = (scrollTop < this.summaryBar.element.offsetHeight ? this.summaryBar.element.offsetHeight : scrollTop);
+        this.dividersElement.style.top = scrollTop + "px";
+        this.eventDividersElement.style.top = scrollTop + "px";
+        this.dividersLabelBarElement.style.top = dividersTop + "px";
+    },
+
+    get needsRefresh()
+    {
+        return this._needsRefresh;
+    },
+
+    set needsRefresh(x)
+    {
+        if (this._needsRefresh === x)
+            return;
+
+        this._needsRefresh = x;
+
+        if (x) {
+            if (this.visible && !("_refreshTimeout" in this))
+                this._refreshTimeout = setTimeout(this.refresh.bind(this), 500);
+        } else {
+            if ("_refreshTimeout" in this) {
+                clearTimeout(this._refreshTimeout);
+                delete this._refreshTimeout;
+            }
+        }
+    },
+
+    refreshIfNeeded: function()
+    {
+        if (this.needsRefresh)
+            this.refresh();
+    },
+
+    show: function()
+    {
+        WebInspector.Panel.prototype.show.call(this);
+
+        this._updateDividersLabelBarPosition();
+        this.refreshIfNeeded();
+    },
+
+    resize: function()
+    {
+        this.updateGraphDividersIfNeeded();
+    },
+
+    updateMainViewWidth: function(width)
+    {
+        this._containerContentElement.style.left = width + "px";
+        this.updateGraphDividersIfNeeded();
+    },
+
+    refresh: function()
+    {
+        this.needsRefresh = false;
+
+        var staleItemsLength = this._staleItems.length;
+        var boundariesChanged = false;
+
+        for (var i = 0; i < staleItemsLength; ++i) {
+            var item = this._staleItems[i];
+            if (!item._itemTreeElement) {
+                // Create the timeline tree element and graph.
+                item._itemTreeElement = this.createItemTreeElement(item);
+                item._itemTreeElement._itemGraph = this.createItemGraph(item);
+
+                this.itemsTreeElement.appendChild(item._itemTreeElement);
+                this.itemsGraphsElement.appendChild(item._itemTreeElement._itemGraph.graphElement);
+            }
+
+            if (item._itemTreeElement.refresh)
+                item._itemTreeElement.refresh();
+
+            if (this.calculator.updateBoundaries(item))
+                boundariesChanged = true;
+        }
+
+        if (boundariesChanged) {
+            // The boundaries changed, so all item graphs are stale.
+            this._staleItems = this._items;
+            staleItemsLength = this._staleItems.length;
+        }
+
+        for (var i = 0; i < staleItemsLength; ++i)
+            this._staleItems[i]._itemTreeElement._itemGraph.refresh(this.calculator);
+
+        this._staleItems = [];
+
+        this.updateGraphDividersIfNeeded();
+    },
+
+    reset: function()
+    {
+        this.containerElement.scrollTop = 0;
+
+        if (this._calculator)
+            this._calculator.reset();
+
+        if (this._items) {
+            var itemsLength = this._items.length;
+            for (var i = 0; i < itemsLength; ++i) {
+                var item = this._items[i];
+                delete item._itemsTreeElement;
+            }
+        }
+
+        this._items = [];
+        this._staleItems = [];
+
+        this.itemsTreeElement.removeChildren();
+        this.itemsGraphsElement.removeChildren();
+
+        this.updateGraphDividersIfNeeded(true);
+    },
+
+    get calculator()
+    {
+        return this._calculator;
+    },
+
+    set calculator(x)
+    {
+        if (!x || this._calculator === x)
+            return;
+
+        this._calculator = x;
+        this._calculator.reset();
+
+        this._staleItems = this._items;
+        this.refresh();
+    },
+
+    addItem: function(item)
+    {
+        this._items.push(item);
+        this.refreshItem(item);
+    },
+
+    removeItem: function(item)
+    {
+        this._items.remove(item, true);
+
+        if (item._itemTreeElement) {
+            this.itemsTreeElement.removeChild(resource._itemTreeElement);
+            this.itemsGraphsElement.removeChild(resource._itemTreeElement._itemGraph.graphElement);
+        }
+
+        delete item._itemTreeElement;
+        this.adjustScrollPosition();
+    },
+
+    refreshItem: function(item)
+    {
+        this._staleItems.push(item);
+        this.needsRefresh = true;
+    },
+
+    revealAndSelectItem: function(item)
+    {
+        if (item._itemsTreeElement) {
+            item._itemsTreeElement.reveal();
+            item._itemsTreeElement.select(true);
+        }
+    },
+
+    sortItems: function(sortingFunction)
+    {
+        var sortedElements = [].concat(this.itemsTreeElement.children);
+        sortedElements.sort(sortingFunction);
+
+        var sortedElementsLength = sortedElements.length;
+        for (var i = 0; i < sortedElementsLength; ++i) {
+            var treeElement = sortedElements[i];
+            if (treeElement === this.itemsTreeElement.children[i])
+                continue;
+
+            var wasSelected = treeElement.selected;
+            this.itemsTreeElement.removeChild(treeElement);
+            this.itemsTreeElement.insertChild(treeElement, i);
+            if (wasSelected)
+                treeElement.select(true);
+
+            var graphElement = treeElement._itemGraph.graphElement;
+            this.itemsGraphsElement.insertBefore(graphElement, this.itemsGraphsElement.children[i]);
+        }
+    },
+
+    adjustScrollPosition: function()
+    {
+        // Prevent the container from being scrolled off the end.
+        if ((this.containerElement.scrollTop + this.containerElement.offsetHeight) > this.sidebarElement.offsetHeight)
+            this.containerElement.scrollTop = (this.sidebarElement.offsetHeight - this.containerElement.offsetHeight);
+    }
+}
+
+WebInspector.AbstractTimelinePanel.prototype.__proto__ = WebInspector.Panel.prototype;
+
+WebInspector.AbstractTimelineCalculator = function()
+{
+}
+
+WebInspector.AbstractTimelineCalculator.prototype = {
+    computeSummaryValues: function(items)
+    {
+        var total = 0;
+        var categoryValues = {};
+
+        var itemsLength = items.length;
+        for (var i = 0; i < itemsLength; ++i) {
+            var item = items[i];
+            var value = this._value(item);
+            if (typeof value === "undefined")
+                continue;
+            if (!(item.category.name in categoryValues))
+                categoryValues[item.category.name] = 0;
+            categoryValues[item.category.name] += value;
+            total += value;
+        }
+
+        return {categoryValues: categoryValues, total: total};
+    },
+
+    computeBarGraphPercentages: function(item)
+    {
+        return {start: 0, middle: 0, end: (this._value(item) / this.boundarySpan) * 100};
+    },
+
+    computeBarGraphLabels: function(item)
+    {
+        const label = this.formatValue(this._value(item));
+        return {left: label, right: label, tooltip: label};
+    },
+
+    get boundarySpan()
+    {
+        return this.maximumBoundary - this.minimumBoundary;
+    },
+
+    updateBoundaries: function(item)
+    {
+        this.minimumBoundary = 0;
+
+        var value = this._value(item);
+        if (typeof this.maximumBoundary === "undefined" || value > this.maximumBoundary) {
+            this.maximumBoundary = value;
+            return true;
+        }
+        return false;
+    },
+
+    reset: function()
+    {
+        delete this.minimumBoundary;
+        delete this.maximumBoundary;
+    },
+
+    _value: function(item)
+    {
+        return 0;
+    },
+
+    formatValue: function(value)
+    {
+        return value.toString();
+    }
+}
+
+WebInspector.AbstractTimelineCategory = function(name, title, color)
+{
+    this.name = name;
+    this.title = title;
+    this.color = color;
+}
+
+WebInspector.AbstractTimelineCategory.prototype = {
+    toString: function()
+    {
+        return this.title;
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js b/src/3rdparty/webkit/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
index 89b4ddc7d5..41a8a3aaee 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
@@ -29,6 +29,110 @@
 // each child still represent the root node. We have to be particularly careful of recursion with this mode
 // because a root node can represent itself AND an ancestor.
 
+WebInspector.BottomUpProfileDataGridNode = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode, /*BottomUpProfileDataGridTree*/ owningTree)
+{
+    // In bottom up mode, our parents are our children since we display an inverted tree.
+    // However, we don't want to show the very top parent since it is redundant.
+    var hasChildren = !!(profileNode.parent && profileNode.parent.parent);
+
+    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, hasChildren);
+
+    this._remainingNodeInfos = [];
+}
+
+WebInspector.BottomUpProfileDataGridNode.prototype = {
+    _takePropertiesFromProfileDataGridNode: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        this._save();
+
+        this.selfTime = profileDataGridNode.selfTime;
+        this.totalTime = profileDataGridNode.totalTime;
+        this.numberOfCalls = profileDataGridNode.numberOfCalls;
+    },
+
+    // When focusing, we keep just the members of the callstack.
+    _keepOnlyChild: function(/*ProfileDataGridNode*/ child)
+    {
+        this._save();
+
+        this.removeChildren();
+        this.appendChild(child);
+    },
+
+    _exclude: function(aCallUID)
+    {
+        if (this._remainingNodeInfos)
+            this._populate();
+
+        this._save();
+
+        var children = this.children;
+        var index = this.children.length;
+
+        while (index--)
+            children[index]._exclude(aCallUID);
+
+        var child = this.childrenByCallUID[aCallUID];
+
+        if (child)
+            this._merge(child, true);
+    },
+
+    _merge: function(/*ProfileDataGridNode*/ child, /*Boolean*/ shouldAbsorb)
+    {
+        this.selfTime -= child.selfTime;
+
+        WebInspector.ProfileDataGridNode.prototype._merge.call(this, child, shouldAbsorb);
+    },
+
+    _sharedPopulate: function()
+    {
+        var remainingNodeInfos = this._remainingNodeInfos;
+        var count = remainingNodeInfos.length;
+
+        for (var index = 0; index < count; ++index) {
+            var nodeInfo = remainingNodeInfos[index];
+            var ancestor = nodeInfo.ancestor;
+            var focusNode = nodeInfo.focusNode;
+            var child = this.findChild(ancestor);
+
+            // If we already have this child, then merge the data together.
+            if (child) {
+                var totalTimeAccountedFor = nodeInfo.totalTimeAccountedFor;
+
+                child.selfTime += focusNode.selfTime;
+                child.numberOfCalls += focusNode.numberOfCalls;
+
+                if (!totalTimeAccountedFor)
+                    child.totalTime += focusNode.totalTime;
+            } else {
+                // If not, add it as a true ancestor.
+                // In heavy mode, we take our visual identity from ancestor node...
+                var child = new WebInspector.BottomUpProfileDataGridNode(this.profileView, ancestor, this.tree);
+
+                if (ancestor !== focusNode) {
+                    // but the actual statistics from the "root" node (bottom of the callstack).
+                    child.selfTime = focusNode.selfTime;
+                    child.totalTime = focusNode.totalTime;
+                    child.numberOfCalls = focusNode.numberOfCalls;
+                }
+
+                this.appendChild(child);
+            }
+
+            var parent = ancestor.parent;
+            if (parent && parent.parent) {
+                nodeInfo.ancestor = parent;
+                child._remainingNodeInfos.push(nodeInfo);
+            }
+        }
+
+        delete this._remainingNodeInfos;
+    }
+}
+
+WebInspector.BottomUpProfileDataGridNode.prototype.__proto__ = WebInspector.ProfileDataGridNode.prototype;
+
 WebInspector.BottomUpProfileDataGridTree = function(/*ProfileView*/ aProfileView, /*ProfileNode*/ aProfileNode)
 {
     WebInspector.ProfileDataGridTree.call(this, aProfileView, aProfileNode);
@@ -139,114 +243,10 @@ WebInspector.BottomUpProfileDataGridTree.prototype = {
 
         if (this.lastComparator)
             this.sort(this.lastComparator, true);
-    }
-}
-
-WebInspector.BottomUpProfileDataGridTree.prototype.__proto__ = WebInspector.ProfileDataGridTree.prototype;
-
-WebInspector.BottomUpProfileDataGridNode = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode, /*BottomUpProfileDataGridTree*/ owningTree)
-{
-    // In bottom up mode, our parents are our children since we display an inverted tree.
-    // However, we don't want to show the very top parent since it is redundant.
-    var hasChildren = !!(profileNode.parent && profileNode.parent.parent);
-
-    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, hasChildren);
-
-    this._remainingNodeInfos = [];
-}
-
-WebInspector.BottomUpProfileDataGridNode.prototype = {
-    _takePropertiesFromProfileDataGridNode: function(/*ProfileDataGridNode*/ profileDataGridNode)
-    {
-        this._save();
-
-        this.selfTime = profileDataGridNode.selfTime;
-        this.totalTime = profileDataGridNode.totalTime;
-        this.numberOfCalls = profileDataGridNode.numberOfCalls;
-    },
-
-    // When focusing, we keep just the members of the callstack.
-    _keepOnlyChild: function(/*ProfileDataGridNode*/ child)
-    {
-        this._save();
-
-        this.removeChildren();
-        this.appendChild(child);
-    },
-
-    _exclude: function(aCallUID)
-    {
-        if (this._remainingNodeInfos)
-            this._populate();
-
-        this._save();
-
-        var children = this.children;
-        var index = this.children.length;
-
-        while (index--)
-            children[index]._exclude(aCallUID);
-
-        var child = this.childrenByCallUID[aCallUID];
-
-        if (child)
-            this._merge(child, true);
-    },
-
-    _merge: function(/*ProfileDataGridNode*/ child, /*Boolean*/ shouldAbsorb)
-    {
-        this.selfTime -= child.selfTime;
-
-        WebInspector.ProfileDataGridNode.prototype._merge.call(this, child, shouldAbsorb);
     },
 
-    _populate: function(event)
-    {
-        var remainingNodeInfos = this._remainingNodeInfos;
-        var count = remainingNodeInfos.length;
-
-        for (var index = 0; index < count; ++index) {
-            var nodeInfo = remainingNodeInfos[index];
-            var ancestor = nodeInfo.ancestor;
-            var focusNode = nodeInfo.focusNode;
-            var child = this.findChild(ancestor);
-
-            // If we already have this child, then merge the data together.
-            if (child) {
-                var totalTimeAccountedFor = nodeInfo.totalTimeAccountedFor;
-
-                child.selfTime += focusNode.selfTime;
-                child.numberOfCalls += focusNode.numberOfCalls;
-
-                if (!totalTimeAccountedFor)
-                    child.totalTime += focusNode.totalTime;
-            } else {
-                // If not, add it as a true ancestor.
-                // In heavy mode, we take our visual identity from ancestor node...
-                var child = new WebInspector.BottomUpProfileDataGridNode(this.profileView, ancestor, this.tree);
-
-                if (ancestor !== focusNode) {
-                    // but the actual statistics from the "root" node (bottom of the callstack).
-                    child.selfTime = focusNode.selfTime;
-                    child.totalTime = focusNode.totalTime;
-                    child.numberOfCalls = focusNode.numberOfCalls;
-                }
-
-                this.appendChild(child);
-            }
-
-            var parent = ancestor.parent;
-            if (parent && parent.parent) {
-                nodeInfo.ancestor = parent;
-                child._remainingNodeInfos.push(nodeInfo);
-            }
-        }
-
-        delete this._remainingNodeInfos;
-
-        if (this.removeEventListener)
-            this.removeEventListener("populate", this._populate, this);
-    }
+    _sharedPopulate: WebInspector.BottomUpProfileDataGridNode.prototype._sharedPopulate
 }
 
-WebInspector.BottomUpProfileDataGridNode.prototype.__proto__ = WebInspector.ProfileDataGridNode.prototype;
+WebInspector.BottomUpProfileDataGridTree.prototype.__proto__ = WebInspector.ProfileDataGridTree.prototype;
+
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Color.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Color.js
index 9d9cd76605..11d6bad315 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Color.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Color.js
@@ -437,7 +437,7 @@ WebInspector.Color.HexTable = {
     "B0C4DE": [[176, 196, 222], [214, 41, 78], "lightSteelBlue"],
     "B0E0E6": [[176, 224, 230], [187, 52, 80], "powderBlue"],
     "B22222": [[178, 34, 34], [0, 68, 42], "fireBrick"],
-    "B8860B": [[184, 134, 11], [43, 89, 38], "darkGoldenRod"],
+    "B8860B": [[184, 134, 11], [43, 89, 38], "darkGoldenrod"],
     "BA55D3": [[186, 85, 211], [288, 59, 58], "mediumOrchid"],
     "BC8F8F": [[188, 143, 143], [0, 25, 65], "rosyBrown"],
     "BDB76B": [[189, 183, 107], [56, 38, 58], "darkKhaki"],
@@ -451,7 +451,7 @@ WebInspector.Color.HexTable = {
     "D87093": [[219, 112, 147], [340, 60, 65], "paleVioletRed"],
     "D8BFD8": [[216, 191, 216], [300, 24, 80], "thistle"],
     "DA70D6": [[218, 112, 214], [302, 59, 65], "orchid"],
-    "DAA520": [[218, 165, 32], [43, 74, 49], "goldenRod"],
+    "DAA520": [[218, 165, 32], [43, 74, 49], "goldenrod"],
     "DC143C": [[237, 164, 61], [35, 83, 58], "crimson"],
     "DCDCDC": [[220, 220, 220], [0, 0, 86], "gainsboro"],
     "DDA0DD": [[221, 160, 221], [300, 47, 75], "plum"],
@@ -460,7 +460,7 @@ WebInspector.Color.HexTable = {
     "E6E6FA": [[230, 230, 250], [240, 67, 94], "lavender"],
     "E9967A": [[233, 150, 122], [15, 72, 70], "darkSalmon"],
     "EE82EE": [[238, 130, 238], [300, 76, 72], "violet"],
-    "EEE8AA": [[238, 232, 170], [55, 67, 80], "paleGoldenRod"],
+    "EEE8AA": [[238, 232, 170], [55, 67, 80], "paleGoldenrod"],
     "F08080": [[240, 128, 128], [0, 79, 72], "lightCoral"],
     "F0E68C": [[240, 230, 140], [54, 77, 75], "khaki"],
     "F0F8FF": [[240, 248, 255], [208, 100, 97], "aliceBlue"],
@@ -475,7 +475,7 @@ WebInspector.Color.HexTable = {
     "FA8072": [[250, 128, 114], [6, 93, 71], "salmon"],
     "FAEBD7": [[250, 235, 215], [34, 78, 91], "antiqueWhite"],
     "FAF0E6": [[250, 240, 230], [30, 67, 94], "linen"],
-    "FAFAD2": [[250, 250, 210], [60, 80, 90], "lightGoldenRodYellow"],
+    "FAFAD2": [[250, 250, 210], [60, 80, 90], "lightGoldenrodYellow"],
     "FDF5E6": [[253, 245, 230], [39, 85, 95], "oldLace"],
     "FF0000": [[255, 0, 0], [0, 100, 50], "red"],
     "FF00FF": [[255, 0, 255], [300, 100, 50], "magenta"],
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
index aa0e08c407..9317824d24 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
@@ -94,49 +94,76 @@ WebInspector.ConsoleView = function(drawer)
     this.warningElement = createFilterElement.call(this, "Warnings");
     this.logElement = createFilterElement.call(this, "Logs");
 
-    this.filter(this.allElement);
+    this.filter(this.allElement, false);
 }
 
 WebInspector.ConsoleView.prototype = {
     
     _updateFilter: function(e)
     {
-        this.filter(e.target);
+        var isMac = InspectorController.platform().indexOf("mac-") === 0;
+        var selectMultiple = false;
+        if (isMac && e.metaKey && !e.ctrlKey && !e.altKey && !e.shiftKey)
+            selectMultiple = true;
+        if (!isMac && e.ctrlKey && !e.metaKey && !e.altKey && !e.shiftKey)
+            selectMultiple = true;
+
+        this.filter(e.target, selectMultiple);
     },
     
-    filter: function(target)
+    filter: function(target, selectMultiple)
     {
+        function unselectAll()
+        {
+            this.allElement.removeStyleClass("selected");
+            this.errorElement.removeStyleClass("selected");
+            this.warningElement.removeStyleClass("selected");
+            this.logElement.removeStyleClass("selected");
+            
+            this.messagesElement.removeStyleClass("filter-all");
+            this.messagesElement.removeStyleClass("filter-errors");
+            this.messagesElement.removeStyleClass("filter-warnings");
+            this.messagesElement.removeStyleClass("filter-logs");
+        }
+        
+        var targetFilterClass = "filter-" + target.category.toLowerCase();
+
         if (target.category == "All") {
             if (target.hasStyleClass("selected")) {
                 // We can't unselect all, so we break early here
                 return;
             }
-            
-            this.errorElement.removeStyleClass("selected");
-            this.warningElement.removeStyleClass("selected");
-            this.logElement.removeStyleClass("selected");
-            
-            document.getElementById("console-messages").removeStyleClass("filter-errors");
-            document.getElementById("console-messages").removeStyleClass("filter-warnings");
-            document.getElementById("console-messages").removeStyleClass("filter-logs");
+
+            unselectAll.call(this);
         } else {
             // Something other than all is being selected, so we want to unselect all
             if (this.allElement.hasStyleClass("selected")) {
                 this.allElement.removeStyleClass("selected");
-                document.getElementById("console-messages").removeStyleClass("filter-all");
+                this.messagesElement.removeStyleClass("filter-all");
             }
         }
         
+        if (!selectMultiple) {
+            // If multiple selection is off, we want to unselect everything else
+            // and just select ourselves.
+            unselectAll.call(this);
+            
+            target.addStyleClass("selected");
+            this.messagesElement.addStyleClass(targetFilterClass);
+            
+            return;
+        }
+        
         if (target.hasStyleClass("selected")) {
+            // If selectMultiple is turned on, and we were selected, we just
+            // want to unselect ourselves.
             target.removeStyleClass("selected");
-            var newClass = "filter-" + target.category.toLowerCase();
-            var filterElement = document.getElementById("console-messages");
-            filterElement.removeStyleClass(newClass);
+            this.messagesElement.removeStyleClass(targetFilterClass);
         } else {
+            // If selectMultiple is turned on, and we weren't selected, we just
+            // want to select ourselves.
             target.addStyleClass("selected");
-            var newClass = "filter-" + target.category.toLowerCase();
-            var filterElement = document.getElementById("console-messages");
-            filterElement.addStyleClass(newClass);
+            this.messagesElement.addStyleClass(targetFilterClass);
         }
     },
     
@@ -174,40 +201,7 @@ WebInspector.ConsoleView.prototype = {
     addMessage: function(msg)
     {
         if (msg instanceof WebInspector.ConsoleMessage && !(msg instanceof WebInspector.ConsoleCommandResult)) {
-            msg.totalRepeatCount = msg.repeatCount;
-            msg.repeatDelta = msg.repeatCount;
-
-            var messageRepeated = false;
-
-            if (msg.isEqual && msg.isEqual(this.previousMessage)) {
-                // Because sometimes we get a large number of repeated messages and sometimes
-                // we get them one at a time, we need to know the difference between how many
-                // repeats we used to have and how many we have now.
-                msg.repeatDelta -= this.previousMessage.totalRepeatCount;
-
-                if (!isNaN(this.repeatCountBeforeCommand))
-                    msg.repeatCount -= this.repeatCountBeforeCommand;
-
-                if (!this.commandSincePreviousMessage) {
-                    // Recreate the previous message element to reset the repeat count.
-                    var messagesElement = this.currentGroup.messagesElement;
-                    messagesElement.removeChild(messagesElement.lastChild);
-                    messagesElement.appendChild(msg.toMessageElement());
-
-                    messageRepeated = true;
-                }
-            } else
-                delete this.repeatCountBeforeCommand;
-
-            // Increment the error or warning count
-            switch (msg.level) {
-            case WebInspector.ConsoleMessage.MessageLevel.Warning:
-                WebInspector.warnings += msg.repeatDelta;
-                break;
-            case WebInspector.ConsoleMessage.MessageLevel.Error:
-                WebInspector.errors += msg.repeatDelta;
-                break;
-            }
+            this._incrementErrorWarningCount(msg);
 
             // Add message to the resource panel
             if (msg.url in WebInspector.resourceURLMap) {
@@ -218,13 +212,9 @@ WebInspector.ConsoleView.prototype = {
 
             this.commandSincePreviousMessage = false;
             this.previousMessage = msg;
-
-            if (messageRepeated)
-                return;
         } else if (msg instanceof WebInspector.ConsoleCommand) {
             if (this.previousMessage) {
                 this.commandSincePreviousMessage = true;
-                this.repeatCountBeforeCommand = this.previousMessage.totalRepeatCount;
             }
         }
 
@@ -252,6 +242,35 @@ WebInspector.ConsoleView.prototype = {
         this.promptElement.scrollIntoView(false);
     },
 
+    updateMessageRepeatCount: function(count) {
+        var msg = this.previousMessage;
+        var prevRepeatCount = msg.totalRepeatCount;
+        
+        if (!this.commandSincePreviousMessage) {
+            msg.repeatDelta = count - prevRepeatCount;
+            msg.repeatCount = msg.repeatCount + msg.repeatDelta;
+            msg.totalRepeatCount = count;
+            msg._updateRepeatCount();
+            this._incrementErrorWarningCount(msg);
+        } else {
+            msgCopy = new WebInspector.ConsoleMessage(msg.source, msg.type, msg.level, msg.line, msg.url, msg.groupLevel, count - prevRepeatCount);
+            msgCopy.totalRepeatCount = count;
+            msgCopy.setMessageBody(msg.args);
+            this.addMessage(msgCopy);
+        }
+    },
+
+    _incrementErrorWarningCount: function(msg) {
+        switch (msg.level) {
+            case WebInspector.ConsoleMessage.MessageLevel.Warning:
+                WebInspector.warnings += msg.repeatDelta;
+                break;
+            case WebInspector.ConsoleMessage.MessageLevel.Error:
+                WebInspector.errors += msg.repeatDelta;
+                break;
+        }
+    },
+
     clearMessages: function(clearInspectorController)
     {
         if (clearInspectorController)
@@ -269,7 +288,6 @@ WebInspector.ConsoleView.prototype = {
         WebInspector.warnings = 0;
 
         delete this.commandSincePreviousMessage;
-        delete this.repeatCountBeforeCommand;
         delete this.previousMessage;
     },
 
@@ -373,10 +391,9 @@ WebInspector.ConsoleView.prototype = {
 
     _promptKeyDown: function(event)
     {
-        switch (event.keyIdentifier) {
-            case "Enter":
-                this._enterKeyPressed(event);
-                return;
+        if (isEnterKey(event)) {
+            this._enterKeyPressed(event);
+            return;
         }
 
         this.prompt.handleKeyEvent(event);
@@ -539,6 +556,7 @@ WebInspector.ConsoleView.prototype = {
             if (!nodeId)
                 return;
             var treeOutline = new WebInspector.ElementsTreeOutline();
+            treeOutline.showInElementsPanelEnabled = true;
             treeOutline.rootDOMNode = WebInspector.domAgent.nodeForId(nodeId);
             treeOutline.element.addStyleClass("outline-disclosure");
             if (!treeOutline.children[0].hasChildren)
@@ -590,6 +608,8 @@ WebInspector.ConsoleMessage = function(source, type, level, line, url, groupLeve
     this.url = url;
     this.groupLevel = groupLevel;
     this.repeatCount = repeatCount;
+    this.repeatDelta = repeatCount;
+    this.totalRepeatCount = repeatCount;
     if (arguments.length > 7)
         this.setMessageBody(Array.prototype.slice.call(arguments, 7));
 }
@@ -597,6 +617,7 @@ WebInspector.ConsoleMessage = function(source, type, level, line, url, groupLeve
 WebInspector.ConsoleMessage.prototype = {
     setMessageBody: function(args)
     {
+        this.args = args;
         switch (this.type) {
             case WebInspector.ConsoleMessage.MessageType.Trace:
                 var span = document.createElement("span");
@@ -692,13 +713,15 @@ WebInspector.ConsoleMessage.prototype = {
 
     toMessageElement: function()
     {
-        if (this.propertiesSection)
-            return this.propertiesSection.element;
+        if (this._element)
+            return this._element;
 
         var element = document.createElement("div");
         element.message = this;
         element.className = "console-message";
 
+        this._element = element;
+
         switch (this.source) {
             case WebInspector.ConsoleMessage.MessageSource.HTML:
                 element.addStyleClass("console-html-source");
@@ -738,9 +761,8 @@ WebInspector.ConsoleMessage.prototype = {
                 break;
         }
         
-        if (this.type === WebInspector.ConsoleMessage.MessageType.StartGroup) {
+        if (this.type === WebInspector.ConsoleMessage.MessageType.StartGroup)
             element.addStyleClass("console-group-title");
-        }
 
         if (this.elementsTreeOutline) {
             element.addStyleClass("outline-disclosure");
@@ -748,15 +770,6 @@ WebInspector.ConsoleMessage.prototype = {
             return element;
         }
 
-        if (this.repeatCount > 1) {
-            var messageRepeatCountElement = document.createElement("span");
-            messageRepeatCountElement.className = "bubble";
-            messageRepeatCountElement.textContent = this.repeatCount;
-
-            element.appendChild(messageRepeatCountElement);
-            element.addStyleClass("repeated-message");
-        }
-
         if (this.url && this.url !== "undefined") {
             var urlElement = document.createElement("a");
             urlElement.className = "console-message-url webkit-html-resource-link";
@@ -776,12 +789,28 @@ WebInspector.ConsoleMessage.prototype = {
 
         var messageTextElement = document.createElement("span");
         messageTextElement.className = "console-message-text";
+        if (this.type === WebInspector.ConsoleMessage.MessageType.Assert)
+            messageTextElement.appendChild(document.createTextNode(WebInspector.UIString("Assertion failed: ")));
         messageTextElement.appendChild(this.formattedMessage);
         element.appendChild(messageTextElement);
 
+        if (this.repeatCount > 1)
+            this._updateRepeatCount();
+
         return element;
     },
 
+    _updateRepeatCount: function() {
+        if (!this.repeatCountElement) {
+            this.repeatCountElement = document.createElement("span");
+            this.repeatCountElement.className = "bubble";
+    
+            this._element.insertBefore(this.repeatCountElement, this._element.firstChild);
+            this._element.addStyleClass("repeated-message");
+        }
+        this.repeatCountElement.textContent = this.repeatCount;
+    },
+
     toString: function()
     {
         var sourceString;
@@ -823,6 +852,9 @@ WebInspector.ConsoleMessage.prototype = {
             case WebInspector.ConsoleMessage.MessageType.EndGroup:
                 typeString = "End Group";
                 break;
+            case WebInspector.ConsoleMessage.MessageType.Assert:
+                typeString = "Assert";
+                break;
         }
         
         var levelString;
@@ -878,7 +910,8 @@ WebInspector.ConsoleMessage.MessageType = {
     Object: 1,
     Trace: 2,
     StartGroup: 3,
-    EndGroup: 4
+    EndGroup: 4,
+    Assert: 5
 }
 
 WebInspector.ConsoleMessage.MessageLevel = {
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
index 6c5fa0204b..e85af662ce 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
@@ -94,10 +94,9 @@ WebInspector.DatabaseQueryView.prototype = {
 
     _promptKeyDown: function(event)
     {
-        switch (event.keyIdentifier) {
-            case "Enter":
-                this._enterKeyPressed(event);
-                return;
+        if (isEnterKey(event)) {
+            this._enterKeyPressed(event);
+            return;
         }
 
         this.prompt.handleKeyEvent(event);
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
index 5d0e6d70a1..aa6319ca91 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
@@ -268,7 +268,12 @@ WebInspector.ElementsPanel.prototype = {
 
             if (!this._searchResults.length) {
                 this._currentSearchResultIndex = 0;
-                this.focusedDOMNode = node;
+
+                // Only change the focusedDOMNode if the search was manually performed, because
+                // the search may have been performed programmatically and we wouldn't want to
+                // change the current focusedDOMNode.
+                if (WebInspector.currentFocusElement === document.getElementById("search"))
+                    this.focusedDOMNode = node;
             }
 
             this._searchResults.push(node);
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
index c4bd37295c..be01647961 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -38,6 +38,7 @@ WebInspector.ElementsTreeOutline = function() {
 
     this.includeRootDOMNode = true;
     this.selectEnabled = false;
+    this.showInElementsPanelEnabled = false;
     this.rootDOMNode = null;
     this.focusedDOMNode = null;
 }
@@ -327,6 +328,8 @@ WebInspector.ElementsTreeElement.prototype = {
             if (this._addAttributeElement && this._addAttributeElement.parentNode)
                 this._addAttributeElement.parentNode.removeChild(this._addAttributeElement);
             delete this._addAttributeElement;
+
+            this.updateSelection();
         }
 
         if (!this._addAttributeElement && visible && !this._editing) {
@@ -341,7 +344,7 @@ WebInspector.ElementsTreeElement.prototype = {
         } else if (!visible && this._addAttributeElement)
             removeAddAttributeSpan.call(this);
     },
-    
+
     updateSelection: function()
     {
         var listItemElement = this.listItemElement;
@@ -509,6 +512,14 @@ WebInspector.ElementsTreeElement.prototype = {
         if (this._editing)
             return;
 
+        if (this.isEventWithinDisclosureTriangle(event))
+            return;
+
+        if (this.treeOutline.showInElementsPanelEnabled) {    
+            WebInspector.showElementsPanel();
+            WebInspector.panels.elements.focusedDOMNode = this.representedObject;
+        }
+
         // Prevent selecting the nearest word on double click.
         if (event.detail >= 2)
             event.preventDefault();
@@ -522,11 +533,6 @@ WebInspector.ElementsTreeElement.prototype = {
         if (this._startEditingFromEvent(event, treeElement))
             return;
 
-        if (this.treeOutline.panel) {
-            this.treeOutline.rootDOMNode = this.representedObject.parentNode;
-            this.treeOutline.focusedDOMNode = this.representedObject;
-        }
-
         if (this.hasChildren && !this.expanded)
             this.expand();
     },
@@ -542,6 +548,8 @@ WebInspector.ElementsTreeElement.prototype = {
             tag.appendChild(node);
             tag.appendChild(document.createTextNode('>'));
         }
+
+        this.updateSelection();
     },
 
     _startEditingFromEvent: function(event, treeElement)
@@ -578,7 +586,7 @@ WebInspector.ElementsTreeElement.prototype = {
             this.toggleNewAttributeButton(false);
             var attribute = listItem.getElementsByClassName("webkit-html-attribute")[0];
             if (attribute)
-                return this._startEditingAttribute(attribute, attribute.getElementsByClassName("webkit-html-attribute-name")[0]);
+                return this._startEditingAttribute(attribute, attribute.getElementsByClassName("webkit-html-attribute-value")[0]);
 
             return this._addNewAttribute(listItem);
         }
@@ -830,9 +838,9 @@ WebInspector.ElementsTreeElement.prototype = {
                     if (node.parentNode && node.parentNode.nodeName.toLowerCase() == "script") {
                         var newNode = document.createElement("span");
                         newNode.textContent = node.textContent;
-                        
+
                         var javascriptSyntaxHighlighter = new WebInspector.JavaScriptSourceSyntaxHighlighter(null, null);
-                        javascriptSyntaxHighlighter.syntaxHighlightLine(newNode, null);
+                        javascriptSyntaxHighlighter.syntaxHighlightNode(newNode);
                         
                         info.title = "<span class=\"webkit-html-text-node webkit-html-js-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
                     } else if (node.parentNode && node.parentNode.nodeName.toLowerCase() == "style") {
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/EventListenersSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/EventListenersSidebarPane.js
index 55b8e55184..29381961ec 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/EventListenersSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/EventListenersSidebarPane.js
@@ -71,6 +71,8 @@ WebInspector.EventListenersSidebarPane.prototype = {
                 var eventListener = eventListeners[i];
                 eventListener.node = WebInspector.domAgent.nodeForId(eventListener.nodeId);
                 delete eventListener.nodeId; // no longer needed
+                if (/^function _inspectorCommandLineAPI_logEvent\(/.test(eventListener.listener.toString()))
+                    continue; // ignore event listeners generated by monitorEvent
                 var type = eventListener.type;
                 var section = sectionMap[type];
                 if (!section) {
@@ -201,18 +203,13 @@ WebInspector.EventListenerBar.prototype = {
 
         if (node.nodeType === Node.DOCUMENT_NODE)
             return "document";
-        
+
         return appropriateSelectorForNode(node);
     },
 
     _getFunctionDisplayName: function()
     {
-        // TODO: v8 does not yet provide the raw function, this handles such a case with a placeholder
-        // I didn't make this a UIString because it should be implemented eventually.
-        if (!this.eventListener.listener)
-            return "(listener)";
-
-        // Requires that Function.toString() return at least the function's signature
+        // Requires that Function.toString() return at least the function's signature.
         var match = this.eventListener.listener.toString().match(/function ([^\(]+?)\(/);
         return (match ? match[1] : WebInspector.UIString("(anonymous function)"));
     }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarBlue.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarBlue.png
new file mode 100644
index 0000000000..22641b5a88
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarBlue.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarGray.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarGray.png
new file mode 100644
index 0000000000..f66cf43f95
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarGray.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarGreen.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarGreen.png
new file mode 100644
index 0000000000..cc590828b2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarGreen.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarOrange.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarOrange.png
new file mode 100644
index 0000000000..e5ae6f5240
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarOrange.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarPurple.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarPurple.png
new file mode 100644
index 0000000000..f891252873
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarPurple.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarRed.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarRed.png
new file mode 100644
index 0000000000..b850037503
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarRed.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarYellow.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarYellow.png
new file mode 100644
index 0000000000..2b3e9a76d0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineBarYellow.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineCheckmarks.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineCheckmarks.png
new file mode 100644
index 0000000000..9afa9bb49f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineCheckmarks.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineDots.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineDots.png
new file mode 100644
index 0000000000..e9ba4d349b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineDots.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineIcon.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineIcon.png
new file mode 100644
index 0000000000..09bcf3041f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/timelineIcon.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
index 3ce96d0e1d..3bed8dabcf 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
@@ -540,7 +540,7 @@ InjectedScript.getCompletions = function(expression, includeInspectorCommandLine
             for (var prop in expressionResult)
                 props[prop] = true;
         if (includeInspectorCommandLineAPI)
-            for (var prop in InjectedScript._window()._inspectorCommandLineAPI)
+            for (var prop in InjectedScript._window().console._inspectorCommandLineAPI)
                 if (prop.charAt(0) !== '_')
                     props[prop] = true;
     } catch(e) {
@@ -575,7 +575,7 @@ InjectedScript._evaluateOn = function(evalFunction, object, expression)
     InjectedScript._ensureCommandLineAPIInstalled(evalFunction, object);
     // Surround the expression in with statements to inject our command line API so that
     // the window object properties still take more precedent than our API functions.
-    expression = "with (window._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
+    expression = "with (window.console._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
     var value = evalFunction.call(object, expression);
 
     // When evaluating on call frame error is not thrown, but returned as a value.
@@ -592,7 +592,7 @@ InjectedScript.addInspectedNode = function(nodeId)
         return false;
 
     InjectedScript._ensureCommandLineAPIInstalled(InjectedScript._window().eval, InjectedScript._window());
-    var inspectedNodes = InjectedScript._window()._inspectorCommandLineAPI._inspectedNodes;
+    var inspectedNodes = InjectedScript._window().console._inspectorCommandLineAPI._inspectedNodes;
     inspectedNodes.unshift(node);
     if (inspectedNodes.length >= 5)
         inspectedNodes.pop();
@@ -901,9 +901,9 @@ InjectedScript._inspectObject = function(o)
 
 InjectedScript._ensureCommandLineAPIInstalled = function(evalFunction, evalObject)
 {
-    if (evalFunction.call(evalObject, "window._inspectorCommandLineAPI"))
+    if (evalFunction.call(evalObject, "window.console._inspectorCommandLineAPI"))
         return;
-    var inspectorCommandLineAPI = evalFunction.call(evalObject, "window._inspectorCommandLineAPI = { \
+    var inspectorCommandLineAPI = evalFunction.call(evalObject, "window.console._inspectorCommandLineAPI = { \
         $: function() { return document.getElementById.apply(document, arguments) }, \
         $$: function() { return document.querySelectorAll.apply(document, arguments) }, \
         $x: function(xpath, context) { \
@@ -922,12 +922,50 @@ InjectedScript._ensureCommandLineAPIInstalled = function(evalFunction, evalObjec
         values: function(o) { var a = []; for (var k in o) a.push(o[k]); return a; }, \
         profile: function() { return console.profile.apply(console, arguments) }, \
         profileEnd: function() { return console.profileEnd.apply(console, arguments) }, \
+        _logEvent: function _inspectorCommandLineAPI_logEvent(e) { console.log(e.type, e); }, \
+        _allEventTypes: [\"mouse\", \"key\", \"load\", \"unload\", \"abort\", \"error\", \
+            \"select\", \"change\", \"submit\", \"reset\", \"focus\", \"blur\", \
+            \"resize\", \"scroll\"], \
+        _normalizeEventTypes: function(t) { \
+            if (typeof t === \"undefined\") \
+                t = _inspectorCommandLineAPI._allEventTypes; \
+            else if (typeof t === \"string\") \
+                t = [t]; \
+            var i, te = []; \
+            for (i = 0; i < t.length; i++) { \
+                if (t[i] === \"mouse\") \
+                    te.splice(0, 0, \"mousedown\", \"mouseup\", \"click\", \"dblclick\", \
+                        \"mousemove\", \"mouseover\", \"mouseout\"); \
+                else if (t[i] === \"key\") \
+                    te.splice(0, 0, \"keydown\", \"keyup\", \"keypress\"); \
+                else \
+                    te.push(t[i]); \
+            } \
+            return te; \
+        }, \
+        monitorEvent: function(o, t) { \
+            if (!o || !o.addEventListener || !o.removeEventListener) \
+                return; \
+            t = _inspectorCommandLineAPI._normalizeEventTypes(t); \
+            for (i = 0; i < t.length; i++) { \
+                o.removeEventListener(t[i], _inspectorCommandLineAPI._logEvent, false); \
+                o.addEventListener(t[i], _inspectorCommandLineAPI._logEvent, false); \
+            } \
+        }, \
+        unmonitorEvent: function(o, t) { \
+            if (!o || !o.removeEventListener) \
+                return; \
+            t = _inspectorCommandLineAPI._normalizeEventTypes(t); \
+            for (i = 0; i < t.length; i++) { \
+                o.removeEventListener(t[i], _inspectorCommandLineAPI._logEvent, false); \
+            } \
+        }, \
         _inspectedNodes: [], \
-        get $0() { return _inspectorCommandLineAPI._inspectedNodes[0] }, \
-        get $1() { return _inspectorCommandLineAPI._inspectedNodes[1] }, \
-        get $2() { return _inspectorCommandLineAPI._inspectedNodes[2] }, \
-        get $3() { return _inspectorCommandLineAPI._inspectedNodes[3] }, \
-        get $4() { return _inspectorCommandLineAPI._inspectedNodes[4] } \
+        get $0() { return console._inspectorCommandLineAPI._inspectedNodes[0] }, \
+        get $1() { return console._inspectorCommandLineAPI._inspectedNodes[1] }, \
+        get $2() { return console._inspectorCommandLineAPI._inspectedNodes[2] }, \
+        get $3() { return console._inspectorCommandLineAPI._inspectedNodes[3] }, \
+        get $4() { return console._inspectorCommandLineAPI._inspectedNodes[4] } \
     };");
 
     inspectorCommandLineAPI.clear = InspectorController.wrapCallback(InjectedScript._clearConsoleMessages);
@@ -1120,6 +1158,8 @@ Object.type = function(obj)
         return "regexp";
     if (obj instanceof win.NodeList)
         return "array";
+    if (obj instanceof win.HTMLCollection || obj instanceof win.HTMLAllCollection)
+        return "array";
     if (obj instanceof win.Error)
         return "error";
     return type;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/InspectorControllerStub.js b/src/3rdparty/webkit/WebCore/inspector/front-end/InspectorControllerStub.js
new file mode 100644
index 0000000000..6fb5a1b07f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/InspectorControllerStub.js
@@ -0,0 +1,291 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+if (!window.InspectorController) {
+
+WebInspector.InspectorControllerStub = function()
+{
+    this._searchingForNode = false;
+    this._windowVisible = true;
+    this._attachedWindowHeight = 0;
+    this._debuggerEnabled = true;
+    this._profilerEnabled = true;
+    this._resourceTrackingEnabled = false;
+    this._timelineEnabled = false;
+    this._settings = {};
+}
+
+WebInspector.InspectorControllerStub.prototype = {
+    wrapCallback: function(func)
+    {
+        return func;
+    },
+
+    isWindowVisible: function()
+    {
+        return this._windowVisible;
+    },
+
+    platform: function()
+    {
+        return "mac-leopard";
+    },
+
+
+    closeWindow: function()
+    {
+        this._windowVisible = false;
+    },
+
+    attach: function()
+    {
+    },
+
+    detach: function()
+    {
+    },
+
+    storeLastActivePanel: function(panel)
+    {
+    },
+
+    clearMessages: function()
+    {
+    },
+
+    searchingForNode: function()
+    {
+        return this._searchingForNode;
+    },
+
+    search: function(sourceRow, query)
+    {
+    },
+
+    toggleNodeSearch: function()
+    {
+        this._searchingForNode = !this._searchingForNode;
+    },
+
+    setAttachedWindowHeight: function(height)
+    {
+    },
+
+    moveByUnrestricted: function(x, y)
+    {
+    },
+
+
+    addResourceSourceToFrame: function(identifier, element)
+    {
+    },
+
+    addSourceToFrame: function(mimeType, source, element)
+    {
+        return false;
+    },
+
+    getResourceDocumentNode: function(identifier)
+    {
+        return undefined;
+    },
+
+    highlightDOMNode: function(node)
+    {
+    },
+
+    hideDOMNodeHighlight: function()
+    {
+    },
+
+    inspectedWindow: function()
+    {
+        return window;
+    },
+
+    loaded: function()
+    {
+    },
+
+    localizedStringsURL: function()
+    {
+        return undefined;
+    },
+
+    windowUnloading: function()
+    {
+        return false;
+    },
+
+    hiddenPanels: function()
+    {
+        return "";
+    },
+
+    debuggerEnabled: function()
+    {
+        return this._debuggerEnabled;
+    },
+
+    enableResourceTracking: function()
+    {
+        this._resourceTrackingEnabled = true;
+        WebInspector.resourceTrackingWasEnabled();
+    },
+
+    disableResourceTracking: function()
+    {
+        this._resourceTrackingEnabled = false;
+        WebInspector.resourceTrackingWasDisabled();
+    },
+
+    resourceTrackingEnabled: function()
+    {
+        return this._resourceTrackingEnabled;
+    },
+
+    enableDebugger: function()
+    {
+        this._debuggerEnabled = true;
+    },
+
+    disableDebugger: function()
+    {
+        this._debuggerEnabled = false;
+    },
+
+    addBreakpoint: function(sourceID, line, condition)
+    {
+    },
+
+    removeBreakpoint: function(sourceID, line)
+    {
+    },
+
+    updateBreakpoint: function(sourceID, line, condition)
+    {
+    },
+
+    pauseInDebugger: function()
+    {
+    },
+
+    pauseOnExceptions: function()
+    {
+        return false;
+    },
+
+    setPauseOnExceptions: function(value)
+    {
+    },
+
+    resumeDebugger: function()
+    {
+    },
+
+    profilerEnabled: function()
+    {
+        return true;
+    },
+
+    enableProfiler: function()
+    {
+        this._profilerEnabled = true;
+    },
+
+    disableProfiler: function()
+    {
+        this._profilerEnabled = false;
+    },
+
+    startProfiling: function()
+    {
+    },
+
+    stopProfiling: function()
+    {
+    },
+
+    getProfileHeaders: function(callId)
+    {
+        WebInspector.didGetProfileHeaders(callId, []);
+    },
+
+    getProfile: function(callId, uid)
+    {
+        if (WebInspector.__fullProfiles && (uid in WebInspector.__fullProfiles))
+        {
+            WebInspector.didGetProfile(callId, WebInspector.__fullProfiles[uid]);
+        }
+    },
+
+    takeHeapSnapshot: function()
+    {
+    },
+
+    databaseTableNames: function(database)
+    {
+        return [];
+    },
+
+    stepIntoStatementInDebugger: function()
+    {
+    },
+
+    stepOutOfFunctionInDebugger: function()
+    {
+    },
+
+    stepOverStatementInDebugger: function()
+    {
+    },
+
+    setSetting: function(setting, value)
+    {
+        this._settings[setting] = value;
+    },
+
+    dispatchOnInjectedScript: function()
+    {
+    },
+
+    releaseWrapperObjectGroup: function()
+    {
+    },
+
+    setting: function(setting)
+    {
+        return this._settings[setting];
+    }
+}
+
+window.InspectorController = new WebInspector.InspectorControllerStub();
+
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Panel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Panel.js
index 5046f6bce9..6cd200b4ff 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Panel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Panel.js
@@ -82,6 +82,8 @@ WebInspector.Panel.prototype = {
             this._toolbarItem.addStyleClass("toggled-on");
 
         WebInspector.currentFocusElement = document.getElementById("main-panels");
+
+        this.updateSidebarWidth();
     },
 
     hide: function()
@@ -267,6 +269,103 @@ WebInspector.Panel.prototype = {
             currentView.jumpToLastSearchResult();
         else
             currentView.jumpToPreviousSearchResult();
+    },
+
+    handleKeyEvent: function(event)
+    {
+        this.handleSidebarKeyEvent(event);
+    },
+
+    handleSidebarKeyEvent: function(event)
+    {
+        if (this.hasSidebar && this.sidebarTree)
+            this.sidebarTree.handleKeyEvent(event);
+    },
+
+    createSidebar: function(parentElement, resizerParentElement)
+    {
+        if (this.hasSidebar)
+            return;
+
+        if (!parentElement)
+            parentElement = this.element;
+
+        if (!resizerParentElement)
+            resizerParentElement = parentElement;
+
+        this.hasSidebar = true;
+
+        this.sidebarElement = document.createElement("div");
+        this.sidebarElement.className = "sidebar";
+        parentElement.appendChild(this.sidebarElement);
+
+        this.sidebarResizeElement = document.createElement("div");
+        this.sidebarResizeElement.className = "sidebar-resizer-vertical";
+        this.sidebarResizeElement.addEventListener("mousedown", this._startSidebarDragging.bind(this), false);
+        resizerParentElement.appendChild(this.sidebarResizeElement);
+
+        this.sidebarTreeElement = document.createElement("ol");
+        this.sidebarTreeElement.className = "sidebar-tree";
+        this.sidebarElement.appendChild(this.sidebarTreeElement);
+
+        this.sidebarTree = new TreeOutline(this.sidebarTreeElement);
+    },
+
+    _startSidebarDragging: function(event)
+    {
+        WebInspector.elementDragStart(this.sidebarResizeElement, this._sidebarDragging.bind(this), this._endSidebarDragging.bind(this), event, "col-resize");
+    },
+
+    _sidebarDragging: function(event)
+    {
+        this.updateSidebarWidth(event.pageX);
+
+        event.preventDefault();
+    },
+
+    _endSidebarDragging: function(event)
+    {
+        WebInspector.elementDragEnd(event);
+    },
+
+    updateSidebarWidth: function(width)
+    {
+        if (!this.hasSidebar)
+            return;
+
+        if (this.sidebarElement.offsetWidth <= 0) {
+            // The stylesheet hasn't loaded yet or the window is closed,
+            // so we can't calculate what is need. Return early.
+            return;
+        }
+
+        if (!("_currentSidebarWidth" in this))
+            this._currentSidebarWidth = this.sidebarElement.offsetWidth;
+
+        if (typeof width === "undefined")
+            width = this._currentSidebarWidth;
+
+        width = Number.constrain(width, Preferences.minSidebarWidth, window.innerWidth / 2);
+
+        this._currentSidebarWidth = width;
+        this.setSidebarWidth(width);
+
+        this.updateMainViewWidth(width);
+
+        var visibleView = this.visibleView;
+        if (visibleView && "resize" in visibleView)
+            visibleView.resize();
+    },
+
+    setSidebarWidth: function(width)
+    {
+        this.sidebarElement.style.width = width + "px";
+        this.sidebarResizeElement.style.left = (width - 3) + "px";
+    },
+
+    updateMainViewWidth: function(width)
+    {
+        // Should be implemented by ancestors.
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
index 3fb0e00c9a..9a7c7412a4 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
@@ -126,20 +126,6 @@ WebInspector.ProfileDataGridNode.prototype = {
         this.profileView._dataGridNodeDeselected(this);
     },
 
-    expand: function()
-    {
-        if (!this.parent) {
-            var currentComparator = this.parent.lastComparator;
-
-            if (!currentComparator || (currentComparator === this.lastComparator))
-                return;
-
-            this.sort(currentComparator);
-        }
-
-        WebInspector.DataGridNode.prototype.expand.call(this);
-    },
-
     sort: function(/*Function*/ comparator, /*Boolean*/ force)
     {
         var gridNodeGroups = [[this]];
@@ -153,7 +139,7 @@ WebInspector.ProfileDataGridNode.prototype = {
 
                 // If the grid node is collapsed, then don't sort children (save operation for later).
                 // If the grid node has the same sorting as previously, then there is no point in sorting it again.
-                if (!force && !gridNode.expanded || gridNode.lastComparator === comparator) {
+                if (!force && (!gridNode.expanded || gridNode.lastComparator === comparator)) {
                     if (gridNode.children.length)
                         gridNode.shouldRefreshChildren = true;
                     continue;
@@ -224,6 +210,26 @@ WebInspector.ProfileDataGridNode.prototype = {
         return this.totalTime / this.tree.totalTime * 100.0;
     },
 
+    get _parent()
+    {
+        return this.parent !== this.dataGrid ? this.parent : this.tree;
+    },
+
+    _populate: function(event)
+    {
+        this._sharedPopulate();
+
+        if (this._parent) {
+            var currentComparator = this._parent.lastComparator;
+
+            if (currentComparator)
+                this.sort(currentComparator, true);
+        }
+
+        if (this.removeEventListener)
+            this.removeEventListener("populate", this._populate, this);
+    },
+
     // When focusing and collapsing we modify lots of nodes in the tree.
     // This allows us to restore them all to their original state when we revert.
     _save: function()
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
index ee96345987..afced41f82 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
@@ -602,6 +602,16 @@ WebInspector.CPUProfileType.prototype = {
     setRecordingProfile: function(isProfiling)
     {
         this._recording = isProfiling;
+    },
+
+    createSidebarTreeElementForProfile: function(profile)
+    {
+        return new WebInspector.ProfileSidebarTreeElement(profile);
+    },
+
+    createView: function(profile)
+    {
+        return new WebInspector.CPUProfileView(profile);
     }
 }
 
@@ -627,18 +637,5 @@ WebInspector.CPUProfile.prototype = {
     get head()
     {
         return this.representedObject.head;
-    },
-
-    createView: function()
-    {
-        return new WebInspector.CPUProfileView(this);
-    },
-
-    // FIXME: Extract this into a superclass so that createView can be simply overridden by subclasses.
-    viewForProfile: function()
-    {
-        if (!this._profileView)
-            this._profileView = this.createView();
-        return this._profileView;
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
index 55e286e444..74c2bb6fa8 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
@@ -61,6 +61,25 @@ WebInspector.ProfileType.prototype = {
 
     buttonClicked: function()
     {
+    },
+
+    viewForProfile: function(profile)
+    {
+        if (!profile._profileView)
+            profile._profileView = this.createView(profile);
+        return profile._profileView;
+    },
+
+    // Must be implemented by subclasses.
+    createView: function(profile)
+    {
+        throw new Error("Needs implemented.");
+    },
+
+    // Must be implemented by subclasses.
+    createSidebarTreeElementForProfile: function(profile)
+    {
+        throw new Error("Needs implemented.");
     }
 }
 
@@ -68,6 +87,8 @@ WebInspector.ProfilesPanel = function()
 {
     WebInspector.Panel.call(this);
 
+    this.createSidebar();
+
     this.element.addStyleClass("profiles");
     this._profileTypesByIdMap = {};
     this._profileTypeButtonsByIdMap = {};
@@ -80,21 +101,6 @@ WebInspector.ProfilesPanel = function()
 
     this.element.appendChild(this.panelEnablerView.element);
 
-    this.sidebarElement = document.createElement("div");
-    this.sidebarElement.id = "profiles-sidebar";
-    this.sidebarElement.className = "sidebar";
-    this.element.appendChild(this.sidebarElement);
-
-    this.sidebarResizeElement = document.createElement("div");
-    this.sidebarResizeElement.className = "sidebar-resizer-vertical";
-    this.sidebarResizeElement.addEventListener("mousedown", this._startSidebarDragging.bind(this), false);
-    this.element.appendChild(this.sidebarResizeElement);
-
-    this.sidebarTreeElement = document.createElement("ol");
-    this.sidebarTreeElement.className = "sidebar-tree";
-    this.sidebarElement.appendChild(this.sidebarTreeElement);
-    this.sidebarTree = new TreeOutline(this.sidebarTreeElement);
-
     this.profileViews = document.createElement("div");
     this.profileViews.id = "profile-views";
     this.element.appendChild(this.profileViews);
@@ -143,7 +149,6 @@ WebInspector.ProfilesPanel.prototype = {
     show: function()
     {
         WebInspector.Panel.prototype.show.call(this);
-        this._updateSidebarWidth();
         if (this._shouldPopulateProfiles)
             this._populateProfiles();
     },
@@ -192,11 +197,6 @@ WebInspector.ProfilesPanel.prototype = {
         this._updateInterface();
     },
 
-    handleKeyEvent: function(event)
-    {
-        this.sidebarTree.handleKeyEvent(event);
-    },
-
     registerProfileType: function(profileType)
     {
         this._profileTypesByIdMap[profileType.id] = profileType;
@@ -212,10 +212,12 @@ WebInspector.ProfilesPanel.prototype = {
 
     addProfileHeader: function(typeId, profile)
     {
-        var sidebarParent = this.getProfileType(typeId).treeElement;
+        var profileType = this.getProfileType(typeId);
+        var sidebarParent = profileType.treeElement;
         var small = false;
         var alternateTitle;
 
+        profile.__profilesPanelProfileType = profileType;
         this._profiles.push(profile);
         this._profilesIdMap[this._makeKey(profile.uid, typeId)] = profile;
 
@@ -257,7 +259,7 @@ WebInspector.ProfilesPanel.prototype = {
             }
         }
 
-        var profileTreeElement = new WebInspector.ProfileSidebarTreeElement(profile);
+        var profileTreeElement = profileType.createSidebarTreeElementForProfile(profile);
         profileTreeElement.small = small;
         if (alternateTitle)
             profileTreeElement.mainTitle = alternateTitle;
@@ -276,7 +278,7 @@ WebInspector.ProfilesPanel.prototype = {
         if (this.visibleView)
             this.visibleView.hide();
 
-        var view = profile.viewForProfile();
+        var view = profile.__profilesPanelProfileType.viewForProfile(profile);
 
         view.show(this.profileViews);
 
@@ -449,49 +451,10 @@ WebInspector.ProfilesPanel.prototype = {
         delete this._shouldPopulateProfiles;
     },
 
-    _startSidebarDragging: function(event)
-    {
-        WebInspector.elementDragStart(this.sidebarResizeElement, this._sidebarDragging.bind(this), this._endSidebarDragging.bind(this), event, "col-resize");
-    },
-
-    _sidebarDragging: function(event)
+    updateMainViewWidth: function(width)
     {
-        this._updateSidebarWidth(event.pageX);
-
-        event.preventDefault();
-    },
-
-    _endSidebarDragging: function(event)
-    {
-        WebInspector.elementDragEnd(event);
-    },
-
-    _updateSidebarWidth: function(width)
-    {
-        if (this.sidebarElement.offsetWidth <= 0) {
-            // The stylesheet hasn't loaded yet or the window is closed,
-            // so we can't calculate what is need. Return early.
-            return;
-        }
-
-        if (!("_currentSidebarWidth" in this))
-            this._currentSidebarWidth = this.sidebarElement.offsetWidth;
-
-        if (typeof width === "undefined")
-            width = this._currentSidebarWidth;
-
-        width = Number.constrain(width, Preferences.minSidebarWidth, window.innerWidth / 2);
-
-        this._currentSidebarWidth = width;
-
-        this.sidebarElement.style.width = width + "px";
         this.profileViews.style.left = width + "px";
         this.profileViewStatusBarItemsContainer.style.left = width + "px";
-        this.sidebarResizeElement.style.left = (width - 3) + "px";
-        
-        var visibleView = this.visibleView;
-        if (visibleView && "resize" in visibleView)
-            visibleView.resize();
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceCategory.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceCategory.js
index fc508d0f59..6e942654b9 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceCategory.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceCategory.js
@@ -26,18 +26,13 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.ResourceCategory = function(title, name)
+WebInspector.ResourceCategory = function(name, title, color)
 {
-    this.name = name;
-    this.title = title;
+    WebInspector.AbstractTimelineCategory.call(this, name, title, color);
     this.resources = [];
 }
 
 WebInspector.ResourceCategory.prototype = {
-    toString: function()
-    {
-        return this.title;
-    },
 
     addResource: function(resource)
     {
@@ -66,3 +61,5 @@ WebInspector.ResourceCategory.prototype = {
         this.resources = [];
     }
 }
+
+WebInspector.ResourceCategory.prototype.__proto__ = WebInspector.AbstractTimelineCategory.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
index 28586f645c..2ea7fdb440 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
@@ -178,7 +178,7 @@ WebInspector.ResourceView.prototype = {
 
         var isFormEncoded = false;
         var requestContentType = this._getHeaderValue(this.resource.requestHeaders, "Content-Type");
-        if (requestContentType.match(/^application\/x-www-form-urlencoded\s*(;.*)?$/i))
+        if (requestContentType && requestContentType.match(/^application\/x-www-form-urlencoded\s*(;.*)?$/i))
             isFormEncoded = true;
 
         if (isFormEncoded) {
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
index 0f873e76fe..940570fccc 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
@@ -29,190 +29,129 @@
 
 WebInspector.ResourcesPanel = function()
 {
-    WebInspector.Panel.call(this);
+    WebInspector.AbstractTimelinePanel.call(this);
 
     this.element.addStyleClass("resources");
 
-    this.filterBarElement = document.createElement("div");
-    this.filterBarElement.id = "resources-filter";
-    this.element.appendChild(this.filterBarElement);
+    this._createPanelEnabler();
 
     this.viewsContainerElement = document.createElement("div");
     this.viewsContainerElement.id = "resource-views";
     this.element.appendChild(this.viewsContainerElement);
 
-    this.containerElement = document.createElement("div");
-    this.containerElement.id = "resources-container";
-    this.containerElement.addEventListener("scroll", this._updateDividersLabelBarPosition.bind(this), false);
-    this.element.appendChild(this.containerElement);
+    this.createInterface();
 
-    this.sidebarElement = document.createElement("div");
-    this.sidebarElement.id = "resources-sidebar";
-    this.sidebarElement.className = "sidebar";
-    this.containerElement.appendChild(this.sidebarElement);
+    this._createStatusbarButtons();
 
-    this.sidebarResizeElement = document.createElement("div");
-    this.sidebarResizeElement.className = "sidebar-resizer-vertical";
-    this.sidebarResizeElement.addEventListener("mousedown", this._startSidebarDragging.bind(this), false);
-    this.element.appendChild(this.sidebarResizeElement);
-
-    this.containerContentElement = document.createElement("div");
-    this.containerContentElement.id = "resources-container-content";
-    this.containerElement.appendChild(this.containerContentElement);
-
-    this.summaryBar = new WebInspector.SummaryBar(this.categories);
-    this.summaryBar.element.id = "resources-summary";
-    this.containerContentElement.appendChild(this.summaryBar.element);
-
-    this.resourcesGraphsElement = document.createElement("div");
-    this.resourcesGraphsElement.id = "resources-graphs";
-    this.containerContentElement.appendChild(this.resourcesGraphsElement);
-
-    this.dividersElement = document.createElement("div");
-    this.dividersElement.id = "resources-dividers";
-    this.containerContentElement.appendChild(this.dividersElement);
-    
-    this.eventDividersElement = document.createElement("div");
-    this.eventDividersElement.id = "resources-event-dividers";
-    this.containerContentElement.appendChild(this.eventDividersElement);
-
-    this.dividersLabelBarElement = document.createElement("div");
-    this.dividersLabelBarElement.id = "resources-dividers-label-bar";
-    this.containerContentElement.appendChild(this.dividersLabelBarElement);
+    this.reset();
+    this.filter(this.filterAllElement, false);
+    this.graphsTreeElement.children[0].select();
+}
 
-    this.sidebarTreeElement = document.createElement("ol");
-    this.sidebarTreeElement.className = "sidebar-tree";
-    this.sidebarElement.appendChild(this.sidebarTreeElement);
+WebInspector.ResourcesPanel.prototype = {
+    toolbarItemClass: "resources",
 
-    this.sidebarTree = new TreeOutline(this.sidebarTreeElement);
+    get toolbarItemLabel()
+    {
+        return WebInspector.UIString("Resources");
+    },
 
-    var timeGraphItem = new WebInspector.SidebarTreeElement("resources-time-graph-sidebar-item", WebInspector.UIString("Time"));
-    timeGraphItem.onselect = this._graphSelected.bind(this);
+    get statusBarItems()
+    {
+        return [this.enableToggleButton.element, this.largerResourcesButton.element, this.sortingSelectElement];
+    },
 
-    var transferTimeCalculator = new WebInspector.ResourceTransferTimeCalculator();
-    var transferDurationCalculator = new WebInspector.ResourceTransferDurationCalculator();
+    get categories()
+    {
+        return WebInspector.resourceCategories;
+    },
 
-    timeGraphItem.sortingOptions = [
-        { name: WebInspector.UIString("Sort by Start Time"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByAscendingStartTime, calculator: transferTimeCalculator },
-        { name: WebInspector.UIString("Sort by Response Time"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByAscendingResponseReceivedTime, calculator: transferTimeCalculator },
-        { name: WebInspector.UIString("Sort by End Time"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByAscendingEndTime, calculator: transferTimeCalculator },
-        { name: WebInspector.UIString("Sort by Duration"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByDescendingDuration, calculator: transferDurationCalculator },
-        { name: WebInspector.UIString("Sort by Latency"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByDescendingLatency, calculator: transferDurationCalculator },
-    ];
+    createItemTreeElement: function(item)
+    {
+        return new WebInspector.ResourceSidebarTreeElement(item);
+    },
 
-    timeGraphItem.selectedSortingOptionIndex = 1;
+    createItemGraph: function(item)
+    {
+        return new WebInspector.ResourceGraph(item);
+    },
 
-    var sizeGraphItem = new WebInspector.SidebarTreeElement("resources-size-graph-sidebar-item", WebInspector.UIString("Size"));
-    sizeGraphItem.onselect = this._graphSelected.bind(this);
+    isCategoryVisible: function(categoryName)
+    {
+        return (this.itemsGraphsElement.hasStyleClass("filter-all") || this.itemsGraphsElement.hasStyleClass("filter-" + categoryName.toLowerCase()));
+    },
 
-    var transferSizeCalculator = new WebInspector.ResourceTransferSizeCalculator();
-    sizeGraphItem.sortingOptions = [
-        { name: WebInspector.UIString("Sort by Size"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByDescendingSize, calculator: transferSizeCalculator },
-    ];
+    populateSidebar: function()
+    {
+        var timeGraphItem = new WebInspector.SidebarTreeElement("resources-time-graph-sidebar-item", WebInspector.UIString("Time"));
+        timeGraphItem.onselect = this._graphSelected.bind(this);
 
-    sizeGraphItem.selectedSortingOptionIndex = 0;
+        var transferTimeCalculator = new WebInspector.ResourceTransferTimeCalculator();
+        var transferDurationCalculator = new WebInspector.ResourceTransferDurationCalculator();
 
-    this.graphsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("GRAPHS"), {}, true);
-    this.sidebarTree.appendChild(this.graphsTreeElement);
+        timeGraphItem.sortingOptions = [
+            { name: WebInspector.UIString("Sort by Start Time"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByAscendingStartTime, calculator: transferTimeCalculator },
+            { name: WebInspector.UIString("Sort by Response Time"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByAscendingResponseReceivedTime, calculator: transferTimeCalculator },
+            { name: WebInspector.UIString("Sort by End Time"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByAscendingEndTime, calculator: transferTimeCalculator },
+            { name: WebInspector.UIString("Sort by Duration"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByDescendingDuration, calculator: transferDurationCalculator },
+            { name: WebInspector.UIString("Sort by Latency"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByDescendingLatency, calculator: transferDurationCalculator },
+        ];
 
-    this.graphsTreeElement.appendChild(timeGraphItem);
-    this.graphsTreeElement.appendChild(sizeGraphItem);
-    this.graphsTreeElement.expand();
+        timeGraphItem.selectedSortingOptionIndex = 1;
 
-    this.resourcesTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RESOURCES"), {}, true);
-    this.sidebarTree.appendChild(this.resourcesTreeElement);
+        var sizeGraphItem = new WebInspector.SidebarTreeElement("resources-size-graph-sidebar-item", WebInspector.UIString("Size"));
+        sizeGraphItem.onselect = this._graphSelected.bind(this);
 
-    this.resourcesTreeElement.expand();
+        var transferSizeCalculator = new WebInspector.ResourceTransferSizeCalculator();
+        sizeGraphItem.sortingOptions = [
+            { name: WebInspector.UIString("Sort by Size"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByDescendingSize, calculator: transferSizeCalculator },
+        ];
 
-    var panelEnablerHeading = WebInspector.UIString("You need to enable resource tracking to use this panel.");
-    var panelEnablerDisclaimer = WebInspector.UIString("Enabling resource tracking will reload the page and make page loading slower.");
-    var panelEnablerButton = WebInspector.UIString("Enable resource tracking");
+        sizeGraphItem.selectedSortingOptionIndex = 0;
 
-    this.panelEnablerView = new WebInspector.PanelEnablerView("resources", panelEnablerHeading, panelEnablerDisclaimer, panelEnablerButton);
-    this.panelEnablerView.addEventListener("enable clicked", this._enableResourceTracking, this);
+        this.graphsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("GRAPHS"), {}, true);
+        this.sidebarTree.appendChild(this.graphsTreeElement);
 
-    this.element.appendChild(this.panelEnablerView.element);
+        this.graphsTreeElement.appendChild(timeGraphItem);
+        this.graphsTreeElement.appendChild(sizeGraphItem);
+        this.graphsTreeElement.expand();
 
-    this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
-    this.enableToggleButton.addEventListener("click", this._toggleResourceTracking.bind(this), false);
+        this.itemsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RESOURCES"), {}, true);
+        this.sidebarTree.appendChild(this.itemsTreeElement);
 
-    this.largerResourcesButton = new WebInspector.StatusBarButton(WebInspector.UIString("Use small resource rows."), "resources-larger-resources-status-bar-item");
-    this.largerResourcesButton.toggled = Preferences.resourcesLargeRows;
-    this.largerResourcesButton.addEventListener("click", this._toggleLargerResources.bind(this), false);
-    if (!Preferences.resourcesLargeRows) {
-        Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
-        this._toggleLargerResources(); // this will toggle the preference back to the original
-    }
-
-    this.sortingSelectElement = document.createElement("select");
-    this.sortingSelectElement.className = "status-bar-item";
-    this.sortingSelectElement.addEventListener("change", this._changeSortingFunction.bind(this), false);
-
-    var createFilterElement = function (category) {
-        var categoryElement = document.createElement("li");
-        categoryElement.category = category;
-        categoryElement.addStyleClass(category);
-        var label = WebInspector.UIString("All");
-        if (WebInspector.resourceCategories[category])
-            label = WebInspector.resourceCategories[category].title;
-        categoryElement.appendChild(document.createTextNode(label));
-        categoryElement.addEventListener("click", this._updateFilter.bind(this), false);
-        this.filterBarElement.appendChild(categoryElement);
-        return categoryElement;
-    };
-
-    var allElement = createFilterElement.call(this, "all");
-    this.filter(allElement.category);
-    for (var category in this.categories)
-        createFilterElement.call(this, category);
+        this.itemsTreeElement.expand();
+    },
 
-    this.reset();
+    _createPanelEnabler: function()
+    {
+        var panelEnablerHeading = WebInspector.UIString("You need to enable resource tracking to use this panel.");
+        var panelEnablerDisclaimer = WebInspector.UIString("Enabling resource tracking will reload the page and make page loading slower.");
+        var panelEnablerButton = WebInspector.UIString("Enable resource tracking");
 
-    timeGraphItem.select();
-}
+        this.panelEnablerView = new WebInspector.PanelEnablerView("resources", panelEnablerHeading, panelEnablerDisclaimer, panelEnablerButton);
+        this.panelEnablerView.addEventListener("enable clicked", this._enableResourceTracking, this);
 
-WebInspector.ResourcesPanel.prototype = {
-    toolbarItemClass: "resources",
+        this.element.appendChild(this.panelEnablerView.element);
 
-    get categories()
-    {
-        if (!this._categories) {
-            this._categories = {documents: {color: {r: 47, g: 102, b: 236}}, stylesheets: {color: {r: 157, g: 231, b: 119}}, images: {color: {r: 164, g: 60, b: 255}}, scripts: {color: {r: 255, g: 121, b: 0}}, xhr: {color: {r: 231, g: 231, b: 10}}, fonts: {color: {r: 255, g: 82, b: 62}}, other: {color: {r: 186, g: 186, b: 186}}};
-            for (var category in this._categories) {
-                this._categories[category].title = WebInspector.resourceCategories[category].title;
-            }
-        }
-        return this._categories; 
+        this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
+        this.enableToggleButton.addEventListener("click", this._toggleResourceTracking.bind(this), false);
     },
 
-    filter: function (category) {
-        if (this._filterCategory && this._filterCategory === category)
-            return;
-
-        if (this._filterCategory) {
-            var filterElement = this.filterBarElement.getElementsByClassName(this._filterCategory)[0];
-            filterElement.removeStyleClass("selected");
-            var oldClass = "filter-" + this._filterCategory;
-            this.resourcesTreeElement.childrenListElement.removeStyleClass(oldClass);
-            this.resourcesGraphsElement.removeStyleClass(oldClass);
+    _createStatusbarButtons: function()
+    {
+        this.largerResourcesButton = new WebInspector.StatusBarButton(WebInspector.UIString("Use small resource rows."), "resources-larger-resources-status-bar-item");
+        this.largerResourcesButton.toggled = Preferences.resourcesLargeRows;
+        this.largerResourcesButton.addEventListener("click", this._toggleLargerResources.bind(this), false);
+        if (!Preferences.resourcesLargeRows) {
+            Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
+            this._toggleLargerResources(); // this will toggle the preference back to the original
         }
-        this._filterCategory = category;
-        var filterElement = this.filterBarElement.getElementsByClassName(this._filterCategory)[0];
-        filterElement.addStyleClass("selected");
-        var newClass = "filter-" + this._filterCategory;
-        this.resourcesTreeElement.childrenListElement.addStyleClass(newClass);
-        this.resourcesGraphsElement.addStyleClass(newClass);
-    },
 
-    _updateFilter: function (e) {
-        this.filter(e.target.category);
+        this.sortingSelectElement = document.createElement("select");
+        this.sortingSelectElement.className = "status-bar-item";
+        this.sortingSelectElement.addEventListener("change", this._changeSortingFunction.bind(this), false);
     },
 
-    get toolbarItemLabel()
-    {
-        return WebInspector.UIString("Resources");
-    },
-    
     get mainResourceLoadTime()
     {
         return this._mainResourceLoadTime || -1;
@@ -226,7 +165,7 @@ WebInspector.ResourcesPanel.prototype = {
         this._mainResourceLoadTime = x;
         
         // Update the dividers to draw the new line
-        this._updateGraphDividersIfNeeded(true);
+        this.updateGraphDividersIfNeeded(true);
     },
     
     get mainResourceDOMContentTime()
@@ -241,21 +180,12 @@ WebInspector.ResourcesPanel.prototype = {
         
         this._mainResourceDOMContentTime = x;
         
-        this._updateGraphDividersIfNeeded(true);
-    },
-
-    get statusBarItems()
-    {
-        return [this.enableToggleButton.element, this.largerResourcesButton.element, this.sortingSelectElement];
+        this.updateGraphDividersIfNeeded(true);
     },
 
     show: function()
     {
-        WebInspector.Panel.prototype.show.call(this);
-
-        this._updateDividersLabelBarPosition();
-        this._updateSidebarWidth();
-        this.refreshIfNeeded();
+        WebInspector.AbstractTimelinePanel.prototype.show.call(this);
 
         var visibleView = this.visibleView;
         if (visibleView) {
@@ -278,7 +208,7 @@ WebInspector.ResourcesPanel.prototype = {
 
     resize: function()
     {
-        this._updateGraphDividersIfNeeded();
+        WebInspector.AbstractTimelinePanel.prototype.resize.call(this);
 
         var visibleView = this.visibleView;
         if (visibleView && "resize" in visibleView)
@@ -296,7 +226,7 @@ WebInspector.ResourcesPanel.prototype = {
         var resourcesLength = this._resources.length;
         for (var i = 0; i < resourcesLength; ++i) {
             var resource = this._resources[i];
-            if (!resource._resourcesTreeElement)
+            if (!resource._itemsTreeElement)
                 continue;
             var resourceView = this.resourceViewForResource(resource);
             if (!resourceView.performSearch || resourceView === visibleView)
@@ -313,7 +243,7 @@ WebInspector.ResourcesPanel.prototype = {
 
         function sortFuction(a, b)
         {
-            return resourceTreeElementSortFunction(a.resource._resourcesTreeElement, b.resource._resourcesTreeElement);
+            return resourceTreeElementSortFunction(a.resource._itemsTreeElement, b.resource._itemsTreeElement);
         }
 
         return sortFuction;
@@ -321,7 +251,7 @@ WebInspector.ResourcesPanel.prototype = {
 
     searchMatchFound: function(view, matches)
     {
-        view.resource._resourcesTreeElement.searchMatches = matches;
+        view.resource._itemsTreeElement.searchMatches = matches;
     },
 
     searchCanceled: function(startingNewSearch)
@@ -333,8 +263,8 @@ WebInspector.ResourcesPanel.prototype = {
 
         for (var i = 0; i < this._resources.length; ++i) {
             var resource = this._resources[i];
-            if (resource._resourcesTreeElement)
-                resource._resourcesTreeElement.updateErrorsAndWarnings();
+            if (resource._itemsTreeElement)
+                resource._itemsTreeElement.updateErrorsAndWarnings();
         }
     },
 
@@ -342,8 +272,8 @@ WebInspector.ResourcesPanel.prototype = {
     {
         for (var i = 0; i < this._resources.length; ++i) {
             var resource = this._resources[i];
-            if (resource._resourcesTreeElement)
-                resource._resourcesTreeElement.resetBubble();
+            if (resource._itemsTreeElement)
+                resource._itemsTreeElement.resetBubble();
         }
 
         WebInspector.Panel.prototype.performSearch.call(this, query);
@@ -356,23 +286,6 @@ WebInspector.ResourcesPanel.prototype = {
         return null;
     },
 
-    get calculator()
-    {
-        return this._calculator;
-    },
-
-    set calculator(x)
-    {
-        if (!x || this._calculator === x)
-            return;
-
-        this._calculator = x;
-        this._calculator.reset();
-
-        this._staleResources = this._resources;
-        this.refresh();
-    },
-
     get sortingFunction()
     {
         return this._sortingFunction;
@@ -384,75 +297,19 @@ WebInspector.ResourcesPanel.prototype = {
         this._sortResourcesIfNeeded();
     },
 
-    get needsRefresh()
-    {
-        return this._needsRefresh;
-    },
-
-    set needsRefresh(x)
-    {
-        if (this._needsRefresh === x)
-            return;
-
-        this._needsRefresh = x;
-
-        if (x) {
-            if (this.visible && !("_refreshTimeout" in this))
-                this._refreshTimeout = setTimeout(this.refresh.bind(this), 500);
-        } else {
-            if ("_refreshTimeout" in this) {
-                clearTimeout(this._refreshTimeout);
-                delete this._refreshTimeout;
-            }
-        }
-    },
-
-    refreshIfNeeded: function()
-    {
-        if (this.needsRefresh)
-            this.refresh();
-    },
-
     refresh: function()
     {
-        this.needsRefresh = false;
-
-        var staleResourcesLength = this._staleResources.length;
-        var boundariesChanged = false;
-
-        for (var i = 0; i < staleResourcesLength; ++i) {
-            var resource = this._staleResources[i];
-            if (!resource._resourcesTreeElement) {
-                // Create the resource tree element and graph.
-                resource._resourcesTreeElement = new WebInspector.ResourceSidebarTreeElement(resource);
-                resource._resourcesTreeElement._resourceGraph = new WebInspector.ResourceGraph(resource);
-
-                this.resourcesTreeElement.appendChild(resource._resourcesTreeElement);
-                this.resourcesGraphsElement.appendChild(resource._resourcesTreeElement._resourceGraph.graphElement);
-            }
-
-            resource._resourcesTreeElement.refresh();
+        WebInspector.AbstractTimelinePanel.prototype.refresh.call(this);
 
-            if (this.calculator.updateBoundaries(resource))
-                boundariesChanged = true;
-        }
-
-        if (boundariesChanged) {
-            // The boundaries changed, so all resource graphs are stale.
-            this._staleResources = this._resources;
-            staleResourcesLength = this._staleResources.length;
-        }
-
-        for (var i = 0; i < staleResourcesLength; ++i)
-            this._staleResources[i]._resourcesTreeElement._resourceGraph.refresh(this.calculator);
-
-        this._staleResources = [];
-
-        this._updateGraphDividersIfNeeded();
         this._sortResourcesIfNeeded();
         this._updateSummaryGraph();
     },
 
+    _updateSummaryGraph: function()
+    {
+        this.summaryBar.update(this._resources);
+    },
+
     resourceTrackingWasEnabled: function()
     {
         this.reset();
@@ -467,14 +324,9 @@ WebInspector.ResourcesPanel.prototype = {
     {
         this.closeVisibleResource();
 
-        this.containerElement.scrollTop = 0;
-
         delete this.currentQuery;
         this.searchCanceled();
 
-        if (this._calculator)
-            this._calculator.reset();
-
         if (this._resources) {
             var resourcesLength = this._resources.length;
             for (var i = 0; i < resourcesLength; ++i) {
@@ -483,23 +335,18 @@ WebInspector.ResourcesPanel.prototype = {
                 resource.warnings = 0;
                 resource.errors = 0;
 
-                delete resource._resourcesTreeElement;
                 delete resource._resourcesView;
             }
         }
 
-        this._resources = [];
-        this._staleResources = [];
+        WebInspector.AbstractTimelinePanel.prototype.reset.call(this);
         
         this.mainResourceLoadTime = -1;
         this.mainResourceDOMContentTime = -1;
-
-        this.resourcesTreeElement.removeChildren();
+ 
         this.viewsContainerElement.removeChildren();
-        this.resourcesGraphsElement.removeChildren();
-        this.summaryBar.reset();
 
-        this._updateGraphDividersIfNeeded(true);
+        this.summaryBar.reset();
 
         if (InspectorController.resourceTrackingEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Resource tracking enabled. Click to disable.");
@@ -527,20 +374,12 @@ WebInspector.ResourcesPanel.prototype = {
         if (this.visibleView === resource._resourcesView)
             this.closeVisibleResource();
 
-        this._resources.remove(resource, true);
-
-        if (resource._resourcesTreeElement) {
-            this.resourcesTreeElement.removeChild(resource._resourcesTreeElement);
-            this.resourcesGraphsElement.removeChild(resource._resourcesTreeElement._resourceGraph.graphElement);
-        }
+        this.removeItem(resource);
 
         resource.warnings = 0;
         resource.errors = 0;
 
-        delete resource._resourcesTreeElement;
         delete resource._resourcesView;
-
-        this._adjustScrollPosition();
     },
 
     addMessageToResource: function(resource, msg)
@@ -557,8 +396,8 @@ WebInspector.ResourcesPanel.prototype = {
             break;
         }
 
-        if (!this.currentQuery && resource._resourcesTreeElement)
-            resource._resourcesTreeElement.updateErrorsAndWarnings();
+        if (!this.currentQuery && resource._itemsTreeElement)
+            resource._itemsTreeElement.updateErrorsAndWarnings();
 
         var view = this.resourceViewForResource(resource);
         if (view.addMessage)
@@ -573,8 +412,8 @@ WebInspector.ResourcesPanel.prototype = {
             resource.warnings = 0;
             resource.errors = 0;
 
-            if (!this.currentQuery && resource._resourcesTreeElement)
-                resource._resourcesTreeElement.updateErrorsAndWarnings();
+            if (!this.currentQuery && resource._itemsTreeElement)
+                resource._itemsTreeElement.updateErrorsAndWarnings();
 
             var view = resource._resourcesView;
             if (!view || !view.clearMessages)
@@ -585,8 +424,7 @@ WebInspector.ResourcesPanel.prototype = {
 
     refreshResource: function(resource)
     {
-        this._staleResources.push(resource);
-        this.needsRefresh = true;
+        this.refreshItem(resource);
     },
 
     recreateViewForResourceIfNeeded: function(resource)
@@ -601,8 +439,8 @@ WebInspector.ResourcesPanel.prototype = {
         resource.warnings = 0;
         resource.errors = 0;
 
-        if (!this.currentQuery && resource._resourcesTreeElement)
-            resource._resourcesTreeElement.updateErrorsAndWarnings();
+        if (!this.currentQuery && resource._itemsTreeElement)
+            resource._itemsTreeElement.updateErrorsAndWarnings();
 
         var oldView = resource._resourcesView;
 
@@ -638,14 +476,11 @@ WebInspector.ResourcesPanel.prototype = {
                 view.highlightLine(line);
         }
 
-        if (resource._resourcesTreeElement) {
-            resource._resourcesTreeElement.reveal();
-            resource._resourcesTreeElement.select(true);
-        }
+        this.revealAndSelectItem(resource);
 
         this.visibleResource = resource;
 
-        this._updateSidebarWidth();
+        this.updateSidebarWidth();
     },
 
     showView: function(view)
@@ -667,7 +502,7 @@ WebInspector.ResourcesPanel.prototype = {
         if (this._lastSelectedGraphTreeElement)
             this._lastSelectedGraphTreeElement.select(true);
 
-        this._updateSidebarWidth();
+        this.updateSidebarWidth();
     },
 
     resourceViewForResource: function(resource)
@@ -696,79 +531,25 @@ WebInspector.ResourcesPanel.prototype = {
         return view.sourceFrame;
     },
 
-    handleKeyEvent: function(event)
-    {
-        this.sidebarTree.handleKeyEvent(event);
-    },
-
     _sortResourcesIfNeeded: function()
     {
-        var sortedElements = [].concat(this.resourcesTreeElement.children);
-        sortedElements.sort(this.sortingFunction);
-
-        var sortedElementsLength = sortedElements.length;
-        for (var i = 0; i < sortedElementsLength; ++i) {
-            var treeElement = sortedElements[i];
-            if (treeElement === this.resourcesTreeElement.children[i])
-                continue;
-
-            var wasSelected = treeElement.selected;
-            this.resourcesTreeElement.removeChild(treeElement);
-            this.resourcesTreeElement.insertChild(treeElement, i);
-            if (wasSelected)
-                treeElement.select(true);
-
-            var graphElement = treeElement._resourceGraph.graphElement;
-            this.resourcesGraphsElement.insertBefore(graphElement, this.resourcesGraphsElement.children[i]);
-        }
+        this.sortItems(this.sortingFunction);
     },
 
-    _updateGraphDividersIfNeeded: function(force)
+    updateGraphDividersIfNeeded: function(force)
     {
-        if (!this.visible) {
-            this.needsRefresh = true;
-            return;
-        }
-
-        if (document.body.offsetWidth <= 0) {
-            // The stylesheet hasn't loaded yet or the window is closed,
-            // so we can't calculate what is need. Return early.
-            return;
-        }
-
-        var dividerCount = Math.round(this.dividersElement.offsetWidth / 64);
-        var slice = this.calculator.boundarySpan / dividerCount;
-        if (!force && this._currentDividerSlice === slice)
+        var proceed = WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded.call(this, force);
+        
+        if (!proceed)
             return;
 
-        this._currentDividerSlice = slice;
-
-        this.dividersElement.removeChildren();
-        this.eventDividersElement.removeChildren();
-        this.dividersLabelBarElement.removeChildren();
-
-        for (var i = 1; i <= dividerCount; ++i) {
-            var divider = document.createElement("div");
-            divider.className = "resources-divider";
-            if (i === dividerCount)
-                divider.addStyleClass("last");
-            divider.style.left = ((i / dividerCount) * 100) + "%";
-
-            this.dividersElement.appendChild(divider.cloneNode());
-
-            var label = document.createElement("div");
-            label.className = "resources-divider-label";
-            if (!isNaN(slice))
-                label.textContent = this.calculator.formatValue(slice * i);
-            divider.appendChild(label);
-
-            this.dividersLabelBarElement.appendChild(divider);
-        }
-
-        if (this.calculator.startAtZero) {
+        if (this.calculator.startAtZero || !this.calculator.computePercentageFromEventTime) {
             // If our current sorting method starts at zero, that means it shows all
             // resources starting at the same point, and so onLoad event and DOMContent
             // event lines really wouldn't make much sense here, so don't render them.
+            // Additionally, if the calculator doesn't have the computePercentageFromEventTime
+            // function defined, we are probably sorting by size, and event times aren't relevant
+            // in this case.
             return;
         }
 
@@ -803,20 +584,6 @@ WebInspector.ResourcesPanel.prototype = {
         }
     },
 
-    _updateSummaryGraph: function()
-    {
-        this.summaryBar.update(this._resources);
-    },
-
-    _updateDividersLabelBarPosition: function()
-    {
-        var scrollTop = this.containerElement.scrollTop;
-        var dividersTop = (scrollTop < this.summaryBar.element.offsetHeight ? this.summaryBar.element.offsetHeight : scrollTop);
-        this.dividersElement.style.top = scrollTop + "px";
-        this.eventDividersElement.style.top = scrollTop + "px";
-        this.dividersLabelBarElement.style.top = dividersTop + "px";
-    },
-
     _graphSelected: function(treeElement)
     {
         if (this._lastSelectedGraphTreeElement)
@@ -843,32 +610,25 @@ WebInspector.ResourcesPanel.prototype = {
 
     _toggleLargerResources: function()
     {
-        if (!this.resourcesTreeElement._childrenListNode)
+        if (!this.itemsTreeElement._childrenListNode)
             return;
 
-        this.resourcesTreeElement.smallChildren = !this.resourcesTreeElement.smallChildren;
+        this.itemsTreeElement.smallChildren = !this.itemsTreeElement.smallChildren;
         Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
         InspectorController.setSetting("resources-large-rows", Preferences.resourcesLargeRows);
 
-        if (this.resourcesTreeElement.smallChildren) {
-            this.resourcesGraphsElement.addStyleClass("small");
+        if (this.itemsTreeElement.smallChildren) {
+            this.itemsGraphsElement.addStyleClass("small");
             this.largerResourcesButton.title = WebInspector.UIString("Use large resource rows.");
             this.largerResourcesButton.toggled = false;
-            this._adjustScrollPosition();
+            this.adjustScrollPosition();
         } else {
-            this.resourcesGraphsElement.removeStyleClass("small");
+            this.itemsGraphsElement.removeStyleClass("small");
             this.largerResourcesButton.title = WebInspector.UIString("Use small resource rows.");
             this.largerResourcesButton.toggled = true;
         }
     },
 
-    _adjustScrollPosition: function()
-    {
-        // Prevent the container from being scrolled off the end.
-        if ((this.containerElement.scrollTop + this.containerElement.offsetHeight) > this.sidebarElement.offsetHeight)
-            this.containerElement.scrollTop = (this.sidebarElement.offsetHeight - this.containerElement.offsetHeight);
-    },
-
     _changeSortingFunction: function()
     {
         var selectedOption = this.sortingSelectElement[this.sortingSelectElement.selectedIndex];
@@ -893,41 +653,8 @@ WebInspector.ResourcesPanel.prototype = {
         }
     },
 
-    _startSidebarDragging: function(event)
-    {
-        WebInspector.elementDragStart(this.sidebarResizeElement, this._sidebarDragging.bind(this), this._endSidebarDragging.bind(this), event, "col-resize");
-    },
-
-    _sidebarDragging: function(event)
+    setSidebarWidth: function(width)
     {
-        this._updateSidebarWidth(event.pageX);
-
-        event.preventDefault();
-    },
-
-    _endSidebarDragging: function(event)
-    {
-        WebInspector.elementDragEnd(event);
-    },
-
-    _updateSidebarWidth: function(width)
-    {
-        if (this.sidebarElement.offsetWidth <= 0) {
-            // The stylesheet hasn't loaded yet or the window is closed,
-            // so we can't calculate what is need. Return early.
-            return;
-        }
-
-        if (!("_currentSidebarWidth" in this))
-            this._currentSidebarWidth = this.sidebarElement.offsetWidth;
-
-        if (typeof width === "undefined")
-            width = this._currentSidebarWidth;
-
-        width = Number.constrain(width, Preferences.minSidebarWidth, window.innerWidth / 2);
-
-        this._currentSidebarWidth = width;
-
         if (this.visibleResource) {
             this.containerElement.style.width = width + "px";
             this.sidebarElement.style.removeProperty("width");
@@ -936,15 +663,13 @@ WebInspector.ResourcesPanel.prototype = {
             this.containerElement.style.removeProperty("width");
         }
 
-        this.containerContentElement.style.left = width + "px";
-        this.viewsContainerElement.style.left = width + "px";
         this.sidebarResizeElement.style.left = (width - 3) + "px";
+    },
 
-        this._updateGraphDividersIfNeeded();
-
-        var visibleView = this.visibleView;
-        if (visibleView && "resize" in visibleView)
-            visibleView.resize();
+    updateMainViewWidth: function(width)
+    {
+        WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth.call(this, width);
+        this.viewsContainerElement.style.left = width + "px";
     },
 
     _enableResourceTracking: function()
@@ -965,88 +690,19 @@ WebInspector.ResourcesPanel.prototype = {
             this.sortingSelectElement.visible = true;
             InspectorController.enableResourceTracking(!!optionalAlways);
         }
-    }
-}
-
-WebInspector.ResourcesPanel.prototype.__proto__ = WebInspector.Panel.prototype;
-
-WebInspector.ResourceCalculator = function()
-{
-}
-
-WebInspector.ResourceCalculator.prototype = {
-    computeSummaryValues: function(resources)
-    {
-        var total = 0;
-        var categoryValues = {};
-
-        var resourcesLength = resources.length;
-        for (var i = 0; i < resourcesLength; ++i) {
-            var resource = resources[i];
-            var value = this._value(resource);
-            if (typeof value === "undefined")
-                continue;
-            if (!(resource.category.name in categoryValues))
-                categoryValues[resource.category.name] = 0;
-            categoryValues[resource.category.name] += value;
-            total += value;
-        }
-
-        return {categoryValues: categoryValues, total: total};
-    },
-
-    computeBarGraphPercentages: function(resource)
-    {
-        return {start: 0, middle: 0, end: (this._value(resource) / this.boundarySpan) * 100};
-    },
-
-    computeBarGraphLabels: function(resource)
-    {
-        const label = this.formatValue(this._value(resource));
-        var tooltip = label;
-        if (resource.cached)
-            tooltip = WebInspector.UIString("%s (from cache)", tooltip);
-        return {left: label, right: label, tooltip: tooltip};
-    },
-
-    get boundarySpan()
-    {
-        return this.maximumBoundary - this.minimumBoundary;
-    },
-
-    updateBoundaries: function(resource)
-    {
-        this.minimumBoundary = 0;
-
-        var value = this._value(resource);
-        if (typeof this.maximumBoundary === "undefined" || value > this.maximumBoundary) {
-            this.maximumBoundary = value;
-            return true;
-        }
-
-        return false;
-    },
-
-    reset: function()
-    {
-        delete this.minimumBoundary;
-        delete this.maximumBoundary;
-    },
-
-    _value: function(resource)
-    {
-        return 0;
     },
 
-    formatValue: function(value)
+    get _resources()
     {
-        return value.toString();
+        return this._items;
     }
 }
 
+WebInspector.ResourcesPanel.prototype.__proto__ = WebInspector.AbstractTimelinePanel.prototype;
+
 WebInspector.ResourceTimeCalculator = function(startAtZero)
 {
-    WebInspector.ResourceCalculator.call(this);
+    WebInspector.AbstractTimelineCalculator.call(this);
     this.startAtZero = startAtZero;
 }
 
@@ -1204,10 +860,10 @@ WebInspector.ResourceTimeCalculator.prototype = {
     _upperBound: function(resource)
     {
         return 0;
-    },
+    }
 }
 
-WebInspector.ResourceTimeCalculator.prototype.__proto__ = WebInspector.ResourceCalculator.prototype;
+WebInspector.ResourceTimeCalculator.prototype.__proto__ = WebInspector.AbstractTimelineCalculator.prototype;
 
 WebInspector.ResourceTransferTimeCalculator = function()
 {
@@ -1254,10 +910,19 @@ WebInspector.ResourceTransferDurationCalculator.prototype.__proto__ = WebInspect
 
 WebInspector.ResourceTransferSizeCalculator = function()
 {
-    WebInspector.ResourceCalculator.call(this);
+    WebInspector.AbstractTimelineCalculator.call(this);
 }
 
 WebInspector.ResourceTransferSizeCalculator.prototype = {
+    computeBarGraphLabels: function(resource)
+    {
+        const label = this.formatValue(this._value(resource));
+        var tooltip = label;
+        if (resource.cached)
+            tooltip = WebInspector.UIString("%s (from cache)", tooltip);
+        return {left: label, right: label, tooltip: tooltip};
+    },
+
     _value: function(resource)
     {
         return resource.contentLength;
@@ -1269,7 +934,7 @@ WebInspector.ResourceTransferSizeCalculator.prototype = {
     }
 }
 
-WebInspector.ResourceTransferSizeCalculator.prototype.__proto__ = WebInspector.ResourceCalculator.prototype;
+WebInspector.ResourceTransferSizeCalculator.prototype.__proto__ = WebInspector.AbstractTimelineCalculator.prototype;
 
 WebInspector.ResourceSidebarTreeElement = function(resource)
 {
@@ -1342,7 +1007,7 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
 
     get selectable()
     {
-        return WebInspector.panels.resources._filterCategory == "all" || WebInspector.panels.resources._filterCategory == this.resource.category.name;
+        return WebInspector.panels.resources.isCategoryVisible(this.resource.category.name);
     },
 
     createIconElement: function()
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
index 790055a5ba..1c11f76b22 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
@@ -425,7 +425,7 @@ WebInspector.SourceFrame.prototype = {
             return;
 
         var expression = selection.getRangeAt(0).toString().trimWhitespace();
-        WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, function(result, exception) {
+        WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, "console", function(result, exception) {
             WebInspector.showConsole();
             var commandMessage = new WebInspector.ConsoleCommand(expression);
             WebInspector.console.addMessage(commandMessage);
@@ -980,132 +980,377 @@ WebInspector.CSSSourceSyntaxHighligher.prototype.__proto__ = WebInspector.Source
 WebInspector.JavaScriptSourceSyntaxHighlighter = function(table, sourceFrame) {
     WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
 
-    this.findNumber = this.generateFinder(/^(-?(\d+\.?\d*([eE][+-]\d+)?|0[xX]\h+|Infinity)|NaN)(?:\W|$)/, 1, "webkit-javascript-number");
-    this.findKeyword = this.generateFinder(/^(null|true|false|break|case|catch|const|default|finally|for|instanceof|new|var|continue|function|return|void|delete|if|this|do|while|else|in|switch|throw|try|typeof|with|debugger|class|enum|export|extends|import|super|get|set)(?:\W|$)/, 1, "webkit-javascript-keyword");
-    this.findSingleLineString = this.generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-javascript-string"); // " this quote keeps Xcode happy
-    this.findMultilineCommentStart = this.generateFinder(/^\/\*.*$/, 0, "webkit-javascript-comment");
-    this.findMultilineCommentEnd = this.generateFinder(/^.*?\*\//, 0, "webkit-javascript-comment");
-    this.findMultilineSingleQuoteStringStart = this.generateFinder(/^'(?:[^'\\]|\\.)*\\$/, 0, "webkit-javascript-string");
-    this.findMultilineSingleQuoteStringEnd = this.generateFinder(/^(?:[^'\\]|\\.)*?'/, 0, "webkit-javascript-string");
-    this.findMultilineDoubleQuoteStringStart = this.generateFinder(/^"(?:[^"\\]|\\.)*\\$/, 0, "webkit-javascript-string");
-    this.findMultilineDoubleQuoteStringEnd = this.generateFinder(/^(?:[^"\\]|\\.)*?"/, 0, "webkit-javascript-string");
-    this.findMultilineRegExpEnd = this.generateFinder(/^(?:[^\/\\]|\\.)*?\/([gim]{0,3})/, 0, "webkit-javascript-regexp");
-    this.findSingleLineComment = this.generateFinder(/^\/\/.*|^\/\*.*?\*\//, 0, "webkit-javascript-comment");
-}
-
-WebInspector.JavaScriptSourceSyntaxHighlighter.prototype = {
-    deleteContinueFlags: function(cell)
+    this.LexState = {
+        Initial: 1,
+        DivisionAllowed: 2,
+    };
+    this.ContinueState = {
+        None: 0,
+        Comment: 1,
+        SingleQuoteString: 2,
+        DoubleQuoteString: 3,
+        RegExp: 4
+    };
+    
+    this.nonToken = "";
+    this.cursor = 0;
+    this.lineIndex = -1;
+    this.lineCode = "";
+    this.lineFragment = null;
+    this.lexState = this.LexState.Initial;
+    this.continueState = this.ContinueState.None;
+    
+    this.rules = [{
+            pattern: /^(?:\/\/.*)/,
+            action: singleLineCommentAction
+        }, {
+            pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*\*+\/)/,
+            action: multiLineSingleLineCommentAction
+        }, {
+            pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*)/,
+            action: multiLineCommentStartAction
+        }, {
+            pattern: /^(?:(?:[^\*]|\*[^\/])*\*+\/)/,
+            action: multiLineCommentEndAction,
+            continueStateCondition: this.ContinueState.Comment
+        }, {
+            pattern: /^.*/,
+            action: multiLineCommentMiddleAction,
+            continueStateCondition: this.ContinueState.Comment
+        }, {
+            pattern: /^(?:(?:0|[1-9]\d*)\.\d+?(?:[eE](?:\d+|\+\d+|-\d+))?|\.\d+(?:[eE](?:\d+|\+\d+|-\d+))?|(?:0|[1-9]\d*)(?:[eE](?:\d+|\+\d+|-\d+))?|0x[0-9a-fA-F]+|0X[0-9a-fA-F]+)/,
+            action: numericLiteralAction
+        }, {
+            pattern: /^(?:"(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*"|'(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*')/,
+            action: stringLiteralAction
+        }, {
+            pattern: /^(?:'(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+            action: singleQuoteStringStartAction
+        }, {
+            pattern: /^(?:(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*')/,
+            action: singleQuoteStringEndAction,
+            continueStateCondition: this.ContinueState.SingleQuoteString
+        }, {
+            pattern: /^(?:(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+            action: singleQuoteStringMiddleAction,
+            continueStateCondition: this.ContinueState.SingleQuoteString
+        }, {
+            pattern: /^(?:"(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+            action: doubleQuoteStringStartAction
+        }, {
+            pattern: /^(?:(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*")/,
+            action: doubleQuoteStringEndAction,
+            continueStateCondition: this.ContinueState.DoubleQuoteString
+        }, {
+            pattern: /^(?:(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+            action: doubleQuoteStringMiddleAction,
+            continueStateCondition: this.ContinueState.DoubleQuoteString
+        }, {
+            pattern: /^(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
+            action: identOrKeywordAction,
+            dontAppendNonToken: true
+        }, {
+            pattern: /^\)/,
+            action: rightParenAction,
+            dontAppendNonToken: true
+        }, {
+            pattern: /^(?:<=|>=|===|==|!=|!==|\+\+|\-\-|<<|>>|>>>|&&|\|\||\+=|\-=|\*=|%=|<<=|>>=|>>>=|&=|\|=|^=|[{}\(\[\]\.;,<>\+\-\*%&\|\^!~\?:=])/,
+            action: punctuatorAction,
+            dontAppendNonToken: true
+        }, {
+            pattern: /^(?:\/=?)/,
+            action: divPunctuatorAction,
+            stateCondition: this.LexState.DivisionAllowed,
+            dontAppendNonToken: true
+        }, {
+            pattern: /^(?:\/(?:(?:\\.)|[^\\*\/])(?:(?:\\.)|[^\\/])*\/(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
+            action: regExpLiteralAction
+        }, {
+            pattern: /^(?:\/(?:(?:\\.)|[^\\*\/])(?:(?:\\.)|[^\\/])*)\\$/,
+            action: regExpStartAction
+        }, {
+            pattern: /^(?:(?:(?:\\.)|[^\\/])*\/(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
+            action: regExpEndAction,
+            continueStateCondition: this.ContinueState.RegExp
+        }, {
+            pattern: /^(?:(?:(?:\\.)|[^\\/])*)\\$/,
+            action: regExpMiddleAction,
+            continueStateCondition: this.ContinueState.RegExp
+        }];
+    
+    function singleLineCommentAction(token)
     {
-        if (!cell)
-            return;
-        delete cell._commentContinues;
-        delete cell._singleQuoteStringContinues;
-        delete cell._doubleQuoteStringContinues;
-        delete cell._regexpContinues;
-    },
-
-    findMultilineRegExpStart: function(str)
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+    }
+    
+    function multiLineSingleLineCommentAction(token)
     {
-        var match = /^\/(?:[^\/\\]|\\.)*\\$/.exec(str);
-        if (!match || !/\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[0]))
-            return null;
-        this.previousMatchLength = match[0].length;
-        return this.createSpan(match[0], "webkit-javascript-regexp");
-    },
-
-    findSingleLineRegExp: function(str)
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+    }
+    
+    function multiLineCommentStartAction(token)
     {
-        var match = /^(\/(?:[^\/\\]|\\.)*\/([gim]{0,3}))(.?)/.exec(str);
-        if (!match || !(match[2].length > 0 || /\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[1]) || /\.|;|,/.test(match[3])))
-            return null;
-        this.previousMatchLength = match[1].length;
-        return this.createSpan(match[1], "webkit-javascript-regexp");
-    },
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+        this.continueState = this.ContinueState.Comment;
+    }
+    
+    function multiLineCommentEndAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+        this.continueState = this.ContinueState.None;
+    }
+    
+    function multiLineCommentMiddleAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+    }
+    
+    function numericLiteralAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-number"));
+        this.lexState = this.LexState.DivisionAllowed;
+    }
+    
+    function stringLiteralAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.lexState = this.LexState.Initial;
+    }
+    
+    function singleQuoteStringStartAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.continueState = this.ContinueState.SingleQuoteString;
+    }
+    
+    function singleQuoteStringEndAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.continueState = this.ContinueState.None;
+    }
+    
+    function singleQuoteStringMiddleAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+    }
+    
+    function doubleQuoteStringStartAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.continueState = this.ContinueState.DoubleQuoteString;
+    }
+    
+    function doubleQuoteStringEndAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.continueState = this.ContinueState.None;
+    }
+    
+    function doubleQuoteStringMiddleAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+    }
+    
+    function regExpLiteralAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+        this.lexState = this.LexState.Initial;
+    }
 
-    syntaxHighlightLine: function(line, prevLine)
+    function regExpStartAction(token)
     {
-        var messageBubble = line.lastChild;
-        if (messageBubble && messageBubble.nodeType === Node.ELEMENT_NODE && messageBubble.hasStyleClass("webkit-html-message-bubble"))
-            line.removeChild(messageBubble);
-        else
-            messageBubble = null;
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+        this.continueState = this.ContinueState.RegExp;
+    }
 
-        var code = line.textContent;
+    function regExpEndAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+        this.continueState = this.ContinueState.None;
+    }
 
-        while (line.firstChild)
-            line.removeChild(line.firstChild);
+    function regExpMiddleAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+    }
+    
+    function identOrKeywordAction(token)
+    {
+        const keywords = ["null", "true", "false", "break", "case", "catch", "const", "default", "finally", "for", "instanceof", "new", "var", "continue", "function", "return", "void", "delete", "if", "this", "do", "while", "else", "in", "switch", "throw", "try", "typeof", "with", "debugger", "class", "enum", "export", "extends", "import", "super", "get", "set"];
+        this.cursor += token.length;
+        if (keywords.indexOf(token) === -1) {
+            this.nonToken += token;
+            this.lexState = this.LexState.DivisionAllowed;
+        } else {
+            this.appendNonToken();
+            this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-keyword"));
+            this.lexState = this.LexState.Initial;
+        }
+    }
+    
+    function divPunctuatorAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.Initial;
+    }
+    
+    function rightParenAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.DivisionAllowed;
+    }
+    
+    function punctuatorAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.Initial;
+    }
+}
 
-        var token;
-        var tmp = 0;
-        var i = 0;
-        this.previousMatchLength = 0;
+WebInspector.JavaScriptSourceSyntaxHighlighter.prototype = {
+    process: function()
+    {
+        // Split up the work into chunks so we don't block the
+        // UI thread while processing.
 
-        if (prevLine) {
-            if (prevLine._commentContinues) {
-                if (!(token = this.findMultilineCommentEnd(code))) {
-                    token = this.createSpan(code, "webkit-javascript-comment");
-                    line._commentContinues = true;
-                }
-            } else if (prevLine._singleQuoteStringContinues) {
-                if (!(token = this.findMultilineSingleQuoteStringEnd(code))) {
-                    token = this.createSpan(code, "webkit-javascript-string");
-                    line._singleQuoteStringContinues = true;
+        var rows = this.table.rows;
+        var rowsLength = rows.length;
+        const tokensPerChunk = 100;
+        const lineLengthLimit = 20000;
+        
+        var boundProcessChunk = processChunk.bind(this);
+        var processChunkInterval = setInterval(boundProcessChunk, 25);
+        boundProcessChunk();
+        
+        function processChunk()
+        {
+            for (var i = 0; i < tokensPerChunk; i++) {
+                if (this.cursor >= this.lineCode.length)
+                    moveToNextLine.call(this);
+                if (this.lineIndex >= rowsLength) {
+                    this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+                    return;
                 }
-            } else if (prevLine._doubleQuoteStringContinues) {
-                if (!(token = this.findMultilineDoubleQuoteStringEnd(code))) {
-                    token = this.createSpan(code, "webkit-javascript-string");
-                    line._doubleQuoteStringContinues = true;
+                if (this.cursor > lineLengthLimit) {
+                    var codeFragment = this.lineCode.substring(this.cursor);
+                    this.nonToken += codeFragment;
+                    this.cursor += codeFragment.length;
                 }
-            } else if (prevLine._regexpContinues) {
-                if (!(token = this.findMultilineRegExpEnd(code))) {
-                    token = this.createSpan(code, "webkit-javascript-regexp");
-                    line._regexpContinues = true;
+
+                this.lex();
+            }
+        }
+        
+        function moveToNextLine()
+        {
+            this.appendNonToken();
+            
+            var row = rows[this.lineIndex];
+            var line = row ? row.cells[1] : null;
+            if (line && this.lineFragment) {
+                var messageBubble = null;
+                if (line.lastChild && line.lastChild.nodeType === Node.ELEMENT_NODE && line.lastChild.hasStyleClass("webkit-html-message-bubble")) {
+                    messageBubble = line.lastChild;
+                    line.removeChild(messageBubble);
                 }
+                
+                Element.prototype.removeChildren.call(line);
+                
+                line.appendChild(this.lineFragment);
+                if (messageBubble)
+                    line.appendChild(messageBubble);
+                this.lineFragment = null;
             }
-            if (token) {
-                i += this.previousMatchLength ? this.previousMatchLength : code.length;
-                tmp = i;
-                line.appendChild(token);
+            this.lineIndex++;
+            if (this.lineIndex >= rowsLength && processChunkInterval) {
+                clearInterval(processChunkInterval);
+                this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+                return;
             }
+            row = rows[this.lineIndex];
+            line = row ? row.cells[1] : null;
+            this.lineCode = line.textContent;
+            this.lineFragment = document.createDocumentFragment();
+            this.cursor = 0;
+            if (!line)
+                moveToNextLine();
         }
-
-        for ( ; i < code.length; ++i) {
-            var codeFragment = code.substr(i);
-            var prevChar = code[i - 1];
-            token = this.findSingleLineComment(codeFragment);
-            if (!token) {
-                if ((token = this.findMultilineCommentStart(codeFragment)))
-                    line._commentContinues = true;
-                else if (!prevChar || /^\W/.test(prevChar)) {
-                    token = this.findNumber(codeFragment) ||
-                            this.findKeyword(codeFragment) ||
-                            this.findSingleLineString(codeFragment) ||
-                            this.findSingleLineRegExp(codeFragment);
-                    if (!token) {
-                        if (token = this.findMultilineSingleQuoteStringStart(codeFragment))
-                            line._singleQuoteStringContinues = true;
-                        else if (token = this.findMultilineDoubleQuoteStringStart(codeFragment))
-                            line._doubleQuoteStringContinues = true;
-                        else if (token = this.findMultilineRegExpStart(codeFragment))
-                            line._regexpContinues = true;
+    },
+    
+    lex: function()
+    {
+        var token = null;
+        var codeFragment = this.lineCode.substring(this.cursor);
+        
+        for (var i = 0; i < this.rules.length; i++) {
+            var rule = this.rules[i];
+            var ruleContinueStateCondition = typeof rule.continueStateCondition === "undefined" ? this.ContinueState.None : rule.continueStateCondition;
+            if (this.continueState === ruleContinueStateCondition) {
+                if (typeof rule.stateCondition !== "undefined" && this.lexState !== rule.stateCondition)
+                    continue;
+                var match = rule.pattern.exec(codeFragment);
+                if (match) {
+                    token = match[0];
+                    if (token) {
+                        if (!rule.dontAppendNonToken)
+                            this.appendNonToken();
+                        return rule.action.call(this, token);
                     }
                 }
             }
-
-            if (token) {
-                if (tmp !== i)
-                    line.appendChild(document.createTextNode(code.substring(tmp, i)));
-                line.appendChild(token);
-                i += this.previousMatchLength - 1;
-                tmp = i + 1;
-            }
         }
+        this.nonToken += codeFragment[0];
+        this.cursor++;
+    },
+    
+    appendNonToken: function ()
+    {
+        if (this.nonToken.length > 0) {
+            this.lineFragment.appendChild(document.createTextNode(this.nonToken));
+            this.nonToken = "";
+        }
+    },
+    
+    syntaxHighlightNode: function(node)
+    {
+        this.lineCode = node.textContent;
+        this.lineFragment = document.createDocumentFragment();
+        this.cursor = 0;
+        while (true) {
+            if (this.cursor >= this.lineCode.length) {
+                var codeFragment = this.lineCode.substring(this.cursor);
+                this.nonToken += codeFragment;
+                this.cursor += codeFragment.length;
+                this.appendNonToken();
+                while (node.firstChild)
+                    node.removeChild(node.firstChild);
+                node.appendChild(this.lineFragment);
+                this.lineFragment =null;
+                return;
+            }
 
-        if (tmp < code.length)
-            line.appendChild(document.createTextNode(code.substring(tmp, i)));
-
-        if (messageBubble)
-            line.appendChild(messageBubble);
+            this.lex();
+        }
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js
index 66b4a92826..1aa11ee55e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js
@@ -31,21 +31,7 @@ WebInspector.StoragePanel = function(database)
 {
     WebInspector.Panel.call(this);
 
-    this.sidebarElement = document.createElement("div");
-    this.sidebarElement.id = "storage-sidebar";
-    this.sidebarElement.className = "sidebar";
-    this.element.appendChild(this.sidebarElement);
-
-    this.sidebarResizeElement = document.createElement("div");
-    this.sidebarResizeElement.className = "sidebar-resizer-vertical";
-    this.sidebarResizeElement.addEventListener("mousedown", this._startSidebarDragging.bind(this), false);
-    this.element.appendChild(this.sidebarResizeElement);
-
-    this.sidebarTreeElement = document.createElement("ol");
-    this.sidebarTreeElement.className = "sidebar-tree";
-    this.sidebarElement.appendChild(this.sidebarTreeElement);
-
-    this.sidebarTree = new TreeOutline(this.sidebarTreeElement);
+    this.createSidebar();
 
     this.databasesListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("DATABASES"), {}, true);
     this.sidebarTree.appendChild(this.databasesListTreeElement);
@@ -86,12 +72,6 @@ WebInspector.StoragePanel.prototype = {
         return [this.storageViewStatusBarItemsContainer];
     },
 
-    show: function()
-    {
-        WebInspector.Panel.prototype.show.call(this);
-        this._updateSidebarWidth();
-    },
-
     reset: function()
     {
         if (this._databases) {
@@ -133,11 +113,6 @@ WebInspector.StoragePanel.prototype = {
             this.sidebarTree.selectedTreeElement.deselect();
     },
 
-    handleKeyEvent: function(event)
-    {
-        this.sidebarTree.handleKeyEvent(event);
-    },
-
     addDatabase: function(database)
     {
         this._databases.push(database);
@@ -416,49 +391,10 @@ WebInspector.StoragePanel.prototype = {
         return null;
     },
 
-    _startSidebarDragging: function(event)
-    {
-        WebInspector.elementDragStart(this.sidebarResizeElement, this._sidebarDragging.bind(this), this._endSidebarDragging.bind(this), event, "col-resize");
-    },
-
-    _sidebarDragging: function(event)
-    {
-        this._updateSidebarWidth(event.pageX);
-
-        event.preventDefault();
-    },
-
-    _endSidebarDragging: function(event)
-    {
-        WebInspector.elementDragEnd(event);
-    },
-
-    _updateSidebarWidth: function(width)
+    updateMainViewWidth: function(width)
     {
-        if (this.sidebarElement.offsetWidth <= 0) {
-            // The stylesheet hasn't loaded yet or the window is closed,
-            // so we can't calculate what is need. Return early.
-            return;
-        }
-
-        if (!("_currentSidebarWidth" in this))
-            this._currentSidebarWidth = this.sidebarElement.offsetWidth;
-
-        if (typeof width === "undefined")
-            width = this._currentSidebarWidth;
-
-        width = Number.constrain(width, Preferences.minSidebarWidth, window.innerWidth / 2);
-
-        this._currentSidebarWidth = width;
-
-        this.sidebarElement.style.width = width + "px";
         this.storageViews.style.left = width + "px";
         this.storageViewStatusBarItemsContainer.style.left = width + "px";
-        this.sidebarResizeElement.style.left = (width - 3) + "px";
-        
-        var visibleView = this.visibleView;
-        if (visibleView && "resize" in visibleView)
-            visibleView.resize();
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js
index 3582f9663c..a95dae35be 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -376,7 +376,7 @@ WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyl
 {
     WebInspector.PropertiesSection.call(this, styleRule.selectorText);
 
-    this.titleElement.addEventListener("click", function(e) { e.stopPropagation(); }, false);
+    this.titleElement.addEventListener("click", this._clickSelector.bind(this), false);
     this.titleElement.addEventListener("dblclick", this._dblclickSelector.bind(this), false);
     this.element.addEventListener("dblclick", this._dblclickEmptySpace.bind(this), false);
 
@@ -591,6 +591,19 @@ WebInspector.StylePropertiesSection.prototype = {
         return item;
     },
 
+    _clickSelector: function(event)
+    {
+        event.stopPropagation();
+
+        // Don't search "Computed Styles", "Style Attribute", or Mapped Attributes.
+        if (this.computedStyle || !this.rule || this.rule.isUser)
+            return;
+
+        var searchElement = document.getElementById("search");
+        searchElement.value = this.styleRule.selectorText;
+        WebInspector.performSearch({ target: searchElement });
+    },
+
     _dblclickEmptySpace: function(event)
     {
         this.expand();
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SummaryBar.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SummaryBar.js
index bbf2b1a276..1c31449f8b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/SummaryBar.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SummaryBar.js
@@ -74,8 +74,7 @@ WebInspector.SummaryBar.prototype = {
             if (!size)
                 continue;
 
-            var color = this.categories[category].color;
-            var colorString = "rgb(" + color.r + ", " + color.g + ", " + color.b + ")";
+            var colorString = this.categories[category].color;
 
             var fillSegment = {color: colorString, value: size};
             fillSegments.push(fillSegment);
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TestController.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TestController.js
index 8da59e7f8a..12e1ac7ecd 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TestController.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TestController.js
@@ -44,6 +44,16 @@ WebInspector.TestController.prototype = {
     {
         var message = typeof result === "undefined" ? "<undefined>" : JSON.stringify(result);
         InspectorController.didEvaluateForTestInFrontend(this._callId, message);
+    },
+
+    runAfterPendingDispatches: function(callback)
+    {
+        if (WebInspector.pendingDispatches === 0) {
+            callback();
+            return;
+        }
+
+        setTimeout(this.runAfterPendingDispatches.bind(this), 0, callback);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js
index 4363da8fef..cbbb7369a9 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js
@@ -33,22 +33,31 @@ WebInspector.TimelineAgent = function() {
 }
 
 // Must be kept in sync with TimelineItem.h
-WebInspector.TimelineAgent.ItemType = {
-    DOMDispatch       : 0,
-    Layout            : 1,
-    RecalculateStyles : 2,
-    Paint             : 3,
-    ParseHTML         : 4
+WebInspector.TimelineAgent.RecordType = {
+    DOMDispatch         : 0,
+    Layout              : 1,
+    RecalculateStyles   : 2,
+    Paint               : 3,
+    ParseHTML           : 4,
+    TimerInstall        : 5,
+    TimerRemove         : 6,
+    TimerFire           : 7,
+    XHRReadyStateChange : 8,
+    XHRLoad             : 9,
+    EvaluateScriptTag   : 10
 };
 
-WebInspector.addItemToTimeline = function(record) {
-    // Not implemented.
+WebInspector.addRecordToTimeline = function(record) {
+    if (WebInspector.panels.timeline)
+        WebInspector.panels.timeline.addRecordToTimeline(record);
 }
 
 WebInspector.timelineProfilerWasStarted = function() {
-    // Not implemented.
+    if (WebInspector.panels.timeline)
+        WebInspector.panels.timeline.timelineWasStarted();
 }
 
 WebInspector.timelineProfilerWasStopped = function() {
-    // Not implemented.
+    if (WebInspector.panels.timeline)
+        WebInspector.panels.timeline.timelineWasStopped();
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TimelinePanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelinePanel.js
new file mode 100644
index 0000000000..df63a0b8b6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelinePanel.js
@@ -0,0 +1,362 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TimelinePanel = function()
+{
+    WebInspector.AbstractTimelinePanel.call(this);
+
+    this.element.addStyleClass("timeline");
+
+    this.createInterface();
+    this.summaryBar.element.id = "timeline-summary";
+    this.itemsGraphsElement.id = "timeline-graphs";
+
+    this._createStatusbarButtons();
+
+    this.calculator = new WebInspector.TimelineCalculator();
+
+    this.filter(this.filterAllElement, false);
+}
+
+WebInspector.TimelinePanel.prototype = {
+    toolbarItemClass: "timeline",
+
+    get toolbarItemLabel()
+    {
+        return WebInspector.UIString("Timeline");
+    },
+
+    get statusBarItems()
+    {
+        return [this.toggleTimelineButton.element, this.clearButton.element];
+    },
+
+    get categories()
+    {
+        if (!this._categories) {
+            this._categories = {
+                loading: new WebInspector.TimelineCategory("loading", WebInspector.UIString("Loading"), "rgb(47,102,236)"),
+                scripting: new WebInspector.TimelineCategory("scripting", WebInspector.UIString("Scripting"), "rgb(157,231,119)"),
+                rendering: new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)"),
+                other: new WebInspector.TimelineCategory("other", WebInspector.UIString("Other"), "rgb(186,186,186)")
+            };
+        }
+        return this._categories;
+    },
+
+    populateSidebar: function()
+    {
+        this.itemsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RECORDS"), {}, true);
+        this.itemsTreeElement.expanded = true;
+        this.sidebarTree.appendChild(this.itemsTreeElement);
+    },
+
+    _createStatusbarButtons: function()
+    {
+        this.toggleTimelineButton = new WebInspector.StatusBarButton("", "record-profile-status-bar-item");
+        this.toggleTimelineButton.addEventListener("click", this._toggleTimelineButtonClicked.bind(this), false);
+
+        this.clearButton = new WebInspector.StatusBarButton("", "timeline-clear-status-bar-item");
+        this.clearButton.addEventListener("click", this.reset.bind(this), false);
+    },
+
+    timelineWasStarted: function()
+    {
+        this.toggleTimelineButton.toggled = true;
+    },
+
+    timelineWasStopped: function()
+    {
+        this.toggleTimelineButton.toggled = false;
+    },
+
+    addRecordToTimeline: function(record)
+    {
+        var formattedRecord = this._formatRecord(record);
+        // Glue subsequent records with same category and title together if they are closer than 100ms to each other.
+        if (this._lastRecord && (!record.children || !record.children.length) &&
+                this._lastRecord.category == formattedRecord.category &&
+                this._lastRecord.title == formattedRecord.title &&
+                this._lastRecord.details == formattedRecord.details &&
+                formattedRecord.startTime - this._lastRecord.endTime < 0.1) {
+            this._lastRecord.endTime = formattedRecord.endTime;
+            this._lastRecord.count++;
+            this.refreshItem(this._lastRecord);
+        } else {
+            this.addItem(formattedRecord);
+
+            for (var i = 0; record.children && i < record.children.length; ++i)
+                this.addRecordToTimeline(record.children[i]);
+            this._lastRecord = record.children && record.children.length ? null : formattedRecord;
+        }
+    },
+
+    createItemTreeElement: function(item)
+    {
+        return new WebInspector.TimelineRecordTreeElement(item);
+    },
+
+    createItemGraph: function(item)
+    {
+        return new WebInspector.TimelineGraph(item);
+    },
+
+    _toggleTimelineButtonClicked: function()
+    {
+        if (InspectorController.timelineProfilerEnabled())
+            InspectorController.stopTimelineProfiler();
+        else
+            InspectorController.startTimelineProfiler();
+    },
+
+    _formatRecord: function(record)
+    {
+        if (!this._recordStyles) {
+            this._recordStyles = {};
+            var recordTypes = WebInspector.TimelineAgent.RecordType;
+            this._recordStyles[recordTypes.DOMDispatch] = { title: WebInspector.UIString("DOM Event"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.Layout] = { title: WebInspector.UIString("Layout"), category: this.categories.rendering };
+            this._recordStyles[recordTypes.RecalculateStyles] = { title: WebInspector.UIString("Recalculate Style"), category: this.categories.rendering };
+            this._recordStyles[recordTypes.Paint] = { title: WebInspector.UIString("Paint"), category: this.categories.rendering };
+            this._recordStyles[recordTypes.ParseHTML] = { title: WebInspector.UIString("Parse"), category: this.categories.loading };
+            this._recordStyles[recordTypes.TimerInstall] = { title: WebInspector.UIString("Install Timer"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.TimerRemove] = { title: WebInspector.UIString("Remove Timer"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.TimerFire] = { title: WebInspector.UIString("Timer Fired"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.XHRReadyStateChange] = { title: WebInspector.UIString("XHR Ready State Change"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.XHRLoad] = { title: WebInspector.UIString("XHR Load"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.EvaluateScriptTag] = { title: WebInspector.UIString("Evaluate Script"), category: this.categories.scripting };
+            this._recordStyles["Other"] = { title: WebInspector.UIString("Other"), icon: 0, category: this.categories.other };
+        }
+
+        var style = this._recordStyles[record.type];
+        if (!style)
+            style = this._recordStyles["Other"];
+
+        var formattedRecord = {};
+        formattedRecord.category = style.category;
+        formattedRecord.title = style.title;
+        formattedRecord.startTime = record.startTime / 1000;
+        formattedRecord.data = record.data;
+        formattedRecord.count = 1;
+        formattedRecord.type = record.type;
+        formattedRecord.details = this._getRecordDetails(record);
+        formattedRecord.endTime = (typeof record.endTime !== "undefined") ? record.endTime / 1000 : formattedRecord.startTime;
+        return formattedRecord;
+    },
+    
+    _getRecordDetails: function(record)
+    {
+        switch (record.type) {
+        case WebInspector.TimelineAgent.RecordType.DOMDispatch:
+            return record.data.type;
+        case WebInspector.TimelineAgent.RecordType.TimerInstall:
+        case WebInspector.TimelineAgent.RecordType.TimerRemove:
+        case WebInspector.TimelineAgent.RecordType.TimerFire:
+            return record.data.timerId;
+        case WebInspector.TimelineAgent.RecordType.XHRReadyStateChange:
+        case WebInspector.TimelineAgent.RecordType.XHRLoad:
+        case WebInspector.TimelineAgent.RecordType.EvaluateScriptTag:
+            return record.data.url;
+        default:
+            return "";
+        }
+    },
+
+    reset: function()
+    {
+        WebInspector.AbstractTimelinePanel.prototype.reset.call(this);
+        this._lastRecord = null;
+    }
+}
+
+WebInspector.TimelinePanel.prototype.__proto__ = WebInspector.AbstractTimelinePanel.prototype;
+
+
+WebInspector.TimelineCategory = function(name, title, color)
+{
+    WebInspector.AbstractTimelineCategory.call(this, name, title, color);
+}
+
+WebInspector.TimelineCategory.prototype = {
+}
+
+WebInspector.TimelineCategory.prototype.__proto__ = WebInspector.AbstractTimelineCategory.prototype;
+
+
+WebInspector.TimelineRecordTreeElement = function(record)
+{
+    this._record = record;
+
+    // Pass an empty title, the title gets made later in onattach.
+    TreeElement.call(this, "", null, false);
+}
+
+WebInspector.TimelineRecordTreeElement.prototype = {
+    onattach: function()
+    {
+        this.listItemElement.removeChildren();
+        this.listItemElement.addStyleClass("timeline-tree-item");
+        this.listItemElement.addStyleClass("timeline-category-" + this._record.category.name);
+
+        var iconElement = document.createElement("span");
+        iconElement.className = "timeline-tree-icon";
+        this.listItemElement.appendChild(iconElement);
+
+        this.typeElement = document.createElement("span");
+        this.typeElement.className = "type";
+        this.typeElement.textContent = this._record.title;
+        this.listItemElement.appendChild(this.typeElement);
+
+        if (this._record.details) {
+            var separatorElement = document.createElement("span");
+            separatorElement.className = "separator";
+            separatorElement.textContent = " ";
+
+            var dataElement = document.createElement("span");
+            dataElement.className = "data";
+            dataElement.textContent = "(" + this._record.details + ")";
+            dataElement.addStyleClass("dimmed");
+            this.listItemElement.appendChild(separatorElement);
+            this.listItemElement.appendChild(dataElement);
+        }
+    },
+
+    refresh: function()
+    {
+        if (this._record.count > 1)
+            this.typeElement.textContent = this._record.title + " x " + this._record.count;
+    }
+}
+
+WebInspector.TimelineRecordTreeElement.prototype.__proto__ = TreeElement.prototype;
+
+
+WebInspector.TimelineCalculator = function()
+{
+    WebInspector.AbstractTimelineCalculator.call(this);
+}
+
+WebInspector.TimelineCalculator.prototype = {
+    computeBarGraphPercentages: function(record)
+    {
+        var start = ((record.startTime - this.minimumBoundary) / this.boundarySpan) * 100;
+        var end = ((record.endTime - this.minimumBoundary) / this.boundarySpan) * 100;
+        return {start: start, end: end};
+    },
+
+    computePercentageFromEventTime: function(eventTime)
+    {
+        return ((eventTime - this.minimumBoundary) / this.boundarySpan) * 100;
+    },
+
+    computeBarGraphLabels: function(record)
+    {
+        return {tooltip: record.title};
+    },
+
+    updateBoundaries: function(record)
+    {
+        var didChange = false;
+
+        var lowerBound = record.startTime;
+
+        if (typeof this.minimumBoundary === "undefined" || lowerBound < this.minimumBoundary) {
+            this.minimumBoundary = lowerBound;
+            didChange = true;
+        }
+
+        var upperBound = record.endTime;
+        if (typeof this.maximumBoundary === "undefined" || upperBound > this.maximumBoundary) {
+            this.maximumBoundary = upperBound;
+            didChange = true;
+        }
+
+        return didChange;
+    },
+
+    formatValue: function(value)
+    {
+        return Number.secondsToString(value, WebInspector.UIString.bind(WebInspector));
+    },
+
+}
+
+WebInspector.TimelineCalculator.prototype.__proto__ = WebInspector.AbstractTimelineCalculator.prototype;
+
+
+WebInspector.TimelineGraph = function(record)
+{
+    this.record = record;
+
+    this._graphElement = document.createElement("div");
+    this._graphElement.className = "timeline-graph-side";
+
+    this._barAreaElement = document.createElement("div");
+    this._barAreaElement.className = "timeline-graph-bar-area hidden";
+    this._graphElement.appendChild(this._barAreaElement);
+
+    this._barElement = document.createElement("div");
+    this._barElement.className = "timeline-graph-bar";
+    this._barAreaElement.appendChild(this._barElement);
+
+    this._graphElement.addStyleClass("timeline-category-" + record.category.name);
+}
+
+WebInspector.TimelineGraph.prototype = {
+    get graphElement()
+    {
+        return this._graphElement;
+    },
+
+    refreshLabelPositions: function()
+    {
+    },
+
+    refresh: function(calculator)
+    {
+        var percentages = calculator.computeBarGraphPercentages(this.record);
+        var labels = calculator.computeBarGraphLabels(this.record);
+
+        this._percentages = percentages;
+
+        this._barAreaElement.removeStyleClass("hidden");
+
+        if (!this._graphElement.hasStyleClass("timeline-category-" + this.record.category.name)) {
+            this._graphElement.removeMatchingStyleClasses("timeline-category-\\w+");
+            this._graphElement.addStyleClass("timeline-category-" + this.record.category.name);
+        }
+
+        this._barElement.style.setProperty("left", percentages.start + "%");
+        this._barElement.style.setProperty("right", (100 - percentages.end) + "%");
+
+        var tooltip = (labels.tooltip || "");
+        this._barElement.title = tooltip;
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TopDownProfileDataGridTree.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
index b9d8b94b87..1b07883c03 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
@@ -33,7 +33,7 @@ WebInspector.TopDownProfileDataGridNode = function(/*ProfileView*/ profileView,
 }
 
 WebInspector.TopDownProfileDataGridNode.prototype = {
-    _populate: function(event)
+    _sharedPopulate: function()
     {
         var children = this._remainingChildren;
         var childrenLength = children.length;
@@ -41,9 +41,6 @@ WebInspector.TopDownProfileDataGridNode.prototype = {
         for (var i = 0; i < childrenLength; ++i)
             this.appendChild(new WebInspector.TopDownProfileDataGridNode(this.profileView, children[i], this.tree));
 
-        if (this.removeEventListener)
-            this.removeEventListener("populate", this._populate, this);
-
         this._remainingChildren = null;
     },
 
@@ -105,7 +102,9 @@ WebInspector.TopDownProfileDataGridTree.prototype = {
             this.sort(this.lastComparator, true);
     },
 
-    _merge: WebInspector.TopDownProfileDataGridNode.prototype._merge
+    _merge: WebInspector.TopDownProfileDataGridNode.prototype._merge,
+
+    _sharedPopulate: WebInspector.TopDownProfileDataGridNode.prototype._sharedPopulate
 }
 
 WebInspector.TopDownProfileDataGridTree.prototype.__proto__ = WebInspector.ProfileDataGridTree.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
index 32f15ce5d2..a1d671ef2f 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
@@ -1,6 +1,7 @@
 <!DOCTYPE RCC><RCC version="1.0">
 <qresource prefix="/webkit/inspector">
     <file>inspector.html</file>
+    <file>AbstractTimelinePanel.js</file>
     <file>BottomUpProfileDataGridTree.js</file>
     <file>Breakpoint.js</file>
     <file>BreakpointsSidebarPane.js</file>
@@ -60,6 +61,7 @@
     <file>TestController.js</file>
     <file>TextPrompt.js</file>
     <file>TimelineAgent.js</file>
+    <file>TimelinePanel.js</file>
     <file>TopDownProfileDataGridTree.js</file>
     <file>treeoutline.js</file>
     <file>utilities.js</file>
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
index fc08bc28cf..78ab23ddd0 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
@@ -203,6 +203,10 @@ body.attached #search-results-matches {
     background-image: url(Images/scriptsIcon.png);
 }
 
+.toolbar-item.timeline .toolbar-icon {
+    background-image: url(Images/timelineIcon.png);
+}
+
 .toolbar-item.storage .toolbar-icon {
     background-image: url(Images/storageIcon.png);
 }
@@ -548,7 +552,7 @@ body.drawer-visible #drawer {
     margin-right: 4px;
     text-align: left;
     font-size: 11px;
-    font-family: Helvetia, Arial, sans-serif;
+    font-family: Helvetica, Arial, sans-serif;
     font-weight: bold;
     text-shadow: none;
     color: white;
@@ -1159,6 +1163,7 @@ body.drawer-visible #drawer {
 .add-attribute {
     margin-left: 1px;
     margin-right: 1px;
+    white-space: nowrap;
 }
 
 .placard {
@@ -2212,12 +2217,8 @@ body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-des
     margin: 0 0 5px 20px;
 }
 
-.panel-enabler-view button {
-    font-size: 13px;
-    margin: 6px 0 0 0;
-    padding: 3px 20px;
+.panel-enabler-view button, .pane button {
     color: rgb(6, 6, 6);
-    height: 24px;
     background-color: transparent;
     border: 1px solid rgb(165, 165, 165);
     background-color: rgb(237, 237, 237);
@@ -2226,12 +2227,24 @@ body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-des
     -webkit-appearance: none;
 }
 
-.panel-enabler-view button:active {
+.panel-enabler-view button {
+    font-size: 13px;
+    margin: 6px 0 0 0;
+    padding: 3px 20px;
+    height: 24px;
+}
+
+.pane button {
+    margin: 6px 0 6px 3px;
+    padding: 2px 9px;
+}
+
+.panel-enabler-view button:active, .pane button:active {
     background-color: rgb(215, 215, 215);
     background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(194, 194, 194)), to(rgb(239, 239, 239)));
 }
 
-body.inactive .panel-enabler-view button, .panel-enabler-view button:disabled {
+body.inactive .panel-enabler-view button, .panel-enabler-view button:disabled, body.inactive .pane button, .pane button:disabled {
     color: rgb(130, 130, 130);
     border-color: rgb(212, 212, 212);
     background-color: rgb(239, 239, 239);
@@ -2401,67 +2414,65 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
 }
 
 #resources-filter {
-    height: 24px;
-    padding: 2px 10px 0;
-    background: -webkit-gradient(linear, left top, left bottom, from(rgb(233, 233, 233)), to(rgb(207, 207, 207)));
-    border-bottom: 1px solid rgb(177, 177, 177);
-    overflow: hidden;
+    background: -webkit-gradient(linear, left top, left bottom, from(rgb(236, 236, 236)), to(rgb(217, 217, 217)));
+    border-bottom: 1px solid rgb(64%, 64%, 64%);
 }
 
 #console-filter {
-    height: 24px;
+    margin-top: 1px;
+}
+
+.scope-bar {
+    height: 23px;
     padding: 2px 10px 0;
     overflow: hidden;
 }
 
-#resources-filter li, #console-filter li {
+.scope-bar li {
     display: inline-block;
-    margin: 1px 1px 0 0;
-    padding: 0 6px 3px;
-    font-size: 12px;
+    margin: 1px 2px 0 0;
+    padding: 1px 7px 3px;
+    font-size: 11px;
     line-height: 12px;
     font-weight: bold;
-    color: rgb(40, 40, 40);
-    border: 1px solid transparent;
-    border-bottom: 0;
+    color: rgb(46, 46, 46);
     background: transparent;
+    text-shadow: rgba(255, 255, 255, 0.5) 0 1px 0;
     -webkit-border-radius: 8px;
-    text-shadow: rgba(255, 255, 255, 0.5) 1px 1px 0;
+    vertical-align: middle;
 }
 
-#console-filter div.divider {
-    margin-left: 5px;
-    margin-right: 5px;
-    /* Only want a border-left here because border on both sides
-    made the divider too thick */
-    border-left: 1px solid gray;
-    display: inline;
+.scope-bar .divider {
+    margin: 1px 9px 0 8px;
+    background-color: rgba(0, 0, 0, 0.4);
+    height: 16px;
+    width: 1px;
+    vertical-align: middle;
+    display: inline-block;
 }
 
-#resources-filter li.selected, #resources-filter li:hover, #resources-filter li:active,
-#console-filter li.selected, #console-filter li:hover, #console-filter li:active {
+.scope-bar li.selected, .scope-bar li:hover, .scope-bar li:active {
     color: white;
-    text-shadow: rgb(80, 80, 80) 1px 1px 1px;
-    background: rgba(20, 20, 20, 0.4);
-    border-color: rgba(20, 20, 20, 0.2);
-    -webkit-box-shadow: 0 1px 0px rgba(255, 255, 255, 0.5);
+    text-shadow: rgba(0, 0, 0, 0.4) 0 1px 0;
 }
 
-#resources-filter li:hover,
-#console-filter li:hover {
-    background: rgba(20, 20, 20, 0.4);
-    border-color: transparent;
-    -webkit-box-shadow: none;
+.scope-bar li:hover {
+    background: rgba(0, 0, 0, 0.2);
 }
 
-#resources-filter li:active,
-#console-filter li:active {
-    background: rgba(20, 20, 20, 0.6);
+.scope-bar li.selected {
+    background: rgba(0, 0, 0, 0.3);
+    -webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, 0.5) inset, 0 -1px 1px rgba(255, 255, 255, 0.25) inset, 0 1px 0 rgba(255, 255, 255, 0.5);
+}
+
+.scope-bar li:active {
+    background: rgba(0, 0, 0, 0.5);
+    -webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, 0.5) inset, 0 -1px 1px rgba(255, 255, 255, 0.25) inset, 0 1px 0 rgba(255, 255, 255, 0.5);
 }
 
 #resources-container {
     position: absolute;
-    top: 24px;
+    top: 23px;
     left: 0;
     bottom: 0;
     right: 0;
@@ -2832,7 +2843,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
 
 #resource-views {
     position: absolute;
-    top: 24px;
+    top: 23px;
     right: 0;
     left: 200px;
     bottom: 0;
@@ -2853,7 +2864,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
 }
 
 .resources .sidebar-resizer-vertical {
-    top: 24px;
+    top: 23px;
 }
 
 .sidebar-tree, .sidebar-tree .children {
@@ -3000,7 +3011,7 @@ body.inactive .sidebar-tree-item .disclosure-button:active {
     padding: 1px 4px;
     text-align: center;
     font-size: 11px;
-    font-family: Helvetia, Arial, sans-serif;
+    font-family: Helvetica, Arial, sans-serif;
     font-weight: bold;
     text-shadow: none;
     color: white;
@@ -3253,6 +3264,125 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     background-image: url(Images/searchSmallGray.png);
 }
 
+/* Timeline Style */
+
+#timeline-summary {
+    position: absolute;
+    top: 0;
+    left: 0;
+    width: 0;
+    height: 0;
+}
+
+.timeline-clear-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/clearConsoleButtonGlyph.png);
+}
+
+.timeline-tree-item {
+    height: 18px;
+    padding-left: 10px;
+    padding-top: 2px;
+    white-space: nowrap;
+    text-overflow: ellipsis;
+    overflow: hidden;
+}
+
+.timeline-tree-item .type {
+    padding-left: 14px;
+}
+
+.timeline-tree-item .timeline-tree-icon {
+    background-image: url(Images/timelineDots.png);
+    margin-top: 2px;
+    width: 12px;
+    height: 12px;
+    position: absolute;
+}
+
+.timeline-tree-item:nth-of-type(2n) {
+    background-color: rgba(0, 0, 0, 0.05);
+}
+
+.timeline-tree-item .data.dimmed {
+    color: rgba(0, 0, 0, 0.7);
+}
+
+.timeline-category-loading, .timeline-category-scripting, .timeline-category-rendering {
+    display: none;
+}
+
+.filter-all .timeline-category-loading, .filter-loading .timeline-category-loading,
+.filter-all .timeline-category-scripting, .filter-scripting .timeline-category-scripting,
+.filter-all .timeline-category-rendering, .filter-rendering .timeline-category-rendering {
+    display: list-item;
+}
+
+#timeline-graphs {
+    position: absolute;
+    left: 0;
+    right: 0;
+    max-height: 100%;
+    top: 19px;
+}
+
+.timeline-graph-side {
+    position: relative;
+    height: 18px;
+    padding: 0 5px;
+    white-space: nowrap;
+    margin-top: 0px;
+    border-top: 1px solid transparent;
+    overflow: hidden;
+}
+
+.timeline-graph-bar-area {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    right: 8px;
+    left: 9px;
+}
+
+.timeline-graph-bar {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    margin: auto -5px;
+    border-width: 4px 4px 5px;
+    height: 9px;
+    min-width: 7px;
+    opacity: 0.8;
+    -webkit-border-image: url(Images/timelineBarGray.png) 4 4 5 4;
+}
+
+.timeline-graph-side:nth-of-type(2n) {
+    background-color: rgba(0, 0, 0, 0.05);
+}
+
+.timeline-category-loading .timeline-graph-bar {
+    -webkit-border-image: url(Images/timelineBarBlue.png) 4 4 5 4;
+}
+
+.timeline-category-scripting .timeline-graph-bar {
+    -webkit-border-image: url(Images/timelineBarOrange.png) 4 4 5 4;
+}
+
+.timeline-category-rendering .timeline-graph-bar {
+    -webkit-border-image: url(Images/timelineBarPurple.png) 4 4 5 4;
+}
+
+.timeline-category-loading .timeline-tree-icon {
+    background-position-y: 0px;
+}
+
+.timeline-category-scripting .timeline-tree-icon {
+    background-position-y: 48px;
+}
+
+.timeline-category-rendering .timeline-tree-icon {
+    background-position-y: 72px;
+}
+
 /* Profiler Style */
 
 #profile-views {
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
index 4fa69e0915..04ab07a2f6 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
@@ -34,6 +34,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="utilities.js"></script>
     <script type="text/javascript" src="treeoutline.js"></script>
     <script type="text/javascript" src="inspector.js"></script>
+    <script type="text/javascript" src="InspectorControllerStub.js"></script>
     <script type="text/javascript" src="Object.js"></script>
     <script type="text/javascript" src="KeyboardShortcut.js"></script>
     <script type="text/javascript" src="TextPrompt.js"></script>
@@ -44,6 +45,8 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="Drawer.js"></script>
     <script type="text/javascript" src="ChangesView.js"></script>
     <script type="text/javascript" src="ConsoleView.js"></script>
+    <script type="text/javascript" src="Panel.js"></script>
+    <script type="text/javascript" src="AbstractTimelinePanel.js"></script>
     <script type="text/javascript" src="Resource.js"></script>
     <script type="text/javascript" src="ResourceCategory.js"></script>
     <script type="text/javascript" src="Database.js"></script>
@@ -69,7 +72,6 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="EventListenersSidebarPane.js"></script>
     <script type="text/javascript" src="Color.js"></script>
     <script type="text/javascript" src="StylesSidebarPane.js"></script>
-    <script type="text/javascript" src="Panel.js"></script>
     <script type="text/javascript" src="PanelEnablerView.js"></script>
     <script type="text/javascript" src="StatusBarButton.js"></script>
     <script type="text/javascript" src="SummaryBar.js"></script>
@@ -94,6 +96,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="InjectedScript.js"></script>
     <script type="text/javascript" src="InjectedScriptAccess.js"></script>
     <script type="text/javascript" src="TimelineAgent.js"></script>
+    <script type="text/javascript" src="TimelinePanel.js"></script>
     <script type="text/javascript" src="TestController.js"></script>
 </head>
 <body class="detached">
@@ -110,7 +113,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     </div>
     <div id="drawer">
         <div id="console-view"><div id="console-messages"><div id="console-prompt" spellcheck="false"><br></div></div></div>
-        <div id="drawer-status-bar" class="status-bar"><div id="other-drawer-status-bar-items"><button id="clear-console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><div id="console-filter" class="status-bar-item"></div></div></div>
+        <div id="drawer-status-bar" class="status-bar"><div id="other-drawer-status-bar-items"><button id="clear-console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><div id="console-filter" class="scope-bar status-bar-item"></div></div></div>
     </div>
 </body>
 </html>
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
index 17b02a1eeb..c24d589058 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
@@ -143,8 +143,11 @@ var WebInspector = {
             this.panels.profiles = new WebInspector.ProfilesPanel();
             this.panels.profiles.registerProfileType(new WebInspector.CPUProfileType());
         }
+        if (hiddenPanels.indexOf("timeline") === -1 && hiddenPanels.indexOf("timeline") === -1)
+            this.panels.timeline = new WebInspector.TimelinePanel();
+
         if (hiddenPanels.indexOf("storage") === -1 && hiddenPanels.indexOf("databases") === -1)
-            this.panels.storage = new WebInspector.StoragePanel();      
+            this.panels.storage = new WebInspector.StoragePanel();
     },
 
     _loadPreferences: function()
@@ -369,6 +372,7 @@ WebInspector.loaded = function()
     document.body.addStyleClass("platform-" + platform);
 
     this._loadPreferences();
+    this.pendingDispatches = 0;
 
     this.drawer = new WebInspector.Drawer();
     this.console = new WebInspector.ConsoleView(this.drawer);
@@ -379,13 +383,13 @@ WebInspector.loaded = function()
     this.domAgent = new WebInspector.DOMAgent();
 
     this.resourceCategories = {
-        documents: new WebInspector.ResourceCategory(WebInspector.UIString("Documents"), "documents"),
-        stylesheets: new WebInspector.ResourceCategory(WebInspector.UIString("Stylesheets"), "stylesheets"),
-        images: new WebInspector.ResourceCategory(WebInspector.UIString("Images"), "images"),
-        scripts: new WebInspector.ResourceCategory(WebInspector.UIString("Scripts"), "scripts"),
-        xhr: new WebInspector.ResourceCategory(WebInspector.UIString("XHR"), "xhr"),
-        fonts: new WebInspector.ResourceCategory(WebInspector.UIString("Fonts"), "fonts"),
-        other: new WebInspector.ResourceCategory(WebInspector.UIString("Other"), "other")
+        documents: new WebInspector.ResourceCategory("documents", WebInspector.UIString("Documents"), "rgb(47,102,236)"),
+        stylesheets: new WebInspector.ResourceCategory("stylesheets", WebInspector.UIString("Stylesheets"), "rgb(157,231,119)"),
+        images: new WebInspector.ResourceCategory("images", WebInspector.UIString("Images"), "rgb(164,60,255)"),
+        scripts: new WebInspector.ResourceCategory("scripts", WebInspector.UIString("Scripts"), "rgb(255,121,0)"),
+        xhr: new WebInspector.ResourceCategory("xhr", WebInspector.UIString("XHR"), "rgb(231,231,10)"),
+        fonts: new WebInspector.ResourceCategory("fonts", WebInspector.UIString("Fonts"), "rgb(255,82,62)"),
+        other: new WebInspector.ResourceCategory("other", WebInspector.UIString("Other"), "rgb(186,186,186)")
     };
 
     this.panels = {};
@@ -456,8 +460,6 @@ WebInspector.loaded = function()
     // this._updateErrorAndWarningCounts();
 
     var searchField = document.getElementById("search");
-    searchField.addEventListener("keydown", this.searchKeyDown.bind(this), false);
-    searchField.addEventListener("keyup", this.searchKeyUp.bind(this), false);
     searchField.addEventListener("search", this.performSearch.bind(this), false); // when the search is emptied
 
     toolbarElement.addEventListener("mousedown", this.toolbarDragStart, true);
@@ -494,7 +496,9 @@ WebInspector.dispatch = function() {
     function delayDispatch()
     {
         WebInspector[methodName].apply(WebInspector, parameters);
+        WebInspector.pendingDispatches--;
     }
+    WebInspector.pendingDispatches++;
     setTimeout(delayDispatch, 0);
 }
 
@@ -511,13 +515,19 @@ WebInspector.windowResize = function(event)
 
 WebInspector.windowFocused = function(event)
 {
-    if (event.target.nodeType === Node.DOCUMENT_NODE)
+    // Fires after blur, so when focusing on either the main inspector
+    // or an <iframe> within the inspector we should always remove the
+    // "inactive" class.
+    if (event.target.document.nodeType === Node.DOCUMENT_NODE)
         document.body.removeStyleClass("inactive");
 }
 
-WebInspector.windowBlured = function(event)
+WebInspector.windowBlurred = function(event)
 {
-    if (event.target.nodeType === Node.DOCUMENT_NODE)
+    // Leaving the main inspector or an <iframe> within the inspector.
+    // We can add "inactive" now, and if we are moving the focus to another
+    // part of the inspector then windowFocused will correct this.
+    if (event.target.document.nodeType === Node.DOCUMENT_NODE)
         document.body.addStyleClass("inactive");
 }
 
@@ -626,7 +636,9 @@ WebInspector.documentKeyDown = function(event)
 
                 break;
 
-            case "U+005B": // [ key
+            // Windows and Mac have two different definitions of [, so accept both.
+            case "U+005B":
+            case "U+00DB": // [ key
                 if (isMac)
                     var isRotateLeft = event.metaKey && !event.shiftKey && !event.ctrlKey && !event.altKey;
                 else
@@ -641,7 +653,9 @@ WebInspector.documentKeyDown = function(event)
 
                 break;
 
-            case "U+005D": // ] key
+            // Windows and Mac have two different definitions of ], so accept both.
+            case "U+005D":
+            case "U+00DD":  // ] key
                 if (isMac)
                     var isRotateRight = event.metaKey && !event.shiftKey && !event.ctrlKey && !event.altKey;
                 else
@@ -1165,7 +1179,7 @@ WebInspector.didCommitLoad = function()
     WebInspector.setDocument(null);
 }
 
-WebInspector.addMessageToConsole = function(payload)
+WebInspector.addConsoleMessage = function(payload)
 {
     var consoleMessage = new WebInspector.ConsoleMessage(
         payload.source,
@@ -1179,6 +1193,11 @@ WebInspector.addMessageToConsole = function(payload)
     this.console.addMessage(consoleMessage);
 }
 
+WebInspector.updateConsoleMessageRepeatCount = function(count)
+{
+    this.console.updateMessageRepeatCount(count);
+}
+
 WebInspector.log = function(message)
 {
     // remember 'this' for setInterval() callback
@@ -1423,26 +1442,15 @@ WebInspector.linkifyURL = function(url, linkText, classes, isExternal)
 
 WebInspector.addMainEventListeners = function(doc)
 {
-    doc.defaultView.addEventListener("focus", this.windowFocused.bind(this), true);
-    doc.defaultView.addEventListener("blur", this.windowBlured.bind(this), true);
+    doc.defaultView.addEventListener("focus", this.windowFocused.bind(this), false);
+    doc.defaultView.addEventListener("blur", this.windowBlurred.bind(this), false);
     doc.addEventListener("click", this.documentClick.bind(this), true);
 }
 
 WebInspector.searchKeyDown = function(event)
 {
-    if (event.keyIdentifier !== "Enter")
-        return;
-
-    // Call preventDefault since this was the Enter key. This prevents a "search" event
-    // from firing for key down. We handle the Enter key on key up in searchKeyUp. This
-    // stops performSearch from being called twice in a row.
-    event.preventDefault();
-}
-
-WebInspector.searchKeyUp = function(event)
-{
-    if (event.keyIdentifier !== "Enter")
-        return;
+    if (!isEnterKey(event))
+        return false;
 
     // Select all of the text so the user can easily type an entirely new query.
     event.target.select();
@@ -1451,14 +1459,33 @@ WebInspector.searchKeyUp = function(event)
     // performance is poor because of searching on every key. The search field has
     // the incremental attribute set, so we still get incremental searches.
     this.performSearch(event);
+
+    // Call preventDefault since this was the Enter key. This prevents a "search" event
+    // from firing for key down. This stops performSearch from being called twice in a row.
+    event.preventDefault();
 }
 
 WebInspector.performSearch = function(event)
 {
     var query = event.target.value;
     var forceSearch = event.keyIdentifier === "Enter";
+    var isShortSearch = (query.length < 3);
+
+    // Clear a leftover short search flag due to a non-conflicting forced search.
+    if (isShortSearch && this.shortSearchWasForcedByKeyEvent && this.currentQuery !== query)
+        delete this.shortSearchWasForcedByKeyEvent;
+
+    // Indicate this was a forced search on a short query.
+    if (isShortSearch && forceSearch)
+        this.shortSearchWasForcedByKeyEvent = true;
+
+    if (!query || !query.length || (!forceSearch && isShortSearch)) {
+        // Prevent clobbering a short search forced by the user.
+        if (this.shortSearchWasForcedByKeyEvent) {
+            delete this.shortSearchWasForcedByKeyEvent;
+            return;
+        }
 
-    if (!query || !query.length || (!forceSearch && query.length < 3)) {
         delete this.currentQuery;
 
         for (var panelName in this.panels) {
@@ -1531,7 +1558,8 @@ WebInspector.UIString = function(string)
         string = window.localizedStrings[string];
     else {
         if (!(string in this.missingLocalizedStrings)) {
-            console.error("Localized string \"" + string + "\" not found.");
+            if (!WebInspector.InspectorControllerStub)
+                console.error("Localized string \"" + string + "\" not found.");
             this.missingLocalizedStrings[string] = true;
         }
 
@@ -1614,7 +1642,7 @@ WebInspector.startEditing = function(element, committedCallback, cancelledCallba
         if (event.handled)
             return;
 
-        if (event.keyIdentifier === "Enter") {
+        if (isEnterKey(event)) {
             editingCommitted.call(element);
             event.preventDefault();
         } else if (event.keyCode === 27) { // Escape key
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js b/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
index 6df23de0f3..e9d185f9a7 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
@@ -817,3 +817,8 @@ String.format = function(format, substitutions, formatters, initialValue, append
 
     return { formattedResult: result, unusedSubstitutions: unusedSubstitutions };
 }
+
+function isEnterKey(event) {
+    // Check if in IME.
+    return event.keyCode !== 229 && event.keyIdentifier === "Enter";
+}
diff --git a/src/3rdparty/webkit/WebCore/loader/Cache.cpp b/src/3rdparty/webkit/WebCore/loader/Cache.cpp
index 391790f416..46fb068c89 100644
--- a/src/3rdparty/webkit/WebCore/loader/Cache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/Cache.cpp
@@ -275,6 +275,12 @@ void Cache::pruneLiveResources()
     
     // Destroy any decoded data in live objects that we can.
     // Start from the tail, since this is the least recently accessed of the objects.
+
+    // The list might not be sorted by the m_lastDecodedAccessTime. The impact
+    // of this weaker invariant is minor as the below if statement to check the
+    // elapsedTime will evaluate to false as the currentTime will be a lot
+    // greater than the current->m_lastDecodedAccessTime.
+    // For more details see: https://bugs.webkit.org/show_bug.cgi?id=30209
     CachedResource* current = m_liveDecodedResources.m_tail;
     while (current) {
         CachedResource* prev = current->m_prevInLiveResourcesList;
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp b/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
index 43de63372c..f2f52b0acd 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
@@ -242,6 +242,12 @@ void CachedResource::setDecodedSize(unsigned size)
         cache()->insertInLRUList(this);
         
         // Insert into or remove from the live decoded list if necessary.
+        // When inserting into the LiveDecodedResourcesList it is possible
+        // that the m_lastDecodedAccessTime is still zero or smaller than
+        // the m_lastDecodedAccessTime of the current list head. This is a
+        // violation of the invariant that the list is to be kept sorted
+        // by access time. The weakening of the invariant does not pose
+        // a problem. For more details please see: https://bugs.webkit.org/show_bug.cgi?id=30209
         if (m_decodedSize && !m_inLiveDecodedResourcesList && hasClients())
             cache()->insertInLiveDecodedResourcesList(this);
         else if (!m_decodedSize && m_inLiveDecodedResourcesList)
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
index df463979e4..9b154484dd 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
@@ -2,6 +2,8 @@
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008 Alp Toker <alp@atoker.com>
+ * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -75,6 +77,7 @@
 #include "PageTransitionEvent.h"
 #include "PlaceholderDocument.h"
 #include "PluginData.h"
+#include "PluginDatabase.h"
 #include "PluginDocument.h"
 #include "ProgressTracker.h"
 #include "RenderPart.h"
@@ -113,10 +116,6 @@
 #include "SVGViewSpec.h"
 #endif
 
-#if PLATFORM(MAC) || PLATFORM(WIN)
-#define PAGE_CACHE_ACCEPTS_UNLOAD_HANDLERS
-#endif
-
 namespace WebCore {
 
 #if ENABLE(SVG)
@@ -337,10 +336,9 @@ void FrameLoader::urlSelected(const ResourceRequest& request, const String& pass
 
     FrameLoadRequest frameRequest(request, target);
 
-    if (referrerPolicy == NoReferrer) {
+    if (referrerPolicy == NoReferrer)
         m_suppressOpenerInNewFrame = true;
-        setOpener(0);
-    } else if (frameRequest.resourceRequest().httpReferrer().isEmpty())
+    else if (frameRequest.resourceRequest().httpReferrer().isEmpty())
         frameRequest.resourceRequest().setHTTPReferrer(m_outgoingReferrer);
     addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
 
@@ -757,6 +755,8 @@ void FrameLoader::receivedFirstData()
     String url;
     if (!m_documentLoader)
         return;
+    if (m_frame->inViewSourceMode())
+        return;
     if (!parseHTTPRefresh(m_documentLoader->response().httpHeaderField("Refresh"), false, delay, url))
         return;
 
@@ -1288,6 +1288,30 @@ bool FrameLoader::shouldUsePlugin(const KURL& url, const String& mimeType, bool
     return objectType == ObjectContentNone || objectType == ObjectContentNetscapePlugin || objectType == ObjectContentOtherPlugin;
 }
 
+ObjectContentType FrameLoader::defaultObjectContentType(const KURL& url, const String& mimeTypeIn)
+{
+    String mimeType = mimeTypeIn;
+    // We don't use MIMETypeRegistry::getMIMETypeForPath() because it returns "application/octet-stream" upon failure
+    if (mimeType.isEmpty())
+        mimeType = MIMETypeRegistry::getMIMETypeForExtension(url.path().substring(url.path().reverseFind('.') + 1));
+
+    if (mimeType.isEmpty())
+        return ObjectContentFrame; // Go ahead and hope that we can display the content.
+
+    if (MIMETypeRegistry::isSupportedImageMIMEType(mimeType))
+        return WebCore::ObjectContentImage;
+
+#if !PLATFORM(MAC) && !PLATFORM(CHROMIUM)  // Mac has no PluginDatabase, nor does Chromium 
+    if (PluginDatabase::installedPlugins()->isMIMETypeRegistered(mimeType))
+        return WebCore::ObjectContentNetscapePlugin;
+#endif
+
+    if (MIMETypeRegistry::isSupportedNonImageMIMEType(mimeType))
+        return WebCore::ObjectContentFrame;
+
+    return WebCore::ObjectContentNone;
+}
+
 static HTMLPlugInElement* toPlugInElement(Node* node)
 {
     if (!node)
@@ -1467,9 +1491,7 @@ bool FrameLoader::canCachePageContainingThisFrame()
         // the right NPObjects. See <rdar://problem/5197041> for more information.
         && !m_containsPlugIns
         && !m_URL.protocolIs("https")
-#ifndef PAGE_CACHE_ACCEPTS_UNLOAD_HANDLERS
         && (!m_frame->domWindow() || !m_frame->domWindow()->hasEventListeners(eventNames().unloadEvent))
-#endif
 #if ENABLE(DATABASE)
         && !m_frame->document()->hasOpenDatabases()
 #endif
@@ -1614,10 +1636,8 @@ bool FrameLoader::logCanCacheFrameDecision(int indentLevel)
             { PCLOG("   -Frame contains plugins"); cannotCache = true; }
         if (m_URL.protocolIs("https"))
             { PCLOG("   -Frame is HTTPS"); cannotCache = true; }
-#ifndef PAGE_CACHE_ACCEPTS_UNLOAD_HANDLERS
         if (m_frame->domWindow() && m_frame->domWindow()->hasEventListeners(eventNames().unloadEvent))
             { PCLOG("   -Frame has an unload event listener"); cannotCache = true; }
-#endif
 #if ENABLE(DATABASE)
         if (m_frame->document()->hasOpenDatabases())
             { PCLOG("   -Frame has open database handles"); cannotCache = true; }
@@ -1728,10 +1748,13 @@ bool FrameLoader::isComplete() const
 void FrameLoader::completed()
 {
     RefPtr<Frame> protect(m_frame);
-    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        child->redirectScheduler()->startTimer();
+
+    for (Frame* descendant = m_frame->tree()->traverseNext(m_frame); descendant; descendant = descendant->tree()->traverseNext(m_frame))
+        descendant->redirectScheduler()->startTimer();
+    
     if (Frame* parent = m_frame->tree()->parent())
         parent->loader()->checkCompleted();
+
     if (m_frame->view())
         m_frame->view()->maintainScrollPositionAtAnchor(0);
 }
@@ -3845,7 +3868,8 @@ void FrameLoader::dispatchDocumentElementAvailable()
 
 void FrameLoader::dispatchWindowObjectAvailable()
 {
-    if (!m_frame->script()->isEnabled() || !m_frame->script()->haveWindowShell())
+    // FIXME: should this be isolated-worlds-aware?
+    if (!m_frame->script()->isEnabled() || !m_frame->script()->existingWindowShell(mainThreadNormalWorld()))
         return;
 
     m_client->windowObjectCleared();
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
index bf0eebc8c5..3bf6196b08 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -322,6 +323,10 @@ public:
     // uses the policy machinery (and therefore is called via the PolicyChecker).  Once we
     // introduce a proper callback type for this function, we should make it private again.
     void continueLoadAfterWillSubmitForm();
+    
+    bool suppressOpenerInNewFrame() const { return m_suppressOpenerInNewFrame; }
+
+    static ObjectContentType defaultObjectContentType(const KURL& url, const String& mimeType);
 
 private:
     bool canCachePageContainingThisFrame();
diff --git a/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.cpp b/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.cpp
index f015c12934..c0d78ae5f5 100644
--- a/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.cpp
@@ -255,12 +255,20 @@ void RedirectScheduler::scheduleHistoryNavigation(int steps)
     if (!m_frame->page())
         return;
 
+    // Invalid history navigations (such as history.forward() during a new load) have the side effect of cancelling any scheduled
+    // redirects. We also avoid the possibility of cancelling the current load by avoiding the scheduled redirection altogether.
+    if (!m_frame->page()->canGoBackOrForward(steps)) { 
+        cancel(); 
+        return; 
+    } 
+
     schedule(new ScheduledRedirection(steps));
 }
 
 void RedirectScheduler::timerFired(Timer<RedirectScheduler>*)
 {
-    ASSERT(m_frame->page());
+    if (!m_frame->page())
+        return;
 
     if (m_frame->page()->defersLoading())
         return;
@@ -282,8 +290,7 @@ void RedirectScheduler::timerFired(Timer<RedirectScheduler>*)
             }
             // go(i!=0) from a frame navigates into the history of the frame only,
             // in both IE and NS (but not in Mozilla). We can't easily do that.
-            if (m_frame->page()->canGoBackOrForward(redirection->historySteps))
-                m_frame->page()->goBackOrForward(redirection->historySteps);
+            m_frame->page()->goBackOrForward(redirection->historySteps);
             return;
         case ScheduledRedirection::formSubmission:
             // The submitForm function will find a target frame before using the redirection timer.
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.h b/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.h
index f06ecde81c..b09d7be1e2 100644
--- a/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.h
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.h
@@ -40,13 +40,8 @@ class Frame;
 class ResourceError;
 class ResourceLoader;
 class ResourceResponse;
-//### tempfix, to be removed
-#ifdef __SYMBIAN32__
-struct ResourceRequest;
-#else
-class ResourceRequest;
-#endif
 class ScriptString;
+struct ResourceRequest;
 
 class ResourceLoadNotifier : public Noncopyable {
 public:
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
index 78ca0a592c..4be3684849 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
@@ -36,10 +36,10 @@
 #include "IconRecord.h"
 #include "IntSize.h"
 #include "Logging.h"
+#include "ScriptController.h"
 #include "SQLiteStatement.h"
 #include "SQLiteTransaction.h"
 #include "SuddenTermination.h"
-#include <runtime/InitializeThreading.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/MainThread.h>
 #include <wtf/StdLibExtras.h>
@@ -93,7 +93,7 @@ static IconDatabaseClient* defaultClient()
 IconDatabase* iconDatabase()
 {
     if (!sharedIconDatabase) {
-        JSC::initializeThreading();
+        ScriptController::initializeThreading();
         sharedIconDatabase = new IconDatabase;
     }
     return sharedIconDatabase;
diff --git a/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.cpp b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.cpp
index 94976a2c43..69b0075027 100644
--- a/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.cpp
+++ b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.cpp
@@ -40,6 +40,20 @@
 
 namespace WebCore {
 
+#if USE(V8)
+static bool notificationCenterAvailable = false;
+
+void NotificationCenter::setIsAvailable(bool available)
+{
+    notificationCenterAvailable = available;
+}
+
+bool NotificationCenter::isAvailable()
+{
+    return notificationCenterAvailable;
+}
+#endif
+
 NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationPresenter* presenter) 
     : ActiveDOMObject(context, this)
     , m_scriptExecutionContext(context)
diff --git a/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.h b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.h
index 596ab8bf0c..10844420cc 100644
--- a/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.h
+++ b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.h
@@ -47,8 +47,12 @@ namespace WebCore {
 
     class NotificationCenter : public RefCounted<NotificationCenter>, public ActiveDOMObject { 
     public:
+#if USE(V8)
+        static void setIsAvailable(bool);
+        static bool isAvailable();
+#endif
         static PassRefPtr<NotificationCenter> create(ScriptExecutionContext* context, NotificationPresenter* presenter) { return adoptRef(new NotificationCenter(context, presenter)); }
-        
+
         Notification* createHTMLNotification(const String& URI, ExceptionCode& ec)
         {
             return Notification::create(KURL(ParsedURLString, URI), context(), ec, presenter());
diff --git a/src/3rdparty/webkit/WebCore/page/Console.cpp b/src/3rdparty/webkit/WebCore/page/Console.cpp
index 79613d3b8b..7d0f697aef 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Console.cpp
@@ -46,6 +46,7 @@
 
 #include "ScriptCallStack.h"
 #include <stdio.h>
+#include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
@@ -247,8 +248,7 @@ void Console::assertCondition(bool condition, ScriptCallStack* callStack)
     if (condition)
         return;
 
-    // FIXME: <https://bugs.webkit.org/show_bug.cgi?id=19135> It would be nice to prefix assertion failures with a message like "Assertion failed: ".
-    addMessage(LogMessageType, ErrorMessageLevel, callStack, true);
+    addMessage(AssertMessageType, ErrorMessageLevel, callStack, true);
 }
 
 void Console::count(ScriptCallStack* callStack)
diff --git a/src/3rdparty/webkit/WebCore/page/Console.h b/src/3rdparty/webkit/WebCore/page/Console.h
index 08d43e30a8..1b93a4aa3b 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.h
+++ b/src/3rdparty/webkit/WebCore/page/Console.h
@@ -64,7 +64,8 @@ namespace WebCore {
         ObjectMessageType,
         TraceMessageType,
         StartGroupMessageType,
-        EndGroupMessageType
+        EndGroupMessageType,
+        AssertMessageType
     };
 
     enum MessageLevel {
diff --git a/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp b/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp
index dd1e8424c4..83bcb02913 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp
@@ -27,6 +27,7 @@
 #include "config.h"
 #include "DOMTimer.h"
 
+#include "InspectorTimelineAgent.h"
 #include "ScheduledAction.h"
 #include "ScriptExecutionContext.h"
 #include <wtf/HashSet.h>
@@ -87,6 +88,12 @@ int DOMTimer::install(ScriptExecutionContext* context, ScheduledAction* action,
     // The timer is deleted when context is deleted (DOMTimer::contextDestroyed) or explicitly via DOMTimer::removeById(),
     // or if it is a one-time timer and it has fired (DOMTimer::fired).
     DOMTimer* timer = new DOMTimer(context, action, timeout, singleShot);
+
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
+        timelineAgent->didInstallTimer(timer->m_timeoutId, timeout, singleShot);
+#endif    
+
     return timer->m_timeoutId;
 }
 
@@ -97,6 +104,12 @@ void DOMTimer::removeById(ScriptExecutionContext* context, int timeoutId)
     // respectively
     if (timeoutId <= 0)
         return;
+
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
+        timelineAgent->didRemoveTimer(timeoutId);
+#endif
+
     delete context->findTimeout(timeoutId);
 }
 
@@ -105,6 +118,12 @@ void DOMTimer::fired()
     ScriptExecutionContext* context = scriptExecutionContext();
     timerNestingLevel = m_nestingLevel;
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context);
+    if (timelineAgent)
+        timelineAgent->willFireTimer(m_timeoutId);
+#endif
+
     // Simple case for non-one-shot timers.
     if (isActive()) {
         if (repeatInterval() && repeatInterval() < s_minTimerInterval) {
@@ -115,6 +134,10 @@ void DOMTimer::fired()
 
         // No access to member variables after this point, it can delete the timer.
         m_action->execute(context);
+#if ENABLE(INSPECTOR)
+        if (timelineAgent)
+            timelineAgent->didFireTimer();
+#endif
         return;
     }
 
@@ -125,6 +148,10 @@ void DOMTimer::fired()
     delete this;
 
     action->execute(context);
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didFireTimer();
+#endif
     delete action;
     timerNestingLevel = 0;
 }
diff --git a/src/3rdparty/webkit/WebCore/page/DOMTimer.h b/src/3rdparty/webkit/WebCore/page/DOMTimer.h
index 3c652583c5..460430f4d2 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMTimer.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMTimer.h
@@ -33,6 +33,7 @@
 
 namespace WebCore {
 
+    class InspectorTimelineAgent;
     class ScheduledAction;
 
     class DOMTimer : public TimerBase, public ActiveDOMObject {
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
index 45870019a1..5addb8388f 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
@@ -160,15 +160,15 @@ module window {
         readonly attribute DOMApplicationCache applicationCache;
 #endif    
 #if defined(ENABLE_DATABASE) && ENABLE_DATABASE
-        Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize)
+        [EnabledAtRuntime] Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize)
             raises(DOMException);
 #endif
 #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
-        readonly attribute Storage sessionStorage;
-        readonly attribute Storage localStorage;
+        readonly attribute [EnabledAtRuntime] Storage sessionStorage;
+        readonly attribute [EnabledAtRuntime] Storage localStorage;
 #endif
 #if defined(ENABLE_NOTIFICATIONS) && ENABLE_NOTIFICATIONS
-        readonly attribute NotificationCenter webkitNotifications;
+        readonly attribute [EnabledAtRuntime] NotificationCenter webkitNotifications;
 #endif
 
 #if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
@@ -426,6 +426,7 @@ module window {
         attribute HTMLUListElementConstructor HTMLUListElement;
 
         attribute HTMLCollectionConstructor HTMLCollection;
+        attribute HTMLAllCollectionConstructor HTMLAllCollection;
 
         attribute [CustomGetter] HTMLImageElementConstructor Image; // Usable with new operator
         attribute [CustomGetter] HTMLOptionElementConstructor Option; // Usable with new operator
diff --git a/src/3rdparty/webkit/WebCore/page/Geolocation.cpp b/src/3rdparty/webkit/WebCore/page/Geolocation.cpp
index 86127d7f48..de4a9a1ec3 100644
--- a/src/3rdparty/webkit/WebCore/page/Geolocation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Geolocation.cpp
@@ -31,10 +31,11 @@
 #include "Document.h"
 #include "Frame.h"
 #include "Page.h"
-#include "PositionError.h"
 
 namespace WebCore {
 
+static const char permissionDeniedErrorMessage[] = "User denied Geolocation";
+
 Geolocation::GeoNotifier::GeoNotifier(Geolocation* geolocation, PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
     : m_geolocation(geolocation)
     , m_successCallback(successCallback)
@@ -42,12 +43,21 @@ Geolocation::GeoNotifier::GeoNotifier(Geolocation* geolocation, PassRefPtr<Posit
     , m_options(options)
     , m_timer(this, &Geolocation::GeoNotifier::timerFired)
 {
+    ASSERT(m_geolocation);
     ASSERT(m_successCallback);
     // If no options were supplied from JS, we should have created a default set
     // of options in JSGeolocationCustom.cpp.
     ASSERT(m_options);
 }
 
+void Geolocation::GeoNotifier::setFatalError(PassRefPtr<PositionError> error)
+{
+    // This method is called at most once on a given GeoNotifier object.
+    ASSERT(!m_fatalError);
+    m_fatalError = error;
+    m_timer.startOneShot(0);
+}
+
 bool Geolocation::GeoNotifier::hasZeroTimeout() const
 {
     return m_options->hasTimeout() && m_options->timeout() == 0;
@@ -63,6 +73,14 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
 {
     m_timer.stop();
 
+    if (m_fatalError) {
+        if (m_errorCallback)
+            m_errorCallback->handleEvent(m_fatalError.get());
+        // This will cause this notifier to be deleted.
+        m_geolocation->fatalErrorOccurred(this);
+        return;
+    }
+
     if (m_errorCallback) {
         RefPtr<PositionError> error = PositionError::create(PositionError::TIMEOUT, "Timeout expired");
         m_errorCallback->handleEvent(error.get());
@@ -70,6 +88,46 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
     m_geolocation->requestTimedOut(this);
 }
 
+void Geolocation::Watchers::set(int id, PassRefPtr<GeoNotifier> notifier)
+{
+    m_idToNotifierMap.set(id, notifier);
+    m_notifierToIdMap.set(notifier, id);
+}
+
+void Geolocation::Watchers::remove(int id)
+{
+    IdToNotifierMap::iterator iter = m_idToNotifierMap.find(id);
+    if (iter == m_idToNotifierMap.end())
+        return;
+    m_notifierToIdMap.remove(iter->second);
+    m_idToNotifierMap.remove(iter);
+}
+
+void Geolocation::Watchers::remove(GeoNotifier* notifier)
+{
+    NotifierToIdMap::iterator iter = m_notifierToIdMap.find(notifier);
+    if (iter == m_notifierToIdMap.end())
+        return;
+    m_idToNotifierMap.remove(iter->second);
+    m_notifierToIdMap.remove(iter);
+}
+
+void Geolocation::Watchers::clear()
+{
+    m_idToNotifierMap.clear();
+    m_notifierToIdMap.clear();
+}
+
+bool Geolocation::Watchers::isEmpty() const
+{
+    return m_idToNotifierMap.isEmpty();
+}
+
+void Geolocation::Watchers::getNotifiersVector(Vector<RefPtr<GeoNotifier> >& copy) const
+{
+    copyValuesToVector(m_idToNotifierMap, copy);
+}
+
 Geolocation::Geolocation(Frame* frame)
     : m_frame(frame)
     , m_service(GeolocationService::create(this))
@@ -92,40 +150,58 @@ void Geolocation::disconnectFrame()
 
 void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
-    RefPtr<GeoNotifier> notifier = GeoNotifier::create(this, successCallback, errorCallback, options);
-
-    if (notifier->hasZeroTimeout() || m_service->startUpdating(notifier->m_options.get()))
-        notifier->startTimerIfNeeded();
-    else {
-        if (notifier->m_errorCallback) {
-            RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "Unable to Start");
-            notifier->m_errorCallback->handleEvent(error.get());
-        }
+    RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
+    if (!notifier)
         return;
-    }
 
     m_oneShots.add(notifier);
 }
 
 int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
+    RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
+    if (!notifier)
+        return 0;
+
+    static int nextAvailableWatchId = 1;
+    // In case of overflow, make sure the ID remains positive, but reuse the ID values.
+    if (nextAvailableWatchId < 1)
+        nextAvailableWatchId = 1;
+    m_watchers.set(nextAvailableWatchId, notifier.release());
+    return nextAvailableWatchId++;
+}
+
+PassRefPtr<Geolocation::GeoNotifier> Geolocation::startRequest(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
+{
     RefPtr<GeoNotifier> notifier = GeoNotifier::create(this, successCallback, errorCallback, options);
 
-    if (notifier->hasZeroTimeout() || m_service->startUpdating(notifier->m_options.get()))
-        notifier->startTimerIfNeeded();
+    // Check whether permissions have already been denied. Note that if this is the case,
+    // the permission state can not change again in the lifetime of this page.
+    if (isDenied())
+        notifier->setFatalError(PositionError::create(PositionError::PERMISSION_DENIED, permissionDeniedErrorMessage));
     else {
-        if (notifier->m_errorCallback) {
-            RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "Unable to Start");
-            notifier->m_errorCallback->handleEvent(error.get());
+        if (notifier->hasZeroTimeout() || m_service->startUpdating(notifier->m_options.get()))
+            notifier->startTimerIfNeeded();
+        else {
+            if (notifier->m_errorCallback) {
+                RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "Unable to Start");
+                notifier->m_errorCallback->handleEvent(error.get());
+            }
+            return 0;
         }
-        return 0;
     }
-    
-    static int sIdentifier = 0;
-    
-    m_watchers.set(++sIdentifier, notifier);
 
-    return sIdentifier;
+    return notifier.release();
+}
+
+void Geolocation::fatalErrorOccurred(Geolocation::GeoNotifier* notifier)
+{
+    // This request has failed fatally. Remove it from our lists.
+    m_oneShots.remove(notifier);
+    m_watchers.remove(notifier);
+
+    if (!hasListeners())
+        m_service->stopUpdating();
 }
 
 void Geolocation::requestTimedOut(GeoNotifier* notifier)
@@ -164,7 +240,7 @@ void Geolocation::setIsAllowed(bool allowed)
     if (isAllowed())
         makeSuccessCallbacks();
     else {
-        RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "User disallowed Geolocation");
+        RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, permissionDeniedErrorMessage);
         error->setIsFatal(true);
         handleError(error.get());
     }
@@ -212,7 +288,7 @@ void Geolocation::stopTimersForOneShots()
 void Geolocation::stopTimersForWatchers()
 {
     Vector<RefPtr<GeoNotifier> > copy;
-    copyValuesToVector(m_watchers, copy);
+    m_watchers.getNotifiersVector(copy);
     
     stopTimer(copy);
 }
@@ -231,7 +307,7 @@ void Geolocation::handleError(PositionError* error)
     copyToVector(m_oneShots, oneShotsCopy);
 
     Vector<RefPtr<GeoNotifier> > watchersCopy;
-    copyValuesToVector(m_watchers, watchersCopy);
+    m_watchers.getNotifiersVector(watchersCopy);
 
     // Clear the lists before we make the callbacks, to avoid clearing notifiers
     // added by calls to Geolocation methods from the callbacks, and to prevent
@@ -294,7 +370,7 @@ void Geolocation::makeSuccessCallbacks()
     copyToVector(m_oneShots, oneShotsCopy);
     
     Vector<RefPtr<GeoNotifier> > watchersCopy;
-    copyValuesToVector(m_watchers, watchersCopy);
+    m_watchers.getNotifiersVector(watchersCopy);
     
     // Clear the lists before we make the callbacks, to avoid clearing notifiers
     // added by calls to Geolocation methods from the callbacks, and to prevent
diff --git a/src/3rdparty/webkit/WebCore/page/Geolocation.h b/src/3rdparty/webkit/WebCore/page/Geolocation.h
index 07a587f747..4827664e9d 100644
--- a/src/3rdparty/webkit/WebCore/page/Geolocation.h
+++ b/src/3rdparty/webkit/WebCore/page/Geolocation.h
@@ -28,6 +28,7 @@
 
 #include "GeolocationService.h"
 #include "PositionCallback.h"
+#include "PositionError.h"
 #include "PositionErrorCallback.h"
 #include "PositionOptions.h"
 #include "Timer.h"
@@ -64,6 +65,7 @@ public:
     
     void setIsAllowed(bool);
     bool isAllowed() const { return m_allowGeolocation == Yes; }
+    bool isDenied() const { return m_allowGeolocation == No; }
     
     void setShouldClearCache(bool shouldClearCache) { m_shouldClearCache = shouldClearCache; }
     bool shouldClearCache() const { return m_shouldClearCache; }
@@ -75,6 +77,7 @@ private:
     public:
         static PassRefPtr<GeoNotifier> create(Geolocation* geolocation, PassRefPtr<PositionCallback> positionCallback, PassRefPtr<PositionErrorCallback> positionErrorCallback, PassRefPtr<PositionOptions> options) { return adoptRef(new GeoNotifier(geolocation, positionCallback, positionErrorCallback, options)); }
         
+        void setFatalError(PassRefPtr<PositionError>);
         bool hasZeroTimeout() const;
         void startTimerIfNeeded();
         void timerFired(Timer<GeoNotifier>*);
@@ -84,11 +87,27 @@ private:
         RefPtr<PositionErrorCallback> m_errorCallback;
         RefPtr<PositionOptions> m_options;
         Timer<GeoNotifier> m_timer;
+        RefPtr<PositionError> m_fatalError;
 
     private:
         GeoNotifier(Geolocation*, PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
     };
 
+    class Watchers {
+    public:
+        void set(int id, PassRefPtr<GeoNotifier>);
+        void remove(int id);
+        void remove(GeoNotifier*);
+        void clear();
+        bool isEmpty() const;
+        void getNotifiersVector(Vector<RefPtr<GeoNotifier> >&) const;
+    private:
+        typedef HashMap<int, RefPtr<GeoNotifier> > IdToNotifierMap;
+        typedef HashMap<RefPtr<GeoNotifier>, int> NotifierToIdMap;
+        IdToNotifierMap m_idToNotifierMap;
+        NotifierToIdMap m_notifierToIdMap;
+    };
+
     bool hasListeners() const { return !m_oneShots.isEmpty() || !m_watchers.isEmpty(); }
 
     void sendError(Vector<RefPtr<GeoNotifier> >&, PositionError*);
@@ -108,13 +127,15 @@ private:
     virtual void geolocationServicePositionChanged(GeolocationService*);
     virtual void geolocationServiceErrorOccurred(GeolocationService*);
 
+    PassRefPtr<GeoNotifier> startRequest(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
+
+    void fatalErrorOccurred(GeoNotifier*);
     void requestTimedOut(GeoNotifier*);
 
     typedef HashSet<RefPtr<GeoNotifier> > GeoNotifierSet;
-    typedef HashMap<int, RefPtr<GeoNotifier> > GeoNotifierMap;
     
     GeoNotifierSet m_oneShots;
-    GeoNotifierMap m_watchers;
+    Watchers m_watchers;
     Frame* m_frame;
     OwnPtr<GeolocationService> m_service;
 
diff --git a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
index 46e6fada44..6d4ce1ffb6 100644
--- a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
+++ b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
@@ -127,9 +127,8 @@ namespace WebCore {
         // SecurityOrigin is represented with the string "null".
         String toString() const;
 
-        // Serialize the security origin for storage in the database. This format is
-        // deprecated and should be used only for compatibility with old databases;
-        // use toString() and createFromString() instead.
+        // Serialize the security origin to a string that could be used as part of
+        // file names. This format should be used in storage APIs only.
         String databaseIdentifier() const;
 
         // This method checks for equality between SecurityOrigins, not whether
diff --git a/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp b/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp
index dcd25f2dde..cf2acfb2bb 100644
--- a/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp
@@ -68,7 +68,7 @@ bool EventHandler::passWidgetMouseDownEventToWidget(RenderWidget* renderWidget)
 
 // This function is used to route the mouse down event to the native widgets, it seems like a
 // work around for the Mac platform which does not support double clicks, but browsers do.
-bool EventHandler::passMouseDownEventToWidget(Widget* )
+bool EventHandler::passMouseDownEventToWidget(Widget*)
 {
     // return false so the normal propogation handles the event
     return false;
@@ -84,7 +84,7 @@ bool EventHandler::eventActivatedView(const PlatformMouseEvent&) const
 // It is used to ensure that events are sync'ed correctly between frames. For example
 // if the user presses down in one frame and up in another frame, this function will
 // returns true, and pass the event to the correct frame.
-bool EventHandler::passSubframeEventToSubframe(MouseEventWithHitTestResults& , Frame* , HitTestResult* )
+bool EventHandler::passSubframeEventToSubframe(MouseEventWithHitTestResults&, Frame*, HitTestResult*)
 {
     notImplemented();
     return false;
@@ -93,7 +93,7 @@ bool EventHandler::passSubframeEventToSubframe(MouseEventWithHitTestResults& , F
 // This is called to route wheel events to child widgets when they are RenderWidget
 // as the parent usually gets wheel event. Don't have a mouse with a wheel to confirm
 // the operation of this function.
-bool EventHandler::passWheelEventToWidget(PlatformWheelEvent& , Widget* )
+bool EventHandler::passWheelEventToWidget(PlatformWheelEvent&, Widget*)
 {
     notImplemented();
     return false;
@@ -105,7 +105,7 @@ bool EventHandler::passMousePressEventToSubframe(MouseEventWithHitTestResults& m
 }
 
 bool EventHandler::passMouseMoveEventToSubframe(MouseEventWithHitTestResults& mev, 
-    Frame* subframe, HitTestResult* )
+    Frame* subframe, HitTestResult*)
 {
     return passSubframeEventToSubframe(mev, subframe);
 }
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
index ec0e284199..59797da694 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
@@ -468,6 +468,7 @@ public:
                 m_fillLayerPropertyWrapper = new FillLayerPropertyWrapper<Length>(&FillLayer::yPosition, &FillLayer::setYPosition);
                 break;
             case CSSPropertyBackgroundSize:
+            case CSSPropertyWebkitBackgroundSize:
             case CSSPropertyWebkitMaskSize:
                 m_fillLayerPropertyWrapper = new FillLayerPropertyWrapper<LengthSize>(&FillLayer::sizeLength, &FillLayer::setSizeLength);
                 break;
@@ -592,6 +593,7 @@ static void ensurePropertyMap()
         gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyBackgroundPositionX, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
         gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyBackgroundPositionY, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
         gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyBackgroundSize, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyWebkitBackgroundSize, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
 
         gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyWebkitMaskPositionX, &RenderStyle::maskLayers, &RenderStyle::accessMaskLayers));
         gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyWebkitMaskPositionY, &RenderStyle::maskLayers, &RenderStyle::accessMaskLayers));
diff --git a/src/3rdparty/webkit/WebCore/platform/FileSystem.h b/src/3rdparty/webkit/WebCore/platform/FileSystem.h
index d1449905ee..9952b392c9 100644
--- a/src/3rdparty/webkit/WebCore/platform/FileSystem.h
+++ b/src/3rdparty/webkit/WebCore/platform/FileSystem.h
@@ -65,15 +65,23 @@ namespace WebCore {
 
 class CString;
 
-#if PLATFORM(QT)
-
-typedef QFile* PlatformFileHandle;
-const PlatformFileHandle invalidPlatformFileHandle = 0;
+// PlatformModule
+#if PLATFORM(WIN_OS)
+typedef HMODULE PlatformModule;
+#elif PLATFORM(QT)
 #if defined(Q_WS_MAC)
 typedef CFBundleRef PlatformModule;
-typedef unsigned PlatformModuleVersion;
-#elif defined(Q_OS_WIN)
-typedef HMODULE PlatformModule;
+#else
+typedef QLibrary* PlatformModule;
+#endif // defined(Q_WS_MAC)
+#elif PLATFORM(GTK)
+typedef GModule* PlatformModule;
+#else
+typedef void* PlatformModule;
+#endif
+
+// PlatformModuleVersion
+#if PLATFORM(WIN_OS)
 struct PlatformModuleVersion {
     unsigned leastSig;
     unsigned mostSig;
@@ -90,57 +98,23 @@ struct PlatformModuleVersion {
     {
     }
 
-    bool operator != (const PlatformModuleVersion& rhs) const
-    {
-        return mostSig != rhs.mostSig && leastSig != rhs.leastSig;
-    }
-
-
-    bool operator > (const PlatformModuleVersion& rhs) const
-    {
-        return mostSig > rhs.mostSig && leastSig > rhs.leastSig;
-    }
-
 };
 #else
-typedef QLibrary* PlatformModule;
 typedef unsigned PlatformModuleVersion;
 #endif
 
+// PlatformFileHandle
+#if PLATFORM(QT)
+typedef QFile* PlatformFileHandle;
+const PlatformFileHandle invalidPlatformFileHandle = 0;
 #elif PLATFORM(WIN_OS)
 typedef HANDLE PlatformFileHandle;
-typedef HMODULE PlatformModule;
 // FIXME: -1 is INVALID_HANDLE_VALUE, defined in <winbase.h>. Chromium tries to
 // avoid using Windows headers in headers.  We'd rather move this into the .cpp.
 const PlatformFileHandle invalidPlatformFileHandle = reinterpret_cast<HANDLE>(-1);
-
-struct PlatformModuleVersion {
-    unsigned leastSig;
-    unsigned mostSig;
-
-    PlatformModuleVersion(unsigned)
-        : leastSig(0)
-        , mostSig(0)
-    {
-    }
-
-    PlatformModuleVersion(unsigned lsb, unsigned msb)
-        : leastSig(lsb)
-        , mostSig(msb)
-    {
-    }
-
-};
 #else
 typedef int PlatformFileHandle;
-#if PLATFORM(GTK)
-typedef GModule* PlatformModule;
-#else
-typedef void* PlatformModule;
-#endif
 const PlatformFileHandle invalidPlatformFileHandle = -1;
-
-typedef unsigned PlatformModuleVersion;
 #endif
 
 bool fileExists(const String&);
diff --git a/src/3rdparty/webkit/WebCore/platform/SSLKeyGenerator.h b/src/3rdparty/webkit/WebCore/platform/SSLKeyGenerator.h
index 398a009e8a..f81f0a599a 100644
--- a/src/3rdparty/webkit/WebCore/platform/SSLKeyGenerator.h
+++ b/src/3rdparty/webkit/WebCore/platform/SSLKeyGenerator.h
@@ -33,7 +33,14 @@ namespace WebCore {
 
     class KURL;
 
-    void getSupportedKeySizes(Vector<String>&);
+    // Returns strings representing key sizes that may be used
+    // for the <keygen> tag. The first string is displayed as the default
+    // key size in the <keygen> menu.
+    void getSupportedKeySizes(Vector<String>& sizes);
+
+    // This function handles the <keygen> tag in form elements.
+    // Returns a signed copy of the combined challenge string and public
+    // key (from a newly generated key pair).
     String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String& challengeString, const KURL&);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/android/ClipboardAndroid.h b/src/3rdparty/webkit/WebCore/platform/android/ClipboardAndroid.h
index 7761704af0..8c9d9fa94a 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/ClipboardAndroid.h
+++ b/src/3rdparty/webkit/WebCore/platform/android/ClipboardAndroid.h
@@ -33,31 +33,31 @@
 
 namespace WebCore {
 
-    class CachedImage;
+class CachedImage;
 
-    class ClipboardAndroid : public Clipboard, public CachedResourceClient {
-    public:
-        ClipboardAndroid(ClipboardAccessPolicy policy, bool isForDragging);
-        ~ClipboardAndroid();
-    
-        void clearData(const String&);
-        void clearAllData();
-        String getData(const String&, bool& success) const;
-        bool setData(const String&, const String&);
-    
-        // extensions beyond IE's API
-        HashSet<String> types() const;
+class ClipboardAndroid : public Clipboard, public CachedResourceClient {
+public:
+    ClipboardAndroid(ClipboardAccessPolicy policy, bool isForDragging);
+    ~ClipboardAndroid();
+
+    void clearData(const String&);
+    void clearAllData();
+    String getData(const String&, bool& success) const;
+    bool setData(const String&, const String&);
+
+    // extensions beyond IE's API
+    HashSet<String> types() const;
+
+    void setDragImage(CachedImage*, const IntPoint&);
+    void setDragImageElement(Node*, const IntPoint&);
     
-        void setDragImage(CachedImage*, const IntPoint&);
-        void setDragImageElement(Node*, const IntPoint&);
-        
-        virtual DragImageRef createDragImage(IntPoint&) const;
-        virtual void declareAndWriteDragImage(Element*, const KURL&, const String&, Frame*);
-        virtual void writeURL(const KURL&, const String&, Frame*);
-        virtual void writeRange(Range*, Frame*);
+    virtual DragImageRef createDragImage(IntPoint&) const;
+    virtual void declareAndWriteDragImage(Element*, const KURL&, const String&, Frame*);
+    virtual void writeURL(const KURL&, const String&, Frame*);
+    virtual void writeRange(Range*, Frame*);
 
-        virtual bool hasData();
-    };
+    virtual bool hasData();
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/platform/android/CursorAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/android/CursorAndroid.cpp
index 5c6e473d65..beef3b295f 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/CursorAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/android/CursorAndroid.cpp
@@ -23,6 +23,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
+
 #define LOG_TAG "WebCore"
 
 #include "config.h"
@@ -282,12 +283,14 @@ const Cursor& westPanningCursor()
     return c;
 }
 
-const Cursor& grabCursor() {
+const Cursor& grabCursor()
+{
     notImplemented();
     return c;
 }
 
-const Cursor& grabbingCursor() {
+const Cursor& grabbingCursor()
+{
     notImplemented();
     return c;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/android/FileChooserAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/android/FileChooserAndroid.cpp
index ec1b758205..caedc7aa64 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/FileChooserAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/android/FileChooserAndroid.cpp
@@ -36,10 +36,9 @@ String FileChooser::basenameForWidth(const Font& font, int width) const
         return String();
     // FIXME: This could be a lot faster, but assuming the data will not
     // often be much longer than the provided width, this may be fast enough.
-    String output = m_filenames[0].copy();
-    while (font.width(TextRun(output.impl())) > width && output.length() > 4) {
+    String output = m_filenames[0].threadsafeCopy();
+    while (font.width(TextRun(output.impl())) > width && output.length() > 4)
         output = output.replace(output.length() - 4, 4, String("..."));
-    }
     return output;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/android/FileSystemAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/android/FileSystemAndroid.cpp
index f2665a2b8c..46c12970e8 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/FileSystemAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/android/FileSystemAndroid.cpp
@@ -30,12 +30,12 @@
 
 #include "CString.h"
 #include "StringBuilder.h"
-#include <fnmatch.h>
-#include <dlfcn.h>
+#include "cutils/log.h"
 #include <dirent.h>
+#include <dlfcn.h>
 #include <errno.h>
+#include <fnmatch.h>
 #include <sys/stat.h>
-#include "cutils/log.h"
 
 namespace WebCore {
 
@@ -72,7 +72,7 @@ CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
 
 bool unloadModule(PlatformModule module)
 {
-    return dlclose(module) == 0;
+    return !dlclose(module);
 }
 
 void closeFile(PlatformFileHandle& handle)
@@ -90,7 +90,7 @@ int writeToFile(PlatformFileHandle handle, const char* data, int length)
         int bytesWritten = write(handle, data, (size_t)(length - totalBytesWritten));
         if (bytesWritten < 0 && errno != EINTR)
             return -1;
-        else if (bytesWritten > 0)
+        if (bytesWritten > 0)
             totalBytesWritten += bytesWritten;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/android/KeyEventAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/android/KeyEventAndroid.cpp
index ab848bdc23..d3c48f5d58 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/KeyEventAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/android/KeyEventAndroid.cpp
@@ -41,128 +41,128 @@ namespace WebCore {
 static int windowsKeyCodeForKeyEvent(unsigned int keyCode)
 {
     // Does not provide all key codes, and does not handle all keys.
-    switch(keyCode) {
-        case kKeyCodeDel:
-            return VK_BACK;
-        case kKeyCodeTab:
-            return VK_TAB;
-        case kKeyCodeClear:
-            return VK_CLEAR;
-        case kKeyCodeDpadCenter:
-        case kKeyCodeNewline:
-            return VK_RETURN;
-        case kKeyCodeShiftLeft:
-        case kKeyCodeShiftRight:
-            return VK_SHIFT;
-        // back will serve as escape, although we probably do not have access to it
-        case kKeyCodeBack:
-            return VK_ESCAPE;
-        case kKeyCodeSpace:
-            return VK_SPACE;
-        case kKeyCodeHome:
-            return VK_HOME;
-        case kKeyCodeDpadLeft:
-            return VK_LEFT;
-        case kKeyCodeDpadUp:
-            return VK_UP;
-        case kKeyCodeDpadRight:
-            return VK_RIGHT;
-        case kKeyCodeDpadDown:
-            return VK_DOWN;
-        case kKeyCode0:
-            return VK_0;
-        case kKeyCode1:
-            return VK_1;
-        case kKeyCode2:
-            return VK_2;
-        case kKeyCode3:
-            return VK_3;
-        case kKeyCode4:
-            return VK_4;
-        case kKeyCode5:
-            return VK_5;
-        case kKeyCode6:
-            return VK_6;
-        case kKeyCode7:
-            return VK_7;
-        case kKeyCode8:
-            return VK_8;
-        case kKeyCode9:
-            return VK_9;
-        case kKeyCodeA:
-            return VK_A;
-        case kKeyCodeB:
-            return VK_B;
-        case kKeyCodeC:
-            return VK_C;
-        case kKeyCodeD:
-            return VK_D;
-        case kKeyCodeE:
-            return VK_E;
-        case kKeyCodeF:
-            return VK_F;
-        case kKeyCodeG:
-            return VK_G;
-        case kKeyCodeH:
-            return VK_H;
-        case kKeyCodeI:
-            return VK_I;
-        case kKeyCodeJ:
-            return VK_J;
-        case kKeyCodeK:
-            return VK_K;
-        case kKeyCodeL:
-            return VK_L;
-        case kKeyCodeM:
-            return VK_M;
-        case kKeyCodeN:
-            return VK_N;
-        case kKeyCodeO:
-            return VK_O;
-        case kKeyCodeP:
-            return VK_P;
-        case kKeyCodeQ:
-            return VK_Q;
-        case kKeyCodeR:
-            return VK_R;
-        case kKeyCodeS:
-            return VK_S;
-        case kKeyCodeT:
-            return VK_T;
-        case kKeyCodeU:
-            return VK_U;
-        case kKeyCodeV:
-            return VK_V;
-        case kKeyCodeW:
-            return VK_W;
-        case kKeyCodeX:
-            return VK_X;
-        case kKeyCodeY:
-            return VK_Y;
-        case kKeyCodeZ:
-            return VK_Z;
-        // colon
-        case kKeyCodeSemicolon:
-            return VK_OEM_1;
-        case kKeyCodeComma:
-            return VK_OEM_COMMA;
-        case kKeyCodeMinus:
-            return VK_OEM_MINUS;
-        case kKeyCodeEquals:
-            return VK_OEM_PLUS;
-        case kKeyCodePeriod:
-            return VK_OEM_PERIOD;
-        case kKeyCodeSlash:
-            return VK_OEM_2;
-        // maybe not the right choice
-        case kKeyCodeLeftBracket:
-            return VK_OEM_4;
-        case kKeyCodeBackslash:
-            return VK_OEM_5;
-        case kKeyCodeRightBracket:
-            return VK_OEM_6;
-        default:
-            return 0;
+    switch (keyCode) {
+    case kKeyCodeDel:
+        return VK_BACK;
+    case kKeyCodeTab:
+        return VK_TAB;
+    case kKeyCodeClear:
+        return VK_CLEAR;
+    case kKeyCodeDpadCenter:
+    case kKeyCodeNewline:
+        return VK_RETURN;
+    case kKeyCodeShiftLeft:
+    case kKeyCodeShiftRight:
+        return VK_SHIFT;
+    // back will serve as escape, although we probably do not have access to it
+    case kKeyCodeBack:
+        return VK_ESCAPE;
+    case kKeyCodeSpace:
+        return VK_SPACE;
+    case kKeyCodeHome:
+        return VK_HOME;
+    case kKeyCodeDpadLeft:
+        return VK_LEFT;
+    case kKeyCodeDpadUp:
+        return VK_UP;
+    case kKeyCodeDpadRight:
+        return VK_RIGHT;
+    case kKeyCodeDpadDown:
+        return VK_DOWN;
+    case kKeyCode0:
+        return VK_0;
+    case kKeyCode1:
+        return VK_1;
+    case kKeyCode2:
+        return VK_2;
+    case kKeyCode3:
+        return VK_3;
+    case kKeyCode4:
+        return VK_4;
+    case kKeyCode5:
+        return VK_5;
+    case kKeyCode6:
+        return VK_6;
+    case kKeyCode7:
+        return VK_7;
+    case kKeyCode8:
+        return VK_8;
+    case kKeyCode9:
+        return VK_9;
+    case kKeyCodeA:
+        return VK_A;
+    case kKeyCodeB:
+        return VK_B;
+    case kKeyCodeC:
+        return VK_C;
+    case kKeyCodeD:
+        return VK_D;
+    case kKeyCodeE:
+        return VK_E;
+    case kKeyCodeF:
+        return VK_F;
+    case kKeyCodeG:
+        return VK_G;
+    case kKeyCodeH:
+        return VK_H;
+    case kKeyCodeI:
+        return VK_I;
+    case kKeyCodeJ:
+        return VK_J;
+    case kKeyCodeK:
+        return VK_K;
+    case kKeyCodeL:
+        return VK_L;
+    case kKeyCodeM:
+        return VK_M;
+    case kKeyCodeN:
+        return VK_N;
+    case kKeyCodeO:
+        return VK_O;
+    case kKeyCodeP:
+        return VK_P;
+    case kKeyCodeQ:
+        return VK_Q;
+    case kKeyCodeR:
+        return VK_R;
+    case kKeyCodeS:
+        return VK_S;
+    case kKeyCodeT:
+        return VK_T;
+    case kKeyCodeU:
+        return VK_U;
+    case kKeyCodeV:
+        return VK_V;
+    case kKeyCodeW:
+        return VK_W;
+    case kKeyCodeX:
+        return VK_X;
+    case kKeyCodeY:
+        return VK_Y;
+    case kKeyCodeZ:
+        return VK_Z;
+    // colon
+    case kKeyCodeSemicolon:
+        return VK_OEM_1;
+    case kKeyCodeComma:
+        return VK_OEM_COMMA;
+    case kKeyCodeMinus:
+        return VK_OEM_MINUS;
+    case kKeyCodeEquals:
+        return VK_OEM_PLUS;
+    case kKeyCodePeriod:
+        return VK_OEM_PERIOD;
+    case kKeyCodeSlash:
+        return VK_OEM_2;
+    // maybe not the right choice
+    case kKeyCodeLeftBracket:
+        return VK_OEM_4;
+    case kKeyCodeBackslash:
+        return VK_OEM_5;
+    case kKeyCodeRightBracket:
+        return VK_OEM_6;
+    default:
+        return 0;
     }
 }
 
@@ -171,28 +171,28 @@ static String keyIdentifierForAndroidKeyCode(int keyCode)
     // Does not return all of the same key identifiers, and
     // does not handle all the keys.
     switch (keyCode) {
-        case kKeyCodeClear:
-            return "Clear";
-        case kKeyCodeNewline:
-        case kKeyCodeDpadCenter:
-            return "Enter";
-        case kKeyCodeHome:
-            return "Home";
-        case kKeyCodeDpadDown:
-            return "Down";
-        case kKeyCodeDpadLeft:
-            return "Left";
-        case kKeyCodeDpadRight:
-            return "Right";
-        case kKeyCodeDpadUp:
-            return "Up";
-        // Standard says that DEL becomes U+00007F.
-        case kKeyCodeDel:
-            return "U+00007F";
-        default:
-            char upper[16];
-            sprintf(upper, "U+%06X", windowsKeyCodeForKeyEvent(keyCode));
-            return String(upper);
+    case kKeyCodeClear:
+        return "Clear";
+    case kKeyCodeNewline:
+    case kKeyCodeDpadCenter:
+        return "Enter";
+    case kKeyCodeHome:
+        return "Home";
+    case kKeyCodeDpadDown:
+        return "Down";
+    case kKeyCodeDpadLeft:
+        return "Left";
+    case kKeyCodeDpadRight:
+        return "Right";
+    case kKeyCodeDpadUp:
+        return "Up";
+    // Standard says that DEL becomes U+00007F.
+    case kKeyCodeDel:
+        return "U+00007F";
+    default:
+        char upper[16];
+        sprintf(upper, "U+%06X", windowsKeyCodeForKeyEvent(keyCode));
+        return String(upper);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/android/ScreenAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/android/ScreenAndroid.cpp
index 2439c1f6d4..dcd2d100b5 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/ScreenAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/android/ScreenAndroid.cpp
@@ -31,14 +31,12 @@
 
 #include "FloatRect.h"
 #include "Widget.h"
-
+#include "ui/DisplayInfo.h"
+#include "ui/PixelFormat.h"
+#include "ui/SurfaceComposerClient.h"
 #undef LOG // FIXME: Still have to do this to get the log to show up
 #include "utils/Log.h"
 
-#include "ui/SurfaceComposerClient.h"
-#include "ui/PixelFormat.h"
-#include "ui/DisplayInfo.h"
-
 namespace WebCore {
 
 int screenDepth(Widget* page)
@@ -70,18 +68,18 @@ int Screen::orientation() const
     // to the values described here
     // (http://developer.apple.com/documentation/AppleApplications/Reference/SafariWebContent/HandlingEvents/chapter_8_section_6.html)
     switch (info.orientation) {
-        case android::ISurfaceComposer::eOrientationDefault:
-            return 0;
-        case android::ISurfaceComposer::eOrientation90:
-            return 90;
-        case android::ISurfaceComposer::eOrientation180:
-            return 180;
-        case android::ISurfaceComposer::eOrientation270:
-            return -90;
-        default:
-            LOGE("Bad orientation returned from getDisplayIndo %d",
-                    info.orientation);
-            return 0;
+    case android::ISurfaceComposer::eOrientationDefault:
+        return 0;
+    case android::ISurfaceComposer::eOrientation90:
+        return 90;
+    case android::ISurfaceComposer::eOrientation180:
+        return 180;
+    case android::ISurfaceComposer::eOrientation270:
+        return -90;
+    default:
+        LOGE("Bad orientation returned from getDisplayIndo %d",
+                info.orientation);
+        return 0;
     }
 }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp b/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp
index c0b57a68fa..b82edaf50a 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp
@@ -28,17 +28,15 @@
 
 #define ANDROID_COMPILE_HACK
 
-#include <stdio.h>
-#include <stdlib.h>
 #include "AXObjectCache.h"
+#include "CString.h"
 #include "CachedPage.h"
 #include "CachedResource.h"
-#include "CookieJar.h"
+#include "Clipboard.h"
 #include "Console.h"
 #include "ContextMenu.h"
 #include "ContextMenuItem.h"
-#include "Clipboard.h"
-#include "CString.h"
+#include "CookieJar.h"
 #include "Cursor.h"
 #include "Database.h"
 #include "DocumentFragment.h"
@@ -49,8 +47,8 @@
 #include "FileList.h"
 #include "Font.h"
 #include "Frame.h"
-#include "FrameLoader.h"
 #include "FrameLoadRequest.h"
+#include "FrameLoader.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "HTMLFrameOwnerElement.h"
@@ -60,21 +58,11 @@
 #include "IconDatabase.h"
 #include "IconLoader.h"
 #include "IntPoint.h"
-
-#if USE(JSC)
-#include "JavaScriptCallFrame.h"
-#include "JavaScriptDebugServer.h"
-#include "API/JSClassRef.h"
-#include "JavaScriptProfile.h"
-#include "jni_utility.h"
-#endif
-
 #include "KURL.h"
 #include "Language.h"
-#include "loader.h"
 #include "LocalizedStrings.h"
-#include "MainResourceLoader.h"
 #include "MIMETypeRegistry.h"
+#include "MainResourceLoader.h"
 #include "Node.h"
 #include "NotImplemented.h"
 #include "PageCache.h"
@@ -89,6 +77,17 @@
 #include "ScrollbarTheme.h"
 #include "SmartReplace.h"
 #include "Widget.h"
+#include "loader.h"
+#include <stdio.h>
+#include <stdlib.h>
+
+#if USE(JSC)
+#include "API/JSClassRef.h"
+#include "JavaScriptCallFrame.h"
+#include "JavaScriptDebugServer.h"
+#include "JavaScriptProfile.h"
+#include "jni_utility.h"
+#endif
 
 using namespace WebCore;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
index d712efbe8b..7e8f2b075a 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
@@ -140,8 +140,10 @@ public:
     virtual CGImageRef getCGImageRef();
 #endif
 
-#if PLATFORM(WIN)
+#if PLATFORM(WIN) || (PLATFORM(QT) && PLATFORM(WIN_OS))
     static PassRefPtr<BitmapImage> create(HBITMAP);
+#endif
+#if PLATFORM(WIN)
     virtual bool getHBITMAP(HBITMAP);
     virtual bool getHBITMAPOfSize(HBITMAP, LPSIZE);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
index 67224e280c..07ec04d5c5 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
@@ -29,6 +29,7 @@
 #include "PlatformString.h"
 
 #include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
 
 #if PLATFORM(MAC)
 #include <OpenGL/OpenGL.h>
@@ -74,11 +75,11 @@ namespace WebCore {
     class GraphicsContext3DInternal;
 #endif
 
-    class GraphicsContext3D : Noncopyable {
+    class GraphicsContext3D : public Noncopyable {
     public:
         enum ShaderType { FRAGMENT_SHADER, VERTEX_SHADER };
     
-        GraphicsContext3D();
+        static PassOwnPtr<GraphicsContext3D> create();
         virtual ~GraphicsContext3D();
 
 #if PLATFORM(MAC)
@@ -92,7 +93,6 @@ namespace WebCore {
         Platform3DObject platformTexture() const { return NullPlatform3DObject; }
 #endif
         void checkError() const;
-        
         void makeContextCurrent();
         
         // Helper to return the size in bytes of OpenGL data types
@@ -320,6 +320,8 @@ namespace WebCore {
         void deleteTexture(unsigned);        
         
     private:        
+        GraphicsContext3D();
+
         int m_currentWidth, m_currentHeight;
         
 #if PLATFORM(MAC)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
index d196a0c59d..c8582bb82f 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -59,9 +59,7 @@ GraphicsLayer::GraphicsLayer(GraphicsLayerClient* client)
     : m_client(client)
     , m_anchorPoint(0.5f, 0.5f, 0)
     , m_opacity(1)
-#ifndef NDEBUG
     , m_zPosition(0)
-#endif
     , m_backgroundColorSet(false)
     , m_contentsOpaque(false)
     , m_preserves3D(false)
@@ -74,9 +72,7 @@ GraphicsLayer::GraphicsLayer(GraphicsLayerClient* client)
     , m_contentsOrientation(CompositingCoordinatesTopDown)
     , m_parent(0)
     , m_maskLayer(0)
-#ifndef NDEBUG
     , m_repaintCount(0)
-#endif
 {
 }
 
@@ -229,7 +225,6 @@ void GraphicsLayer::resumeAnimations()
 {
 }
 
-#ifndef NDEBUG
 void GraphicsLayer::updateDebugIndicators()
 {
     if (GraphicsLayer::showDebugBorders()) {
@@ -251,7 +246,6 @@ void GraphicsLayer::setZPosition(float position)
 {
     m_zPosition = position;
 }
-#endif
 
 float GraphicsLayer::accumulatedOpacity() const
 {
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
index e5b17a6452..85eace092c 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
@@ -276,10 +276,8 @@ public:
     
     void dumpLayer(TextStream&, int indent = 0) const;
 
-#ifndef NDEBUG
     int repaintCount() const { return m_repaintCount; }
     int incrementRepaintCount() { return ++m_repaintCount; }
-#endif
 
     // Report whether the underlying compositing system uses a top-down
     // or a bottom-up coordinate system.
@@ -294,7 +292,6 @@ public:
     virtual void setContentsOrientation(CompositingCoordinatesOrientation orientation) { m_contentsOrientation = orientation; }
     CompositingCoordinatesOrientation contentsOrientation() const { return m_contentsOrientation; }
 
-#ifndef NDEBUG
     static bool showDebugBorders();
     static bool showRepaintCounter();
     
@@ -305,7 +302,6 @@ public:
     // z-position is the z-equivalent of position(). It's only used for debugging purposes.
     virtual float zPosition() const { return m_zPosition; }
     virtual void setZPosition(float);
-#endif
 
     virtual void distributeOpacity(float);
     virtual float accumulatedOpacity() const;
@@ -342,9 +338,7 @@ protected:
 
     Color m_backgroundColor;
     float m_opacity;
-#ifndef NDEBUG
     float m_zPosition;
-#endif
 
     bool m_backgroundColorSet : 1;
     bool m_contentsOpaque : 1;
@@ -365,9 +359,7 @@ protected:
 
     IntRect m_contentsRect;
 
-#ifndef NDEBUG
     int m_repaintCount;
-#endif
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp
index 1e2e552ddb..a2ed9bd088 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp
@@ -30,6 +30,7 @@
 #include "GraphicsContext.h"
 #include "ImageData.h"
 #include <math.h>
+#include <wtf/MathExtras.h>
 
 namespace WebCore {
 
@@ -92,8 +93,8 @@ inline void saturate(double& red, double& green, double& blue, const float& s)
 
 inline void huerotate(double& red, double& green, double& blue, const float& hue)
 {
-    double cosHue = cos(hue * M_PI / 180); 
-    double sinHue = sin(hue * M_PI / 180); 
+    double cosHue = cos(hue * piDouble / 180); 
+    double sinHue = sin(hue * piDouble / 180); 
     double r = red   * (0.213 + cosHue * 0.787 - sinHue * 0.213) +
                green * (0.715 - cosHue * 0.715 - sinHue * 0.715) +
                blue  * (0.072 - cosHue * 0.072 + sinHue * 0.928);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
index 43e5edd567..0d76d8d6a9 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
@@ -92,11 +92,11 @@ void FEComponentTransfer::setAlphaFunction(const ComponentTransferFunction& func
     m_alphaFunc = func;
 }
 
-void identity(unsigned char*, const ComponentTransferFunction&)
+static void identity(unsigned char*, const ComponentTransferFunction&)
 {
 }
 
-void table(unsigned char* values, const ComponentTransferFunction& transferFunction)
+static void table(unsigned char* values, const ComponentTransferFunction& transferFunction)
 {
     const Vector<float>& tableValues = transferFunction.tableValues;
     unsigned n = tableValues.size();
@@ -113,7 +113,7 @@ void table(unsigned char* values, const ComponentTransferFunction& transferFunct
     }
 }
 
-void discrete(unsigned char* values, const ComponentTransferFunction& transferFunction)
+static void discrete(unsigned char* values, const ComponentTransferFunction& transferFunction)
 {
     const Vector<float>& tableValues = transferFunction.tableValues;
     unsigned n = tableValues.size();
@@ -128,7 +128,7 @@ void discrete(unsigned char* values, const ComponentTransferFunction& transferFu
     }
 }
 
-void linear(unsigned char* values, const ComponentTransferFunction& transferFunction)
+static void linear(unsigned char* values, const ComponentTransferFunction& transferFunction)
 {
     for (unsigned i = 0; i < 256; ++i) {
         double val = transferFunction.slope * i + 255 * transferFunction.intercept;
@@ -137,7 +137,7 @@ void linear(unsigned char* values, const ComponentTransferFunction& transferFunc
     }
 }
 
-void gamma(unsigned char* values, const ComponentTransferFunction& transferFunction)
+static void gamma(unsigned char* values, const ComponentTransferFunction& transferFunction)
 {
     for (unsigned i = 0; i < 256; ++i) {
         double val = 255.0 * (transferFunction.amplitude * pow((i / 255.0), transferFunction.exponent) + transferFunction.offset);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
index a62dfdcacb..f480f10fca 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
@@ -30,6 +30,7 @@
 #include "GraphicsContext.h"
 #include "ImageData.h"
 #include <math.h>
+#include <wtf/MathExtras.h>
 
 namespace WebCore {
 
@@ -66,10 +67,10 @@ void FEGaussianBlur::setStdDeviationY(float y)
     m_y = y;
 }
 
-void boxBlur(CanvasPixelArray*& srcPixelArray, CanvasPixelArray*& dstPixelArray,
+static void boxBlur(CanvasPixelArray*& srcPixelArray, CanvasPixelArray*& dstPixelArray,
                  unsigned dx, int stride, int strideLine, int effectWidth, int effectHeight, bool alphaImage)
 {
-    int dxLeft = static_cast<int>(floor(dx / 2));
+    int dxLeft = dx / 2;
     int dxRight = dx - dxLeft;
 
     for (int y = 0; y < effectHeight; ++y) {
@@ -110,8 +111,8 @@ void FEGaussianBlur::apply(Filter* filter)
     if (m_x == 0 || m_y == 0)
         return;
 
-    unsigned sdx = static_cast<unsigned>(floor(m_x * 3 * sqrt(2 * M_PI) / 4.f + 0.5f));
-    unsigned sdy = static_cast<unsigned>(floor(m_y * 3 * sqrt(2 * M_PI) / 4.f + 0.5f));
+    unsigned sdx = static_cast<unsigned>(floor(m_x * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
+    unsigned sdy = static_cast<unsigned>(floor(m_y * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
 
     IntRect effectDrawingRect = calculateDrawingIntRect(m_in->subRegion());
     RefPtr<ImageData> srcImageData(m_in->resultImage()->getPremultipliedImageData(effectDrawingRect));
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp
index da6ddacbfe..b671107509 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -120,6 +120,38 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
         imageObserver()->didDraw(this);
 }
 
+BitmapImage::BitmapImage(QPixmap* pixmap, ImageObserver* observer)
+    : Image(observer)
+    , m_currentFrame(0)
+    , m_frames(0)
+    , m_frameTimer(0)
+    , m_repetitionCount(cAnimationNone)
+    , m_repetitionCountStatus(Unknown)
+    , m_repetitionsComplete(0)
+    , m_isSolidColor(false)
+    , m_checkedForSolidColor(false)
+    , m_animationFinished(true)
+    , m_allDataReceived(true)
+    , m_haveSize(true)
+    , m_sizeAvailable(true)
+    , m_decodedSize(0)
+    , m_haveFrameCount(true)
+    , m_frameCount(1)
+{
+    initPlatformData();
+
+    int width = pixmap->width();
+    int height = pixmap->height();
+    m_decodedSize = width * height * 4;
+    m_size = IntSize(width, height);
+
+    m_frames.grow(1);
+    m_frames[0].m_frame = pixmap;
+    m_frames[0].m_hasAlpha = pixmap->hasAlpha();
+    m_frames[0].m_haveMetadata = true;
+    checkForSolidColor();
+}
+
 void BitmapImage::initPlatformData()
 {
 }
@@ -181,6 +213,13 @@ void BitmapImage::checkForSolidColor()
     m_solidColor = QColor::fromRgba(framePixmap->toImage().pixel(0, 0));
 }
 
+#if PLATFORM(WIN_OS)
+PassRefPtr<BitmapImage> BitmapImage::create(HBITMAP hBitmap)
+{
+    return BitmapImage::create(new QPixmap(QPixmap::fromWinHBITMAP(hBitmap)));
+}
+#endif
+
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/platform/network/Credential.cpp b/src/3rdparty/webkit/WebCore/platform/network/Credential.cpp
index caca785ac5..f905743190 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/Credential.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/Credential.cpp
@@ -32,6 +32,7 @@ namespace WebCore {
 Credential::Credential()
     : m_user("")
     , m_password("")
+    , m_persistence(CredentialPersistenceNone)
 {
 }
    
@@ -44,7 +45,7 @@ Credential::Credential(const String& user, const String& password, CredentialPer
 {
 }
 
-bool Credential::isEmpty()
+bool Credential::isEmpty() const
 {
     return m_user.isEmpty() && m_password.isEmpty();
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/network/Credential.h b/src/3rdparty/webkit/WebCore/platform/network/Credential.h
index ca4a45a1f0..0471fbca71 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/Credential.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/Credential.h
@@ -41,7 +41,7 @@ public:
     Credential();
     Credential(const String& user, const String& password, CredentialPersistence);
     
-    bool isEmpty();
+    bool isEmpty() const;
     
     const String& user() const;
     const String& password() const;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/FormDataBuilder.cpp b/src/3rdparty/webkit/WebCore/platform/network/FormDataBuilder.cpp
index 27bdee319f..04c75278cf 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/FormDataBuilder.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/FormDataBuilder.cpp
@@ -108,6 +108,34 @@ static inline void append(Vector<char>& buffer, const CString& string)
     buffer.append(string.data(), string.length());
 }
 
+static void appendQuotedString(Vector<char>& buffer, const CString& string)
+{
+    // Append a string as a quoted value, escaping quotes and line breaks.
+    // FIXME: Is it correct to use percent escaping here? Other browsers do not encode these characters yet,
+    // so we should test popular servers to find out if there is an encoding form they can handle.
+    unsigned length = string.length();
+    for (unsigned i = 0; i < length; ++i) {
+        unsigned char c = string.data()[i];
+
+        switch (c) {
+        case  0x0a:
+            append(buffer, "%0A");
+            break;
+        case 0x0d:
+            append(buffer, "%0D");
+            break;
+        case '"':
+            append(buffer, "%22");
+            break;
+        case '%':
+            append(buffer, "%25");
+            break;
+        default:
+            append(buffer, c);
+        }
+    }
+}
+
 Vector<char> FormDataBuilder::generateUniqueBoundaryString()
 {
     Vector<char> boundary;
@@ -161,8 +189,10 @@ void FormDataBuilder::beginMultiPartHeader(Vector<char>& buffer, const CString&
 {
     addBoundaryToMultiPartHeader(buffer, boundary);
 
+    // FIXME: This loses data irreversibly if the input name includes characters you can't encode
+    // in the website's character set.
     append(buffer, "Content-Disposition: form-data; name=\"");
-    append(buffer, name);
+    appendQuotedString(buffer, name);
     append(buffer, '"');
 }
 
@@ -179,12 +209,10 @@ void FormDataBuilder::addBoundaryToMultiPartHeader(Vector<char>& buffer, const C
 
 void FormDataBuilder::addFilenameToMultiPartHeader(Vector<char>& buffer, const TextEncoding& encoding, const String& filename)
 {
-    // FIXME: This won't work if the filename includes a " mark,
-    // or control characters like CR or LF. This also does strange
-    // things if the filename includes characters you can't encode
+    // FIXME: This loses data irreversibly if the filename includes characters you can't encode
     // in the website's character set.
     append(buffer, "; filename=\"");
-    append(buffer, encoding.encode(filename.characters(), filename.length(), QuestionMarksForUnencodables));
+    appendQuotedString(buffer, encoding.encode(filename.characters(), filename.length(), QuestionMarksForUnencodables));
     append(buffer, '"');
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
index 4c77999f4a..e0707d9602 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
@@ -218,6 +218,26 @@ void ResourceRequestBase::setHTTPHeaderField(const AtomicString& name, const Str
         m_platformRequestUpdated = false;
 }
 
+void ResourceRequestBase::clearHTTPReferrer()
+{
+    updateResourceRequest(); 
+
+    m_httpHeaderFields.remove("Referer");
+
+    if (url().protocolInHTTPFamily())
+        m_platformRequestUpdated = false;
+}
+
+void ResourceRequestBase::clearHTTPOrigin()
+{
+    updateResourceRequest(); 
+
+    m_httpHeaderFields.remove("Origin");
+
+    if (url().protocolInHTTPFamily())
+        m_platformRequestUpdated = false;
+}
+
 void ResourceRequestBase::setResponseContentDispositionEncodingFallbackArray(const String& encoding1, const String& encoding2, const String& encoding3)
 {
     updateResourceRequest(); 
@@ -358,7 +378,7 @@ void ResourceRequestBase::updateResourceRequest() const
     m_resourceRequestUpdated = true;
 }
 
-#if !PLATFORM(MAC) && !USE(CFNETWORK) && !USE(SOUP)
+#if !PLATFORM(MAC) && !USE(CFNETWORK) && !USE(SOUP) && !PLATFORM(CHROMIUM)
 unsigned initializeMaximumHTTPConnectionCountPerHost()
 {
     // This is used by the loader to control the number of issued parallel load requests. 
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h
index 348e6b3ee0..84a7bd0b7c 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h
@@ -88,11 +88,11 @@ namespace WebCore {
         
         String httpReferrer() const { return httpHeaderField("Referer"); }
         void setHTTPReferrer(const String& httpReferrer) { setHTTPHeaderField("Referer", httpReferrer); }
-        void clearHTTPReferrer() { m_httpHeaderFields.remove("Referer"); }
+        void clearHTTPReferrer();
         
         String httpOrigin() const { return httpHeaderField("Origin"); }
         void setHTTPOrigin(const String& httpOrigin) { setHTTPHeaderField("Origin", httpOrigin); }
-        void clearHTTPOrigin() { m_httpHeaderFields.remove("Origin"); }
+        void clearHTTPOrigin();
 
         String httpUserAgent() const { return httpHeaderField("User-Agent"); }
         void setHTTPUserAgent(const String& httpUserAgent) { setHTTPHeaderField("User-Agent", httpUserAgent); }
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 202346d254..ed5e024582 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -175,8 +175,8 @@ void QNetworkReplyHandler::abort()
         QNetworkReply* reply = release();
         reply->abort();
         reply->deleteLater();
-        deleteLater();
     }
+    deleteLater();
 }
 
 QNetworkReply* QNetworkReplyHandler::release()
@@ -188,6 +188,7 @@ QNetworkReply* QNetworkReplyHandler::release()
         // posted meta call events that were the result of a signal emission
         // don't reach the slots in our instance.
         QCoreApplication::removePostedEvents(this, QEvent::MetaCall);
+        m_reply->setParent(0);
         m_reply = 0;
     }
     return reply;
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/CursorQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/CursorQt.cpp
index aad84be12f..3fc83f9275 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/CursorQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/CursorQt.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2006 George Staikos <staikos@kde.org>
  * Copyright (C) 2006 Charles Samuels <charles@kde.org>
- * Copyright (C) 2008 Holger Hans Peter Freyther
+ * Copyright (C) 2008, 2009 Holger Hans Peter Freyther
  *
  * All rights reserved.
  *
@@ -92,14 +92,14 @@ protected:
         , SplitVCursor(Qt::SplitVCursor)
         , NoDropCursor(Qt::ForbiddenCursor)
         , BlankCursor(Qt::BlankCursor)
-        , ZoomInCursor(QPixmap(QLatin1String(":/webkit/resources/zoomInCursor.png")))
-        , ZoomOutCursor(QPixmap(QLatin1String(":/webkit/resources/zoomOutCursor.png")))
-        , VerticalTextCursor(QPixmap(QLatin1String(":/webkit/resources/verticalTextCursor.png")))
-        , CellCursor(QPixmap(QLatin1String(":/webkit/resources/cellCursor.png")))
-        , ContextMenuCursor(QPixmap(QLatin1String(":/webkit/resources/contextMenuCursor.png")))
-        , CopyCursor(QPixmap(QLatin1String(":/webkit/resources/copyCursor.png")))
-        , ProgressCursor(QPixmap(QLatin1String(":/webkit/resources/progressCursor.png")))
-        , AliasCursor(QPixmap(QLatin1String(":/webkit/resources/aliasCursor.png")))
+        , ZoomInCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/zoomInCursor.png")), 7, 7))
+        , ZoomOutCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/zoomOutCursor.png")), 7, 7))
+        , VerticalTextCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/verticalTextCursor.png")), 7, 7))
+        , CellCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/cellCursor.png")), 7, 7))
+        , ContextMenuCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/contextMenuCursor.png")), 3, 2))
+        , CopyCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/copyCursor.png")), 3, 2))
+        , ProgressCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/progressCursor.png")), 3, 2))
+        , AliasCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/aliasCursor.png")), 11, 3))
 
 #endif
     {
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp
index 66118e140a..9cc27ab074 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp
@@ -32,11 +32,11 @@ namespace WebCore {
 void PlatformWheelEvent::applyDelta(int delta, Qt::Orientation orientation)
 {
     if (orientation == Qt::Horizontal) {
-        m_deltaX = (delta / 120);
+        m_deltaX = (delta / 120.0f);
         m_deltaY = 0;
     } else {
         m_deltaX = 0;
-        m_deltaY = (delta / 120);
+        m_deltaY = (delta / 120.0f);
     }
 
     m_wheelTicksX = m_deltaX;
diff --git a/src/3rdparty/webkit/WebCore/platform/text/String.cpp b/src/3rdparty/webkit/WebCore/platform/text/String.cpp
index bef2674cde..44582a9259 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/String.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/String.cpp
@@ -441,7 +441,7 @@ String String::number(unsigned long n)
 
 String String::number(long long n)
 {
-#if PLATFORM(WIN_OS)
+#if PLATFORM(WIN_OS) && !PLATFORM(QT)
     return String::format("%I64i", n);
 #else
     return String::format("%lli", n);
@@ -450,7 +450,7 @@ String String::number(long long n)
 
 String String::number(unsigned long long n)
 {
-#if PLATFORM(WIN_OS)
+#if PLATFORM(WIN_OS) && !PLATFORM(QT)
     return String::format("%I64u", n);
 #else
     return String::format("%llu", n);
diff --git a/src/3rdparty/webkit/WebCore/platform/win/BitmapInfo.cpp b/src/3rdparty/webkit/WebCore/platform/win/BitmapInfo.cpp
new file mode 100644
index 0000000000..9a2312cf2f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/win/BitmapInfo.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Brent Fulgham
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BitmapInfo.h"
+
+namespace WebCore {
+
+BitmapInfo bitmapInfoForSize(int width, int height)
+{
+    BitmapInfo bitmapInfo;
+    bitmapInfo.bmiHeader.biSize          = sizeof(BITMAPINFOHEADER);
+    bitmapInfo.bmiHeader.biWidth         = width; 
+    bitmapInfo.bmiHeader.biHeight        = height;
+    bitmapInfo.bmiHeader.biPlanes        = 1;
+    bitmapInfo.bmiHeader.biBitCount      = 32;
+    bitmapInfo.bmiHeader.biCompression   = BI_RGB;
+    bitmapInfo.bmiHeader.biSizeImage     = 0;
+    bitmapInfo.bmiHeader.biXPelsPerMeter = 0;
+    bitmapInfo.bmiHeader.biYPelsPerMeter = 0;
+    bitmapInfo.bmiHeader.biClrUsed       = 0;
+    bitmapInfo.bmiHeader.biClrImportant  = 0;
+
+    return bitmapInfo;
+}
+
+BitmapInfo::BitmapInfo()
+{
+    memset(&bmiHeader, 0, sizeof(bmiHeader));
+    bmiHeader.biSize = sizeof(BITMAPINFOHEADER);
+}
+
+BitmapInfo BitmapInfo::create(const IntSize& size)
+{
+   return bitmapInfoForSize(size.width(), size.height());
+}
+
+BitmapInfo BitmapInfo::createBottomUp(const IntSize& size)
+{
+   return bitmapInfoForSize(size.width(), -size.height());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.cpp b/src/3rdparty/webkit/WebCore/platform/win/BitmapInfo.h
index ce2609ce14..0127fdba08 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/win/BitmapInfo.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Brent Fulgham
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,10 +11,10 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
@@ -23,13 +24,20 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "JSHTMLAllCollection.h"
+#ifndef BitmapInfo_h
+#define BitmapInfo_h
 
-using namespace JSC;
+#include <windows.h>
+#include "IntSize.h"
 
 namespace WebCore {
 
-const ClassInfo JSHTMLAllCollection::s_info = { "HTMLAllCollection", 0, 0, 0 };
+struct BitmapInfo : public BITMAPINFO {
+    BitmapInfo ();
+    static BitmapInfo create(const IntSize&);
+    static BitmapInfo createBottomUp(const IntSize&);
+};
 
 } // namespace WebCore
+
+#endif // BitmapInfo_h
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp
index c7979d14ad..ea8e4adeae 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp
@@ -320,7 +320,7 @@ void PluginDatabase::clear()
     m_preferredPlugins.clear();
 }
 
-#if (!PLATFORM(SYMBIAN)) && (!PLATFORM(WIN_OS) || PLATFORM(WX))
+#if (!PLATFORM(WINCE)) && (!PLATFORM(SYMBIAN)) && (!PLATFORM(WIN_OS) || PLATFORM(WX) || !ENABLE(NETSCAPE_PLUGIN_API))
 // For Safari/Win the following three methods are implemented
 // in PluginDatabaseWin.cpp, but if we can use WebCore constructs
 // for the logic we should perhaps move it here under XP_WIN?
@@ -380,7 +380,7 @@ Vector<String> PluginDatabase::defaultPluginDirectories()
     // Add paths specific to each port
 #if PLATFORM(QT)
     Vector<String> qtPaths;
-    String qtPath(getenv("QTWEBKIT_PLUGIN_PATH"));
+    String qtPath(qgetenv("QTWEBKIT_PLUGIN_PATH").constData());
     qtPath.split(UChar(':'), /* allowEmptyEntries */ false, qtPaths);
     paths.append(qtPaths);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
index 19337f0d44..8f2dfa990b 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
@@ -319,15 +319,24 @@ bool PluginPackage::equal(const PluginPackage& a, const PluginPackage& b)
 {
     return a.m_description == b.m_description;
 }
+#endif
 
 int PluginPackage::compareFileVersion(const PlatformModuleVersion& compareVersion) const
 {
     // return -1, 0, or 1 if plug-in version is less than, equal to, or greater than
     // the passed version
+
+#if PLATFORM(WIN_OS)
+    if (m_moduleVersion.mostSig != compareVersion.mostSig)
+        return m_moduleVersion.mostSig > compareVersion.mostSig ? 1 : -1;
+    if (m_moduleVersion.leastSig != compareVersion.leastSig)
+        return m_moduleVersion.leastSig > compareVersion.leastSig ? 1 : -1;
+#else    
     if (m_moduleVersion != compareVersion)
         return m_moduleVersion > compareVersion ? 1 : -1;
+#endif
+
     return 0;
 }
-#endif
 
 }
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
index 8320bc4867..d69f8a731d 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
@@ -394,7 +394,7 @@ static bool getString(ScriptController* proxy, JSValue result, String& string)
         return false;
     JSLock lock(JSC::SilenceAssertionsOnly);
 
-    ExecState* exec = proxy->globalObject()->globalExec();
+    ExecState* exec = proxy->globalObject(pluginWorld())->globalExec();
     UString ustring = result.toString(exec);
     exec->clearException();
 
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginView.h b/src/3rdparty/webkit/WebCore/plugins/PluginView.h
index 1477561aa8..0a57fa62eb 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginView.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginView.h
@@ -61,6 +61,7 @@ namespace JSC {
 namespace WebCore {
     class Element;
     class Frame;
+    class Image;
     class KeyboardEvent;
     class MouseEvent;
     class KURL;
@@ -226,7 +227,7 @@ namespace WebCore {
         void invalidateWindowlessPluginRect(const IntRect&);
 
 #if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
-        void paintWindowedPluginIntoContext(GraphicsContext*, const IntRect&) const;
+        void paintWindowedPluginIntoContext(GraphicsContext*, const IntRect&);
         static HDC WINAPI hookedBeginPaint(HWND, PAINTSTRUCT*);
         static BOOL WINAPI hookedEndPaint(HWND, const PAINTSTRUCT*);
 #endif
@@ -263,6 +264,11 @@ namespace WebCore {
         void handleFocusOutEvent();
 #endif
 
+#if PLATFORM(WIN_OS)
+        void paintIntoTransformedContext(HDC);
+        PassRefPtr<Image> snapshot();
+#endif
+
         int m_mode;
         int m_paramCount;
         char** m_paramNames;
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp b/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
index 28637a11af..e61736b65d 100644
--- a/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
@@ -178,11 +178,20 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     const bool syncX = m_pluginDisplay && m_pluginDisplay != QX11Info::display();
 
     QPainter* painter = context->platformContext();
+    IntRect exposedRect(rect);
+    exposedRect.intersect(frameRect());
+    exposedRect.move(-frameRect().x(), -frameRect().y());
 
     QPixmap qtDrawable = QPixmap::fromX11Pixmap(m_drawable, QPixmap::ExplicitlyShared);
     const int drawableDepth = ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth;
     ASSERT(drawableDepth == qtDrawable.depth());
 
+    // When printing, Qt uses a QPicture to capture the output in preview mode. The
+    // QPicture holds a reference to the X Pixmap. As a result, the print preview would
+    // update itself when the X Pixmap changes. To prevent this, we create a copy.
+    if (m_element->document()->printing())
+        qtDrawable = qtDrawable.copy();
+
     if (m_isTransparent && drawableDepth != 32) {
         // Attempt content propagation for drawable with no alpha by copying over from the backing store
         QPoint offset;
@@ -202,11 +211,11 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
             && backingStoreHasUntransformedContents) {
             GC gc = XDefaultGC(QX11Info::display(), QX11Info::appScreen());
             XCopyArea(QX11Info::display(), backingStorePixmap->handle(), m_drawable, gc,
-                offset.x() + m_windowRect.x() + m_clipRect.x(), offset.y() + m_windowRect.y() + m_clipRect.y(),
-                m_clipRect.width(), m_clipRect.height(), m_clipRect.x(), m_clipRect.y());
+                offset.x() + m_windowRect.x() + exposedRect.x(), offset.y() + m_windowRect.y() + exposedRect.y(),
+                exposedRect.width(), exposedRect.height(), exposedRect.x(), exposedRect.y());
         } else { // no backing store, clean the pixmap because the plugin thinks its transparent
             QPainter painter(&qtDrawable);
-            painter.fillRect(m_clipRect, Qt::white);
+            painter.fillRect(exposedRect, Qt::white);
         }
 
         if (syncX)
@@ -218,19 +227,19 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     XGraphicsExposeEvent& exposeEvent = xevent.xgraphicsexpose;
     exposeEvent.type = GraphicsExpose;
     exposeEvent.display = QX11Info::display();
-    exposeEvent.drawable = m_drawable;
-    exposeEvent.x = m_clipRect.x();
-    exposeEvent.y = m_clipRect.y();
-    exposeEvent.width = m_clipRect.x() + m_clipRect.width(); // flash bug? it thinks width is the right
-    exposeEvent.height = m_clipRect.y() + m_clipRect.height(); // flash bug? it thinks height is the bottom
+    exposeEvent.drawable = qtDrawable.handle();
+    exposeEvent.x = exposedRect.x();
+    exposeEvent.y = exposedRect.y();
+    exposeEvent.width = exposedRect.x() + exposedRect.width(); // flash bug? it thinks width is the right in transparent mode
+    exposeEvent.height = exposedRect.y() + exposedRect.height(); // flash bug? it thinks height is the bottom in transparent mode
 
     dispatchNPEvent(xevent);
 
     if (syncX)
         XSync(m_pluginDisplay, False); // sync changes by plugin
 
-    painter->drawPixmap(frameRect().x() + m_clipRect.x(), frameRect().y() + m_clipRect.y(), qtDrawable,
-        m_clipRect.x(), m_clipRect.y(), m_clipRect.width(), m_clipRect.height());
+    painter->drawPixmap(QPoint(frameRect().x() + exposedRect.x(), frameRect().y() + exposedRect.y()), qtDrawable,
+                        exposedRect);
 }
 
 // TODO: Unify across ports.
@@ -630,7 +639,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
     case NPNVnetscapeWindow: {
         void* w = reinterpret_cast<void*>(value);
         QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
-        *((XID *)w) = client ? client->ownerWidget()->winId() : 0;
+        *((XID *)w) = client ? client->ownerWidget()->window()->winId() : 0;
         return NPERR_NO_ERROR;
     }
 
@@ -661,7 +670,7 @@ void PluginView::invalidateRect(NPRect* rect)
         invalidate();
         return;
     }
-    IntRect r(rect->left, rect->top, rect->right + rect->left, rect->bottom + rect->top);
+    IntRect r(rect->left, rect->top, rect->right - rect->left, rect->bottom - rect->top);
     invalidateWindowlessPluginRect(r);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp b/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp
index e6fb9d51f7..dc9ec17bd9 100644
--- a/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp
@@ -56,17 +56,6 @@ static String getVersionInfo(const LPVOID versionInfoData, const String& info)
     return String(reinterpret_cast<UChar*>(buffer), bufferLength - 1);
 }
 
-int PluginPackage::compareFileVersion(const PlatformModuleVersion& compareVersion) const
-{
-    // return -1, 0, or 1 if plug-in version is less than, equal to, or greater than
-    // the passed version
-    if (m_moduleVersion.mostSig != compareVersion.mostSig)
-        return m_moduleVersion.mostSig > compareVersion.mostSig ? 1 : -1;
-    if (m_moduleVersion.leastSig != compareVersion.leastSig)
-        return m_moduleVersion.leastSig > compareVersion.leastSig ? 1 : -1;
-    return 0;
-}
-
 bool PluginPackage::isPluginBlacklisted()
 {
     if (name() == "Citrix ICA Client") {
diff --git a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
index e1bf8d62ab..5ccce0e3ff 100644
--- a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
@@ -30,6 +30,7 @@
 #include "PluginView.h"
 
 #include "BitmapImage.h"
+#include "BitmapInfo.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -495,7 +496,54 @@ bool PluginView::dispatchNPEvent(NPEvent& npEvent)
     return result;
 }
 
-void PluginView::paintWindowedPluginIntoContext(GraphicsContext* context, const IntRect& rect) const
+void PluginView::paintIntoTransformedContext(HDC hdc)
+{
+    if (m_isWindowed) {
+        SendMessage(platformPluginWidget(), WM_PRINTCLIENT, reinterpret_cast<WPARAM>(hdc), PRF_CLIENT | PRF_CHILDREN | PRF_OWNED);
+        return;
+    }
+
+    m_npWindow.type = NPWindowTypeDrawable;
+    m_npWindow.window = hdc;
+
+    WINDOWPOS windowpos = { 0 };
+
+#if PLATFORM(WINCE)
+    IntRect r = static_cast<FrameView*>(parent())->contentsToWindow(frameRect());
+
+    windowpos.x = r.x();
+    windowpos.y = r.y();
+    windowpos.cx = r.width();
+    windowpos.cy = r.height();
+#else
+    IntPoint p = static_cast<FrameView*>(parent())->contentsToWindow(frameRect().location());
+
+    windowpos.x = p.x();
+    windowpos.y = p.y();
+    windowpos.cx = frameRect().width();
+    windowpos.cy = frameRect().height();
+#endif
+
+    NPEvent npEvent;
+    npEvent.event = WM_WINDOWPOSCHANGED;
+    npEvent.lParam = reinterpret_cast<uint32>(&windowpos);
+    npEvent.wParam = 0;
+
+    dispatchNPEvent(npEvent);
+
+    setNPWindowRect(frameRect());
+
+    npEvent.event = WM_PAINT;
+    npEvent.wParam = reinterpret_cast<uint32>(hdc);
+
+    // This is supposed to be a pointer to the dirty rect, but it seems that the Flash plugin
+    // ignores it so we just pass null.
+    npEvent.lParam = 0;
+
+    dispatchNPEvent(npEvent);
+}
+
+void PluginView::paintWindowedPluginIntoContext(GraphicsContext* context, const IntRect& rect)
 {
 #if !PLATFORM(WINCE)
     ASSERT(m_isWindowed);
@@ -517,7 +565,7 @@ void PluginView::paintWindowedPluginIntoContext(GraphicsContext* context, const
 
     SetWorldTransform(hdc, &transform);
 
-    SendMessage(platformPluginWidget(), WM_PRINTCLIENT, reinterpret_cast<WPARAM>(hdc), PRF_CLIENT | PRF_CHILDREN | PRF_OWNED);
+    paintIntoTransformedContext(hdc);
 
     SetWorldTransform(hdc, &originalTransform);
 
@@ -547,7 +595,6 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     ASSERT(parent()->isFrameView());
     IntRect rectInWindow = static_cast<FrameView*>(parent())->contentsToWindow(frameRect());
     HDC hdc = context->getWindowsContext(rectInWindow, m_isTransparent);
-    NPEvent npEvent;
 
     // On Safari/Windows without transparency layers the GraphicsContext returns the HDC
     // of the window and the plugin expects that the passed in DC has window coordinates.
@@ -563,44 +610,7 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     }
 #endif
 
-    m_npWindow.type = NPWindowTypeDrawable;
-    m_npWindow.window = hdc;
-
-    WINDOWPOS windowpos;
-    memset(&windowpos, 0, sizeof(windowpos));
-
-#if PLATFORM(WINCE)
-    IntRect r = static_cast<FrameView*>(parent())->contentsToWindow(frameRect());
-
-    windowpos.x = r.x();
-    windowpos.y = r.y();
-    windowpos.cx = r.width();
-    windowpos.cy = r.height();
-#else
-    IntPoint p = static_cast<FrameView*>(parent())->contentsToWindow(frameRect().location());
-
-    windowpos.x = p.x();
-    windowpos.y = p.y();
-    windowpos.cx = frameRect().width();
-    windowpos.cy = frameRect().height();
-#endif
-
-    npEvent.event = WM_WINDOWPOSCHANGED;
-    npEvent.lParam = reinterpret_cast<uint32>(&windowpos);
-    npEvent.wParam = 0;
-
-    dispatchNPEvent(npEvent);
-
-    setNPWindowRect(frameRect());
-
-    npEvent.event = WM_PAINT;
-    npEvent.wParam = reinterpret_cast<uint32>(hdc);
-
-    // This is supposed to be a pointer to the dirty rect, but it seems that the Flash plugin
-    // ignores it so we just pass null.
-    npEvent.lParam = 0;
-
-    dispatchNPEvent(npEvent);
+    paintIntoTransformedContext(hdc);
 
     context->releaseWindowsContext(hdc, frameRect(), m_isTransparent);
 }
@@ -1018,6 +1028,39 @@ void PluginView::platformDestroy()
     setPlatformPluginWidget(0);
 }
 
+PassRefPtr<Image> PluginView::snapshot()
+{
+    OwnPtr<HDC> hdc(CreateCompatibleDC(0));
+
+    if (!m_isWindowed) {
+        // Enable world transforms.
+        SetGraphicsMode(hdc.get(), GM_ADVANCED);
+
+        XFORM transform;
+        GetWorldTransform(hdc.get(), &transform);
+
+        // Windowless plug-ins assume that they're drawing onto the view's DC.
+        // Translate the context so that the plug-in draws at (0, 0).
+        ASSERT(parent()->isFrameView());
+        IntPoint position = static_cast<FrameView*>(parent())->contentsToWindow(frameRect()).location();
+        transform.eDx = -position.x();
+        transform.eDy = -position.y();
+        SetWorldTransform(hdc.get(), &transform);
+    }
+
+    void* bits;
+    BitmapInfo bmp = BitmapInfo::createBottomUp(frameRect().size());
+    OwnPtr<HBITMAP> hbmp(CreateDIBSection(0, &bmp, DIB_RGB_COLORS, &bits, 0, 0));
+
+    HBITMAP hbmpOld = static_cast<HBITMAP>(SelectObject(hdc.get(), hbmp.get()));
+
+    paintIntoTransformedContext(hdc.get());
+
+    SelectObject(hdc.get(), hbmpOld);
+
+    return BitmapImage::create(hbmp.get());
+}
+
 void PluginView::halt()
 {
     ASSERT(!m_isHalted);
@@ -1025,8 +1068,7 @@ void PluginView::halt()
 
 #if !PLATFORM(QT)
     // Show a screenshot of the plug-in.
-    OwnPtr<HBITMAP> nodeImage(m_parentFrame->nodeImage(m_element));
-    toRenderWidget(m_element->renderer())->showSubstituteImage(BitmapImage::create(nodeImage.get()));
+    toRenderWidget(m_element->renderer())->showSubstituteImage(snapshot());
 #endif
 
     m_isHalted = true;
diff --git a/src/3rdparty/webkit/WebCore/rendering/HitTestResult.cpp b/src/3rdparty/webkit/WebCore/rendering/HitTestResult.cpp
index 0aaddc9fd0..50933c6d49 100644
--- a/src/3rdparty/webkit/WebCore/rendering/HitTestResult.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/HitTestResult.cpp
@@ -123,17 +123,6 @@ Frame* HitTestResult::targetFrame() const
     return frame->tree()->find(m_innerURLElement->target());
 }
 
-IntRect HitTestResult::boundingBox() const
-{
-    if (m_innerNonSharedNode) {
-        RenderObject* renderer = m_innerNonSharedNode->renderer();
-        if (renderer)
-            return renderer->absoluteBoundingBoxRect();
-    }
-    
-    return IntRect();
-}
-
 bool HitTestResult::isSelected() const
 {
     if (!m_innerNonSharedNode)
@@ -246,7 +235,7 @@ IntRect HitTestResult::imageRect() const
 {
     if (!image())
         return IntRect();
-    return m_innerNonSharedNode->renderBox()->absoluteContentBox();
+    return m_innerNonSharedNode->renderBox()->absoluteContentQuad().enclosingBoundingBox();
 }
 
 KURL HitTestResult::absoluteImageURL() const
diff --git a/src/3rdparty/webkit/WebCore/rendering/HitTestResult.h b/src/3rdparty/webkit/WebCore/rendering/HitTestResult.h
index f29ca41950..25e10585c5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/HitTestResult.h
+++ b/src/3rdparty/webkit/WebCore/rendering/HitTestResult.h
@@ -63,7 +63,6 @@ public:
     void setIsOverWidget(bool b) { m_isOverWidget = b; }
 
     Frame* targetFrame() const;
-    IntRect boundingBox() const;
     bool isSelected() const;
     String spellingToolTip(TextDirection&) const;
     String replacedString() const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
index 73b9a3a998..9611660427 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
@@ -646,6 +646,15 @@ void MediaControlVolumeSliderElement::defaultEventHandler(Event* event)
     }
 }
 
+void MediaControlVolumeSliderElement::update()
+{
+    float volume = m_mediaElement->volume();
+    if (value().toFloat() != volume) {
+        setValue(String::number(volume));
+        MediaControlInputElement::update();
+    }
+}
+
 // ----------------------------
 
 MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(Document* document, HTMLMediaElement* element)
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
index e562bb5159..8b297733fd 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
@@ -234,6 +234,7 @@ class MediaControlVolumeSliderElement : public MediaControlInputElement {
 public:
     MediaControlVolumeSliderElement(Document*, HTMLMediaElement*);
     virtual void defaultEventHandler(Event*);
+    virtual void update();
 };
 
 // ----------------------------
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBox.h b/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
index 41c5622588..9050dcbe14 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
@@ -318,7 +318,7 @@ protected:
     
     virtual bool shouldCalculateSizeAsReplaced() const { return isReplaced() && !isInlineBlockOrInlineTable(); }
 
-    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState&) const;
     virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
index 05d29d0d8c..03021137c4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
@@ -30,6 +30,7 @@
 #include "RenderArena.h"
 #include "RenderBlock.h"
 #include "RenderView.h"
+#include "TransformState.h"
 #include "VisiblePosition.h"
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -705,6 +706,92 @@ void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
     o->computeRectForRepaint(repaintContainer, rect, fixed);
 }
 
+IntSize RenderInline::offsetFromContainer(RenderObject* container) const
+{
+    ASSERT(container == this->container());
+
+    IntSize offset;    
+    if (isRelPositioned())
+        offset += relativePositionOffset();
+
+    if (!isInline() || isReplaced()) {
+        RenderBlock* cb;
+        if (container->isBlockFlow() && (cb = toRenderBlock(container))->hasColumns()) {
+            IntRect rect(0, 0, 1, 1);
+            cb->adjustRectForColumns(rect);
+        }
+    }
+
+    if (container->hasOverflowClip())
+        offset -= toRenderBox(container)->layer()->scrolledContentOffset();
+
+    return offset;
+}
+
+void RenderInline::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState& transformState) const
+{
+    if (repaintContainer == this)
+        return;
+
+    if (RenderView *v = view()) {
+        if (v->layoutStateEnabled() && !repaintContainer) {
+            LayoutState* layoutState = v->layoutState();
+            IntSize offset = layoutState->m_offset;
+            if (style()->position() == RelativePosition && layer())
+                offset += layer()->relativePositionOffset();
+            transformState.move(offset);
+            return;
+        }
+    }
+
+    bool containerSkipped;
+    RenderObject* o = container(repaintContainer, &containerSkipped);
+    if (!o)
+        return;
+
+    IntSize containerOffset = offsetFromContainer(o);
+
+    bool preserve3D = useTransforms && (o->style()->preserves3D() || style()->preserves3D());
+    if (useTransforms && shouldUseTransformFromContainer(o)) {
+        TransformationMatrix t;
+        getTransformFromContainer(o, containerOffset, t);
+        transformState.applyTransform(t, preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+    } else
+        transformState.move(containerOffset.width(), containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+
+    if (containerSkipped) {
+        // There can't be a transform between repaintContainer and o, because transforms create containers, so it should be safe
+        // to just subtract the delta between the repaintContainer and o.
+        IntSize containerOffset = repaintContainer->offsetFromAncestorContainer(o);
+        transformState.move(-containerOffset.width(), -containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+        return;
+    }
+
+    o->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
+}
+
+void RenderInline::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState& transformState) const
+{
+    // We don't expect this function to be called during layout.
+    ASSERT(!view() || !view()->layoutStateEnabled());
+
+    RenderObject* o = container();
+    if (!o)
+        return;
+
+    o->mapAbsoluteToLocalPoint(fixed, useTransforms, transformState);
+
+    IntSize containerOffset = offsetFromContainer(o);
+
+    bool preserve3D = useTransforms && (o->style()->preserves3D() || style()->preserves3D());
+    if (useTransforms && shouldUseTransformFromContainer(o)) {
+        TransformationMatrix t;
+        getTransformFromContainer(o, containerOffset, t);
+        transformState.applyTransform(t, preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+    } else
+        transformState.move(-containerOffset.width(), -containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+}
+
 void RenderInline::updateDragState(bool dragOn)
 {
     RenderBoxModelObject::updateDragState(dragOn);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderInline.h b/src/3rdparty/webkit/WebCore/rendering/RenderInline.h
index 8e0064e702..8e9715ccbd 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderInline.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderInline.h
@@ -44,6 +44,8 @@ public:
     virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
     virtual void absoluteQuads(Vector<FloatQuad>&);
 
+    virtual IntSize offsetFromContainer(RenderObject*) const;
+
     IntRect linesBoundingBox() const;
     IntRect linesVisibleOverflowBoundingBox() const;
 
@@ -107,6 +109,9 @@ private:
     virtual IntRect rectWithOutlineForRepaint(RenderBoxModelObject* repaintContainer, int outlineWidth);
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& rect, bool fixed);
 
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState&) const;
+    virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
+
     virtual VisiblePosition positionForPoint(const IntPoint&);
 
     virtual IntRect borderBoundingBox() const
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
index 1da26289d1..1d4da23381 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
@@ -258,6 +258,7 @@ void RenderMedia::createVolumeSlider()
     m_volumeSlider = new MediaControlVolumeSliderElement(document(), mediaElement());
     m_volumeSlider->setAttribute(precisionAttr, "float");
     m_volumeSlider->setAttribute(maxAttr, "1");
+    m_volumeSlider->setAttribute(valueAttr, String::number(mediaElement()->volume()));
     m_volumeSlider->attachToParent(m_volumeSliderContainer.get());
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.cpp
index ed20ecf691..56fbec43c2 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -54,6 +54,12 @@ static Image* platformResource(const char* name)
     return 0;
 }
 
+static bool hasSource(const HTMLMediaElement* mediaElement)
+{
+    return mediaElement->networkState() != HTMLMediaElement::NETWORK_EMPTY
+        && mediaElement->networkState() != HTMLMediaElement::NETWORK_NO_SOURCE;
+}
+
 static bool paintMediaButton(GraphicsContext* context, const IntRect& rect, Image* image)
 {
     IntRect imageRect = image->rect();
@@ -71,7 +77,7 @@ static bool paintMediaMuteButton(RenderObject* object, const RenderObject::Paint
     static Image* soundNone = platformResource("mediaSoundNone");
     static Image* soundDisabled = platformResource("mediaSoundDisabled");
 
-    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE || !mediaElement->hasAudio())
+    if (!hasSource(mediaElement) || !mediaElement->hasAudio())
         return paintMediaButton(paintInfo.context, rect, soundDisabled);
 
     return paintMediaButton(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
@@ -87,8 +93,7 @@ static bool paintMediaPlayButton(RenderObject* object, const RenderObject::Paint
     static Image* mediaPause = platformResource("mediaPause");
     static Image* mediaPlayDisabled = platformResource("mediaPlayDisabled");
 
-    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_EMPTY ||
-        mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE)
+    if (!hasSource(mediaElement))
         return paintMediaButton(paintInfo.context, rect, mediaPlayDisabled);
 
     return paintMediaButton(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
@@ -147,6 +152,13 @@ static bool paintMediaSliderThumb(RenderObject* object, const RenderObject::Pain
     if (!object->parent()->isSlider())
         return false;
 
+    HTMLMediaElement* mediaElement = toParentMediaElement(object->parent());
+    if (!mediaElement)
+        return false;
+
+    if (!hasSource(mediaElement))
+        return true;
+
     static Image* mediaSliderThumb = platformResource("mediaSliderThumb");
     return paintMediaButton(paintInfo.context, rect, mediaSliderThumb);
 }
@@ -228,6 +240,8 @@ bool RenderMediaControlsChromium::shouldRenderMediaControlPart(ControlPart part,
     case MediaCurrentTimePart:
     case MediaTimeRemainingPart:
         return true;
+    default:
+        ;
     }
     return false;
 }
@@ -258,6 +272,9 @@ bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType
     case MediaCurrentTimeDisplay:
     case MediaTimeRemainingDisplay:
     case MediaControlsPanel:
+    case MediaRewindButton:
+    case MediaReturnToRealtimeButton:
+    case MediaStatusDisplay:
         ASSERT_NOT_REACHED();
         break;
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
index 20503f33cb..4b38d53e74 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
@@ -611,21 +611,11 @@ bool RenderThemeChromiumWin::paintTextFieldInternal(RenderObject* o,
                                                     const IntRect& r,
                                                     bool drawEdges)
 {
-    // Nasty hack to make us not paint the border on text fields with a
-    // border-radius. Webkit paints elements with border-radius for us.
-    // FIXME: Get rid of this if-check once we can properly clip rounded
-    // borders: http://b/1112604 and http://b/1108635
-    // FIXME: make sure we do the right thing if css background-clip is set.
-    if (o->style()->hasBorderRadius())
-        return false;
-
-    const ThemeData& themeData = getThemeData(o);
-
     // Fallback to white if the specified color object is invalid.
+    // (Note ChromiumBridge::paintTextField duplicates this check).
     Color backgroundColor(Color::white);
-    if (o->style()->backgroundColor().isValid()) {
+    if (o->style()->backgroundColor().isValid())
         backgroundColor = o->style()->backgroundColor();
-    }
 
     // If we have background-image, don't fill the content area to expose the
     // parent's background. Also, we shouldn't fill the content area if the
@@ -634,17 +624,32 @@ bool RenderThemeChromiumWin::paintTextFieldInternal(RenderObject* o,
     // Note that we should paint the content area white if we have neither the
     // background color nor background image explicitly specified to keep the
     // appearance of select element consistent with other browsers.
-    bool fillContentArea = !o->style()->hasBackgroundImage() && backgroundColor.alpha() != 0;
-
-    WebCore::ThemePainter painter(i.context, r);
-    ChromiumBridge::paintTextField(painter.context(),
-                                   themeData.m_part,
-                                   themeData.m_state,
-                                   themeData.m_classicState,
-                                   painter.drawRect(),
-                                   backgroundColor,
-                                   fillContentArea,
-                                   drawEdges);
+    bool fillContentArea = !o->style()->hasBackgroundImage() && backgroundColor.alpha();
+
+    if (o->style()->hasBorderRadius()) {
+        // If the style has rounded borders, setup the context to clip the
+        // background (themed or filled) appropriately.
+        // FIXME: make sure we do the right thing if css background-clip is set.
+        i.context->save();
+        IntSize topLeft, topRight, bottomLeft, bottomRight;
+        o->style()->getBorderRadiiForRect(r, topLeft, topRight, bottomLeft, bottomRight);
+        i.context->addRoundedRectClip(r, topLeft, topRight, bottomLeft, bottomRight);
+    }
+    {
+        const ThemeData& themeData = getThemeData(o);
+        WebCore::ThemePainter painter(i.context, r);
+        ChromiumBridge::paintTextField(painter.context(),
+                                       themeData.m_part,
+                                       themeData.m_state,
+                                       themeData.m_classicState,
+                                       painter.drawRect(),
+                                       backgroundColor,
+                                       fillContentArea,
+                                       drawEdges);
+        // End of block commits the painter before restoring context.
+    }
+    if (o->style()->hasBorderRadius())
+        i.context->restore();
     return false;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
index bbc54a7200..3b8698081f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
@@ -59,7 +59,7 @@ namespace WebCore {
 
         // System fonts.
         virtual void systemFont(int propId, FontDescription&) const;
-        virtual Color systemColor(int cssValueId) const;
+        virtual Color systemColor(int cssValueId) const;

 
         virtual void adjustSliderThumbSize(RenderObject*) const;
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp
index 5c6e738d2b..b7ab191d7d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp
@@ -28,6 +28,7 @@
 
 #include "CSSMutableStyleDeclaration.h"
 #include "CharacterNames.h"
+#include "CString.h"
 #include "Document.h"
 #include "Frame.h"
 #include "FrameView.h"
@@ -553,4 +554,31 @@ String externalRepresentation(RenderObject* o)
     return ts.release();
 }
 
+static void writeCounterValuesFromChildren(TextStream& stream, RenderObject* parent)
+{
+    for (RenderObject* child = parent->firstChild(); child; child = child->nextSibling()) {
+        if (child->isCounter()) {
+            String str(toRenderText(child)->text());
+            stream << str;
+        }
+    }
+}
+
+String counterValueForElement(Element* element)
+{
+    // Make sure the element is not freed during the layout.
+    RefPtr<Element> elementRef(element);
+    element->document()->updateLayout();
+    TextStream stream;
+    // The counter renderers should be children of anonymous children
+    // (i.e., :before or :after pseudo-elements).
+    if (RenderObject* renderer = element->renderer()) {
+        for (RenderObject* child = renderer->firstChild(); child; child = child->nextSibling()) {
+            if (child->isAnonymous())
+                writeCounterValuesFromChildren(stream, child);
+        }
+    }
+    return stream.release();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.h b/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.h
index daca25379f..325f109478 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.h
@@ -28,15 +28,18 @@
 
 namespace WebCore {
 
-    class RenderObject;
-    class String;
-    class TextStream;
+class Element;
+class RenderObject;
+class String;
+class TextStream;
 
-    String externalRepresentation(RenderObject*);
-    void write(TextStream&, const RenderObject&, int indent = 0);
+String externalRepresentation(RenderObject*);
+void write(TextStream&, const RenderObject&, int indent = 0);
 
-    // Helper function shared with SVGRenderTreeAsText
-    String quoteAndEscapeNonPrintables(const String&);
+// Helper function shared with SVGRenderTreeAsText
+String quoteAndEscapeNonPrintables(const String&);
+
+String counterValueForElement(Element*);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
index 0f295e4f5f..ea087f9031 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
@@ -94,6 +94,9 @@ void SVGRenderBase::prepareToRenderSVGContent(RenderObject* object, RenderObject
         paintInfo.context->beginTransparencyLayer(opacity);
     }
 
+    if (ShadowData* shadow = svgStyle->shadow())
+        paintInfo.context->setShadow(IntSize(shadow->x, shadow->y), shadow->blur, shadow->color); 
+
 #if ENABLE(FILTERS)
     AtomicString filterId(svgStyle->filter());
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.cpp b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.cpp
index 1289b06b79..e8827c4733 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.cpp
@@ -51,6 +51,7 @@ SVGRenderStyle::SVGRenderStyle()
     mask = defaultStyle->mask;
     misc = defaultStyle->misc;
     markers = defaultStyle->markers;
+    shadowSVG = defaultStyle->shadowSVG;
 
     setBitDefaults();
 }
@@ -67,6 +68,7 @@ SVGRenderStyle::SVGRenderStyle(CreateDefaultType)
     mask.init();
     misc.init();
     markers.init();
+    shadowSVG.init();
 }
 
 SVGRenderStyle::SVGRenderStyle(const SVGRenderStyle& other)
@@ -80,6 +82,7 @@ SVGRenderStyle::SVGRenderStyle(const SVGRenderStyle& other)
     mask = other.mask;
     misc = other.misc;
     markers = other.markers;
+    shadowSVG = other.shadowSVG;
 
     svg_inherited_flags = other.svg_inherited_flags;
     svg_noninherited_flags = other.svg_noninherited_flags;
@@ -93,7 +96,7 @@ bool SVGRenderStyle::operator==(const SVGRenderStyle& o) const
 {
     return (fill == o.fill && stroke == o.stroke && text == o.text &&
         stops == o.stops && clip == o.clip && mask == o.mask &&
-        misc == o.misc && markers == o.markers &&
+        misc == o.misc && markers == o.markers && shadowSVG == o.shadowSVG &&
         svg_inherited_flags == o.svg_inherited_flags &&
         svg_noninherited_flags == o.svg_noninherited_flags);
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h
index e50d349897..12477d771e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h
@@ -30,6 +30,7 @@
 #include "GraphicsTypes.h"
 #include "SVGPaint.h"
 #include "SVGRenderStyleDefs.h"
+#include "ShadowData.h"
 
 #include <wtf/Platform.h>
 
@@ -98,6 +99,8 @@ namespace WebCore {
         SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(Color, misc, lightingColor, LightingColor, lightingColor, Color(255, 255, 255))
         SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(CSSValue, misc, baselineShiftValue, BaselineShiftValue, baselineShiftValue, 0)
 
+        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_OWNPTR(ShadowData, shadowSVG, shadow, Shadow, shadow, 0)
+
         // convenience
         bool hasStroke() const { return (strokePaint()->paintType() != SVGPaint::SVG_PAINTTYPE_NONE); }
         bool hasFill() const { return (fillPaint()->paintType() != SVGPaint::SVG_PAINTTYPE_NONE); }
@@ -172,6 +175,7 @@ namespace WebCore {
         DataRef<StyleClipData> clip;
         DataRef<StyleMaskData> mask;
         DataRef<StyleMiscData> misc;
+        DataRef<StyleShadowSVGData> shadowSVG;
 
     private:
         enum CreateDefaultType { CreateDefault };
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.cpp b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.cpp
index f5faad3e8d..2ed1d8fcc1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.cpp
@@ -213,6 +213,25 @@ bool StyleMiscData::operator==(const StyleMiscData &other) const
            && baselineShiftValue == other.baselineShiftValue;
 }
 
+StyleShadowSVGData::StyleShadowSVGData()
+{
+}
+
+StyleShadowSVGData::StyleShadowSVGData(const StyleShadowSVGData& other)
+    : RefCounted<StyleShadowSVGData>()
+    , shadow(other.shadow ? new ShadowData(*other.shadow) : 0)
+{
+}
+
+bool StyleShadowSVGData::operator==(const StyleShadowSVGData& other) const
+{
+    if ((!shadow && other.shadow) || (shadow && !other.shadow))
+        return false;
+    if (shadow && other.shadow && (*shadow != *other.shadow))
+        return false;
+    return true;
+}
+
 #endif // ENABLE(SVG)
 
 // vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h
index c0f5d4efea..f4cf9327a3 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h
@@ -33,6 +33,9 @@
 #include "Color.h"
 #include "Path.h"
 #include "PlatformString.h"
+#include "ShadowData.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
@@ -65,6 +68,13 @@
     } \
     static Data* initial##Type() { return Initial; }
 
+#define SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_OWNPTR(Data, Group, Variable, Type, Name, Initial) \
+    Data* Name() const { return Group->Variable.get(); } \
+    void set##Type(Data* obj) { \
+        Group.access()->Variable.set(obj); \
+    } \
+    static Data* initial##Type() { return Initial; }
+
 #define SVG_RS_SET_VARIABLE(Group, Variable, Value) \
     if (!(Group->Variable == Value)) \
         Group.access()->Variable = Value;
@@ -279,6 +289,24 @@ namespace WebCore {
         StyleMiscData();
         StyleMiscData(const StyleMiscData&);
     };
+    
+    class StyleShadowSVGData : public RefCounted<StyleShadowSVGData> {
+    public:
+        static PassRefPtr<StyleShadowSVGData> create() { return adoptRef(new StyleShadowSVGData); }
+        PassRefPtr<StyleShadowSVGData> copy() const { return adoptRef(new StyleShadowSVGData(*this)); }
+        
+        bool operator==(const StyleShadowSVGData& other) const;
+        bool operator!=(const StyleShadowSVGData& other) const
+        {
+            return !(*this == other);
+        }
+
+        OwnPtr<ShadowData> shadow;
+
+    private:
+        StyleShadowSVGData();
+        StyleShadowSVGData(const StyleShadowSVGData& other);
+    };
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/storage/Database.cpp b/src/3rdparty/webkit/WebCore/storage/Database.cpp
index 08ea289a3b..5aaa26f8ef 100644
--- a/src/3rdparty/webkit/WebCore/storage/Database.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/Database.cpp
@@ -46,6 +46,7 @@
 #include "NotImplemented.h"
 #include "Page.h"
 #include "OriginQuotaManager.h"
+#include "ScriptController.h"
 #include "SQLiteDatabase.h"
 #include "SQLiteFileSystem.h"
 #include "SQLiteStatement.h"
@@ -57,7 +58,6 @@
 
 #if USE(JSC)
 #include "JSDOMWindow.h"
-#include <runtime/InitializeThreading.h>
 #endif
 
 namespace WebCore {
@@ -128,7 +128,7 @@ PassRefPtr<Database> Database::openDatabase(Document* document, const String& na
         return 0;
     }
 
-    RefPtr<Database> database = adoptRef(new Database(document, name, expectedVersion));
+    RefPtr<Database> database = adoptRef(new Database(document, name, expectedVersion, displayName, estimatedSize));
 
     if (!database->openAndVerifyVersion(e)) {
        LOG(StorageAPI, "Failed to open and verify version (expected %s) of database %s", expectedVersion.ascii().data(), database->databaseDebugName().ascii().data());
@@ -147,27 +147,28 @@ PassRefPtr<Database> Database::openDatabase(Document* document, const String& na
     return database;
 }
 
-Database::Database(Document* document, const String& name, const String& expectedVersion)
+Database::Database(Document* document, const String& name, const String& expectedVersion, const String& displayName, unsigned long estimatedSize)
     : m_transactionInProgress(false)
     , m_document(document)
     , m_name(name.crossThreadString())
     , m_guid(0)
     , m_expectedVersion(expectedVersion)
+    , m_displayName(displayName)
+    , m_estimatedSize(estimatedSize)
     , m_deleted(false)
     , m_stopped(false)
     , m_opened(false)
 {
     ASSERT(document);
-    m_securityOrigin = document->securityOrigin();
+    m_mainThreadSecurityOrigin = document->securityOrigin();
+    m_databaseThreadSecurityOrigin = m_mainThreadSecurityOrigin->threadsafeCopy();
 
     if (m_name.isNull())
         m_name = "";
 
-#if USE(JSC)
-    JSC::initializeThreading();
-#endif
+    ScriptController::initializeThreading();
 
-    m_guid = guidForOriginAndName(m_securityOrigin->toString(), name);
+    m_guid = guidForOriginAndName(m_mainThreadSecurityOrigin->toString(), name);
 
     {
         MutexLocker locker(guidMutex());
@@ -183,7 +184,7 @@ Database::Database(Document* document, const String& name, const String& expecte
 
     ASSERT(m_document->databaseThread());
 
-    m_filename = DatabaseTracker::tracker().fullPathForDatabase(m_securityOrigin.get(), m_name);
+    m_filename = DatabaseTracker::tracker().fullPathForDatabase(m_mainThreadSecurityOrigin.get(), m_name);
 
     DatabaseTracker::tracker().addOpenDatabase(this);
     m_document->addOpenDatabase(this);
@@ -366,20 +367,9 @@ void Database::stop()
     }
 }
 
-unsigned long long Database::databaseSize() const
-{
-    return SQLiteFileSystem::getDatabaseFileSize(m_filename);
-}
-
 unsigned long long Database::maximumSize() const
 {
-    // The maximum size for this database is the full quota for this origin, minus the current usage within this origin,
-    // except for the current usage of this database
-
-    OriginQuotaManager& manager(DatabaseTracker::tracker().originQuotaManager());
-    Locker<OriginQuotaManager> locker(manager);
-
-    return DatabaseTracker::tracker().quotaForOrigin(m_securityOrigin.get()) - manager.diskUsage(m_securityOrigin.get()) + databaseSize();
+    return DatabaseTracker::tracker().getMaxSizeForDatabase(this);
 }
 
 void Database::disableAuthorizer()
@@ -647,9 +637,13 @@ void Database::setExpectedVersion(const String& version)
     updateGuidVersionMap(m_guid, version);
 }
 
-PassRefPtr<SecurityOrigin> Database::securityOriginCopy() const
+SecurityOrigin* Database::securityOrigin() const
 {
-    return m_securityOrigin->threadsafeCopy();
+    if (isMainThread())
+        return m_mainThreadSecurityOrigin.get();
+    if (currentThread() == document()->databaseThread()->getThreadID())
+        return m_databaseThreadSecurityOrigin.get();
+    return 0;
 }
 
 String Database::stringIdentifier() const
@@ -658,6 +652,23 @@ String Database::stringIdentifier() const
     return m_name.threadsafeCopy();
 }
 
+String Database::displayName() const
+{
+    // Return a deep copy for ref counting thread safety
+    return m_displayName.threadsafeCopy();
+}
+
+unsigned long Database::estimatedSize() const
+{
+    return m_estimatedSize;
+}
+
+String Database::fileName() const
+{
+    // Return a deep copy for ref counting thread safety
+    return m_filename.threadsafeCopy();
+}
+
 #endif
 
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/Database.h b/src/3rdparty/webkit/WebCore/storage/Database.h
index b8506863eb..f275027e20 100644
--- a/src/3rdparty/webkit/WebCore/storage/Database.h
+++ b/src/3rdparty/webkit/WebCore/storage/Database.h
@@ -89,8 +89,11 @@ public:
     Vector<String> tableNames();
 
     Document* document() const { return m_document.get(); }
-    PassRefPtr<SecurityOrigin> securityOriginCopy() const;
+    SecurityOrigin* securityOrigin() const;
     String stringIdentifier() const;
+    String displayName() const;
+    unsigned long estimatedSize() const;
+    String fileName() const;
 
     bool getVersionFromDatabase(String&);
     bool setVersionInDatabase(const String&);
@@ -121,7 +124,8 @@ public:
     SQLTransactionCoordinator* transactionCoordinator() const;
 
 private:
-    Database(Document* document, const String& name, const String& expectedVersion);
+    Database(Document* document, const String& name, const String& expectedVersion,
+             const String& displayName, unsigned long estimatedSize);
 
     bool openAndVerifyVersion(ExceptionCode&);
 
@@ -136,10 +140,13 @@ private:
     static void deliverPendingCallback(void*);
 
     RefPtr<Document> m_document;
-    RefPtr<SecurityOrigin> m_securityOrigin;
+    RefPtr<SecurityOrigin> m_mainThreadSecurityOrigin;
+    RefPtr<SecurityOrigin> m_databaseThreadSecurityOrigin;
     String m_name;
     int m_guid;
     String m_expectedVersion;
+    String m_displayName;
+    unsigned long m_estimatedSize;
     String m_filename;
 
     bool m_deleted;
@@ -152,7 +159,7 @@ private:
     RefPtr<DatabaseAuthorizer> m_databaseAuthorizer;
 
 #ifndef NDEBUG
-    String databaseDebugName() const { return m_securityOrigin->toString() + "::" + m_name; }
+    String databaseDebugName() const { return m_mainThreadSecurityOrigin->toString() + "::" + m_name; }
 #endif
 };
 
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp b/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp
index 9e3afdd4a7..40c83ee116 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp
@@ -152,22 +152,20 @@ void DatabaseThread::scheduleImmediateTask(PassRefPtr<DatabaseTask> task)
     m_queue.prepend(task);
 }
 
+class SameDatabasePredicate {
+public:
+    SameDatabasePredicate(const Database* database) : m_database(database) { }
+    bool operator()(RefPtr<DatabaseTask>& task) const { return task->database() == m_database; }
+private:
+    const Database* m_database;
+};
+
 void DatabaseThread::unscheduleDatabaseTasks(Database* database)
 {
     // Note that the thread loop is running, so some tasks for the database
     // may still be executed. This is unavoidable.
-
-    Deque<RefPtr<DatabaseTask> > filteredReverseQueue;
-    RefPtr<DatabaseTask> task;
-    while (m_queue.tryGetMessage(task)) {
-        if (task->database() != database)
-            filteredReverseQueue.append(task);
-    }
-
-    while (!filteredReverseQueue.isEmpty()) {
-        m_queue.append(filteredReverseQueue.first());
-        filteredReverseQueue.removeFirst();
-    }
+    SameDatabasePredicate predicate(database);
+    m_queue.removeIf(predicate);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
index 265cd0d51c..c0c424209b 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
@@ -33,6 +33,7 @@
 
 #include "ChromeClient.h"
 #include "Database.h"
+#include "DatabaseThread.h"
 #include "DatabaseTrackerClient.h"
 #include "Document.h"
 #include "Logging.h"
@@ -182,6 +183,16 @@ bool DatabaseTracker::hasEntryForDatabase(SecurityOrigin* origin, const String&
     return statement.step() == SQLResultRow;
 }
 
+unsigned long long DatabaseTracker::getMaxSizeForDatabase(const Database* database)
+{
+    ASSERT(currentThread() == database->document()->databaseThread()->getThreadID());
+    // The maximum size for a database is the full quota for its origin, minus the current usage within the origin,
+    // plus the current usage of the given database
+    Locker<OriginQuotaManager> locker(originQuotaManager());
+    SecurityOrigin* origin = database->securityOrigin();
+    return quotaForOrigin(origin) - originQuotaManager().diskUsage(origin) + SQLiteFileSystem::getDatabaseFileSize(database->fileName());
+}
+
 String DatabaseTracker::originPath(SecurityOrigin* origin) const
 {
     ASSERT(currentThread() == m_thread);
@@ -409,13 +420,11 @@ void DatabaseTracker::addOpenDatabase(Database* database)
     if (!m_openDatabaseMap)
         m_openDatabaseMap.set(new DatabaseOriginMap);
 
-    RefPtr<SecurityOrigin> origin(database->securityOriginCopy());
     String name(database->stringIdentifier());
-
-    DatabaseNameMap* nameMap = m_openDatabaseMap->get(origin);
+    DatabaseNameMap* nameMap = m_openDatabaseMap->get(database->securityOrigin());
     if (!nameMap) {
         nameMap = new DatabaseNameMap;
-        m_openDatabaseMap->set(origin, nameMap);
+        m_openDatabaseMap->set(database->securityOrigin(), nameMap);
     }
 
     DatabaseSet* databaseSet = nameMap->get(name);
@@ -441,10 +450,8 @@ void DatabaseTracker::removeOpenDatabase(Database* database)
         return;
     }
 
-    RefPtr<SecurityOrigin> origin(database->securityOriginCopy());
     String name(database->stringIdentifier());
-
-    DatabaseNameMap* nameMap = m_openDatabaseMap->get(origin);
+    DatabaseNameMap* nameMap = m_openDatabaseMap->get(database->securityOrigin());
     if (!nameMap) {
         ASSERT_NOT_REACHED();
         return;
@@ -469,7 +476,7 @@ void DatabaseTracker::removeOpenDatabase(Database* database)
     if (!nameMap->isEmpty())
         return;
 
-    m_openDatabaseMap->remove(origin);
+    m_openDatabaseMap->remove(database->securityOrigin());
     delete nameMap;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h
index 2f6e06dfbb..85e4858ad0 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h
@@ -86,6 +86,8 @@ public:
 
     bool hasEntryForOrigin(SecurityOrigin*);
 
+    unsigned long long getMaxSizeForDatabase(const Database*);
+
 private:
     DatabaseTracker();
 
diff --git a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
index 20bb34d1f5..30b32717ac 100644
--- a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
@@ -104,8 +104,7 @@ void OriginQuotaManager::markDatabase(Database* database)
 {
     ASSERT(database);
     ASSERT(m_usageRecordGuardLocked);
-    RefPtr<SecurityOrigin> origin = database->securityOriginCopy();
-    OriginUsageRecord* usageRecord = m_usageMap.get(origin);
+    OriginUsageRecord* usageRecord = m_usageMap.get(database->securityOrigin());
     ASSERT(usageRecord);
 
     usageRecord->markDatabase(database->stringIdentifier());
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
index 149b384c56..165685b15e 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
@@ -40,7 +40,6 @@
 #include "Logging.h"
 #include "Page.h"
 #include "PlatformString.h"
-#include "SecurityOrigin.h"
 #include "Settings.h"
 #include "SQLError.h"
 #include "SQLiteTransaction.h"
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.cpp b/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.cpp
index e72f5ed79e..5918bd8ef0 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.cpp
@@ -47,7 +47,7 @@ void SQLTransactionClient::didCommitTransaction(SQLTransaction* transaction)
     ASSERT(currentThread() == transaction->database()->document()->databaseThread()->getThreadID());
     Database* database = transaction->database();
     DatabaseTracker::tracker().scheduleNotifyDatabaseChanged(
-        database->document()->securityOrigin(), database->stringIdentifier());
+        database->securityOrigin(), database->stringIdentifier());
 }
 
 void SQLTransactionClient::didExecuteStatement(SQLTransaction* transaction)
@@ -65,11 +65,9 @@ bool SQLTransactionClient::didExceedQuota(SQLTransaction* transaction)
     Page* page = database->document()->page();
     ASSERT(page);
 
-    RefPtr<SecurityOrigin> origin = database->securityOriginCopy();
-
-    unsigned long long currentQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
+    unsigned long long currentQuota = DatabaseTracker::tracker().quotaForOrigin(database->securityOrigin());
     page->chrome()->client()->exceededDatabaseQuota(database->document()->frame(), database->stringIdentifier());
-    unsigned long long newQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
+    unsigned long long newQuota = DatabaseTracker::tracker().quotaForOrigin(database->securityOrigin());
     return (newQuota > currentQuota);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEventDispatcher.cpp b/src/3rdparty/webkit/WebCore/storage/StorageEventDispatcher.cpp
index d2eab664a2..9763e076cd 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageEventDispatcher.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEventDispatcher.cpp
@@ -55,7 +55,7 @@ void StorageEventDispatcher::dispatch(const String& key, const String& oldValue,
         }
 
         for (unsigned i = 0; i < frames.size(); ++i)
-            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), frames[i]->domWindow()->sessionStorage()));
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), frames[i]->domWindow()->sessionStorage()));
     } else {
         // Send events to every page.
         const HashSet<Page*>& pages = page->group().pages();
@@ -68,7 +68,7 @@ void StorageEventDispatcher::dispatch(const String& key, const String& oldValue,
         }
 
         for (unsigned i = 0; i < frames.size(); ++i)
-            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), frames[i]->domWindow()->localStorage()));
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), frames[i]->domWindow()->localStorage()));
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.cpp
index 98b6459ba1..6960519a5c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.cpp
@@ -245,20 +245,23 @@ PassRefPtr<CSSValue> SVGStyledElement::getPresentationAttribute(const String& na
     if (!mappedAttributes())
         return 0;
 
-    Attribute* attr = mappedAttributes()->getAttributeItem(QualifiedName(nullAtom, name, nullAtom));
+    QualifiedName attributeName(nullAtom, name, nullAtom);
+    Attribute* attr = mappedAttributes()->getAttributeItem(attributeName);
     if (!attr || !attr->isMappedAttribute() || !attr->style())
         return 0;
 
     MappedAttribute* cssSVGAttr = static_cast<MappedAttribute*>(attr);
-
-    // FIXME: Is it possible that the style will not be shared at the time this
-    // is called, but a later addition to the DOM will make it shared?
-    if (!cssSVGAttr->style()->hasOneRef()) {
+    // This function returns a pointer to a CSSValue which can be mutated from JavaScript.
+    // If the associated MappedAttribute uses the same CSSMappedAttributeDeclaration
+    // as StyledElement's mappedAttributeDecls cache, create a new CSSMappedAttributeDeclaration
+    // before returning so that any modifications to the CSSValue will not affect other attributes.
+    MappedAttributeEntry entry;
+    mapToEntry(attributeName, entry);
+    if (getMappedAttributeDecl(entry, cssSVGAttr) == cssSVGAttr->decl()) {
         cssSVGAttr->setDecl(0);
         int propId = SVGStyledElement::cssPropertyIdForSVGAttributeName(cssSVGAttr->name());
         addCSSProperty(cssSVGAttr, propId, cssSVGAttr->value());
     }
-
     return cssSVGAttr->style()->getPropertyCSSValue(name);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.cpp b/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.cpp
index e969514f9a..be8ab78494 100644
--- a/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.cpp
@@ -28,6 +28,52 @@
 
 namespace WebCore {
 
+void SynchronizableProperties::addProperty(SVGAnimatedPropertyBase* base)
+{
+    m_bases.add(base);
+}
+
+void SynchronizableProperties::synchronize()
+{
+    ASSERT(!m_bases.isEmpty());
+    if (m_shouldSynchronize) {
+        BaseSet::iterator it = m_bases.begin();
+        BaseSet::iterator end = m_bases.end();
+
+        for (; it != end; ++it) {
+            SVGAnimatedPropertyBase* base = *it;
+            ASSERT(base);
+            base->synchronize();
+        }
+    }
+}
+
+void SynchronizableProperties::startAnimation()
+{
+    ASSERT(!m_bases.isEmpty());
+    BaseSet::iterator it = m_bases.begin();
+    BaseSet::iterator end = m_bases.end();
+
+    for (; it != end; ++it) {
+        SVGAnimatedPropertyBase* base = *it;
+        ASSERT(base);
+        base->startAnimation();
+    }
+}
+
+void SynchronizableProperties::stopAnimation()
+{
+    ASSERT(!m_bases.isEmpty());
+    BaseSet::iterator it = m_bases.begin();
+    BaseSet::iterator end = m_bases.end();
+
+    for (; it != end; ++it) {
+        SVGAnimatedPropertyBase* base = *it;
+        ASSERT(base);
+        base->stopAnimation();
+    }
+}
+
 SynchronizablePropertyController::SynchronizablePropertyController()
 {
 }
@@ -36,20 +82,15 @@ void SynchronizablePropertyController::registerProperty(const QualifiedName& att
 {
     // 'attrName' is ambigious. For instance in SVGMarkerElement both 'orientType' / 'orientAngle'
     // SVG DOM objects are synchronized with the 'orient' attribute. This why we need a HashSet.
-    SynchronizableProperty property(base);
-
     PropertyMap::iterator it = m_map.find(attrName.localName());
     if (it == m_map.end()) {
-        Properties properties;
-        properties.add(property);
+        SynchronizableProperties properties;
+        properties.addProperty(base);
         m_map.set(attrName.localName(), properties);
         return;
     }
 
-    Properties& properties = it->second;
-    ASSERT(!properties.isEmpty());
-
-    properties.add(property);
+    it->second.addProperty(base);
 }
 
 void SynchronizablePropertyController::setPropertyNeedsSynchronization(const QualifiedName& attrName)
@@ -57,17 +98,7 @@ void SynchronizablePropertyController::setPropertyNeedsSynchronization(const Qua
     PropertyMap::iterator itProp = m_map.find(attrName.localName());
     ASSERT(itProp != m_map.end());
 
-    Properties& properties = itProp->second;
-    ASSERT(!properties.isEmpty());
-
-    Properties::iterator it = properties.begin();
-    Properties::iterator end = properties.end();
-
-    for (; it != end; ++it) {
-        SynchronizableProperty& property = *it;
-        ASSERT(property.base);
-        property.shouldSynchronize = true;
-    }
+    itProp->second.setNeedsSynchronization();
 }
 
 void SynchronizablePropertyController::synchronizeProperty(const String& name)
@@ -76,21 +107,7 @@ void SynchronizablePropertyController::synchronizeProperty(const String& name)
     if (itProp == m_map.end())
         return;
 
-    Properties& properties = itProp->second;
-    ASSERT(!properties.isEmpty());
-
-    Properties::iterator it = properties.begin();
-    Properties::iterator end = properties.end();
-
-    for (; it != end; ++it) {
-        SynchronizableProperty& property = *it;
-        ASSERT(property.base);
-
-        if (!property.shouldSynchronize)
-            continue;
-
-        property.base->synchronize();
-    }
+    itProp->second.synchronize();
 }
 
 void SynchronizablePropertyController::synchronizeAllProperties()
@@ -101,23 +118,8 @@ void SynchronizablePropertyController::synchronizeAllProperties()
     PropertyMap::iterator itProp = m_map.begin();
     PropertyMap::iterator endProp = m_map.end();
 
-    for (; itProp != endProp; ++itProp) {
-        Properties& properties = itProp->second;
-        ASSERT(!properties.isEmpty());
-
-        Properties::iterator it = properties.begin();
-        Properties::iterator end = properties.end();
-
-        for (; it != end; ++it) {
-            SynchronizableProperty& property = *it;
-            ASSERT(property.base);
-
-            if (!property.shouldSynchronize)
-                continue;
-
-            property.base->synchronize();
-        }
-    }
+    for (; itProp != endProp; ++itProp)
+        itProp->second.synchronize();
 }
 
 void SynchronizablePropertyController::startAnimation(const String& name)
@@ -126,17 +128,7 @@ void SynchronizablePropertyController::startAnimation(const String& name)
     if (itProp == m_map.end())
         return;
 
-    Properties& properties = itProp->second;
-    ASSERT(!properties.isEmpty());
-
-    Properties::iterator it = properties.begin();
-    Properties::iterator end = properties.end();
-
-    for (; it != end; ++it) {
-        SynchronizableProperty& property = *it;
-        ASSERT(property.base);
-        property.base->startAnimation();
-    }
+    itProp->second.startAnimation();
 }
 
 void SynchronizablePropertyController::stopAnimation(const String& name)
@@ -145,17 +137,7 @@ void SynchronizablePropertyController::stopAnimation(const String& name)
     if (itProp == m_map.end())
         return;
 
-    Properties& properties = itProp->second;
-    ASSERT(!properties.isEmpty());
-
-    Properties::iterator it = properties.begin();
-    Properties::iterator end = properties.end();
-
-    for (; it != end; ++it) {
-        SynchronizableProperty& property = *it;
-        ASSERT(property.base);
-        property.base->stopAnimation();
-    }
+    itProp->second.stopAnimation();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.h b/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.h
index b7f101b0fc..1ec50265d1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.h
+++ b/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.h
@@ -31,65 +31,28 @@ namespace WebCore {
 class QualifiedName;
 class SVGAnimatedPropertyBase;
 
-struct SynchronizableProperty {
-    SynchronizableProperty()
-        : base(0)
-        , shouldSynchronize(false)
-    {
-    }
-
-    explicit SynchronizableProperty(SVGAnimatedPropertyBase* _base)
-        : base(_base)
-        , shouldSynchronize(false)
-    {
-    }
-
-    explicit SynchronizableProperty(WTF::HashTableDeletedValueType)
-        : base(reinterpret_cast<SVGAnimatedPropertyBase*>(-1))
-        , shouldSynchronize(false)
-    {
-    }
-
-    bool isHashTableDeletedValue() const
-    {
-        return base == reinterpret_cast<SVGAnimatedPropertyBase*>(-1);
-    }
-
-    bool operator==(const SynchronizableProperty& other) const
-    {
-        return base == other.base && shouldSynchronize == other.shouldSynchronize;
-    }
-
-    SVGAnimatedPropertyBase* base;
-    bool shouldSynchronize;
-};
-
-struct SynchronizablePropertyHash {
-    static unsigned hash(const SynchronizableProperty& key)
+class SynchronizableProperties {
+public:
+    SynchronizableProperties()
+        : m_shouldSynchronize(false)
     {
-        return StringImpl::computeHash(reinterpret_cast<const UChar*>(&key), sizeof(SynchronizableProperty) / sizeof(UChar));
     }
 
-    static bool equal(const SynchronizableProperty& a, const SynchronizableProperty& b)
+    void setNeedsSynchronization()
     {
-        return a == b;
+        m_shouldSynchronize = true;
     }
 
-    static const bool safeToCompareToEmptyOrDeleted = true;
-};
-
-struct SynchronizablePropertyHashTraits : WTF::GenericHashTraits<SynchronizableProperty> {
-    static const bool emptyValueIsZero = true;
+    void addProperty(SVGAnimatedPropertyBase*);
+    void synchronize();
+    void startAnimation();
+    void stopAnimation();
 
-    static void constructDeletedValue(SynchronizableProperty& slot)
-    {
-        new (&slot) SynchronizableProperty(WTF::HashTableDeletedValue);
-    }
+private:
+    typedef HashSet<SVGAnimatedPropertyBase*> BaseSet;
 
-    static bool isDeletedValue(const SynchronizableProperty& value)
-    {
-        return value.isHashTableDeletedValue();
-    }
+    BaseSet m_bases;
+    bool m_shouldSynchronize;
 };
 
 // Helper class used exclusively by SVGElement to keep track of all animatable properties within a SVGElement,
@@ -110,8 +73,7 @@ private:
     SynchronizablePropertyController();
 
 private:
-    typedef HashSet<SynchronizableProperty, SynchronizablePropertyHash, SynchronizablePropertyHashTraits> Properties;
-    typedef HashMap<String, Properties> PropertyMap;
+    typedef HashMap<String, SynchronizableProperties> PropertyMap;
 
     PropertyMap m_map;
 };
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp b/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp
index f3bbdd7ffa..32e05591c0 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp
@@ -110,7 +110,8 @@ WebSocket::WebSocket(ScriptExecutionContext* context)
 
 WebSocket::~WebSocket()
 {
-    close();
+    if (m_channel.get())
+        m_channel->disconnect();
 }
 
 void WebSocket::connect(const KURL& url, ExceptionCode& ec)
@@ -190,7 +191,7 @@ ScriptExecutionContext* WebSocket::scriptExecutionContext() const
 void WebSocket::didConnect()
 {
     LOG(Network, "WebSocket %p didConnect", this);
-    if (m_state != CONNECTING) {
+    if (m_state != CONNECTING || !scriptExecutionContext()) {
         didClose();
         return;
     }
@@ -201,7 +202,7 @@ void WebSocket::didConnect()
 void WebSocket::didReceiveMessage(const String& msg)
 {
     LOG(Network, "WebSocket %p didReceiveMessage %s", this, msg.utf8().data());
-    if (m_state != OPEN)
+    if (m_state != OPEN || !scriptExecutionContext())
         return;
     RefPtr<MessageEvent> evt = MessageEvent::create();
     // FIXME: origin, lastEventId, source, messagePort.
@@ -213,7 +214,8 @@ void WebSocket::didClose()
 {
     LOG(Network, "WebSocket %p didClose", this);
     m_state = CLOSED;
-    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, Event::create(eventNames().closeEvent, false, false)));
+    if (scriptExecutionContext())
+        scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, Event::create(eventNames().closeEvent, false, false)));
 }
 
 EventTargetData* WebSocket::eventTargetData()
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.cpp b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.cpp
index 145cd340eb..be388b42f4 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.cpp
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.cpp
@@ -71,6 +71,7 @@ void WebSocketChannel::connect()
     LOG(Network, "WebSocketChannel %p connect", this);
     ASSERT(!m_handle.get());
     m_handshake.reset();
+    ref();
     m_handle = SocketStreamHandle::create(m_handshake.url(), this);
 }
 
@@ -103,6 +104,14 @@ void WebSocketChannel::close()
         m_handle->close();  // will call didClose()
 }
 
+void WebSocketChannel::disconnect()
+{
+    LOG(Network, "WebSocketChannel %p disconnect", this);
+    m_client = 0;
+    if (m_handle.get())
+        m_handle->close();
+}
+
 void WebSocketChannel::willOpenStream(SocketStreamHandle*, const KURL&)
 {
 }
@@ -126,13 +135,15 @@ void WebSocketChannel::didClose(SocketStreamHandle* handle)
 {
     LOG(Network, "WebSocketChannel %p didClose", this);
     ASSERT(handle == m_handle.get() || !m_handle.get());
-    if (!m_handle.get())
-        return;
-    m_unhandledBufferSize = handle->bufferedAmount();
-    WebSocketChannelClient* client = m_client;
-    m_client = 0;
-    m_handle = 0;
-    client->didClose();
+    if (m_handle.get()) {
+        m_unhandledBufferSize = handle->bufferedAmount();
+        WebSocketChannelClient* client = m_client;
+        m_client = 0;
+        m_handle = 0;
+        if (client)
+            client->didClose();
+    }
+    deref();
 }
 
 void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* data, int len)
@@ -143,6 +154,10 @@ void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* da
         handle->close();
         return;
     }
+    if (!m_client) {
+        handle->close();
+        return;
+    }
     if (m_handshake.mode() != WebSocketHandshake::Connected) {
         int headerLength = m_handshake.readServerHandshake(m_buffer, m_bufferSize);
         if (headerLength <= 0)
@@ -184,7 +199,7 @@ void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* da
                     handle->close();
                     return;
                 }
-                length = length * 128 + *p & 0x7f;
+                length = length * 128 + (*p & 0x7f);
                 ++p;
             }
             if (p + length < end) {
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.h b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.h
index 75f41f6dce..ad38163a12 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.h
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.h
@@ -47,7 +47,7 @@ namespace WebCore {
 
     class WebSocketChannel : public RefCounted<WebSocketChannel>, public SocketStreamHandleClient {
     public:
-        static PassRefPtr<WebSocketChannel> create(ScriptExecutionContext* context, WebSocketChannelClient* client, const KURL& url, const String& protocol) { return new WebSocketChannel(context, client, url, protocol); }
+        static PassRefPtr<WebSocketChannel> create(ScriptExecutionContext* context, WebSocketChannelClient* client, const KURL& url, const String& protocol) { return adoptRef(new WebSocketChannel(context, client, url, protocol)); }
         virtual ~WebSocketChannel();
 
         virtual void connect();
@@ -57,6 +57,8 @@ namespace WebCore {
 
         virtual void close();
 
+        virtual void disconnect();
+
         virtual void willOpenStream(SocketStreamHandle*, const KURL&);
         virtual void willSendData(SocketStreamHandle*, const char*, int);
         virtual void didOpen(SocketStreamHandle*);
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerContext.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerContext.cpp
index f4d795b24c..9a88309f2a 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerContext.cpp
@@ -49,6 +49,7 @@
 #include "WorkerThreadableLoader.h"
 #include "XMLHttpRequestException.h"
 #include <wtf/RefPtr.h>
+#include <wtf/UnusedParam.h>
 
 #if ENABLE(NOTIFICATIONS)
 #include "NotificationCenter.h"
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerContext.idl b/src/3rdparty/webkit/WebCore/workers/WorkerContext.idl
index 17bee55416..0a5817cee6 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerContext.idl
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerContext.idl
@@ -72,7 +72,7 @@ module threads {
 
 #if defined(ENABLE_NOTIFICATIONS) && ENABLE_NOTIFICATIONS
         // Notification interface
-        readonly attribute NotificationCenter webkitNotifications;
+        readonly attribute [EnabledAtRuntime] NotificationCenter webkitNotifications;
 #endif
 
         // Constructors
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp
index ca48d8d2d0..87a65401e7 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp
@@ -33,6 +33,7 @@
 #include "EventNames.h"
 #include "File.h"
 #include "HTTPParsers.h"
+#include "InspectorTimelineAgent.h"
 #include "ResourceError.h"
 #include "ResourceRequest.h"
 #include "SecurityOrigin.h"
@@ -47,7 +48,9 @@
 #include <wtf/RefCountedLeakCounter.h>
 
 #if USE(JSC)
+#include "JSDOMBinding.h"
 #include "JSDOMWindow.h"
+#include <runtime/Protect.h>
 #endif
 
 namespace WebCore {
@@ -248,10 +251,32 @@ void XMLHttpRequest::callReadyStateChangeListener()
     if (!scriptExecutionContext())
         return;
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext());
+    if (timelineAgent)
+        timelineAgent->willChangeXHRReadyState(m_url.string(), m_state);
+#endif
+
     dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().readystatechangeEvent));
 
-    if (m_state == DONE && !m_error)
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didChangeXHRReadyState();
+#endif
+
+    if (m_state == DONE && !m_error) {
+#if ENABLE(INSPECTOR)
+        if (timelineAgent)
+            timelineAgent->willLoadXHR(m_url.string());
+#endif
+
         dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadEvent));
+
+#if ENABLE(INSPECTOR)
+        if (timelineAgent)
+            timelineAgent->didLoadXHR();
+#endif
+    }
 }
 
 void XMLHttpRequest::setWithCredentials(bool value, ExceptionCode& ec)
@@ -604,10 +629,8 @@ void XMLHttpRequest::dropProtection()
     // out. But it is protected from GC while loading, so this
     // can't be recouped until the load is done, so only
     // report the extra cost at that point.
-
-    if (JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(scriptExecutionContext()))
-        if (DOMObject* wrapper = getCachedDOMObjectWrapper(*globalObject->globalData(), this))
-            JSC::Heap::heap(wrapper)->reportExtraMemoryCost(m_responseText.size() * 2);
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*scriptExecutionContext()->globalData(), this))
+        JSC::Heap::heap(wrapper)->reportExtraMemoryCost(m_responseText.size() * 2);
 #endif
 
     unsetPendingActivity(this);
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h
index 30744a0062..c7e019254e 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h
@@ -182,7 +182,7 @@ private:
     unsigned m_lastSendLineNumber;
     String m_lastSendURL;
     ExceptionCode m_exceptionCode;
-    
+
     EventTargetData m_eventTargetData;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathFunctions.cpp b/src/3rdparty/webkit/WebCore/xml/XPathFunctions.cpp
index da39443266..1089f7c633 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathFunctions.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XPathFunctions.cpp
@@ -667,12 +667,13 @@ Value FunRound::evaluate() const
     return round(arg(0)->evaluate().toNumber());
 }
 
+struct FunctionMapping {
+    const char* name;
+    FunctionRec function;
+};
+
 static void createFunctionMap()
 {
-    struct FunctionMapping {
-        const char *name;
-        FunctionRec function;
-    };
     static const FunctionMapping functions[] = {
         { "boolean", { &createFunBoolean, 1 } },
         { "ceiling", { &createFunCeiling, 1 } },
diff --git a/src/3rdparty/webkit/WebKit.pri b/src/3rdparty/webkit/WebKit.pri
index 2dba0d443b..10291b4c87 100644
--- a/src/3rdparty/webkit/WebKit.pri
+++ b/src/3rdparty/webkit/WebKit.pri
@@ -25,6 +25,10 @@ building-libs {
                 LIBS += -lQtWebKit$${QT_MAJOR_VERSION}
             } else {
                 LIBS += -lQtWebKit
+                symbian {
+                    TARGET.EPOCSTACKSIZE = 0x14000 // 80 kB
+                    TARGET.EPOCHEAPSIZE = 0x20000 0x2000000 // Min 128kB, Max 32MB
+                }
             }
         }
     }
diff --git a/src/3rdparty/webkit/WebKit/ChangeLog b/src/3rdparty/webkit/WebKit/ChangeLog
index 607a0397af..5006da7f66 100644
--- a/src/3rdparty/webkit/WebKit/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/ChangeLog
@@ -1,3 +1,19 @@
+2009-10-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Updated license
+
+        * LICENSE:
+
+2009-10-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Move some WebView event handling code into its own file, WebViewEventHandling.mm
+
+        * WebKit.xcodeproj/project.pbxproj:
+
 2009-10-19  John Gregg  <johnnyg@google.com>
 
         Reviewed by Dimitri Glazkov.
diff --git a/src/3rdparty/webkit/WebKit/LICENSE b/src/3rdparty/webkit/WebKit/LICENSE
index 47dee862ee..f29b41c3b2 100644
--- a/src/3rdparty/webkit/WebKit/LICENSE
+++ b/src/3rdparty/webkit/WebKit/LICENSE
@@ -1,25 +1,21 @@
-Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
-
 1.  Redistributions of source code must retain the above copyright
-    notice, this list of conditions and the following disclaimer. 
+    notice, this list of conditions and the following disclaimer.
 2.  Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
-    documentation and/or other materials provided with the distribution. 
-3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
-    its contributors may be used to endorse or promote products derived
-    from this software without specific prior written permission. 
+    documentation and/or other materials provided with the distribution.
 
-THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
 EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
 DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig b/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig
index 6572d2c582..fabc00986e 100644
--- a/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig
+++ b/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 3;
+MINOR_VERSION = 4;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
@@ -36,6 +36,7 @@ SYSTEM_VERSION_PREFIX_ = 4; // Some Tiger versions of Xcode don't set MAC_OS_X_V
 SYSTEM_VERSION_PREFIX_1040 = 4;
 SYSTEM_VERSION_PREFIX_1050 = 5;
 SYSTEM_VERSION_PREFIX_1060 = 6;
+SYSTEM_VERSION_PREFIX_1070 = 7;
 
 // The production build always uses the full version with a system version prefix.
 BUNDLE_VERSION_Production = $(SYSTEM_VERSION_PREFIX)$(FULL_VERSION);
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
index 0cb4204247..50a09865f4 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
@@ -164,101 +164,17 @@ void QGraphicsWebViewPrivate::_q_setStatusBarMessage(const QString& s)
 
 /*!
     \class QGraphicsWebView
-    \brief The QGraphicsWebView class allows Web content to be added to a GraphicsView.
+    \brief The QGraphicsWebView class allows web content to be added to a GraphicsView.
     \since 4.6
 
-    An instance of this class renders Web content from a URL or supplied as data, using
-    features of the QtWebKit module.
+    A WebGraphicsItem renders web content based on a URL or set data.
 
-    If the width and height of the item is not set, they will dynamically adjust to
-    a size appropriate for the content. This width may be large (e.g., 980 pixels or
-    more) for typical online Web pages.
-
-    \section1 Browser Features
-
-    Many of the functions, signals and properties provided by QWebView are also available
-    for this item, making it simple to adapt existing code to use QGraphicsWebView instead
-    of QWebView.
-
-    The item uses a QWebPage object to perform the rendering of Web content, and this can
-    be obtained with the page() function, enabling the document itself to be accessed and
-    modified.
-
-    As with QWebView, the item records the browsing history using a QWebHistory object,
-    accessible using the history() function. The QWebSettings object that defines the
-    configuration of the browser can be obtained with the settings() function, enabling
-    features like plugin support to be customized for each item.
-
-    \sa QWebView, QGraphicsTextItem
-*/
-
-/*!
-    \fn void QGraphicsWebView::titleChanged(const QString &title)
-
-    This signal is emitted whenever the \a title of the main frame changes.
-
-    \sa title()
+    If the width and height of the item is not set, they will
+    dynamically adjust to a size appropriate for the content.
+    This width may be large (eg. 980) for typical online web pages.
 */
 
 /*!
-    \fn void QGraphicsWebView::urlChanged(const QUrl &url)
-
-    This signal is emitted when the \a url of the view changes.
-
-    \sa url(), load()
-*/
-
-/*!
-    \fn void QGraphicsWebView::statusChanged()
-
-    This signal is emitted when the status bar text is changed by the page.
-*/
-
-/*!
-    \fn void QGraphicsWebView::iconChanged()
-
-    This signal is emitted whenever the icon of the page is loaded or changes.
-
-    In order for icons to be loaded, you will need to set an icon database path
-    using QWebSettings::setIconDatabasePath().
-
-    \sa icon(), QWebSettings::setIconDatabasePath()
-*/
-
-/*!
-    \fn void QGraphicsWebView::loadStarted()
-
-    This signal is emitted when a new load of the page is started.
-
-    \sa progressChanged(), loadFinished()
-*/
-
-/*!
-    \fn void QGraphicsWebView::loadFinished(bool ok)
-
-    This signal is emitted when a load of the page is finished.
-    \a ok will indicate whether the load was successful or any error occurred.
-
-    \sa loadStarted()
-*/
-
-/*!
-    \fn void QGraphicsWebView::progressChanged(qreal progress)
-
-    This signal is emitted every time an element in the web page
-    completes loading and the overall loading progress advances.
-
-    This signal tracks the progress of all child frames.
-
-    The current value is provided by \a progress and scales from 0.0 to 1.0,
-    which is the default range of QProgressBar.
-
-    \sa loadStarted(), loadFinished()
-*/
-
-
-
-/*!
     Constructs an empty QGraphicsWebView with parent \a parent.
 
     \sa load()
@@ -275,12 +191,16 @@ QGraphicsWebView::QGraphicsWebView(QGraphicsItem* parent)
 }
 
 /*!
-    Destroys the item.
+    Destroys the web graphicsitem.
 */
 QGraphicsWebView::~QGraphicsWebView()
 {
     if (d->page) {
+#if QT_VERSION >= 0x040600
+        d->page->d->view.clear();
+#else
         d->page->d->view = 0;
+#endif
         d->page->d->client = 0; // unset the page client
     }
 
@@ -330,6 +250,28 @@ bool QGraphicsWebView::sceneEvent(QEvent* event)
 
 /*! \reimp
 */
+QVariant QGraphicsWebView::itemChange(GraphicsItemChange change, const QVariant& value)
+{
+    switch (change) {
+    // Differently from QWebView, it is interesting to QGraphicsWebView to handle
+    // post mouse cursor change notifications. Reason: 'ItemCursorChange' is sent
+    // as the first action in QGraphicsItem::setCursor implementation, and at that
+    // item widget's cursor has not been effectively changed yet.
+    // After cursor is properly set (at 'ItemCursorHasChanged' emission time), we
+    // fire 'CursorChange'.
+    case ItemCursorChange:
+        return value;
+    case ItemCursorHasChanged:
+        QEvent event(QEvent::CursorChange);
+        QApplication::sendEvent(this, &event);
+        return value;
+    }
+
+    return QGraphicsWidget::itemChange(change, value);
+}
+
+/*! \reimp
+*/
 bool QGraphicsWebView::event(QEvent* event)
 {
     // Re-implemented in order to allows fixing event-related bugs in patch releases.
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
index 26f7374a5f..43cf59a62d 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
@@ -85,6 +85,7 @@ public:
     virtual void setGeometry(const QRectF& rect);
     virtual void updateGeometry();
     virtual void paint(QPainter*, const QStyleOptionGraphicsItem* options, QWidget* widget = 0);
+    virtual QVariant itemChange(GraphicsItemChange change, const QVariant& value);
     virtual bool event(QEvent*);
 
 public Q_SLOTS:
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
index 5b83870190..6305d10ad8 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
@@ -202,23 +202,9 @@ bool QWebElement::isNull() const
 
     \sa findFirst()
 */
-QList<QWebElement> QWebElement::findAll(const QString &selectorQuery) const
+QWebElementCollection QWebElement::findAll(const QString &selectorQuery) const
 {
-    QList<QWebElement> elements;
-    if (!m_element)
-        return elements;
-
-    ExceptionCode exception = 0; // ###
-    RefPtr<NodeList> nodes = m_element->querySelectorAll(selectorQuery, exception);
-    if (!nodes)
-        return elements;
-
-    for (unsigned i = 0; i < nodes->length(); ++i) {
-        WebCore::Node* n = nodes->item(i);
-        elements.append(QWebElement(static_cast<Element*>(n)));
-    }
-
-    return elements;
+    return QWebElementCollection(*this, selectorQuery);
 }
 
 /*!
@@ -682,7 +668,7 @@ static bool setupScriptContext(WebCore::Element* element, JSC::JSValue& thisValu
     if (!scriptController)
         return false;
 
-    state = scriptController->globalObject()->globalExec();
+    state = scriptController->globalObject(mainThreadNormalWorld())->globalExec();
     if (!state)
         return false;
 
@@ -1137,7 +1123,7 @@ QWebElement QWebElement::clone() const
     The element is still valid after removal, and can be inserted into other
     parts of the document.
 
-    \sa removeChildren(), removeFromDocument()
+    \sa removeAllChildren(), removeFromDocument()
 */
 QWebElement &QWebElement::takeFromDocument()
 {
@@ -1153,7 +1139,7 @@ QWebElement &QWebElement::takeFromDocument()
 /*!
     Removes this element from the document and makes it a null element.
 
-    \sa removeChildren(), takeFromDocument()
+    \sa removeAllChildren(), takeFromDocument()
 */
 void QWebElement::removeFromDocument()
 {
@@ -1171,7 +1157,7 @@ void QWebElement::removeFromDocument()
 
     \sa removeFromDocument(), takeFromDocument()
 */
-void QWebElement::removeChildren()
+void QWebElement::removeAllChildren()
 {
     if (!m_element)
         return;
@@ -1450,3 +1436,391 @@ void QWebElement::render(QPainter* painter)
     context.restore();
 }
 
+class QWebElementCollectionPrivate : public QSharedData
+{
+public:
+    static QWebElementCollectionPrivate* create(const PassRefPtr<Node> &context, const QString &query);
+
+    RefPtr<NodeList> m_result;
+
+private:
+    inline QWebElementCollectionPrivate() {}
+};
+
+QWebElementCollectionPrivate* QWebElementCollectionPrivate::create(const PassRefPtr<Node> &context, const QString &query)
+{
+    if (!context)
+        return 0;
+
+    // Let WebKit do the hard work hehehe
+    ExceptionCode exception = 0; // ###
+    RefPtr<NodeList> nodes = context->querySelectorAll(query, exception);
+    if (!nodes)
+        return 0;
+
+    QWebElementCollectionPrivate* priv = new QWebElementCollectionPrivate;
+    priv->m_result = nodes;
+    return priv;
+}
+
+/*!
+    \class QWebElementCollection
+    \since 4.6
+    \brief The QWebElementCollection class represents a collection of web elements.
+    \preliminary
+
+    Elements in a document can be selected using QWebElement::findAll() or using the
+    QWebElement constructor. The collection is composed by choosing all elements in the
+    document that match a specified CSS selector expression.
+
+    The number of selected elements is provided through the count() property. Individual
+    elements can be retrieved by index using at().
+
+    It is also possible to iterate through all elements in the collection using Qt's foreach
+    macro:
+
+    \code
+        QWebElementCollection collection = document.findAll("p");
+        foreach (QWebElement paraElement, collection) {
+            ...
+        }
+    \endcode
+*/
+
+/*!
+    Constructs an empty collection.
+*/
+QWebElementCollection::QWebElementCollection()
+{
+}
+
+/*!
+    Constructs a copy of \a other.
+*/
+QWebElementCollection::QWebElementCollection(const QWebElementCollection &other)
+    : d(other.d)
+{
+}
+
+/*!
+    Constructs a collection of elements from the list of child elements of \a contextElement that
+    match the specified CSS selector \a query.
+*/
+QWebElementCollection::QWebElementCollection(const QWebElement &contextElement, const QString &query)
+{
+    d = QExplicitlySharedDataPointer<QWebElementCollectionPrivate>(QWebElementCollectionPrivate::create(contextElement.m_element, query));
+}
+
+/*!
+    Assigns \a other to this collection and returns a reference to this collection.
+*/
+QWebElementCollection &QWebElementCollection::operator=(const QWebElementCollection &other)
+{
+    d = other.d;
+    return *this;
+}
+
+/*!
+    Destroys the collection.
+*/
+QWebElementCollection::~QWebElementCollection()
+{
+}
+
+/*! \fn QWebElementCollection &QWebElementCollection::operator+=(const QWebElementCollection &other)
+
+    Appends the items of the \a other list to this list and returns a
+    reference to this list.
+
+    \sa operator+(), append()
+*/
+
+/*!
+    Returns a collection that contains all the elements of this collection followed
+    by all the elements in the \a other collection. Duplicates may occur in the result.
+
+    \sa operator+=()
+*/
+QWebElementCollection QWebElementCollection::operator+(const QWebElementCollection &other) const
+{
+    QWebElementCollection n = *this; n.d.detach(); n += other; return n;
+}
+
+/*!
+    Extends the collection by appending all items of \a other.
+
+    The resulting collection may include duplicate elements.
+
+    \sa operator+=()
+*/
+void QWebElementCollection::append(const QWebElementCollection &other)
+{
+    if (!d) {
+        *this = other;
+        return;
+    }
+    if (!other.d)
+        return;
+    Vector<RefPtr<Node> > nodes;
+    RefPtr<NodeList> results[] = { d->m_result, other.d->m_result };
+    nodes.reserveInitialCapacity(results[0]->length() + results[1]->length());
+
+    for (int i = 0; i < 2; ++i) {
+        int j = 0;
+        Node* n = results[i]->item(j);
+        while (n) {
+            nodes.append(n);
+            n = results[i]->item(++j);
+        }
+    }
+
+    d->m_result = StaticNodeList::adopt(nodes);
+}
+
+/*!
+    Returns the number of elements in the collection.
+*/
+int QWebElementCollection::count() const
+{
+    if (!d)
+        return 0;
+    return d->m_result->length();
+}
+
+/*!
+    Returns the element at index position \a i in the collection.
+*/
+QWebElement QWebElementCollection::at(int i) const
+{
+    if (!d)
+        return QWebElement();
+    Node* n = d->m_result->item(i);
+    return QWebElement(static_cast<Element*>(n));
+}
+
+/*!
+    \fn const QWebElement QWebElementCollection::operator[](int position) const
+
+    Returns the element at the specified \a position in the collection.
+*/
+
+/*! \fn QWebElement QWebElementCollection::first() const
+
+    Returns the first element in the collection.
+
+    \sa last(), operator[](), at(), count()
+*/
+
+/*! \fn QWebElement QWebElementCollection::last() const
+
+    Returns the last element in the collection.
+
+    \sa first(), operator[](), at(), count()
+*/
+
+/*!
+    Returns a QList object with the elements contained in this collection.
+*/
+QList<QWebElement> QWebElementCollection::toList() const
+{
+    if (!d)
+        return QList<QWebElement>();
+    QList<QWebElement> elements;
+    int i = 0;
+    Node* n = d->m_result->item(i);
+    while (n) {
+        if (n->isElementNode())
+            elements.append(QWebElement(static_cast<Element*>(n)));
+        n = d->m_result->item(++i);
+    }
+    return elements;
+}
+
+/*!
+    \fn QWebElementCollection::const_iterator QWebElementCollection::begin() const
+
+    Returns an STL-style iterator pointing to the first element in the collection.
+
+    \sa end()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator QWebElementCollection::end() const
+
+    Returns an STL-style iterator pointing to the imaginary element after the
+    last element in the list.
+
+    \sa begin()
+*/
+
+/*!
+    \class QWebElementCollection::const_iterator
+    \since 4.6
+    \brief The QWebElementCollection::const_iterator class provides an STL-style const iterator for QWebElementCollection.
+
+    QWebElementCollection provides STL style const iterators for fast low-level access to the elements.
+
+    QWebElementCollection::const_iterator allows you to iterate over a QWebElementCollection.
+
+    The default QWebElementCollection::const_iterator constructors creates an uninitialized iterator. You must initialize
+    it using a QWebElementCollection function like QWebElementCollection::begin() or QWebElementCollection::end() before you
+    can start iterating.
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator::const_iterator()
+
+    Constructs an uninitialized iterator.
+
+    Functions like operator*() and operator++() should not be called on
+    an uninitialized iterator. Use operator=() to assign a value
+    to it before using it.
+
+    \sa QWebElementCollection::begin()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator::const_iterator(const const_iterator &other)
+
+    Constructs a copy of \a other.
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator::const_iterator(const QWebElementCollection *collection, int index)
+    \internal
+*/
+
+/*!
+    \fn const QWebElement QWebElementCollection::const_iterator::operator*() const
+
+    Returns the current element.
+*/
+
+/*!
+    \fn bool QWebElementCollection::const_iterator::operator==(const const_iterator &other) const
+
+    Returns true if \a other points to the same item as this iterator;
+    otherwise returns false.
+
+    \sa operator!=()
+*/
+
+/*!
+    \fn bool QWebElementCollection::const_iterator::operator!=(const const_iterator &other) const
+
+    Returns true if \a other points to a different element than this;
+    iterator; otherwise returns false.
+
+    \sa operator==()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator &QWebElementCollection::const_iterator::operator++()
+
+    The prefix ++ operator (\c{++it}) advances the iterator to the next element in the collection
+    and returns an iterator to the new current element.
+
+    Calling this function on QWebElementCollection::end() leads to undefined results.
+
+    \sa operator--()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator QWebElementCollection::const_iterator::operator++(int)
+
+    \overload
+
+    The postfix ++ operator (\c{it++}) advances the iterator to the next element in the collection
+    and returns an iterator to the previously current element.
+
+    Calling this function on QWebElementCollection::end() leads to undefined results.
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator &QWebElementCollection::const_iterator::operator--()
+
+    The prefix -- operator (\c{--it}) makes the preceding element current and returns an
+    iterator to the new current element.
+
+    Calling this function on QWebElementCollection::begin() leads to undefined results.
+
+    \sa operator++()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator QWebElementCollection::const_iterator::operator--(int)
+
+    \overload
+
+    The postfix -- operator (\c{it--}) makes the preceding element current and returns
+    an iterator to the previously current element.
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator &QWebElementCollection::const_iterator::operator+=(int j)
+
+    Advances the iterator by \a j elements. If \a j is negative, the iterator goes backward.
+
+    \sa operator-=(), operator+()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator &QWebElementCollection::const_iterator::operator-=(int j)
+
+    Makes the iterator go back by \a j elements. If \a j is negative, the iterator goes forward.
+
+    \sa operator+=(), operator-()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator QWebElementCollection::const_iterator::operator+(int j) const
+
+    Returns an iterator to the element at \a j positions forward from this iterator. If \a j
+    is negative, the iterator goes backward.
+
+    \sa operator-(), operator+=()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator QWebElementCollection::const_iterator::operator-(int j) const
+
+    Returns an iterator to the element at \a j positiosn backward from this iterator.
+    If \a j is negative, the iterator goes forward.
+
+    \sa operator+(), operator-=()
+*/
+
+/*!
+    \fn int QWebElementCollection::const_iterator::operator-(const_iterator other) const
+
+    Returns the number of elements between the item point to by \a other
+    and the element pointed to by this iterator.
+*/
+
+/*!
+    \fn bool QWebElementCollection::const_iterator::operator<(const const_iterator &other) const
+
+    Returns true if the element pointed to by this iterator is less than the element pointed to
+    by the \a other iterator.
+*/
+
+/*!
+    \fn bool QWebElementCollection::const_iterator::operator<=(const const_iterator &other) const
+
+    Returns true if the element pointed to by this iterator is less than or equal to the
+    element pointed to by the \a other iterator.
+*/
+
+/*!
+    \fn bool QWebElementCollection::const_iterator::operator>(const const_iterator &other) const
+
+    Returns true if the element pointed to by this iterator is greater than the element pointed to
+    by the \a other iterator.
+*/
+
+/*!
+    \fn bool QWebElementCollection::const_iterator::operator>=(const const_iterator &other) const
+
+    Returns true if the element pointed to by this iterator is greater than or equal to the
+    element pointed to by the \a other iterator.
+*/
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
index 351ccb4617..a18d262cbc 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
@@ -36,6 +36,7 @@ class QPainter;
 QT_END_NAMESPACE
 
 class QWebFrame;
+class QWebElementCollection;
 class QWebElementPrivate;
 
 class QWEBKIT_EXPORT QWebElement {
@@ -50,8 +51,8 @@ public:
 
     bool isNull() const;
 
-    QList<QWebElement> findAll(const QString& selectorQuery) const;
-    QWebElement findFirst(const QString& selectorQuery) const;
+    QWebElementCollection findAll(const QString &selectorQuery) const;
+    QWebElement findFirst(const QString &selectorQuery) const;
 
     void setPlainText(const QString& text);
     QString toPlainText() const;
@@ -96,7 +97,7 @@ public:
     QWebElement document() const;
     QWebFrame *webFrame() const;
 
-    // TODO: Add QList<QWebElement> overloads
+    // TODO: Add QWebElementCollection overloads
     // docs need example snippet
     void appendInside(const QString& markup);
     void appendInside(const QWebElement& element);
@@ -125,7 +126,7 @@ public:
     QWebElement clone() const;
     QWebElement& takeFromDocument();
     void removeFromDocument();
-    void removeChildren();
+    void removeAllChildren();
 
     QVariant evaluateJavaScript(const QString& scriptSource);
 
@@ -146,6 +147,7 @@ private:
     static QWebElement enclosingElement(WebCore::Node*);
 
     friend class QWebFrame;
+    friend class QWebElementCollection;
     friend class QWebHitTestResult;
     friend class QWebHitTestResultPrivate;
     friend class QWebPage;
@@ -154,4 +156,70 @@ private:
     WebCore::Element* m_element;
 };
 
+class QWebElementCollectionPrivate;
+
+class QWEBKIT_EXPORT QWebElementCollection
+{
+public:
+    QWebElementCollection();
+    QWebElementCollection(const QWebElement &contextElement, const QString &query);
+    QWebElementCollection(const QWebElementCollection &);
+    QWebElementCollection &operator=(const QWebElementCollection &);
+    ~QWebElementCollection();
+
+    QWebElementCollection operator+(const QWebElementCollection &other) const;
+    inline QWebElementCollection &operator+=(const QWebElementCollection &other)
+    {
+        append(other); return *this;
+    }
+
+    void append(const QWebElementCollection &collection);
+
+    int count() const;
+    QWebElement at(int i) const;
+
+    inline QWebElement first() const { return at(0); }
+    inline QWebElement last() const { return at(count() - 1); }
+
+    QList<QWebElement> toList() const;
+
+    class const_iterator {
+       public:
+           int i;
+           const QWebElementCollection *s;
+
+           inline const_iterator(const QWebElementCollection *collection, int index) : i(index), s(collection) {}
+           inline const_iterator(const const_iterator &o) : i(o.i), s(o.s) {}
+
+           inline const QWebElement operator*() const { return s->at(i); }
+
+           inline bool operator==(const const_iterator& o) const { return i == o.i && s == o.s; }
+           inline bool operator!=(const const_iterator& o) const { return i != o.i || s != o.s; }
+           inline bool operator<(const const_iterator& o) const { return i < o.i; }
+           inline bool operator<=(const const_iterator& o) const { return i <= o.i; }
+           inline bool operator>(const const_iterator& o) const { return i > o.i; }
+           inline bool operator>=(const const_iterator& o) const { return i >= o.i; }
+
+           inline const_iterator &operator++() { ++i; return *this; }
+           inline const_iterator operator++(int) { const_iterator n(s, i); ++i; return n; }
+           inline const_iterator &operator--() { i--; return *this; }
+           inline const_iterator operator--(int) { const_iterator n(s, i); i--; return n; }
+           inline const_iterator &operator+=(int j) { i += j; return *this; }
+           inline const_iterator &operator-=(int j) { i -= j; return *this; }
+           inline const_iterator operator+(int j) const { return const_iterator(s, i + j); }
+           inline const_iterator operator-(int j) const { return const_iterator(s, i - j); }
+           inline int operator-(const_iterator j) const { return i - j.i; }
+       private:
+            inline const_iterator() : i(0), s(0) {}
+    };
+    friend class const_iterator;
+
+    inline const_iterator begin() const { return const_iterator(this, 0); }
+    inline const_iterator end() const { return const_iterator(this, count()); }
+    inline QWebElement operator[](int i) const { return at(i); }
+
+private:
+    QExplicitlySharedDataPointer<QWebElementCollectionPrivate> d;
+};
+
 #endif // QWEBELEMENT_H
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
index d2c324d838..606dae48bf 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
@@ -185,6 +185,17 @@ void QWEBKIT_EXPORT qt_drt_garbageCollector_collectOnAlternateThread(bool waitUn
     gcController().garbageCollectOnAlternateThreadForDebugging(waitUntilDone);
 }
 
+// Returns the value of counter in the element specified by \a id.
+QString QWEBKIT_EXPORT qt_drt_counterValueForElementById(QWebFrame* qFrame, const QString& id)
+{
+    Frame* frame = QWebFramePrivate::core(qFrame);
+    if (Document* document = frame->document()) {
+        Element* element = document->getElementById(id);
+        return WebCore::counterValueForElement(element);
+    }
+    return QString();
+}
+
 QWebFrameData::QWebFrameData(WebCore::Page* parentPage, WebCore::Frame* parentFrame,
                              WebCore::HTMLFrameOwnerElement* ownerFrameElement,
                              const WebCore::String& frameName)
@@ -232,7 +243,7 @@ WebCore::Scrollbar* QWebFramePrivate::verticalScrollBar() const
     return frame->view()->verticalScrollbar();
 }
 
-void QWebFramePrivate::renderPrivate(QPainter *painter, const QRegion &clip)
+void QWebFramePrivate::renderPrivate(QPainter *painter, QWebFrame::RenderLayer layer, const QRegion &clip)
 {
     if (!frame->view() || !frame->contentRenderer())
         return;
@@ -241,24 +252,58 @@ void QWebFramePrivate::renderPrivate(QPainter *painter, const QRegion &clip)
     if (vector.isEmpty())
         return;
 
-    WebCore::FrameView* view = frame->view();
-    view->layoutIfNeededRecursive();
-
     GraphicsContext context(painter);
+    if (context.paintingDisabled() && !context.updatingControlTints())
+        return;
 
-    if (clipRenderToViewport)
-        view->paint(&context, vector.first());
-    else
-        view->paintContents(&context, vector.first());
+    WebCore::FrameView* view = frame->view();
+    view->layoutIfNeededRecursive();
 
-    for (int i = 1; i < vector.size(); ++i) {
+    for (int i = 0; i < vector.size(); ++i) {
         const QRect& clipRect = vector.at(i);
+        QRect intersectedRect = clipRect.intersected(view->frameRect());
+
         painter->save();
         painter->setClipRect(clipRect, Qt::IntersectClip);
-        if (clipRenderToViewport)
-            view->paint(&context, clipRect);
-        else
-            view->paintContents(&context, clipRect);
+
+        int x = view->x();
+        int y = view->y();
+
+        if (layer & QWebFrame::ContentsLayer) {
+            context.save();
+
+            int scrollX = view->scrollX();
+            int scrollY = view->scrollY();
+
+            QRect rect = intersectedRect;
+            context.translate(x, y);
+            rect.translate(-x, -y);
+            context.translate(-scrollX, -scrollY);
+            rect.translate(scrollX, scrollY);
+            context.clip(view->visibleContentRect());
+
+            view->paintContents(&context, rect);
+
+            context.restore();
+        }
+
+        if (layer & QWebFrame::ScrollBarLayer
+            && !view->scrollbarsSuppressed()
+            && (view->horizontalScrollbar() || view->verticalScrollbar())) {
+            context.save();
+
+            QRect rect = intersectedRect;
+            context.translate(x, y);
+            rect.translate(-x, -y);
+
+            view->paintScrollbars(&context, rect);
+
+            context.restore();
+        }
+
+        if (layer & QWebFrame::PanIconLayer)
+            view->paintPanScrollIcon(&context);
+
         painter->restore();
     }
 }
@@ -386,7 +431,7 @@ void QWebFrame::addToJavaScriptWindowObject(const QString &name, QObject *object
         return;
 
     JSC::JSLock lock(JSC::SilenceAssertionsOnly);
-    JSDOMWindow* window = toJSDOMWindow(d->frame);
+    JSDOMWindow* window = toJSDOMWindow(d->frame, mainThreadNormalWorld());
     JSC::Bindings::RootObject* root = d->frame->script()->bindingRootObject();
     if (!window) {
         qDebug() << "Warning: couldn't get window object";
@@ -946,44 +991,37 @@ void QWebFrame::setScrollPosition(const QPoint &pos)
 }
 
 /*!
-  Render the frame into \a painter clipping to \a clip.
+  \since 4.6
+  Render the \a layer of the frame using \a painter clipping to \a clip.
 
   \sa print()
 */
-void QWebFrame::render(QPainter *painter, const QRegion &clip)
-{
-    d->renderPrivate(painter, clip);
-}
 
-/*!
-  Render the frame into \a painter.
-*/
-void QWebFrame::render(QPainter *painter)
+void QWebFrame::render(QPainter* painter, RenderLayer layer, const QRegion& clip)
 {
-    if (!d->frame->view())
-        return;
-
-    d->renderPrivate(painter, QRegion(d->frame->view()->frameRect()));
+    if (!clip.isEmpty())
+        d->renderPrivate(painter, layer, clip);
+    else if (d->frame->view())
+        d->renderPrivate(painter, layer, QRegion(d->frame->view()->frameRect()));
 }
 
 /*!
-    \since 4.6
-    \property QWebFrame::clipRenderToViewport
-
-    Returns true if render will clip content to viewport; otherwise returns false.
+  Render the frame into \a painter clipping to \a clip.
 */
-bool QWebFrame::clipRenderToViewport() const
+void QWebFrame::render(QPainter *painter, const QRegion &clip)
 {
-    return d->clipRenderToViewport;
+    d->renderPrivate(painter, AllLayers, clip);
 }
 
 /*!
-    \since 4.6
-    Sets whether the content of a frame will be clipped to viewport when rendered.
+  Render the frame into \a painter.
 */
-void QWebFrame::setClipRenderToViewport(bool clipRenderToViewport)
+void QWebFrame::render(QPainter *painter)
 {
-    d->clipRenderToViewport = clipRenderToViewport;
+    if (!d->frame->view())
+        return;
+
+    d->renderPrivate(painter, AllLayers, QRegion(d->frame->view()->frameRect()));
 }
 
 /*!
@@ -1114,7 +1152,7 @@ QWebElement QWebFrame::documentElement() const
 
     \sa QWebElement::findAll()
 */
-QList<QWebElement> QWebFrame::findAllElements(const QString &selectorQuery) const
+QWebElementCollection QWebFrame::findAllElements(const QString &selectorQuery) const
 {
     return documentElement().findAll(selectorQuery);
 }
@@ -1264,7 +1302,7 @@ QVariant QWebFrame::evaluateJavaScript(const QString& scriptSource)
     if (proxy) {
         JSC::JSValue v = d->frame->script()->executeScript(ScriptSourceCode(scriptSource)).jsValue();
         int distance = 0;
-        rc = JSC::Bindings::convertValueToQVariant(proxy->globalObject()->globalExec(), v, QMetaType::Void, &distance);
+        rc = JSC::Bindings::convertValueToQVariant(proxy->globalObject(mainThreadNormalWorld())->globalExec(), v, QMetaType::Void, &distance);
     }
     return rc;
 }
@@ -1402,7 +1440,6 @@ QWebHitTestResultPrivate::QWebHitTestResultPrivate(const WebCore::HitTestResult
     if (!hitTest.innerNode())
         return;
     pos = hitTest.point();
-    boundingRect = hitTest.boundingBox();
     WebCore::TextDirection dir;
     title = hitTest.title(dir);
     linkText = hitTest.textContent();
@@ -1412,6 +1449,7 @@ QWebHitTestResultPrivate::QWebHitTestResultPrivate(const WebCore::HitTestResult
     imageUrl = hitTest.absoluteImageURL();
     innerNode = hitTest.innerNode();
     innerNonSharedNode = hitTest.innerNonSharedNode();
+    boundingRect = innerNonSharedNode ? innerNonSharedNode->renderer()->absoluteBoundingBoxRect(true) : IntRect();
     WebCore::Image *img = hitTest.image();
     if (img) {
         QPixmap *pix = img->nativeImageForCurrentFrame();
@@ -1659,4 +1697,3 @@ QWebFrame *QWebHitTestResult::frame() const
         return 0;
     return d->frame;
 }
-
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.h
index 55c73b4132..08285f84ad 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.h
@@ -50,6 +50,7 @@ class QWebHitTestResult;
 class QWebHistoryItem;
 class QWebSecurityOrigin;
 class QWebElement;
+class QWebElementCollection;
 
 namespace WebCore {
     class WidgetPrivate;
@@ -112,7 +113,6 @@ class QWEBKIT_EXPORT QWebFrame : public QObject {
     Q_PROPERTY(QIcon icon READ icon)
     Q_PROPERTY(QSize contentsSize READ contentsSize)
     Q_PROPERTY(QPoint scrollPosition READ scrollPosition WRITE setScrollPosition)
-    Q_PROPERTY(bool clipRenderToViewport READ clipRenderToViewport WRITE setClipRenderToViewport)
     Q_PROPERTY(bool focus READ hasFocus)
 private:
     QWebFrame(QWebPage *parent, QWebFrameData *frameData);
@@ -165,10 +165,17 @@ public:
     QPoint scrollPosition() const;
     void setScrollPosition(const QPoint &pos);
 
-    void render(QPainter *painter, const QRegion &clip);
-    void render(QPainter *painter);
-    bool clipRenderToViewport() const;
-    void setClipRenderToViewport(bool clipRenderToViewport);
+    enum RenderLayer {
+        ContentsLayer = 0x10,
+        ScrollBarLayer = 0x20,
+        PanIconLayer = 0x40,
+
+        AllLayers = 0xff
+    };
+
+    void render(QPainter*);
+    void render(QPainter*, const QRegion& clip);
+    void render(QPainter*, RenderLayer layer, const QRegion& clip = QRegion());
 
     void setTextSizeMultiplier(qreal factor);
     qreal textSizeMultiplier() const;
@@ -184,7 +191,7 @@ public:
     QSize contentsSize() const;
 
     QWebElement documentElement() const;
-    QList<QWebElement> findAllElements(const QString &selectorQuery) const;
+    QWebElementCollection findAllElements(const QString &selectorQuery) const;
     QWebElement findFirstElement(const QString &selectorQuery) const;
 
     QWebHitTestResult hitTestContent(const QPoint &pos) const;
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h
index 632f83a268..081e65de7d 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h
@@ -70,7 +70,6 @@ public:
         , allowsScrolling(true)
         , marginWidth(-1)
         , marginHeight(-1)
-        , clipRenderToViewport(true)
         {}
     void init(QWebFrame* qframe, QWebFrameData* frameData);
 
@@ -82,7 +81,7 @@ public:
     static WebCore::Frame* core(QWebFrame*);
     static QWebFrame* kit(WebCore::Frame*);
 
-    void renderPrivate(QPainter *painter, const QRegion &clip);
+    void renderPrivate(QPainter*, QWebFrame::RenderLayer, const QRegion& clip);
 
     QWebFrame *q;
     Qt::ScrollBarPolicy horizontalScrollBarPolicy;
@@ -94,7 +93,6 @@ public:
     bool allowsScrolling;
     int marginWidth;
     int marginHeight;
-    bool clipRenderToViewport;
 };
 
 class QWebHitTestResultPrivate {
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp
index 5752d6697b..d852012b66 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp
@@ -31,6 +31,11 @@
 #include <QSharedData>
 #include <QDebug>
 
+enum {
+    InitialHistoryVersion = 1,
+    DefaultHistoryVersion = InitialHistoryVersion
+};
+
 /*!
   \class QWebHistoryItem
   \since 4.4
@@ -226,7 +231,8 @@ bool QWebHistoryItem::isValid() const
   number of items is given by count(), and the history can be cleared with the
   clear() function.
 
-  QWebHistory's state can be saved with saveState() and loaded with restoreState().
+  QWebHistory's state can be saved to a QDataStream using the >> operator and loaded
+  by using the << operator.
 
   \sa QWebHistoryItem, QWebHistoryInterface, QWebPage
 */
@@ -475,135 +481,72 @@ void QWebHistory::setMaximumItemCount(int count)
 }
 
 /*!
-   \enum QWebHistory::HistoryStateVersion
+  \since 4.6
+  \fn QDataStream& operator<<(QDataStream& stream, const QWebHistory& history)
+  \relates QWebHistory
 
-   This enum describes the versions available for QWebHistory's saveState() function:
+  \brief The operator<< function streams a history into a data stream.
 
-   \value HistoryVersion_1 Version 1 (Qt 4.6)
-   \value DefaultHistoryVersion The current default version in 1.
+  It saves the \a history into the specified \a stream.
 */
 
+QDataStream& operator<<(QDataStream& target, const QWebHistory& history)
+{
+    QWebHistoryPrivate* d = history.d;
+
+    int version = DefaultHistoryVersion;
+
+    target << version;
+    target << history.count() << history.currentItemIndex();
+
+    const WebCore::HistoryItemVector &items = d->lst->entries();
+    for (unsigned i = 0; i < items.size(); i++)
+        items[i].get()->saveState(target, version);
+
+    return target;
+}
+
 /*!
+  \fn QDataStream& operator>>(QDataStream& stream, QWebHistory& history)
+  \relates QWebHistory
   \since 4.6
 
-  Restores the state of QWebHistory from the given \a buffer. Returns true
-  if the history was successfully restored; otherwise returns false.
+  \brief The operator>> function loads a history from a data stream.
 
-  \sa saveState()
+  Loads a QWebHistory from the specified \a stream into the given \a history.
 */
-bool QWebHistory::restoreState(const QByteArray& buffer)
+
+QDataStream& operator>>(QDataStream& source, QWebHistory& history)
 {
-    QDataStream stream(buffer);
+    QWebHistoryPrivate* d = history.d;
+
     int version;
-    bool result = false;
-    stream >> version;
 
-    switch (version) {
-    case HistoryVersion_1: {
+    source >> version;
+
+    if (version == 1) {
         int count;
         int currentIndex;
-        stream >> count >> currentIndex;
+        source >> count >> currentIndex;
 
-        clear();
+        history.clear();
         // only if there are elements
         if (count) {
             // after clear() is new clear HistoryItem (at the end we had to remove it)
-            WebCore::HistoryItem *nullItem = d->lst->currentItem();
-            for (int i = 0;i < count;i++) {
+            WebCore::HistoryItem* nullItem = d->lst->currentItem();
+            for (int i = 0; i < count; i++) {
                 WTF::PassRefPtr<WebCore::HistoryItem> item = WebCore::HistoryItem::create();
-                item->restoreState(stream, version);
+                item->restoreState(source, version);
                 d->lst->addItem(item);
             }
             d->lst->removeItem(nullItem);
-            goToItem(itemAt(currentIndex));
-            result = stream.status() == QDataStream::Ok;
+            history.goToItem(history.itemAt(currentIndex));
         }
-        break;
-    }
-    default: {} // result is false;
     }
 
     d->page()->updateNavigationActions();
 
-    return result;
-};
-
-/*!
-  \since 4.6
-  Saves the state of this QWebHistory into a QByteArray.
-
-  Saves the current state of this QWebHistory. The version number, \a version, is
-  stored as part of the data.
-
-  To restore the saved state, pass the return value to restoreState().
-
-  \sa restoreState()
-*/
-QByteArray QWebHistory::saveState(HistoryStateVersion version) const
-{
-    QByteArray buffer;
-    QDataStream stream(&buffer, QIODevice::WriteOnly);
-    stream << version;
-
-    switch (version) {
-    case HistoryVersion_1: {
-        stream << count() << currentItemIndex();
-
-        const WebCore::HistoryItemVector &items = d->lst->entries();
-        for (unsigned i = 0; i < items.size(); i++)
-            items[i].get()->saveState(stream, version);
-
-        if (stream.status() != QDataStream::Ok)
-            buffer = QByteArray();  // make buffer isNull()==true and isEmpty()==true
-        break;
-    }
-    default:
-        buffer.clear();
-
-    }
-
-    return buffer;
-}
-
-/*!
-  \since 4.6
-  \fn QDataStream& operator<<(QDataStream& stream, const QWebHistory& history)
-  \relates QWebHistory
-
-  \brief The operator<< function streams a history into a data stream.
-
-  It saves the \a history into the specified \a stream. This is a
-  convenience function and is equivalent to calling the saveState()
-  method.
-
-  \sa QWebHistory::saveState()
-*/
-
-QDataStream& operator<<(QDataStream& stream, const QWebHistory& history)
-{
-    return stream << history.saveState();
-}
-
-/*!
-  \fn QDataStream& operator>>(QDataStream& stream, QWebHistory& history)
-  \relates QWebHistory
-  \since 4.6
-
-  \brief The operator>> function loads a history from a data stream.
-
-  Loads a QWebHistory from the specified \a stream into the given \a history.
-  This is a convenience function and it is equivalent to calling the restoreState()
-  method.
-
-  \sa QWebHistory::restoreState()
-*/
-
-QDataStream& operator>>(QDataStream& stream, QWebHistory& history)
-{
-    QByteArray buffer;
-    stream >> buffer;
-    history.restoreState(buffer);
-    return stream;
+    return source;
 }
 
 QWebPagePrivate* QWebHistoryPrivate::page()
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.h
index e46f124c05..cce4553565 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.h
@@ -42,9 +42,6 @@ public:
     QWebHistoryItem &operator=(const QWebHistoryItem &other);
     ~QWebHistoryItem();
 
-    //bool restoreState(QByteArray& buffer);
-    //QByteArray saveState(QWebHistory::HistoryStateVersion version = DefaultHistoryVersion) const;
-
     QUrl originalUrl() const;
     QUrl url() const;
 
@@ -69,22 +66,10 @@ private:
     QExplicitlySharedDataPointer<QWebHistoryItemPrivate> d;
 };
 
-//QWEBKIT_EXPORT QDataStream & operator<<(QDataStream& out,const QWebHistoryItem& hist);
-//QWEBKIT_EXPORT QDataStream & operator>>(QDataStream& in,QWebHistoryItem& hist);
-
 
 class QWebHistoryPrivate;
 class QWEBKIT_EXPORT QWebHistory {
 public:
-    enum HistoryStateVersion {
-        HistoryVersion_1,
-        /*, HistoryVersion_2, */
-        DefaultHistoryVersion = HistoryVersion_1
-    };
-
-    bool restoreState(const QByteArray& buffer);
-    QByteArray saveState(HistoryStateVersion version = DefaultHistoryVersion) const;
-
     void clear();
 
     QList<QWebHistoryItem> items() const;
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
index 764bfadaef..0b122b4788 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
@@ -77,6 +77,7 @@
 #include "LocalizedStrings.h"
 #include "Cache.h"
 #include "runtime/InitializeThreading.h"
+#include "PageGroup.h"
 
 #include <QApplication>
 #include <QBasicTimer>
@@ -262,7 +263,9 @@ static inline Qt::DropAction dragOpToDropAction(unsigned actions)
 QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     : q(qq)
     , client(0)
+#if QT_VERSION < 0x040600
     , view(0)
+#endif
     , inspectorFrontend(0)
     , inspector(0)
     , inspectorIsInternalOnly(false)
@@ -302,6 +305,8 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
 
     history.d = new QWebHistoryPrivate(page->backForwardList());
     memset(actions, 0, sizeof(actions));
+
+    PageGroup::setShouldTrackVisitedLinks(true);
 }
 
 QWebPagePrivate::~QWebPagePrivate()
@@ -378,7 +383,7 @@ static QWebPage::WebAction webActionForContextMenuAction(WebCore::ContextMenuAct
 QMenu *QWebPagePrivate::createContextMenu(const WebCore::ContextMenu *webcoreMenu,
         const QList<WebCore::ContextMenuItem> *items, QBitArray *visitedWebActions)
 {
-    QMenu* menu = new QMenu(view);
+    QMenu* menu = new QMenu(q->view());
     for (int i = 0; i < items->count(); ++i) {
         const ContextMenuItem &item = items->at(i);
         switch (item.type()) {
@@ -759,13 +764,13 @@ void QWebPagePrivate::mouseReleaseEvent(QGraphicsSceneMouseEvent* ev)
 void QWebPagePrivate::handleSoftwareInputPanel(Qt::MouseButton button)
 {
 #if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
-    if (view && view->testAttribute(Qt::WA_InputMethodEnabled)
+    if (q->view() && q->view()->testAttribute(Qt::WA_InputMethodEnabled)
         && button == Qt::LeftButton && qApp->autoSipEnabled()) {
         QStyle::RequestSoftwareInputPanel behavior = QStyle::RequestSoftwareInputPanel(
-            view->style()->styleHint(QStyle::SH_RequestSoftwareInputPanel));
+            q->view()->style()->styleHint(QStyle::SH_RequestSoftwareInputPanel));
         if (!clickCausedFocus || behavior == QStyle::RSIP_OnMouseClick) {
             QEvent event(QEvent::RequestSoftwareInputPanel);
-            QApplication::sendEvent(view, &event);
+            QApplication::sendEvent(q->view(), &event);
         }
     }
 
@@ -909,8 +914,8 @@ void QWebPagePrivate::keyPressEvent(QKeyEvent *ev)
     if (!handled) {
         handled = true;
         QFont defaultFont;
-        if (view)
-            defaultFont = view->font();
+        if (q->view())
+            defaultFont = q->view()->font();
         QFontMetrics fm(defaultFont);
         if (!handleScrolling(ev, frame)) {
             switch (ev->key()) {
@@ -1665,7 +1670,7 @@ QWebHistory *QWebPage::history() const
 */
 void QWebPage::setView(QWidget *view)
 {
-    if (d->view != view) {
+    if (this->view() != view) {
         d->view = view;
         setViewportSize(view ? view->size() : QSize(0, 0));
     }
@@ -1678,7 +1683,11 @@ void QWebPage::setView(QWidget *view)
 */
 QWidget *QWebPage::view() const
 {
+#if QT_VERSION < 0x040600
     return d->view;
+#else
+    return d->view.data();
+#endif
 }
 
 /*!
@@ -1705,7 +1714,7 @@ void QWebPage::javaScriptAlert(QWebFrame *frame, const QString& msg)
 {
     Q_UNUSED(frame)
 #ifndef QT_NO_MESSAGEBOX
-    QMessageBox::information(d->view, tr("JavaScript Alert - %1").arg(mainFrame()->url().host()), msg, QMessageBox::Ok);
+    QMessageBox::information(view(), tr("JavaScript Alert - %1").arg(mainFrame()->url().host()), msg, QMessageBox::Ok);
 #endif
 }
 
@@ -1721,7 +1730,7 @@ bool QWebPage::javaScriptConfirm(QWebFrame *frame, const QString& msg)
 #ifdef QT_NO_MESSAGEBOX
     return true;
 #else
-    return QMessageBox::Yes == QMessageBox::information(d->view, tr("JavaScript Confirm - %1").arg(mainFrame()->url().host()), msg, QMessageBox::Yes, QMessageBox::No);
+    return QMessageBox::Yes == QMessageBox::information(view(), tr("JavaScript Confirm - %1").arg(mainFrame()->url().host()), msg, QMessageBox::Yes, QMessageBox::No);
 #endif
 }
 
@@ -1739,7 +1748,7 @@ bool QWebPage::javaScriptPrompt(QWebFrame *frame, const QString& msg, const QStr
     Q_UNUSED(frame)
     bool ok = false;
 #ifndef QT_NO_INPUTDIALOG
-    QString x = QInputDialog::getText(d->view, tr("JavaScript Prompt - %1").arg(mainFrame()->url().host()), msg, QLineEdit::Normal, defaultValue, &ok);
+    QString x = QInputDialog::getText(view(), tr("JavaScript Prompt - %1").arg(mainFrame()->url().host()), msg, QLineEdit::Normal, defaultValue, &ok);
     if (ok && result)
         *result = x;
 #endif
@@ -1764,7 +1773,7 @@ bool QWebPage::shouldInterruptJavaScript()
 #ifdef QT_NO_MESSAGEBOX
     return false;
 #else
-    return QMessageBox::Yes == QMessageBox::information(d->view, tr("JavaScript Problem - %1").arg(mainFrame()->url().host()), tr("The script on this page appears to have a problem. Do you want to stop the script?"), QMessageBox::Yes, QMessageBox::No);
+    return QMessageBox::Yes == QMessageBox::information(view(), tr("JavaScript Problem - %1").arg(mainFrame()->url().host()), tr("The script on this page appears to have a problem. Do you want to stop the script?"), QMessageBox::Yes, QMessageBox::No);
 #endif
 }
 
@@ -1781,7 +1790,7 @@ bool QWebPage::shouldInterruptJavaScript()
 */
 QWebPage *QWebPage::createWindow(WebWindowType type)
 {
-    QWebView *webView = qobject_cast<QWebView *>(d->view);
+    QWebView *webView = qobject_cast<QWebView *>(view());
     if (webView) {
         QWebView *newView = webView->createWindow(type);
         if (newView)
@@ -2652,17 +2661,6 @@ void QWebPage::updatePositionDependentActions(const QPoint &pos)
     as a result of the user clicking on a "file upload" button in a HTML form where multiple
     file selection is allowed.
 
-    \omitvalue ErrorPageExtension (introduced in Qt 4.6)
-*/
-
-/*!
-    \enum QWebPage::ErrorDomain
-    \since 4.6
-    \internal
-
-    \value QtNetwork
-    \value Http
-    \value WebKit
 */
 
 /*!
@@ -2713,12 +2711,6 @@ void QWebPage::updatePositionDependentActions(const QPoint &pos)
 */
 
 /*!
-    \fn QWebPage::ErrorPageExtensionReturn::ErrorPageExtensionReturn()
-
-    Constructs a new error page object.
-*/
-
-/*!
     \class QWebPage::ChooseMultipleFilesExtensionOption
     \since 4.5
     \brief The ChooseMultipleFilesExtensionOption class describes the option
@@ -2764,7 +2756,7 @@ bool QWebPage::extension(Extension extension, const ExtensionOption *option, Ext
     if (extension == ChooseMultipleFilesExtension) {
         // FIXME: do not ignore suggestedFiles
         QStringList suggestedFiles = static_cast<const ChooseMultipleFilesExtensionOption*>(option)->suggestedFileNames;
-        QStringList names = QFileDialog::getOpenFileNames(d->view, QString::null);
+        QStringList names = QFileDialog::getOpenFileNames(view(), QString::null);
         static_cast<ChooseMultipleFilesExtensionReturn*>(output)->fileNames = names;
         return true;
     }
@@ -2846,7 +2838,7 @@ QString QWebPage::chooseFile(QWebFrame *parentFrame, const QString& suggestedFil
 {
     Q_UNUSED(parentFrame)
 #ifndef QT_NO_FILEDIALOG
-    return QFileDialog::getOpenFileName(d->view, QString::null, suggestedFile);
+    return QFileDialog::getOpenFileName(view(), QString::null, suggestedFile);
 #else
     return QString::null;
 #endif
@@ -3109,8 +3101,8 @@ QString QWebPage::userAgentForUrl(const QUrl& url) const
 
     // Language
     QLocale locale;
-    if (d->view)
-        locale = d->view->locale();
+    if (view())
+        locale = view()->locale();
     QString name = locale.name();
     name[2] = QLatin1Char('-');
     ua.append(name);
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
index b9571fab42..f0f842d099 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
@@ -135,7 +135,12 @@ public:
 #ifndef QT_NO_UNDOSTACK
     QUndoStack *undoStack;
 #endif
+
+#if QT_VERSION >= 0x040600
+    QWeakPointer<QWidget> view;
+#else
     QWidget* view;
+#endif
 
     bool insideOpenCall;
     quint64 m_totalBytes;
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp
index 7c44e37ee4..2a225c5765 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp
@@ -30,6 +30,16 @@
 
 using namespace WebCore;
 
+void QWEBKIT_EXPORT qt_drt_whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains)
+{
+    SecurityOrigin::whiteListAccessFromOrigin(*SecurityOrigin::createFromString(sourceOrigin), destinationProtocol, destinationHost, allowDestinationSubdomains);
+}
+
+void QWEBKIT_EXPORT qt_drt_resetOriginAccessWhiteLists()
+{
+    SecurityOrigin::resetOriginAccessWhiteLists();
+}
+
 /*!
     \class QWebSecurityOrigin
     \since 4.5
@@ -239,21 +249,3 @@ QStringList QWebSecurityOrigin::localSchemes()
     }
     return list;
 }
-
-/*!
-    \since 4.6
-    \internal
-*/
-void QWebSecurityOrigin::whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains)
-{
-    SecurityOrigin::whiteListAccessFromOrigin(*SecurityOrigin::createFromString(sourceOrigin), destinationProtocol, destinationHost, allowDestinationSubdomains);
-}
-
-/*!
-    \since 4.6
-    \internal
-*/
-void QWebSecurityOrigin::resetOriginAccessWhiteLists()
-{
-    SecurityOrigin::resetOriginAccessWhiteLists();
-}
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.h
index 94b96f0aa3..16f8bc1d4d 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.h
@@ -40,8 +40,6 @@ public:
     static void addLocalScheme(const QString& scheme);
     static void removeLocalScheme(const QString& scheme);
     static QStringList localSchemes();
-    static void whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains);
-    static void resetOriginAccessWhiteLists();
 
     ~QWebSecurityOrigin();
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
index cb487ce737..48de8c6b9b 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
@@ -151,7 +151,7 @@ void QWebViewPrivate::_q_pageDestroyed()
     It can be used in various applications to display web content live from the
     Internet.
 
-    The image below shows QWebView previewed in \QD with a Nokia website.
+    The image below shows QWebView previewed in \QD with the Trolltech website.
 
     \image qwebview-url.png
 
@@ -246,7 +246,11 @@ QWebView::QWebView(QWidget *parent)
 QWebView::~QWebView()
 {
     if (d->page) {
+#if QT_VERSION >= 0x040600
+        d->page->d->view.clear();
+#else
         d->page->d->view = 0;
+#endif
         d->page->d->client = 0;
     }
 
@@ -324,79 +328,6 @@ void QWebView::setPage(QWebPage* page)
 }
 
 /*!
-    Returns a valid URL from a user supplied \a string if one can be deducted.
-    In the case that is not possible, an invalid QUrl() is returned.
-
-    \since 4.6
-
-    Most applications that can browse the web, allow the user to input a URL
-    in the form of a plain string. This string can be manually typed into
-    a location bar, obtained from the clipboard, or passed in via command
-    line arguments.
-
-    When the string is not already a valid URL, a best guess is performed,
-    making various web related assumptions.
-
-    In the case the string corresponds to a valid file path on the system,
-    a file:// URL is constructed, using QUrl::fromLocalFile().
-
-    If that is not the case, an attempt is made to turn the string into a
-    http:// or ftp:// URL. The latter in the case the string starts with
-    'ftp'. The result is then passed through QUrl's tolerant parser, and
-    in the case or success, a valid QUrl is returned, or else a QUrl().
-
-    \section1 Examples:
-
-    \list
-    \o webkit.org becomes http://webkit.org
-    \o ftp.webkit.org becomes ftp://ftp.webkit.org
-    \o localhost becomes http://localhost
-    \o /home/user/test.html becomes file:///home/user/test.html (if exists)
-    \endlist
-
-    \section2 Tips when dealing with URLs and strings:
-
-    \list
-    \o When creating a QString from a QByteArray or a char*, always use
-      QString::fromUtf8().
-    \o Do not use QUrl(string), nor QUrl::toString() anywhere where the URL might
-       be used, such as in the location bar, as those functions loose data.
-       Instead use QUrl::fromEncoded() and QUrl::toEncoded(), respectively.
-    \endlist
- */
-QUrl QWebView::guessUrlFromString(const QString &string)
-{
-    QString trimmedString = string.trimmed();
-
-    // Check the most common case of a valid url with scheme and host first
-    QUrl url = QUrl::fromEncoded(trimmedString.toUtf8(), QUrl::TolerantMode);
-    if (url.isValid() && !url.scheme().isEmpty() && !url.host().isEmpty())
-        return url;
-
-    // Absolute files that exists
-    if (QDir::isAbsolutePath(trimmedString) && QFile::exists(trimmedString))
-        return QUrl::fromLocalFile(trimmedString);
-
-    // If the string is missing the scheme or the scheme is not valid prepend a scheme
-    QString scheme = url.scheme();
-    if (scheme.isEmpty() || scheme.contains(QLatin1Char('.')) || scheme == QLatin1String("localhost")) {
-        // Do not do anything for strings such as "foo", only "foo.com"
-        int dotIndex = trimmedString.indexOf(QLatin1Char('.'));
-        if (dotIndex != -1 || trimmedString.startsWith(QLatin1String("localhost"))) {
-            const QString hostscheme = trimmedString.left(dotIndex).toLower();
-            QByteArray scheme = (hostscheme == QLatin1String("ftp")) ? "ftp" : "http";
-            trimmedString = QLatin1String(scheme) + QLatin1String("://") + trimmedString;
-        }
-        url = QUrl::fromEncoded(trimmedString.toUtf8(), QUrl::TolerantMode);
-    }
-
-    if (url.isValid())
-        return url;
-
-    return QUrl();
-}
-
-/*!
     Loads the specified \a url and displays it.
 
     \note The view remains the same until enough data has arrived to display the new \a url.
@@ -684,24 +615,38 @@ qreal QWebView::textSizeMultiplier() const
     return page()->mainFrame()->textSizeMultiplier();
 }
 
-#if !defined(Q_OS_SYMBIAN)
 /*!
     \property QWebView::renderHints
     \since 4.6
     \brief the default render hints for the view
 
-    These hints are used to initialize QPainter before painting the web page.
+    These hints are used to initialize QPainter before painting the Web page.
 
     QPainter::TextAntialiasing is enabled by default.
 
+    \note This property is not available on Symbian. However, the getter and
+    setter functions can still be used directly.
+
+    \sa QPainter::renderHints()
+*/
+
+/*!
+    \since 4.6
+    Returns the render hints used by the view to render content.
+
     \sa QPainter::renderHints()
 */
-#endif
 QPainter::RenderHints QWebView::renderHints() const
 {
     return d->renderHints;
 }
 
+/*!
+    \since 4.6
+    Sets the render hints used by the view to the specified \a hints.
+
+    \sa QPainter::setRenderHints()
+*/
 void QWebView::setRenderHints(QPainter::RenderHints hints)
 {
     if (hints == d->renderHints)
@@ -711,11 +656,11 @@ void QWebView::setRenderHints(QPainter::RenderHints hints)
 }
 
 /*!
-    If \a enabled is true, the render hint \a hint is enabled; otherwise it
-    is disabled.
-
     \since 4.6
-    \sa renderHints
+    If \a enabled is true, enables the specified render \a hint; otherwise
+    disables it.
+
+    \sa renderHints, QPainter::renderHints()
 */
 void QWebView::setRenderHint(QPainter::RenderHint hint, bool enabled)
 {
@@ -1110,7 +1055,7 @@ void QWebView::changeEvent(QEvent *e)
 /*!
     \fn void QWebView::statusBarMessage(const QString& text)
 
-    This signal is emitted when the status bar \a text is changed by the page.
+    This signal is emitted when the statusbar \a text is changed by the page.
 */
 
 /*!
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h
index 15b583679c..e9c1ec8e05 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h
@@ -53,9 +53,8 @@ class QWEBKIT_EXPORT QWebView : public QWidget {
 
 // FIXME: temporary work around for elftran issue that it couldn't find the QPainter::staticMetaObject
 // symbol from Qt lib; it should be reverted after the right symbol is exported.  
-// remember to revert the qdoc \property comment as well.
 // See bug: http://qt.nokia.com/developer/task-tracker/index_html?method=entry&id=258893
-#if !defined(Q_OS_SYMBIAN)
+#if defined(Q_QDOC) || !defined(Q_OS_SYMBIAN)
     Q_PROPERTY(QPainter::RenderHints renderHints READ renderHints WRITE setRenderHints)
 #endif
     Q_FLAGS(QPainter::RenderHints)
@@ -66,8 +65,6 @@ public:
     QWebPage* page() const;
     void setPage(QWebPage* page);
 
-    static QUrl guessUrlFromString(const QString& string);
-
     void load(const QUrl& url);
 #if QT_VERSION < 0x040400 && !defined(qdoc)
     void load(const QWebNetworkRequest& request);
diff --git a/src/3rdparty/webkit/WebKit/qt/ChangeLog b/src/3rdparty/webkit/WebKit/qt/ChangeLog
index 79876130eb..b19a1d02ee 100644
--- a/src/3rdparty/webkit/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/qt/ChangeLog
@@ -1,3 +1,484 @@
+2009-10-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Remove QWebView::guessUrlFromString() and replace its use
+        with the new QUrl::fromUserInput() if using Qt 4.6 or newer.
+
+        * Api/qwebview.cpp:
+        * Api/qwebview.h:
+        * QGVLauncher/main.cpp:
+        (urlFromUserInput):
+        (WebPage::applyProxy):
+        (MainWindow::load):
+        * QtLauncher/main.cpp:
+        (urlFromUserInput):
+        (MainWindow::MainWindow):
+        (MainWindow::changeLocation):
+        * tests/qwebview/tst_qwebview.cpp:
+
+2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Serialize directly to the stream, and not first to an QByteArray,
+        that is later serialized. That is slower and also uses more bytes.
+
+        * Api/qwebhistory.cpp:
+        (operator<<):
+        (operator>>):
+
+2009-10-28  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] WebFrame::counterValueForElementById must not be exposed
+        https://bugs.webkit.org/show_bug.cgi?id=30882
+
+        * Api/qwebframe.cpp:
+        (qt_drt_counterValueForElementById):
+        * Api/qwebframe.h:
+
+2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide a way to get counter values with layoutTestContoller
+        https://bugs.webkit.org/show_bug.cgi?id=30555
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::counterValueForElementById):
+        (QWebHitTestResult::frame):
+        * Api/qwebframe.h:
+
+2009-10-28  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Pushing missing WebKit/qt/tests/qwebframe/resources/ dir from bug 29248.
+
+        [Qt] [API] Make it possible to have 'invisible' loads
+        https://bugs.webkit.org/show_bug.cgi?id=29248
+
+        * tests/qwebframe/resources/image2.png: Copied from WebKit/qt/tests/qwebelement/image.png.
+
+2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] QWebHistory::saveState() is inconsistent with the Qt API
+        https://bugs.webkit.org/show_bug.cgi?id=30710
+
+        Make the versioning internal and enforce it in the WebCore
+        part. Adjust the comments, as well as remove now dead code.
+
+        * Api/qwebhistory.cpp:
+        (operator<<):
+        (operator>>):
+        * Api/qwebhistory.h:
+
+2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] QWebHistory::saveState() is inconsistent with the Qt API
+        https://bugs.webkit.org/show_bug.cgi?id=30710
+
+        Remove the QWebHistory::saveState() and ::restoreState() as
+        they are inconsistent with the Qt API.
+
+        Update unittests to reflect the change.
+
+        * Api/qwebhistory.cpp:
+        (operator<<):
+        (operator>>):
+        * Api/qwebhistory.h:
+        * tests/qwebhistory/tst_qwebhistory.cpp:
+        (saveHistory):
+        (restoreHistory):
+        (tst_QWebHistory::saveAndRestore_crash_1):
+        (tst_QWebHistory::saveAndRestore_crash_2):
+        (tst_QWebHistory::saveAndRestore_crash_3):
+        (tst_QWebHistory::clear):
+
+2009-10-27  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        Complementary fix to bug 30779.
+
+        By mistake I used QWeakPointer's toStrongRef() method which docs
+        explicitly say to not be used in this situation (when the tracked
+        pointer is devired from QObject). Instead QWeakPointer's data()
+        is recommended.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::view):
+
+2009-10-27  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Fraser.
+
+        Change HitTestResult methods to use (3d) transformation aware methods
+        https://bugs.webkit.org/show_bug.cgi?id=27347
+
+        The HitTestResult::boundingBox method was removed. The
+        RenderObject must be used directly. In contrast to the
+        old HitTestResult::boundingBox method this code must use
+        a (3d) transformation aware method to not run into an
+        assert in SVGRenderBase::mapLocalToContainer.
+
+        * Api/qwebframe.cpp:
+        (QWebHitTestResultPrivate::QWebHitTestResultPrivate):
+
+2009-10-27  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by Oliver Hunt.
+
+        Change two methods to be internal for DRT use only.
+
+        Part of [Qt] Review all new API in Qt 4.6
+        https://bugs.webkit.org/show_bug.cgi?id=29843#c11
+
+        * Api/qwebsecurityorigin.cpp:
+        (qt_drt_whiteListAccessFromOrigin):
+        (qt_drt_resetOriginAccessWhiteLists):
+        (QWebSecurityOrigin::localSchemes):
+        * Api/qwebsecurityorigin.h:
+
+2009-10-27  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make sure that initiating a rotation while rotating won't make
+        it end up at rotation positions that are not a multiply of
+        180 degrees.
+
+        * QGVLauncher/main.cpp:
+        (MainView::animatedFlip):
+
+2009-10-27  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed Qt build fix.
+
+        Update the tests as well to the new API change.
+
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::clear):
+
+2009-10-27  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by Tor Arne Vestbø.
+
+        [Qt] QWebElement::removeChildren() should be
+        QWebElement::removeAllChildren()
+        https://bugs.webkit.org/show_bug.cgi?id=30630
+
+        * Api/qwebelement.cpp:
+        (QWebElement::removeAllChildren):
+        * Api/qwebelement.h:
+
+2009-10-27  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Antti Koivisto and Holger Freyther.
+
+        Make QWebPagePrivate's (QWidget) view to be a QWeakPointer.
+        https://bugs.webkit.org/show_bug.cgi?id=30779
+
+        The fact that it was been set from external objects of qwebpage
+        and not being deleted internally can lead to dangling references.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::~QGraphicsWebView):
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        (QWebPagePrivate::createContextMenu):
+        (QWebPagePrivate::handleSoftwareInputPanel):
+        (QWebPagePrivate::keyPressEvent):
+        (QWebPage::setView):
+        (QWebPage::view):
+        (QWebPage::javaScriptAlert):
+        (QWebPage::javaScriptConfirm):
+        (QWebPage::javaScriptPrompt):
+        (QWebPage::shouldInterruptJavaScript):
+        (QWebPage::createWindow):
+        (QWebPage::extension):
+        (QWebPage::chooseFile):
+        (QWebPage::userAgentForUrl):
+        * Api/qwebpage_p.h:
+        * Api/qwebview.cpp:
+        (QWebView::~QWebView):
+
+2009-10-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed documentation fix from David Boddie (Qt Doc Team)
+
+        Removes the check around the RenderHints property documentation
+        that was clearly added to synchronize the source and header files
+        when the #if !defined(Q_OS_SYMBIAN) guards was added to the
+        property.
+
+        The documentation has also been updated to ensure that Symbian
+        users know that there is no actual RenderHints property on their
+        platform.
+
+        * Api/qwebview.cpp:
+
+2009-10-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed documentation fix from David Boddie (Qt Doc Team)
+
+        Ensure that qdoc will always see the RenderHints property.
+
+        The property was only defined in the header file if the Q_OS_SYMBIAN
+        symbol was not defined, resulting in the property not showing up
+        in the Qt documentation just because one platform doesn't support it.
+
+        A follow up commit will improve the documentation for the property
+        and note that it is not supported on the Symbiam platform.
+
+        * Api/qwebview.h:
+
+2009-10-26  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Reintroduce QWebElementCollection
+
+        Revert the patch that has replaced QWebElementCollection 
+        with QList<QWebElement>. Update the tests accordingly.
+
+        Remove the constness of the return type of QWebElement operator[]. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=30767
+
+        * Api/qwebelement.cpp:
+        (QWebElement::findAll):
+        (QWebElementCollectionPrivate::QWebElementCollectionPrivate):
+        (QWebElementCollectionPrivate::create):
+        (QWebElementCollection::QWebElementCollection):
+        (QWebElementCollection::operator=):
+        (QWebElementCollection::~QWebElementCollection):
+        (QWebElementCollection::operator+):
+        (QWebElementCollection::append):
+        (QWebElementCollection::count):
+        (QWebElementCollection::at):
+        (QWebElementCollection::toList):
+        * Api/qwebelement.h:
+        (const_iterator::begin):
+        (const_iterator::end):
+        (const_iterator::operator[]):
+        * Api/qwebframe.cpp:
+        (QWebFrame::findAllElements):
+        * Api/qwebframe.h:
+        * QtLauncher/main.cpp:
+        (MainWindow::selectElements):
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::simpleCollection):
+        (tst_QWebElement::iteration):
+        (tst_QWebElement::emptyCollection):
+        (tst_QWebElement::appendCollection):
+        (tst_QWebElement::nullSelect):
+        (tst_QWebElement::hasSetFocus):
+        (tst_QWebElement::render):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::inputMethods):
+
+2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] [Symbian] Set the capability and memory required to run QtWebKit for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=30476
+
+        Assign ReadUserData WriteUserData NetworkServices Symbian capabilities
+        to all QtWebkit executables.
+
+        * QGVLauncher/QGVLauncher.pro:
+        * QtLauncher/QtLauncher.pro:
+        * tests/benchmarks/loading/tst_loading.pro:
+        * tests/benchmarks/painting/tst_painting.pro:
+        * tests/qgraphicswebview/qgraphicswebview.pro:
+        * tests/qwebelement/qwebelement.pro:
+        * tests/qwebframe/qwebframe.pro:
+        * tests/qwebhistory/qwebhistory.pro:
+        * tests/qwebhistoryinterface/qwebhistoryinterface.pro:
+        * tests/qwebpage/qwebpage.pro:
+        * tests/qwebplugindatabase/qwebplugindatabase.pro:
+        * tests/qwebview/qwebview.pro:
+
+2009-10-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative build fix - qt is currently already broken!)
+        Build fix following bug #30696.
+
+        * Api/qwebelement.cpp:
+        (setupScriptContext):
+        * Api/qwebframe.cpp:
+        (QWebFrame::evaluateJavaScript):
+
+2009-10-22  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Enable track visited links in QWebPage
+        https://bugs.webkit.org/show_bug.cgi?id=30574
+
+        Test: fast/history/clicked-link-is-visited.html
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+
+2009-10-22  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Add Print Shortcut to QtLauncher
+
+        https://bugs.webkit.org/show_bug.cgi?id=30682
+
+        * QtLauncher/main.cpp:
+        (MainWindow::setupUI):
+
+2009-10-22  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Rubberstamped by Tor Arne Vestbø.
+
+        Code standarlization for QGVLauncher.
+
+        1) Made member initilization lists in constructors
+           to be per line.
+        2) Made applyProxy method inline as all other methods in
+           WebPage class.
+
+        * QGVLauncher/main.cpp:
+        (WebPage::WebPage):
+        (WebPage::applyProxy):
+        (MainView::MainView):
+        (MainWindow::MainWindow):
+        (MainWindow::init):
+
+2009-10-22  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add a Y-Axis rotation to QGVLauncher.
+
+        It uses the QStateMachine API from Qt 4.6.
+
+        * QGVLauncher/main.cpp:
+        (WebView::WebView):
+        (WebView::setYRotation):
+        (WebView::yRotation):
+        (MainView::flip):
+        (MainView::animatedYFlip):
+        (SharedScene::SharedScene):
+        (SharedScene::webView):
+        (MainWindow::init):
+        (MainWindow::animatedYFlip):
+        (MainWindow::buildUI):
+
+2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed By Adam Barth.
+
+        Add some actions to the menu for cursor debugging.
+
+        GraphicsView based launcher only.
+
+        * QGVLauncher/main.cpp:
+        (MainView::setWaitCursor):
+        (MainView::resetCursor):
+        (MainView::flip):
+        (MainWindow::setWaitCursor):
+        (MainWindow::resetCursor):
+        (MainWindow::buildUI):
+
+2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by Adam Barth.
+
+        Remove clipRenderToViewport as agreed upon in
+        https://bugs.webkit.org/show_bug.cgi?id=29843
+
+        * Api/qwebframe.cpp:
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+        (QWebFramePrivate::QWebFramePrivate):
+
+2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Update the tests to test the new render functionality, and take
+        into consideration that render() clips to the frame itself as well
+        as the viewport.
+
+        QWebFrame::render() now always clips, so the old tests were bogus.
+
+        Rendering pure contents (no scrollbars etc) without clipping can now
+        be accomplished using QWebFrame::documentElement()->render(...)
+
+        * Api/qwebframe.cpp:
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+        (QWebFramePrivate::QWebFramePrivate):
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by Adam Barth.
+
+        As we do not support rendering a QWebFrame without it being clipped
+        the the frame as well as the viewport, we now set the viewport size
+        to the size of the contents.
+
+        Rendering pure contents (no scrollbars etc) without clipping can be
+        acomplished using QWebFrame::documentElement()->render(...)
+
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::render):
+
+2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add menu item to dump the plugin list to the console,
+        which can be handy for debugging.
+
+        * QtLauncher/main.cpp:
+        (MainWindow::dumpPlugins):
+        (MainWindow::setupUI):
+
+2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Introduce new render method on QWebFrame, which supports specifying
+        which layers to render (scrollbars, contents, pan-icon).
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::renderPrivate):
+        (QWebFrame::render):
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+
+2009-10-19  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Infinite loop (leading to crash) when setting cursor in QGraphicsWebView
+        https://bugs.webkit.org/show_bug.cgi?id=30549
+
+        Patch reimplements QGraphicsItem's itemChange method, and make
+        CursorChange event to be emitted after cursor has already been
+        set.
+
+        QWidget::setCursor send the event just after it sets the cursor,
+        then patch makes both behaviors compatible.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::itemChange):
+        * Api/qgraphicswebview.h:
+
 2009-10-19  Nate Chapin  <japhet@chromium.org>
 
         Unreviewed, build fix.
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/loading/tst_loading.pro b/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/loading/tst_loading.pro
index 80717c24c4..bc5e75f208 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/loading/tst_loading.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/loading/tst_loading.pro
@@ -5,4 +5,7 @@ SOURCES += tst_loading.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 
-symbian:TARGET.UID3 = 0xA000E541
+symbian {
+    TARGET.UID3 = 0xA000E541
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/tst_painting.pro b/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/tst_painting.pro
index f45d80429e..48c7072279 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/tst_painting.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/tst_painting.pro
@@ -5,4 +5,7 @@ SOURCES += tst_painting.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 
-symbian:TARGET.UID3 = 0xA000E542
+symbian {
+    TARGET.UID3 = 0xA000E542
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro b/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
index cba6f11fab..57b44375ff 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
@@ -4,3 +4,7 @@ include(../../../../WebKit.pri)
 SOURCES  += tst_qgraphicswebview.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian {
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.pro
index 0a140ad63c..c45a9ac5a1 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.pro
@@ -6,4 +6,7 @@ RESOURCES += qwebelement.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 
-symbian:TARGET.UID3 = 0xA000E53A
+symbian {
+    TARGET.UID3 = 0xA000E53A
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
index db2f7d76c0..cf83fe8a5e 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
@@ -70,7 +70,10 @@ private slots:
     void attributesNS();
     void classes();
     void namespaceURI();
+    void iteration();
     void foreachManipulation();
+    void emptyCollection();
+    void appendCollection();
     void evaluateJavaScript();
     void documentElement();
     void frame();
@@ -134,7 +137,7 @@ void tst_QWebElement::simpleCollection()
     m_mainFrame->setHtml(html);
     QWebElement body = m_mainFrame->documentElement();
 
-    QList<QWebElement> list = body.findAll("p");
+    QWebElementCollection list = body.findAll("p");
     QCOMPARE(list.count(), 2);
     QCOMPARE(list.at(0).toPlainText(), QString("first para"));
     QCOMPARE(list.at(1).toPlainText(), QString("second para"));
@@ -267,6 +270,41 @@ void tst_QWebElement::namespaceURI()
 
 }
 
+void tst_QWebElement::iteration()
+{
+    QString html = "<body><p>first para</p><p>second para</p></body>";
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement();
+
+   QWebElementCollection paras = body.findAll("p");
+    QList<QWebElement> referenceList = paras.toList();
+
+    QList<QWebElement> foreachList;
+    foreach(QWebElement p, paras) {
+       foreachList.append(p);
+    }
+    QVERIFY(foreachList.count() == 2);
+    QCOMPARE(foreachList.count(), referenceList.count());
+    QCOMPARE(foreachList.at(0), referenceList.at(0));
+    QCOMPARE(foreachList.at(1), referenceList.at(1));
+
+    QList<QWebElement> forLoopList;
+    for (int i = 0; i < paras.count(); ++i) {
+        forLoopList.append(paras.at(i));
+    }
+    QVERIFY(foreachList.count() == 2);
+    QCOMPARE(foreachList.count(), referenceList.count());
+    QCOMPARE(foreachList.at(0), referenceList.at(0));
+    QCOMPARE(foreachList.at(1), referenceList.at(1));
+
+    for (int i = 0; i < paras.count(); ++i) {
+        QCOMPARE(paras.at(i), paras[i]);
+    }
+
+    QCOMPARE(paras.at(0), paras.first());
+    QCOMPARE(paras.at(1), paras.last());
+}
+
 void tst_QWebElement::foreachManipulation()
 {
     QString html = "<body><p>first para</p><p>second para</p></body>";
@@ -280,6 +318,43 @@ void tst_QWebElement::foreachManipulation()
     QCOMPARE(body.findAll("div").count(), 4);
 }
 
+void tst_QWebElement::emptyCollection()
+{
+    QWebElementCollection emptyCollection;
+    QCOMPARE(emptyCollection.count(), 0);
+}
+
+void tst_QWebElement::appendCollection()
+{
+    QString html = "<body><span class='a'>aaa</span><p>first para</p><div>foo</div>"
+        "<span class='b'>bbb</span><p>second para</p><div>bar</div></body>";
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement();
+
+    QWebElementCollection collection = body.findAll("p");
+    QCOMPARE(collection.count(), 2);
+
+    collection.append(body.findAll("div"));
+    QCOMPARE(collection.count(), 4);
+
+    collection += body.findAll("span.a");
+    QCOMPARE(collection.count(), 5);
+
+    QWebElementCollection all = collection + body.findAll("span.b");
+    QCOMPARE(all.count(), 6);
+    QCOMPARE(collection.count(), 5);
+
+     all += collection;
+    QCOMPARE(all.count(), 11);
+
+    QCOMPARE(collection.count(), 5);
+    QWebElementCollection test;
+    test.append(collection);
+    QCOMPARE(test.count(), 5);
+    test.append(QWebElementCollection());
+    QCOMPARE(test.count(), 5);
+}
+
 void tst_QWebElement::evaluateJavaScript()
 {
     QVariant result;
@@ -629,7 +704,7 @@ void tst_QWebElement::clear()
 
     QCOMPARE(body.findAll("div").count(), 1);
     QCOMPARE(body.findAll("p").count(), 3);
-    body.findFirst("div").removeChildren();
+    body.findFirst("div").removeAllChildren();
     QCOMPARE(body.findAll("div").count(), 1);
     QCOMPARE(body.findAll("p").count(), 2);
 }
@@ -773,7 +848,7 @@ void tst_QWebElement::nullSelect()
 {
     m_mainFrame->setHtml("<body><p>Test");
 
-    QList<QWebElement> collection = m_mainFrame->findAllElements("invalid{syn(tax;;%#$f223e>>");
+    QWebElementCollection collection = m_mainFrame->findAllElements("invalid{syn(tax;;%#$f223e>>");
     QVERIFY(collection.count() == 0);
 }
 
@@ -815,7 +890,7 @@ void tst_QWebElement::hasSetFocus()
                             "<input type='text' id='input2'/>" \
                             "</body></html>");
 
-    QList<QWebElement> inputs = m_mainFrame->documentElement().findAll("input");
+    QWebElementCollection inputs = m_mainFrame->documentElement().findAll("input");
     QWebElement input1 = inputs.at(0);
     input1.setFocus();
     QVERIFY(input1.hasFocus());
@@ -851,7 +926,10 @@ void tst_QWebElement::render()
     waitForSignal(&page, SIGNAL(loadFinished(bool)));
     QCOMPARE(loadSpy.count(), 1);
 
-    QList<QWebElement> imgs = page.mainFrame()->findAllElements("img");
+    QSize size = page.mainFrame()->contentsSize();
+    page.setViewportSize(size);
+
+    QWebElementCollection imgs = page.mainFrame()->findAllElements("img");
     QCOMPARE(imgs.count(), 1);
 
     QImage resource(":/image.png");
@@ -882,7 +960,7 @@ void tst_QWebElement::render()
 
     // compare table rendered through QWebElement::render to whole page table rendering
     QRect tableRect(0, 0, 300, 300);
-    QList<QWebElement> tables = page.mainFrame()->findAllElements("table");
+    QWebElementCollection tables = page.mainFrame()->findAllElements("table");
     QCOMPARE(tables.count(), 1);
 
     QImage image3(300, 300, QImage::Format_ARGB32);
@@ -893,7 +971,6 @@ void tst_QWebElement::render()
 
     QImage image4(300, 300, QImage::Format_ARGB32);
     QPainter painter4(&image4);
-    page.mainFrame()->setClipRenderToViewport(false);
     page.mainFrame()->render(&painter4, tableRect);
     painter4.end();
 
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro
index 4c92e91dbc..0e540e5746 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro
@@ -7,4 +7,7 @@ QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 DEFINES += SRCDIR=\\\"$$PWD/resources\\\"
 
-symbian:TARGET.UID3 = 0xA000E53D
+symbian {
+    TARGET.UID3 = 0xA000E53D
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/image2.png b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/image2.png
new file mode 100644
index 0000000000..8d703640c1
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/resources/image2.png
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 100f2725d7..7cc62b0c7f 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -586,6 +586,7 @@ private slots:
     void javaScriptWindowObjectClearedOnEvaluate();
     void setHtml();
     void setHtmlWithResource();
+    void setHtmlWithBaseURL();
     void ipv6HostEncoding();
     void metaData();
     void popupFocus();
@@ -2371,6 +2372,28 @@ void tst_QWebFrame::setHtmlWithResource()
     QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("red"));
 }
 
+void tst_QWebFrame::setHtmlWithBaseURL()
+{
+    QString html("<html><body><p>hello world</p><img src='resources/image2.png'/></body></html>");
+
+    QWebPage page;
+    QWebFrame* frame = page.mainFrame();
+
+    // in few seconds, the image should be completey loaded
+    QSignalSpy spy(&page, SIGNAL(loadFinished(bool)));
+
+    frame->setHtml(html, QUrl::fromLocalFile(QDir::currentPath()));
+    QTest::qWait(200);
+    QCOMPARE(spy.count(), 1);
+
+    QCOMPARE(frame->evaluateJavaScript("document.images.length").toInt(), 1);
+    QCOMPARE(frame->evaluateJavaScript("document.images[0].width").toInt(), 128);
+    QCOMPARE(frame->evaluateJavaScript("document.images[0].height").toInt(), 128);
+
+    // no history item has to be added.
+    QCOMPARE(m_view->page()->history()->count(), 0);
+}
+
 class TestNetworkManager : public QNetworkAccessManager
 {
 public:
@@ -2668,26 +2691,24 @@ void tst_QWebFrame::render()
 
     QPicture picture;
 
-    // render clipping to Viewport
-    frame->setClipRenderToViewport(true);
+    QSize size = page.mainFrame()->contentsSize();
+    page.setViewportSize(size);
+
+    // render contents layer only (the iframe is smaller than the image, so it will have scrollbars)
     QPainter painter1(&picture);
-    frame->render(&painter1);
+    frame->render(&painter1, QWebFrame::ContentsLayer);
     painter1.end();
 
-    QSize size = page.mainFrame()->contentsSize();
-    page.setViewportSize(size);
-    QCOMPARE(size.width(), picture.boundingRect().width());   // 100px
-    QCOMPARE(size.height(), picture.boundingRect().height()); // 100px
+    QCOMPARE(size.width(), picture.boundingRect().width() + frame->scrollBarGeometry(Qt::Vertical).width());
+    QCOMPARE(size.height(), picture.boundingRect().height() + frame->scrollBarGeometry(Qt::Horizontal).height());
 
-    // render without clipping to Viewport
-    frame->setClipRenderToViewport(false);
+    // render everything, should be the size of the iframe
     QPainter painter2(&picture);
-    frame->render(&painter2);
+    frame->render(&painter2, QWebFrame::AllLayers);
     painter2.end();
 
-    QImage resource(":/image.png");
-    QCOMPARE(resource.width(), picture.boundingRect().width());   // resource width: 128px
-    QCOMPARE(resource.height(), picture.boundingRect().height()); // resource height: 128px
+    QCOMPARE(size.width(), picture.boundingRect().width());   // width: 100px
+    QCOMPARE(size.height(), picture.boundingRect().height()); // height: 100px
 }
 
 void tst_QWebFrame::scrollPosition()
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro
index 8ee63cc6ac..7445e3bac8 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro
@@ -6,4 +6,7 @@ RESOURCES  += tst_qwebhistory.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 
-symbian:TARGET.UID3 = 0xA000E53B
+symbian {
+    TARGET.UID3 = 0xA000E53B
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
index 4f4d3c4836..ec2d497b0c 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
@@ -56,9 +56,6 @@ private slots:
     void serialize_1(); //QWebHistory countity
     void serialize_2(); //QWebHistory index
     void serialize_3(); //QWebHistoryItem
-    void saveAndRestore_1();  //simple checks saveState and restoreState
-    void saveAndRestore_2();  //bad parameters saveState and restoreState
-    void saveAndRestore_3();  //try use different version
     void saveAndRestore_crash_1();
     void saveAndRestore_crash_2();
     void saveAndRestore_crash_3();
@@ -294,67 +291,40 @@ void tst_QWebHistory::serialize_3()
     QVERIFY(load.atEnd());
 }
 
-/** Simple checks should be a bit redundant to streaming operators */
-void tst_QWebHistory::saveAndRestore_1() 
+static void saveHistory(QWebHistory* history, QByteArray* in)
 {
-    QAction* actionBack = page->action(QWebPage::Back);
-    hist->back();
-    waitForLoadFinished.exec();
-    QVERIFY(actionBack->isEnabled());
-    QByteArray buffer(hist->saveState());
-    hist->clear();
-    QVERIFY(!actionBack->isEnabled());
-    QVERIFY(hist->count() == 1);
-    hist->restoreState(buffer);
-
-    //check only few values, do not make full test
-    //because most of the code is shared with streaming operators
-    //and these are checked before
-    QCOMPARE(hist->count(), histsize);
-    QCOMPARE(hist->currentItemIndex(), histsize - 2);
-    QCOMPARE(hist->itemAt(0).title(), QString("page1"));
-    QCOMPARE(hist->itemAt(histsize - 1).title(), QString("page") + QString::number(histsize));
-    QVERIFY(actionBack->isEnabled());
+    in->clear();
+    QDataStream save(in, QIODevice::WriteOnly);
+    save << *history;
 }
 
-/** Check returns value if there are bad parameters. Actually, result
-  * is no so importent. The test shouldn't crash :-) */
-void tst_QWebHistory::saveAndRestore_2() 
+static void restoreHistory(QWebHistory* history, QByteArray* out)
 {
-    QByteArray buffer;
-    hist->restoreState(buffer);
-    QVERIFY(hist->count() == 1);
-    QVERIFY(hist->itemAt(0).isValid());
-}
-
-/** Try to use bad version value */
-void tst_QWebHistory::saveAndRestore_3() 
-{
-    QByteArray tmp = hist->saveState((QWebHistory::HistoryStateVersion)29999);
-    QVERIFY(hist->saveState((QWebHistory::HistoryStateVersion)29999).isEmpty());
-    QVERIFY(hist->count() == histsize);
-    QVERIFY(hist->itemAt(3).isValid());
+    QDataStream load(out, QIODevice::ReadOnly);
+    load >> *history;
 }
 
 /** The test shouldn't crash */
 void tst_QWebHistory::saveAndRestore_crash_1()
 {
-    QByteArray tmp = hist->saveState();
-    for (unsigned i = 0; i < 5; i++){
-        hist->restoreState(tmp);
-        hist->saveState();
+    QByteArray buffer;
+    saveHistory(hist, &buffer);
+    for (unsigned i = 0; i < 5; i++) {
+        restoreHistory(hist, &buffer);
+        saveHistory(hist, &buffer);
     }
 }
 
 /** The test shouldn't crash */
 void tst_QWebHistory::saveAndRestore_crash_2()
 {
-    QByteArray tmp = hist->saveState();
+    QByteArray buffer;
+    saveHistory(hist, &buffer);
     QWebPage* page2 = new QWebPage(this);
     QWebHistory* hist2 = page2->history();
-    for (unsigned i = 0; i < 5; i++){
-        hist2->restoreState(tmp);
-        hist2->saveState();
+    for (unsigned i = 0; i < 5; i++) {
+        restoreHistory(hist2, &buffer);
+        saveHistory(hist2, &buffer);
     }
     delete page2;
 }
@@ -362,17 +332,18 @@ void tst_QWebHistory::saveAndRestore_crash_2()
 /** The test shouldn't crash */
 void tst_QWebHistory::saveAndRestore_crash_3()
 {
-    QByteArray tmp = hist->saveState();
+    QByteArray buffer;
+    saveHistory(hist, &buffer);
     QWebPage* page2 = new QWebPage(this);
     QWebHistory* hist1 = hist;
     QWebHistory* hist2 = page2->history();
-    for (unsigned i = 0; i < 5; i++){
-        hist1->restoreState(tmp);
-        hist2->restoreState(tmp);
+    for (unsigned i = 0; i < 5; i++) {
+        restoreHistory(hist1, &buffer);
+        restoreHistory(hist2, &buffer);
         QVERIFY(hist1->count() == hist2->count());
         QVERIFY(hist1->count() == histsize);
         hist2->back();
-        tmp = hist2->saveState();
+        saveHistory(hist2, &buffer);
         hist2->clear();
     }
     delete page2;
@@ -381,15 +352,16 @@ void tst_QWebHistory::saveAndRestore_crash_3()
 /** ::clear */
 void tst_QWebHistory::clear()
 {
+    QByteArray buffer;
+
     QAction* actionBack = page->action(QWebPage::Back);
     QVERIFY(actionBack->isEnabled());
-    hist->saveState();
+    saveHistory(hist, &buffer);
     QVERIFY(hist->count() > 1);
     hist->clear();
     QVERIFY(hist->count() == 1);  // Leave current item.
     QVERIFY(!actionBack->isEnabled());
 
-
     QWebPage* page2 = new QWebPage(this);
     QWebHistory* hist2 = page2->history();
     QVERIFY(hist2->count() == 0);
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro
index 53e1afe5d4..764f806df1 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro
@@ -5,4 +5,7 @@ SOURCES  += tst_qwebhistoryinterface.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 
-symbian:TARGET.UID3 = 0xA000E53C
+symbian {
+    TARGET.UID3 = 0xA000E53C
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
index 101837aead..6b28efd93c 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
@@ -7,4 +7,7 @@ QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 DEFINES += SRCDIR=\\\"$$PWD/\\\"
 
-symbian:TARGET.UID3 = 0xA000E53E
+symbian {
+    TARGET.UID3 = 0xA000E53E
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 21b3bc7f78..0cf85eefee 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -1270,7 +1270,7 @@ void tst_QWebPage::inputMethods()
                                             "</body></html>");
     m_view->page()->mainFrame()->setFocus();
 
-    QList<QWebElement> inputs = m_view->page()->mainFrame()->documentElement().findAll("input");
+    QWebElementCollection inputs = m_view->page()->mainFrame()->documentElement().findAll("input");
 
     QMouseEvent evpres(QEvent::MouseButtonPress, inputs.at(0).geometry().center(), Qt::LeftButton, Qt::NoButton, Qt::NoModifier);
     m_view->page()->event(&evpres);
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro
index 1376ca5879..569146abdc 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro
@@ -5,4 +5,7 @@ SOURCES  += tst_qwebplugindatabase.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 
-symbian:TARGET.UID3 = 0xA000E540
+symbian {
+    TARGET.UID3 = 0xA000E540
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
index bba7c39558..e67bb7ad4d 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
@@ -6,4 +6,7 @@ QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 DEFINES += SRCDIR=\\\"$$PWD/\\\"
 
-symbian:TARGET.UID3 = 0xA000E53F
+symbian {
+    TARGET.UID3 = 0xA000E53F
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
index 920422359c..fda979ef50 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
@@ -41,8 +41,6 @@ public slots:
 
 private slots:
     void renderHints();
-    void guessUrlFromString_data();
-    void guessUrlFromString();
     void getWebKitVersion();
 
     void reusePage_data();
@@ -105,68 +103,6 @@ void tst_QWebView::renderHints()
     QVERIFY(!(webView.renderHints() & QPainter::HighQualityAntialiasing));
 }
 
-void tst_QWebView::guessUrlFromString_data()
-{
-    QTest::addColumn<QString>("string");
-    QTest::addColumn<QUrl>("guessUrlFromString");
-
-    // Null
-    QTest::newRow("null") << QString() << QUrl();
-
-    // File
-    QDirIterator it(QDir::homePath());
-    QString fileString;
-    int c = 0;
-    while (it.hasNext()) {
-        it.next();
-        QTest::newRow(QString("file-%1").arg(c++).toLatin1()) << it.filePath() << QUrl::fromLocalFile(it.filePath());
-    }
-
-    // basic latin1
-    QTest::newRow("unicode-0") << QString::fromUtf8("å.com/") << QUrl::fromEncoded(QString::fromUtf8("http://å.com/").toUtf8(), QUrl::TolerantMode);
-    // unicode
-    QTest::newRow("unicode-1") << QString::fromUtf8("λ.com/") << QUrl::fromEncoded(QString::fromUtf8("http://λ.com/").toUtf8(), QUrl::TolerantMode);
-
-    // no scheme
-    QTest::newRow("add scheme-0") << "webkit.org" << QUrl("http://webkit.org");
-    QTest::newRow("add scheme-1") << "www.webkit.org" << QUrl("http://www.webkit.org");
-    QTest::newRow("add scheme-2") << "ftp.webkit.org" << QUrl("ftp://ftp.webkit.org");
-    QTest::newRow("add scheme-3") << "webkit" << QUrl("webkit");
-
-    // QUrl's tolerant parser should already handle this
-    QTest::newRow("not-encoded-0") << "http://webkit.org/test page.html" << QUrl("http://webkit.org/test%20page.html");
-
-    // Make sure the :80, i.e. port doesn't screw anything up
-    QUrl portUrl("http://webkit.org");
-    portUrl.setPort(80);
-    QTest::newRow("port-0") << "webkit.org:80" << portUrl;
-    QTest::newRow("port-1") << "http://webkit.org:80" << portUrl;
-
-    // mailto doesn't have a ://, but is valid
-    QUrl mailto("ben@meyerhome.net");
-    mailto.setScheme("mailto");
-    QTest::newRow("mailto") << "mailto:ben@meyerhome.net" << mailto;
-
-    // misc
-    QTest::newRow("localhost-0") << "localhost" << QUrl("http://localhost");
-    QTest::newRow("localhost-1") << "localhost:80" << QUrl("http://localhost:80");
-    QTest::newRow("spaces-0") << "  http://webkit.org/test page.html " << QUrl("http://webkit.org/test%20page.html");
-
-    // FYI: The scheme in the resulting url user
-    QUrl authUrl("user:pass@domain.com");
-    QTest::newRow("misc-1") << "user:pass@domain.com" << authUrl;
-}
-
-// public static QUrl guessUrlFromString(QString const& string)
-void tst_QWebView::guessUrlFromString()
-{
-    QFETCH(QString, string);
-    QFETCH(QUrl, guessUrlFromString);
-
-    QUrl url = QWebView::guessUrlFromString(string);
-    QCOMPARE(url, guessUrlFromString);
-}
-
 void tst_QWebView::getWebKitVersion()
 {
     QVERIFY(qWebKitVersion().toDouble() > 0);