1464 files changed, 43818 insertions, 16003 deletions

diff --git a/doc/src/platforms/supported-platforms.qdoc b/doc/src/platforms/supported-platforms.qdoc
index 4c3929aaa5..302ecb4373 100644
--- a/doc/src/platforms/supported-platforms.qdoc
+++ b/doc/src/platforms/supported-platforms.qdoc
@@ -106,10 +106,8 @@
                                      \o Compilers
     \row    \o Windows XP, Vista
                                      \o gcc 3.4.2 (MinGW)
-    \omit
     \row    \o Windows 7
                                      \o MSVC 2008
-    \endomit
     \row    \o Apple Mac OS X 10.6 "Snow Leopard"
                                      \o As provided by Apple
     \row    \o Apple Mac OS X 10.4 "Tiger"
diff --git a/doc/src/qt4-intro.qdoc b/doc/src/qt4-intro.qdoc
index cecff0eee1..494398405b 100644
--- a/doc/src/qt4-intro.qdoc
+++ b/doc/src/qt4-intro.qdoc
@@ -834,7 +834,7 @@
     these settings when you edit forms.
 
     More information about these improvements can be found in the
-    \l{What's New in Qt Designer 4.6} overview.
+    \l{What's New in Qt Designer 4.5} overview.
 
     \section1 Qt Linguist Improvements
 
diff --git a/examples/gestures/imagegestures/imagewidget.cpp b/examples/gestures/imagegestures/imagewidget.cpp
index 95525c53e5..28de6da270 100644
--- a/examples/gestures/imagegestures/imagewidget.cpp
+++ b/examples/gestures/imagegestures/imagewidget.cpp
@@ -128,9 +128,9 @@ void ImageWidget::panTriggered(QPanGesture *gesture)
             setCursor(Qt::ArrowCursor);
     }
 #endif
-    QSizeF lastOffset = gesture->offset();
-    horizontalOffset += lastOffset.width();
-    verticalOffset += lastOffset.height();
+    QPointF lastOffset = gesture->offset();
+    horizontalOffset += lastOffset.x();
+    verticalOffset += lastOffset.y();
     update();
 }
 
diff --git a/src/3rdparty/libpng/ANNOUNCE b/src/3rdparty/libpng/ANNOUNCE
index 5580fb8b4c..b73bbb5eb6 100644
--- a/src/3rdparty/libpng/ANNOUNCE
+++ b/src/3rdparty/libpng/ANNOUNCE
@@ -1,5 +1,5 @@
 
-Libpng 1.2.29 - May 8, 2008
+Libpng 1.2.40 - September 10, 2009
 
 This is a public release of libpng, intended for use in production codes.
 
@@ -8,53 +8,49 @@ Files available for download:
 Source files with LF line endings (for Unix/Linux) and with a
 "configure" script
 
-   libpng-1.2.29.tar.gz
-   libpng-1.2.29.tar.lzma
-     (Get the lzma codec from <http://tukaani.org/lzma>).
-   libpng-1.2.29.tar.bz2
+   libpng-1.2.40.tar.xz (LZMA-compressed, recommended)
+   libpng-1.2.40.tar.gz
+   libpng-1.2.40.tar.bz2
 
 Source files with LF line endings (for Unix/Linux) without the
 "configure" script
 
-   libpng-1.2.29-no-config.tar.gz
-   libpng-1.2.29-no-config.tar.lzma
-   libpng-1.2.29-no-config.tar.bz2
+   libpng-1.2.40-no-config.tar.xz (LZMA-compressed, recommended)
+   libpng-1.2.40-no-config.tar.gz
+   libpng-1.2.40-no-config.tar.bz2
 
 Source files with CRLF line endings (for Windows), without the
 "configure" script
 
-   lpng1229.zip
-   lpng1229.7z
-   lpng1229.tar.bz2
+   lpng1240.zip
+   lpng1240.7z
+   lpng1240.tar.bz2
 
 Project files
 
-   libpng-1.2.29-project-netware.zip
-   libpng-1.2.29-project-wince.zip
+   libpng-1.2.40-project-netware.zip
+   libpng-1.2.40-project-wince.zip
 
 Other information:
 
-   libpng-1.2.29-README.txt
-   libpng-1.2.29-KNOWNBUGS.txt
-   libpng-1.2.29-LICENSE.txt
-   libpng-1.2.29-Y2K-compliance.txt
-   libpng-1.2.29-[previous version]-diff.txt
+   libpng-1.2.40-README.txt
+   libpng-1.2.40-KNOWNBUGS.txt
+   libpng-1.2.40-LICENSE.txt
+   libpng-1.2.40-Y2K-compliance.txt
+   libpng-1.2.40-[previous version]-diff.txt
 
-Changes since the last public release (1.2.28):
+Changes since the last public release (1.2.39):
 
-version 1.2.29 [May 8, 2008]
+version 1.2.40 [September 10, 2009]
 
-  Removed some stray *.diff and *.orig files
-  Reverted Makefile.in, aclocal.m4, and configure to the libpng-1.2.26
-    versions.
-  Added --force to autogen libtoolize options and --force-missing to
-    automake options.
-  Changed $(ECHO) to echo in Makefile.am and Makefile.in
-  Updated all configure files to autoconf-2.62
-  #ifdef out pnggcrd.c code if using MSC_VER
+  Removed an extra png_debug() recently added to png_write_find_filter().
+  Fixed incorrect #ifdef in pngset.c regarding unknown chunk support.
+  Various bugfixes and improvements to CMakeLists.txt (Philip Lowman)
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
-(subscription required; visit 
+
+Send comments/corrections/commendations to png-mng-implement at lists.sf.net
+(subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
 to subscribe) or to glennrp at users.sourceforge.net
 
diff --git a/src/3rdparty/libpng/CHANGES b/src/3rdparty/libpng/CHANGES
index 590987c79c..9bb8ac88b1 100644
--- a/src/3rdparty/libpng/CHANGES
+++ b/src/3rdparty/libpng/CHANGES
@@ -1,4 +1,4 @@
-
+/*
 CHANGES - changes for libpng
 
 version 0.2
@@ -539,7 +539,8 @@ version 1.0.5d [November 29, 1999]
   Eliminated pngtypes.h; use macros instead to declare PNG_CHNK arrays.
   Renamed "PNG_GLOBAL_ARRAYS" to "PNG_USE_GLOBAL_ARRAYS" and made available
     to applications a macro "PNG_USE_LOCAL_ARRAYS".
-  #ifdef out all the new declarations when PNG_USE_GLOBAL_ARRAYS is defined.
+  Remove all the new declarations with #ifdef/#endif when
+    PNG_USE_GLOBAL_ARRAYS is defined.
   Added PNG_EXPORT_VAR macro to accommodate making DLL's.
 version 1.0.5e [November 30, 1999]
   Added iCCP, iTXt, and sPLT support; added "lang" member to the png_text
@@ -1179,7 +1180,7 @@ version 1.2.4beta3 [June 28, 2002]
   Plugged memory leak of row_buf in pngtest.c when there is a png_error().
   Detect buffer overflow in pngpread.c when IDAT is corrupted with extra data.
   Added "test-installed" target to makefile.32sunu, makefile.64sunu,
-    makefile.beos, makefile.darwin, makefile.dec, makefile.macosx, 
+    makefile.beos, makefile.darwin, makefile.dec, makefile.macosx,
     makefile.solaris, makefile.hpux, makefile.hpgcc, and makefile.so9.
 version 1.2.4rc1 and 1.0.14rc1 [July 2, 2002]
   Added "test-installed" target to makefile.cygwin and makefile.sco.
@@ -1300,7 +1301,7 @@ version 1.2.6beta4 [July 28, 2004]
   Added PNG_NO_SEQUENTIAL_READ_SUPPORTED macro to conditionally remove
     sequential read support.
   Added some "#if PNG_WRITE_SUPPORTED" blocks.
-  #ifdef'ed out some redundancy in png_malloc_default().
+  Removed some redundancy with #ifdef/#endif in png_malloc_default().
   Use png_malloc instead of png_zalloc to allocate the pallete.
 version 1.0.16rc1 and 1.2.6rc1 [August 4, 2004]
   Fixed buffer overflow vulnerability in png_handle_tRNS()
@@ -1370,7 +1371,8 @@ version 1.2.8beta1 [November 1, 2004]
   Fixed bug, introduced in libpng-1.2.7, that overruns a buffer during
     strip alpha operation in png_do_strip_filler().
   Added PNG_1_2_X definition in pngconf.h
-  #ifdef out png_info_init in png.c and png_read_init in pngread.c (as of 1.3.0)
+  Comment out with #ifdef/#endif png_info_init in png.c and png_read_init
+    in pngread.c (as of 1.3.0)
 version 1.2.8beta2 [November 2, 2004]
   Reduce color_type to a nonalpha type after strip alpha operation in
     png_do_strip_filler().
@@ -1387,7 +1389,7 @@ version 1.2.8beta5 [November 20, 2004]
   Use png_ptr->flags instead of png_ptr->transformations to pass
     PNG_STRIP_ALPHA info to png_do_strip_filler(), to preserve ABI
     compatibility.
-  Revised handling of SPECIALBUILD, PRIVATEBUILD, 
+  Revised handling of SPECIALBUILD, PRIVATEBUILD,
     PNG_LIBPNG_BUILD_SPECIAL_STRING and PNG_LIBPNG_BUILD_PRIVATE_STRING.
 version 1.2.8rc1 [November 24, 2004]
   Moved handling of BUILD macros from pngconf.h to png.h
@@ -1685,14 +1687,14 @@ version 1.2.16beta1 [January 6, 2007]
 
 version 1.2.16beta2 [January 16, 2007]
   Revised scripts/CMakeLists.txt
- 
+
 version 1.0.24, 1.2.16 [January 31, 2007]
   No changes.
- 
+
 version 1.2.17beta1 [March 6, 2007]
   Revised scripts/CMakeLists.txt to install both shared and static libraries.
   Deleted a redundant line from pngset.c.
- 
+
 version 1.2.17beta2 [April 26, 2007]
   Relocated misplaced test for png_ptr == NULL in pngpread.c
   Change "==" to "&" for testing PNG_RGB_TO_GRAY_ERR & PNG_RGB_TO_GRAY_WARN
@@ -1713,7 +1715,7 @@ version 1.2.17rc2 [May 8, 2007]
   Added png_ptr->unknown_chunk to hold working unknown chunk data, so it
     can be free'ed in case of error.  Revised unknown chunk handling in
     pngrutil.c and pngpread.c to use this structure.
- 
+
 version 1.2.17rc3 [May 8, 2007]
   Revised symbol-handling in configure script.
 
@@ -1756,9 +1758,9 @@ version 1.2.19beta6 [May 22, 2007]
   Added a special "_MSC_VER" case that defines png_snprintf to _snprintf
 
 version 1.2.19beta7 [May 22, 2007]
-  Squelched png_squelch_warnings() in pnggccrd.c and added an
-    #ifdef PNG_MMX_CODE_SUPPORTED block around the declarations that caused
-    the warnings that png_squelch_warnings was squelching.
+  Squelched png_squelch_warnings() in pnggccrd.c and added
+    an #ifdef PNG_MMX_CODE_SUPPORTED/#endif block around the declarations
+    that caused the warnings that png_squelch_warnings was squelching.
 
 version 1.2.19beta8 [May 22, 2007]
   Removed __MMX__ from test in pngconf.h.
@@ -2107,7 +2109,7 @@ version 1.2.27beta01 [April 12, 2008]
   Fixed bug (introduced in libpng-1.0.5h) with handling zero-length
     unknown chunks.
   Added more information about png_set_keep_unknown_chunks() to the
-    documetation.
+    documentation.
   Reject tRNS chunk with out-of-range samples instead of masking off
     the invalid high bits as done in since libpng-1.2.19beta5.
 
@@ -2127,7 +2129,7 @@ version 1.2.27beta04 [April 18, 2008]
   Rebuilt Makefile.in, aclocal.m4, and configure with autoconf-2.62
 
 version 1.2.27beta05 [April 19, 2008]
-  Added MAINTEINERCLEANFILES variable to Makefile.am
+  Added MAINTAINERCLEANFILES variable to Makefile.am
 
 version 1.2.27beta06 [April 21, 2008]
   Avoid changing color_type from GRAY to RGB by
@@ -2156,7 +2158,7 @@ version 1.2.29beta03 [May 2, 2008]
     automake options.
   Changed $(ECHO) to echo in Makefile.am and Makefile.in
   Updated all configure files to autoconf-2.62
-  #ifdef out pnggcrd.c code if using MSC_VER
+  Comment out pnggcrd.c code with #ifdef/#endif if using MSC_VER
 
 version 1.2.29rc01 [May 4, 2008]
   No changes.
@@ -2164,6 +2166,309 @@ version 1.2.29rc01 [May 4, 2008]
 version 1.0.35 and 1.2.29 [May 8, 2008]
   No changes.
 
+version 1.0.37 [May 9, 2008]
+  Updated Makefile.in and configure (omitted version 1.0.36).
+
+version 1.2.30beta01 [May 29, 2008]
+  Updated libpng.pc-configure.in and libpng-config.in per debian bug reports.
+
+version 1.2.30beta02 [June 25, 2008]
+  Restored png_flush(png_ptr) at the end of png_write_end(), that was
+    removed from libpng-1.0.9beta03.
+
+version 1.2.30beta03 [July 6, 2008]
+  Merged some cosmetic whitespace changes from libpng-1.4.0beta19.
+  Inline call of png_get_uint_32() in png_get_uint_31(), as in 1.4.0beta19.
+  Added demo of decoding vpAg and sTER chunks to pngtest.c, from 1.4.0beta19.
+  Changed PNGMAJ from 0 to 12 in makefile.darwin, which does not like 0.
+  Added new private function png_read_chunk_header() from 1.4.0beta19.
+  Merge reading of chunk length and chunk type into a single 8-byte read.
+  Merge writing of chunk length and chunk type into a single 8-byte write.
+
+version 1.2.30beta04 [July 10, 2008]
+  Merged more cosmetic whitespace changes from libpng-1.4.0beta19.
+
+version 1.0.38rc01, 1.2.30rc01 [July 18, 2008]
+  No changes.
+
+version 1.0.38rc02, 1.2.30rc02 [July 21, 2008]
+  Moved local array "chunkdata" from pngrutil.c to the png_struct, so
+    it will be freed by png_read_destroy() in case of a read error (Kurt
+    Christensen).
+
+version 1.0.38rc03, 1.2.30rc03 [July 21, 2008]
+  Changed "purpose" and "buffer" to png_ptr->chunkdata to avoid memory leaking.
+
+version 1.0.38rc04, 1.2.30rc04 [July 22, 2008]
+  Changed "chunkdata = NULL" to "png_ptr->chunkdata = NULL" several places in
+    png_decompress_chunk().
+
+version 1.0.38rc05, 1.2.30rc05 [July 25, 2008]
+  Changed all remaining "chunkdata" to "png_ptr->chunkdata" in
+    png_decompress_chunk() and remove chunkdata from parameter list.
+  Put a call to png_check_chunk_name() in png_read_chunk_header().
+  Revised png_check_chunk_name() to reject a name with a lowercase 3rd byte.
+  Removed two calls to png_check_chunk_name() occuring later in the process.
+
+version 1.0.38rc06, 1.2.30rc06 [July 29, 2008]
+  Added a call to png_check_chunk_name() in pngpread.c
+  Reverted png_check_chunk_name() to accept a name with a lowercase 3rd byte.
+
+version 1.0.38r07, 1.2.30r07 [August 2, 2008]
+  Changed "-Wall" to "-W -Wall" in the CFLAGS in all makefiles (Cosmin Truta)
+  Declared png_ptr "volatile" in pngread.c and pngwrite.c to avoid warnings.
+  Added code in pngset.c to quiet compiler warnings.
+  Updated contrib/visupng/cexcept.h to version 2.0.1
+  Relocated a misplaced "#endif /* PNG_NO_WRITE_FILTER */" in pngwutil.c
+
+version 1.0.38r08, 1.2.30r08 [August 2, 2008]
+  Enclose "volatile" declarations in #ifdef PNG_SETJMP_SUPPORTED (Cosmin).
+
+version 1.0.38, 1.2.30 [August 14, 2008]
+  No changes.
+
+version 1.2.31rc01 [August 19, 2008]
+  Removed extra crc check at the end of png_handle_cHRM().  Bug introduced
+    in libpng-1.2.30beta03 (Heiko Nitzsche).
+
+version 1.2.31rc02 [August 19, 2008]
+  Added PNG_WRITE_FLUSH_SUPPORTED block around new png_flush() call.
+
+version 1.2.31rc03 [August 19, 2008]
+  Added PNG_WRITE_FLUSH_AFTER_IEND_SUPPORTED block, off by default, around
+    new png_flush().
+
+version 1.0.39, 1.2.31 [August 21, 2008]
+  No changes.
+
+version 1.2.32beta01 [September 6, 2008]
+  Shortened tIME_string to 29 bytes in pngtest.c (bug introduced in
+    libpng-1.2.22).
+  Fixed off-by-one error introduced in png_push_read_zTXt() function in
+    libpng-1.2.30beta04/pngpread.c (Harald van Dijk)
+  These bugs have been given the vulnerability id CVE-2008-3964.
+
+version 1.0.40, 1.2.32 [September 18, 2008]
+  No changes.
+
+version 1.2.33beta01 [October 6, 2008]
+  Revised makefile.darwin to fix shared library numbering.
+  Change png_set_gray_1_2_4_to_8() to png_set_expand_gray_1_2_4_to_8()
+    in example.c (debian bug report)
+
+version 1.2.33rc01 [October 15, 2008]
+  No changes.
+
+version 1.0.41rc01, version 1.2.33rc02 [October 23, 2008]
+  Changed remaining "key" to "png_ptr->chunkdata" in png_handle_tEXt()
+    to avoid memory leak after memory failure while reading tEXt chunk.`
+
+version 1.2.33 [October 31, 2008]
+  No changes.
+
+version 1.2.34beta01 [November 27, 2008]
+  Revised png_warning() to write its message on standard output by default
+    when warning_fn is NULL. This was the behavior prior to libpng-1.2.9beta9.
+  Fixed string vs pointer-to-string error in png_check_keyword().
+  Added png_check_cHRM_fixed() in png.c and moved checking from pngget.c,
+    pngrutil.c, and pngwrite.c, and eliminated floating point cHRM checking.
+  Added check for zero-area RGB cHRM triangle in png_check_cHRM_fixed().
+  In png_check_cHRM_fixed(), ensure white_y is > 0, and removed redundant
+    check for all-zero coordinates that is detected by the triangle check.
+  Revised png_warning() to write its message on standard output by default
+    when warning_fn is NULL.
+
+version 1.2.34beta02 [November 28, 2008]
+  Corrected off-by-one error in bKGD validity check in png_write_bKGD()
+    and in png_handle_bKGD().
+
+version 1.2.34beta03 [December 1, 2008]
+  Revised bKGD validity check to use >= x instead of > x + 1
+  Merged with png_debug from libpng-1.4.0 to remove newlines.
+
+version 1.2.34beta04 [December 2, 2008]
+  More merging with png_debug from libpng-1.4.0 to remove newlines.
+
+version 1.2.34beta05 [December 5, 2008]
+  Removed redundant check for key==NULL before calling png_check_keyword()
+    to ensure that new_key gets initialized and removed extra warning
+    (Arvan Pritchard).
+
+version 1.2.34beta06 [December 9, 2008]
+  In png_write_png(), respect the placement of the filler bytes in an earlier
+    call to png_set_filler() (Jim Barry).
+
+version 1.2.34beta07 [December 9, 2008]
+  Undid previous change and added PNG_TRANSFORM_STRIP_FILLER_BEFORE and
+    PNG_TRANSFORM_STRIP_FILLER_AFTER conditionals and deprecated
+    PNG_TRANSFORM_STRIP_FILLER (Jim Barry).
+
+version 1.0.42rc01, 1.2.34rc01 [December 11, 2008]
+  No changes.
+
+version 1.0.42, 1.2.34 [December 18, 2008]
+  No changes.
+
+version 1.2.35beta01 [February 4, 2009]
+  Zero out some arrays of pointers after png_malloc(). (Tavis Ormandy)
+
+version 1.2.35beta02 [February 4, 2009]
+  Zero out more arrays of pointers after png_malloc().
+
+version 1.2.35beta03 [February 5, 2009]
+  Use png_memset() instead of a loop to intialize pointers.  We realize
+    this will not work on platforms where the NULL pointer is not all zeroes.
+
+version 1.2.35rc01 [February 11, 2009]
+  No changes.
+
+version 1.2.35rc02 [February 12, 2009]
+  Fix typo in new png_memset call in pngset.c (png_color should be png_charp)
+
+version 1.0.43 and 1.2.35 [February 14, 2009]
+  No changes.
+
+version 1.2.36beta01 [February 28, 2009]
+  Revised comments in png_set_read_fn() and png_set_write_fn().
+  Revised order of #ifdef's and indentation in png_debug definitions of png.h
+    bug introduced in libpng-1.2.34.
+
+version 1.2.36beta02 [March 21, 2009]
+  Use png_memset() after png_malloc() of big_row_buf when reading an
+    interlaced file, to avoid a possible UMR.
+  Undid recent revision of PNG_NO_STDIO version of png_write_flush().  Users
+    having trouble with fflush() can build with PNG_NO_WRITE_FLUSH defined.
+  Revised libpng*.txt documentation about use of png_write_flush().
+  Removed fflush() from pngtest.c.
+  Added "#define PNG_NO_WRITE_FLUSH" to contrib/pngminim/encoder/pngusr.h
+
+version 1.2.36beta03 [March 27, 2009]
+  Relocated misplaced PNG_1_0_X define in png.h that caused the prototype
+    for png_set_strip_error_numbers() to be omitted from PNG_NO_ASSEMBLER_CODE
+    builds.  This bug was introduced in libpng-1.2.15beta4.
+  Added a section on differences between 1.0.x and 1.2.x to libpng.3/libpng.txt
+
+version 1.2.36beta04 [April 5, 2009]
+  Fixed potential memory leak of "new_name" in png_write_iCCP() (Ralph Giles)
+
+version 1.2.36beta05 [April 24, 2009]
+  Added "ifndef PNG_SKIP_SETJMP_CHECK" block in pngconf.h to allow
+    application code writers to bypass the check for multiple inclusion
+    of setjmp.h when they know that it is safe to ignore the situation.
+  Made some cosmetic changes to whitespace in pngtest output.
+  Renamed "user_chunk_data" to "my_user_chunk_data" in pngtest.c to suppress
+    "shadowed declaration" warning from gcc-4.3.3.
+  Renamed "gamma" to "png_gamma" in pngset.c to avoid "shadowed declaration"
+    warning about a global "gamma" variable in math.h on some platforms.
+
+version 1.2.36rc01 [April 30, 2009]
+  No changes.
+
+version 1.0.44 and 1.2.36 [May 7, 2009]
+  No changes.
+
+version 1.2.37beta01 [May 14, 2009]
+  Fixed inconsistency in pngrutil.c, introduced in libpng-1.2.36.  The
+    memset() was using "png_ptr->rowbytes" instead of "row_bytes", which
+    the corresponding png_malloc() uses (Joe Drew).
+  Clarified usage of sig_bit versus sig_bit_p in example.c (Vincent Torri)
+  Updated some of the makefiles in the scripts directory (merged with
+    those in libpng-1.4.0beta57).
+
+version 1.2.37beta02 [May 19, 2009]
+  Fixed typo in libpng documentation (FILTER_AVE should be FILTER_AVG)
+  Relocated misplaced #endif in pngwrite.c, sCAL chunk handler.
+  Conditionally compile png_read_finish_row() which is not used by
+    progressive readers.
+  Added contrib/pngminim/preader to demonstrate building minimal progressive
+    decoder, based on contrib/gregbook with embedded libpng and zlib.
+
+version 1.2.37beta03 [May 20, 2009]
+  In contrib/pngminim/*, renamed "makefile.std" to "makefile", since there
+    is only one makefile in those directories, and revised the README files
+    accordingly.
+  Reformated sources in libpng style (3-space indentation, comment format)
+
+version 1.2.37rc01 [May 27, 2009]
+  No changes.
+
+versions 1.2.37 and 1.0.45 [June 4, 2009]
+  Reformatted several remaining "else statement;" and "if () statement;" into
+    two lines.
+  Added "#define PNG_NO_WRITE_SWAP" to contrib/pngminim/encoder/pngusr.h
+    and "define PNG_NO_READ_SWAP" to decoder/pngusr.h and preader/pngusr.h
+  Added sections about the git repository and our coding style to the
+    documentation (merged from libpng-1.4.0beta62)
+  Added a section to the libpng documentation about using png_get_io_ptr()
+    in configure scripts to detect the presence of libpng.
+
+version 1.2.38beta01 [June 17, 2009]
+  Revised libpng*.txt and libpng.3 to mention calling png_set_IHDR()
+    multiple times and to specify the sample order in the tRNS chunk,
+    because the ISO PNG specification has a typo in the tRNS table.
+  Changed several PNG_UNKNOWN_CHUNK_SUPPORTED to
+    PNG_HANDLE_AS_UNKNOWN_SUPPORTED, to make the png_set_keep mechanism
+    available for ignoring known chunks even when not saving unknown chunks.
+  Adopted preference for consistent use of "#ifdef" and "#ifndef" versus
+    "#if defined()" and "if !defined()" where possible.
+  Added PNG_NO_HANDLE_AS_UNKNOWN in the PNG_LEGACY_SUPPORTED block of
+    pngconf.h, and moved the various unknown chunk macro definitions
+    outside of the PNG_READ|WRITE_ANCILLARY_CHUNK_SUPPORTED blocks.
+
+version 1.0.46 [June 18, 2009]
+  Removed some editing cruft from scripts/libpng.pc.in and some makefiles.
+
+version 1.2.38rc01 [June 24, 2009]
+  No changes.
+
+version 1.2.38rc02 [June 29, 2009]
+  Added a reference to the libpng license in each source file.
+
+version 1.2.38rc03 [July 11, 2009]
+  Revised references to the libpng license in pngconf.h and contrib/visupng
+    source files.
+  Rebuilt configure scripts with autoconf-2.63.
+
+version 1.0.47 and 1.2.38 [July 16, 2009]
+  No changes.
+
+version 1.2.39beta01 [July 25, 2009]
+  Added a prototype for png_64bit_product() in png.c
+
+version 1.2.39beta02 [July 27, 2009]
+  Avoid a possible NULL dereference in debug build, in png_set_text_2().
+    (bug introduced in libpng-0.95, discovered by Evan Rouault)
+
+version 1.2.39beta03 [July 29, 2009]
+  Relocated new png_64_bit_product() prototype into png.h
+  Expanded the information about prototypes in the libpng style section of
+    the documentation.
+  Rebuilt configure scripts with autoconf-2.64.
+
+version 1.2.39beta04 [August 1, 2009]
+  Replaced *.tar.lzma with *.txz in distribution.  Get the xz codec
+    from <http://tukaani.org/xz>.
+
+version 1.2.39beta05 [August 1, 2009]
+  Reject attempt to write iCCP chunk with negative embedded profile length
+    (JD Chen)
+
+version 1.2.39c01 [August 6, 2009]
+  No changes.
+
+version 1.2.39 and 1.0.48 [August 13, 2009]
+  No changes.
+
+version 1.2.40beta01 [August 20, 2009]
+  Removed an extra png_debug() recently added to png_write_find_filter().
+  Fixed incorrect #ifdef in pngset.c regarding unknown chunk support.
+
+version 1.2.40rc01 [September 2, 2009]
+  Various bugfixes and improvements to CMakeLists.txt (Philip Lowman)
+
+version 1.2.40 and 1.0.49 [September 10, 2009]
+  No changes.
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
@@ -2171,3 +2476,4 @@ to subscribe)
 or to glennrp at users.sourceforge.net
 
 Glenn R-P
+*/
diff --git a/src/3rdparty/libpng/INSTALL b/src/3rdparty/libpng/INSTALL
index 6060e31294..2986ae3bea 100644
--- a/src/3rdparty/libpng/INSTALL
+++ b/src/3rdparty/libpng/INSTALL
@@ -1,5 +1,5 @@
 
-Installing libpng version 1.2.29 - May 8, 2008
+Installing libpng version 1.2.40 - September 10, 2009
 
 On Unix/Linux and similar systems, you can simply type
 
@@ -44,7 +44,7 @@ to have access to the zlib.h and zconf.h include files that
 correspond to the version of zlib that's installed.
 
 You can rename the directories that you downloaded (they
-might be called "libpng-1.2.29" or "lpng109" and "zlib-1.2.1"
+might be called "libpng-1.2.40" or "lpng109" and "zlib-1.2.1"
 or "zlib121") so that you have directories called "zlib" and "libpng".
 
 Your directory structure should look like this:
@@ -101,9 +101,9 @@ include
  CMakeLists.txt    =>  "cmake" script
  makefile.std      =>  Generic UNIX makefile (cc, creates static libpng.a)
  makefile.elf      =>  Linux/ELF makefile symbol versioning,
-                       gcc, creates libpng12.so.0.1.2.29)
+                       gcc, creates libpng12.so.0.1.2.40)
  makefile.linux    =>  Linux/ELF makefile
-                       (gcc, creates libpng12.so.0.1.2.29)
+                       (gcc, creates libpng12.so.0.1.2.40)
  makefile.gcc      =>  Generic makefile (gcc, creates static libpng.a)
  makefile.knr      =>  Archaic UNIX Makefile that converts files with
                        ansi2knr (Requires ansi2knr.c from
@@ -125,14 +125,14 @@ include
  makefile.openbsd  =>  OpenBSD makefile
  makefile.sgi      =>  Silicon Graphics IRIX makefile (cc, creates static lib)
  makefile.sggcc    =>  Silicon Graphics (gcc,
-                       creates libpng12.so.0.1.2.29)
+                       creates libpng12.so.0.1.2.40)
  makefile.sunos    =>  Sun makefile
  makefile.solaris  =>  Solaris 2.X makefile (gcc,
-                       creates libpng12.so.0.1.2.29)
+                       creates libpng12.so.0.1.2.40)
  makefile.solaris-x86 =>  Solaris/intelMMX 2.X makefile (gcc,
-                       creates libpng12.so.0.1.2.29)
+                       creates libpng12.so.0.1.2.40)
  makefile.so9      =>  Solaris 9 makefile (gcc,
-                       creates libpng12.so.0.1.2.29)
+                       creates libpng12.so.0.1.2.40)
  makefile.32sunu   =>  Sun Ultra 32-bit makefile
  makefile.64sunu   =>  Sun Ultra 64-bit makefile
  makefile.sco      =>  For SCO OSr5  ELF and Unixware 7 with Native cc
diff --git a/src/3rdparty/libpng/KNOWNBUG b/src/3rdparty/libpng/KNOWNBUG
index 7688a9ceb8..5e0c96ff45 100644
--- a/src/3rdparty/libpng/KNOWNBUG
+++ b/src/3rdparty/libpng/KNOWNBUG
@@ -1,5 +1,5 @@
 
-Known bugs in libpng version 1.2.29
+Known bugs in libpng version 1.2.40
 
 1. February 23, 2006: The custom makefiles don't build libpng with -lz.
 
diff --git a/src/3rdparty/libpng/LICENSE b/src/3rdparty/libpng/LICENSE
index 072d9efec0..93dd04a15b 100644
--- a/src/3rdparty/libpng/LICENSE
+++ b/src/3rdparty/libpng/LICENSE
@@ -8,8 +8,10 @@ COPYRIGHT NOTICE, DISCLAIMER, and LICENSE:
 If you modify libpng you may insert additional notices immediately following
 this sentence.
 
-libpng versions 1.2.6, August 15, 2004, through 1.2.29, May 8, 2008, are
-Copyright (c) 2004, 2006-2008 Glenn Randers-Pehrson, and are
+This code is released under the libpng license.
+
+libpng versions 1.2.6, August 15, 2004, through 1.2.40, September 10, 2009, are
+Copyright (c) 2004, 2006-2009 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors
 
@@ -106,4 +108,4 @@ certification mark of the Open Source Initiative.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-May 8, 2008
+September 10, 2009
diff --git a/src/3rdparty/libpng/README b/src/3rdparty/libpng/README
index fd2dbb1ad0..171b65a45a 100644
--- a/src/3rdparty/libpng/README
+++ b/src/3rdparty/libpng/README
@@ -1,4 +1,4 @@
-README for libpng version 1.2.29 - May 8, 2008 (shared library 12.0)
+README for libpng version 1.2.40 - September 10, 2009 (shared library 12.0)
 See the note about version numbers near the top of png.h
 
 See INSTALL for instructions on how to install libpng.
@@ -6,7 +6,10 @@ See INSTALL for instructions on how to install libpng.
 Libpng comes in several distribution formats.  Get libpng-*.tar.gz,
 libpng-*.tar.lzma, or libpng-*.tar.bz2 if you want UNIX-style line
 endings in the text files, or lpng*.7z or lpng*.zip if you want DOS-style
-line endings.
+line endings.  You can get UNIX-style line endings from the *.zip file
+by using "unzip -a" but there seems to be no simple way to recover
+UNIX-style line endings from the *.7z file.  The *.tar.lzma file is
+recommended for *NIX users instead.
 
 Version 0.89 was the first official release of libpng.  Don't let the
 fact that it's the first release fool you.  The libpng library has been in
@@ -55,7 +58,7 @@ to set different actions based on whether the CRC error occurred in a
 critical or an ancillary chunk.
 
 The changes made to the library, and bugs fixed are based on discussions
-on the PNG-implement mailing list
+on the png-mng-implement mailing list
 and not on material submitted privately to Guy, Andreas, or Glenn.  They will
 forward any good suggestions to the list.
 
@@ -111,14 +114,14 @@ to subscribe) or to glennrp at users.sourceforge.net
 
 You can't reach Guy, the original libpng author, at the addresses
 given in previous versions of this document.  He and Andreas will read mail
-addressed to the png-implement list, however.
+addressed to the png-mng-implement list, however.
 
 Please do not send general questions about PNG.  Send them to
 the (png-mng-misc at lists.sourceforge.net, subscription required, visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement to subscribe)
 On the other hand,
 please do not send libpng questions to that address, send them to me
-or to the png-implement list.  I'll
+or to the png-mng-implement list.  I'll
 get them in the end anyway.  If you have a question about something
 in the PNG specification that is related to using libpng, send it
 to me.  Send me any questions that start with "I was using libpng,
@@ -191,11 +194,11 @@ Files in this distribution:
        descrip.mms      =>  VMS makefile for MMS or MMK
        makefile.std     =>  Generic UNIX makefile (cc, creates static libpng.a)
        makefile.elf     =>  Linux/ELF makefile symbol versioning,
-                            gcc, creates libpng12.so.0.1.2.29)
+                            gcc, creates libpng12.so.0.1.2.40)
        makefile.linux   =>  Linux/ELF makefile
-                            (gcc, creates libpng12.so.0.1.2.29)
+                            (gcc, creates libpng12.so.0.1.2.40)
        makefile.gcmmx   =>  Linux/ELF makefile
-                            (gcc, creates libpng12.so.0.1.2.29,
+                            (gcc, creates libpng12.so.0.1.2.40,
                             uses assembler code tuned for Intel MMX platform)
        makefile.gcc     =>  Generic makefile (gcc, creates static libpng.a)
        makefile.knr     =>  Archaic UNIX Makefile that converts files with
@@ -217,12 +220,12 @@ Files in this distribution:
        makefile.openbsd =>  OpenBSD makefile
        makefile.sgi     =>  Silicon Graphics IRIX (cc, creates static lib)
        makefile.sggcc   =>  Silicon Graphics
-                            (gcc, creates libpng12.so.0.1.2.29)
+                            (gcc, creates libpng12.so.0.1.2.40)
        makefile.sunos   =>  Sun makefile
        makefile.solaris =>  Solaris 2.X makefile
-                            (gcc, creates libpng12.so.0.1.2.29)
+                            (gcc, creates libpng12.so.0.1.2.40)
        makefile.so9     =>  Solaris 9 makefile
-                            (gcc, creates libpng12.so.0.1.2.29)
+                            (gcc, creates libpng12.so.0.1.2.40)
        makefile.32sunu  =>  Sun Ultra 32-bit makefile
        makefile.64sunu  =>  Sun Ultra 64-bit makefile
        makefile.sco     =>  For SCO OSr5  ELF and Unixware 7 with Native cc
diff --git a/src/3rdparty/libpng/TODO b/src/3rdparty/libpng/TODO
index a5f639577d..face7658c6 100644
--- a/src/3rdparty/libpng/TODO
+++ b/src/3rdparty/libpng/TODO
@@ -22,3 +22,4 @@ Build gamma tables using fixed point (and do away with floating point entirely).
 Use greater precision when changing to linear gamma for compositing against
   background and doing rgb-to-gray transformation.
 Investigate pre-incremented loop counters and other loop constructions.
+Add interpolated method of handling interlacing.
diff --git a/src/3rdparty/libpng/Y2KINFO b/src/3rdparty/libpng/Y2KINFO
index 43348df0f5..e31bb7f161 100644
--- a/src/3rdparty/libpng/Y2KINFO
+++ b/src/3rdparty/libpng/Y2KINFO
@@ -1,13 +1,13 @@
    Y2K compliance in libpng:
    =========================
 
-      May 8, 2008
+      September 10, 2009
 
       Since the PNG Development group is an ad-hoc body, we can't make
       an official declaration.
 
       This is your unofficial assurance that libpng from version 0.71 and
-      upward through 1.2.29 are Y2K compliant.  It is my belief that earlier
+      upward through 1.2.40 are Y2K compliant.  It is my belief that earlier
       versions were also Y2K compliant.
 
       Libpng only has three year fields.  One is a 2-byte unsigned integer
diff --git a/src/3rdparty/libpng/configure b/src/3rdparty/libpng/configure
index 56b2452823..4871efc8c6 100755
--- a/src/3rdparty/libpng/configure
+++ b/src/3rdparty/libpng/configure
@@ -1,13 +1,13 @@
 #!/bin/sh
 echo "
   There is no \"configure\" script in this distribution of
-  libpng-1.2.29.
+  libpng-1.2.40.
 
   Instead, please copy the appropriate makefile for your system from the
   \"scripts\" directory.  Read the INSTALL file for more details.
 
   Update, July 2004: you can get a \"configure\" based distribution
   from the libpng distribution sites.  Download the file
-  libpng-1.2.29.tar.gz, libpng-1.2.29.tar.lzma, or libpng-1.2.29.tar.bz2
+  libpng-1.2.40.tar.gz, libpng-1.2.40.tar.lzma, or libpng-1.2.40.tar.bz2
 "
 
diff --git a/src/3rdparty/libpng/example.c b/src/3rdparty/libpng/example.c
index 08158731a6..dcf38de8c2 100644
--- a/src/3rdparty/libpng/example.c
+++ b/src/3rdparty/libpng/example.c
@@ -2,9 +2,9 @@
 #if 0 /* in case someone actually tries to compile this */
 
 /* example.c - an example of using libpng
- * Last changed in libpng 1.2.1 December 7, 2001.
+ * Last changed in libpng 1.2.37 [June 4, 2009]
  * This file has been placed in the public domain by the authors.
- * Maintained 1998-2007 Glenn Randers-Pehrson
+ * Maintained 1998-2009 Glenn Randers-Pehrson
  * Maintained 1996, 1997 Andreas Dilger)
  * Written 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  */
@@ -91,14 +91,15 @@ void read_png(char *file_name)  /* We need to open the file */
 
    if ((fp = fopen(file_name, "rb")) == NULL)
       return (ERROR);
+
 #else no_open_file /* prototype 2 */
-void read_png(FILE *fp, unsigned int sig_read)  /* file is already open */
+void read_png(FILE *fp, unsigned int sig_read)  /* File is already open */
 {
    png_structp png_ptr;
    png_infop info_ptr;
    png_uint_32 width, height;
    int bit_depth, color_type, interlace_type;
-#endif no_open_file /* only use one prototype! */
+#endif no_open_file /* Only use one prototype! */
 
    /* Create and initialize the png_struct with the desired error handler
     * functions.  If you want to use the default stderr and longjump method,
@@ -164,6 +165,7 @@ void read_png(FILE *fp, unsigned int sig_read)  /* file is already open */
     * pixels) into the info structure with this call:
     */
    png_read_png(png_ptr, info_ptr, png_transforms, png_voidp_NULL);
+
 #else
    /* OK, you're doing it the hard way, with the lower-level functions */
 
@@ -175,13 +177,13 @@ void read_png(FILE *fp, unsigned int sig_read)  /* file is already open */
    png_get_IHDR(png_ptr, info_ptr, &width, &height, &bit_depth, &color_type,
        &interlace_type, int_p_NULL, int_p_NULL);
 
-/* Set up the data transformations you want.  Note that these are all
- * optional.  Only call them if you want/need them.  Many of the
- * transformations only work on specific types of images, and many
- * are mutually exclusive.
- */
+   /* Set up the data transformations you want.  Note that these are all
+    * optional.  Only call them if you want/need them.  Many of the
+    * transformations only work on specific types of images, and many
+    * are mutually exclusive.
+    */
 
-   /* tell libpng to strip 16 bit/color files down to 8 bits/color */
+   /* Tell libpng to strip 16 bit/color files down to 8 bits/color */
    png_set_strip_16(png_ptr);
 
    /* Strip alpha bytes from the input data without combining with the
@@ -204,7 +206,7 @@ void read_png(FILE *fp, unsigned int sig_read)  /* file is already open */
 
    /* Expand grayscale images to the full 8 bits from 1, 2, or 4 bits/pixel */
    if (color_type == PNG_COLOR_TYPE_GRAY && bit_depth < 8)
-      png_set_gray_1_2_4_to_8(png_ptr);
+      png_set_expand_gray_1_2_4_to_8(png_ptr);
 
    /* Expand paletted or RGB images with transparency to full alpha channels
     * so the data will be available as RGBA quartets.
@@ -228,10 +230,11 @@ void read_png(FILE *fp, unsigned int sig_read)  /* file is already open */
       png_set_background(png_ptr, &my_background,
                          PNG_BACKGROUND_GAMMA_SCREEN, 0, 1.0);
 
-   /* Some suggestions as to how to get a screen gamma value */
-
-   /* Note that screen gamma is the display_exponent, which includes
-    * the CRT_exponent and any correction for viewing conditions */
+   /* Some suggestions as to how to get a screen gamma value
+    *
+    * Note that screen gamma is the display_exponent, which includes
+    * the CRT_exponent and any correction for viewing conditions
+    */
    if (/* We have a user-defined screen gamma value */)
    {
       screen_gamma = user-defined screen_gamma;
@@ -244,7 +247,7 @@ void read_png(FILE *fp, unsigned int sig_read)  /* file is already open */
    /* If we don't have another value */
    else
    {
-      screen_gamma = 2.2;  /* A good guess for a PC monitors in a dimly
+      screen_gamma = 2.2;  /* A good guess for a PC monitor in a dimly
                               lit room */
       screen_gamma = 1.7 or 1.0;  /* A good guess for Mac systems */
    }
@@ -277,7 +280,7 @@ void read_png(FILE *fp, unsigned int sig_read)  /* file is already open */
       png_colorp palette;
 
       /* This reduces the image to the application supplied palette */
-      if (/* we have our own palette */)
+      if (/* We have our own palette */)
       {
          /* An array of colors to which the image should be dithered */
          png_color std_color_cube[MAX_SCREEN_COLORS];
@@ -297,7 +300,7 @@ void read_png(FILE *fp, unsigned int sig_read)  /* file is already open */
       }
    }
 
-   /* invert monochrome files to have 0 as white and 1 as black */
+   /* Invert monochrome files to have 0 as white and 1 as black */
    png_set_invert_mono(png_ptr);
 
    /* If you want to shift the pixel values from the range [0,255] or
@@ -306,20 +309,20 @@ void read_png(FILE *fp, unsigned int sig_read)  /* file is already open */
     */
    if (png_get_valid(png_ptr, info_ptr, PNG_INFO_sBIT))
    {
-      png_color_8p sig_bit;
+      png_color_8p sig_bit_p;
 
-      png_get_sBIT(png_ptr, info_ptr, &sig_bit);
-      png_set_shift(png_ptr, sig_bit);
+      png_get_sBIT(png_ptr, info_ptr, &sig_bit_p);
+      png_set_shift(png_ptr, sig_bit_p);
    }
 
-   /* flip the RGB pixels to BGR (or RGBA to BGRA) */
+   /* Flip the RGB pixels to BGR (or RGBA to BGRA) */
    if (color_type & PNG_COLOR_MASK_COLOR)
       png_set_bgr(png_ptr);
 
-   /* swap the RGBA or GA data to ARGB or AG (or BGRA to ABGR) */
+   /* Swap the RGBA or GA data to ARGB or AG (or BGRA to ABGR) */
    png_set_swap_alpha(png_ptr);
 
-   /* swap bytes of 16 bit files to least significant byte first */
+   /* Swap bytes of 16 bit files to least significant byte first */
    png_set_swap(png_ptr);
 
    /* Add filler (or alpha) byte (before/after each RGB triplet) */
@@ -342,11 +345,13 @@ void read_png(FILE *fp, unsigned int sig_read)  /* file is already open */
    /* The easiest way to read the image: */
    png_bytep row_pointers[height];
 
+   /* Clear the pointer array */
+   for (row = 0; row < height; row++)
+      row_pointers[row] = NULL;
+
    for (row = 0; row < height; row++)
-   {
       row_pointers[row] = png_malloc(png_ptr, png_get_rowbytes(png_ptr,
          info_ptr));
-   }
 
    /* Now it's time to read the image.  One of these methods is REQUIRED */
 #ifdef entire /* Read the entire image in one go */
@@ -372,32 +377,31 @@ void read_png(FILE *fp, unsigned int sig_read)  /* file is already open */
 #else no_sparkle /* Read the image using the "rectangle" effect */
          png_read_rows(png_ptr, png_bytepp_NULL, &row_pointers[y],
             number_of_rows);
-#endif no_sparkle /* use only one of these two methods */
+#endif no_sparkle /* Use only one of these two methods */
       }
 
-      /* if you want to display the image after every pass, do
-         so here */
-#endif no_single /* use only one of these two methods */
+      /* If you want to display the image after every pass, do so here */
+#endif no_single /* Use only one of these two methods */
    }
-#endif no_entire /* use only one of these two methods */
+#endif no_entire /* Use only one of these two methods */
 
-   /* read rest of file, and get additional chunks in info_ptr - REQUIRED */
+   /* Read rest of file, and get additional chunks in info_ptr - REQUIRED */
    png_read_end(png_ptr, info_ptr);
 #endif hilevel
 
    /* At this point you have read the entire image */
 
-   /* clean up after the read, and free any memory allocated - REQUIRED */
+   /* Clean up after the read, and free any memory allocated - REQUIRED */
    png_destroy_read_struct(&png_ptr, &info_ptr, png_infopp_NULL);
 
-   /* close the file */
+   /* Close the file */
    fclose(fp);
 
-   /* that's it */
+   /* That's it */
    return (OK);
 }
 
-/* progressively read a file */
+/* Progressively read a file */
 
 int
 initialize_png_reader(png_structp *png_ptr, png_infop *info_ptr)
@@ -462,7 +466,7 @@ process_data(png_structp *png_ptr, png_infop *info_ptr,
 
    /* This one's new also.  Simply give it chunks of data as
     * they arrive from the data stream (in order, of course).
-    * On Segmented machines, don't give it any more than 64K.
+    * On segmented machines, don't give it any more than 64K.
     * The library seems to run fine with sizes of 4K, although
     * you can give it much less if necessary (I assume you can
     * give it chunks of 1 byte, but I haven't tried with less
@@ -476,36 +480,37 @@ process_data(png_structp *png_ptr, png_infop *info_ptr,
 
 info_callback(png_structp png_ptr, png_infop info)
 {
-/* do any setup here, including setting any of the transformations
- * mentioned in the Reading PNG files section.  For now, you _must_
- * call either png_start_read_image() or png_read_update_info()
- * after all the transformations are set (even if you don't set
- * any).  You may start getting rows before png_process_data()
- * returns, so this is your last chance to prepare for that.
- */
+   /* Do any setup here, including setting any of the transformations
+    * mentioned in the Reading PNG files section.  For now, you _must_
+    * call either png_start_read_image() or png_read_update_info()
+    * after all the transformations are set (even if you don't set
+    * any).  You may start getting rows before png_process_data()
+    * returns, so this is your last chance to prepare for that.
+    */
 }
 
 row_callback(png_structp png_ptr, png_bytep new_row,
    png_uint_32 row_num, int pass)
 {
-/*
- * This function is called for every row in the image.  If the
- * image is interlaced, and you turned on the interlace handler,
- * this function will be called for every row in every pass.
- *
- * In this function you will receive a pointer to new row data from
- * libpng called new_row that is to replace a corresponding row (of
- * the same data format) in a buffer allocated by your application.
- *
- * The new row data pointer new_row may be NULL, indicating there is
- * no new data to be replaced (in cases of interlace loading).
- *
- * If new_row is not NULL then you need to call
- * png_progressive_combine_row() to replace the corresponding row as
- * shown below:
- */
+   /*
+    * This function is called for every row in the image.  If the
+    * image is interlaced, and you turned on the interlace handler,
+    * this function will be called for every row in every pass.
+    *
+    * In this function you will receive a pointer to new row data from
+    * libpng called new_row that is to replace a corresponding row (of
+    * the same data format) in a buffer allocated by your application.
+    *
+    * The new row data pointer "new_row" may be NULL, indicating there is
+    * no new data to be replaced (in cases of interlace loading).
+    *
+    * If new_row is not NULL then you need to call
+    * png_progressive_combine_row() to replace the corresponding row as
+    * shown below:
+    */
+
    /* Check if row_num is in bounds. */
-   if((row_num >= 0) && (row_num < height))
+   if ((row_num >= 0) && (row_num < height))
    {
      /* Get pointer to corresponding row in our
       * PNG read buffer.
@@ -515,47 +520,47 @@ row_callback(png_structp png_ptr, png_bytep new_row,
      /* If both rows are allocated then copy the new row
       * data to the corresponding row data.
       */
-     if((old_row != NULL) && (new_row != NULL))
+     if ((old_row != NULL) && (new_row != NULL))
      png_progressive_combine_row(png_ptr, old_row, new_row);
    }
-/*
- * The rows and passes are called in order, so you don't really
- * need the row_num and pass, but I'm supplying them because it
- * may make your life easier.
- *
- * For the non-NULL rows of interlaced images, you must call
- * png_progressive_combine_row() passing in the new row and the
- * old row, as demonstrated above.  You can call this function for
- * NULL rows (it will just return) and for non-interlaced images
- * (it just does the png_memcpy for you) if it will make the code
- * easier.  Thus, you can just do this for all cases:
- */
+   /*
+    * The rows and passes are called in order, so you don't really
+    * need the row_num and pass, but I'm supplying them because it
+    * may make your life easier.
+    *
+    * For the non-NULL rows of interlaced images, you must call
+    * png_progressive_combine_row() passing in the new row and the
+    * old row, as demonstrated above.  You can call this function for
+    * NULL rows (it will just return) and for non-interlaced images
+    * (it just does the png_memcpy for you) if it will make the code
+    * easier.  Thus, you can just do this for all cases:
+    */
 
    png_progressive_combine_row(png_ptr, old_row, new_row);
 
-/* where old_row is what was displayed for previous rows.  Note
- * that the first pass (pass == 0 really) will completely cover
- * the old row, so the rows do not have to be initialized.  After
- * the first pass (and only for interlaced images), you will have
- * to pass the current row as new_row, and the function will combine
- * the old row and the new row.
- */
+   /* where old_row is what was displayed for previous rows.  Note
+    * that the first pass (pass == 0 really) will completely cover
+    * the old row, so the rows do not have to be initialized.  After
+    * the first pass (and only for interlaced images), you will have
+    * to pass the current row as new_row, and the function will combine
+    * the old row and the new row.
+    */
 }
 
 end_callback(png_structp png_ptr, png_infop info)
 {
-/* this function is called when the whole image has been read,
- * including any chunks after the image (up to and including
- * the IEND).  You will usually have the same info chunk as you
- * had in the header, although some data may have been added
- * to the comments and time fields.
- *
- * Most people won't do much here, perhaps setting a flag that
- * marks the image as finished.
- */
+   /* This function is called when the whole image has been read,
+    * including any chunks after the image (up to and including
+    * the IEND).  You will usually have the same info chunk as you
+    * had in the header, although some data may have been added
+    * to the comments and time fields.
+    *
+    * Most people won't do much here, perhaps setting a flag that
+    * marks the image as finished.
+    */
 }
 
-/* write a png file */
+/* Write a png file */
 void write_png(char *file_name /* , ... other image information ... */)
 {
    FILE *fp;
@@ -563,7 +568,7 @@ void write_png(char *file_name /* , ... other image information ... */)
    png_infop info_ptr;
    png_colorp palette;
 
-   /* open the file */
+   /* Open the file */
    fp = fopen(file_name, "wb");
    if (fp == NULL)
       return (ERROR);
@@ -597,30 +602,34 @@ void write_png(char *file_name /* , ... other image information ... */)
     */
    if (setjmp(png_jmpbuf(png_ptr)))
    {
-      /* If we get here, we had a problem reading the file */
+      /* If we get here, we had a problem writing the file */
       fclose(fp);
       png_destroy_write_struct(&png_ptr, &info_ptr);
       return (ERROR);
    }
 
    /* One of the following I/O initialization functions is REQUIRED */
+
 #ifdef streams /* I/O initialization method 1 */
-   /* set up the output control if you are using standard C streams */
+   /* Set up the output control if you are using standard C streams */
    png_init_io(png_ptr, fp);
+
 #else no_streams /* I/O initialization method 2 */
-   /* If you are using replacement read functions, instead of calling
-    * png_init_io() here you would call */
+   /* If you are using replacement write functions, instead of calling
+    * png_init_io() here you would call
+    */
    png_set_write_fn(png_ptr, (void *)user_io_ptr, user_write_fn,
       user_IO_flush_function);
    /* where user_io_ptr is a structure you want available to the callbacks */
-#endif no_streams /* only use one initialization method */
+#endif no_streams /* Only use one initialization method */
 
 #ifdef hilevel
    /* This is the easy way.  Use it if you already have all the
-    * image info living info in the structure.  You could "|" many
+    * image info living in the structure.  You could "|" many
     * PNG_TRANSFORM flags into the png_transforms integer here.
     */
    png_write_png(png_ptr, info_ptr, png_transforms, png_voidp_NULL);
+
 #else
    /* This is the hard way */
 
@@ -635,25 +644,27 @@ void write_png(char *file_name /* , ... other image information ... */)
    png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth, PNG_COLOR_TYPE_???,
       PNG_INTERLACE_????, PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);
 
-   /* set the palette if there is one.  REQUIRED for indexed-color images */
+   /* Set the palette if there is one.  REQUIRED for indexed-color images */
    palette = (png_colorp)png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH
-             * png_sizeof (png_color));
-   /* ... set palette colors ... */
+             * png_sizeof(png_color));
+   /* ... Set palette colors ... */
    png_set_PLTE(png_ptr, info_ptr, palette, PNG_MAX_PALETTE_LENGTH);
    /* You must not free palette here, because png_set_PLTE only makes a link to
-      the palette that you malloced.  Wait until you are about to destroy
-      the png structure. */
+    * the palette that you malloced.  Wait until you are about to destroy
+    * the png structure.
+    */
 
-   /* optional significant bit chunk */
-   /* if we are dealing with a grayscale image then */
+   /* Optional significant bit (sBIT) chunk */
+   png_color_8 sig_bit;
+   /* If we are dealing with a grayscale image then */
    sig_bit.gray = true_bit_depth;
-   /* otherwise, if we are dealing with a color image then */
+   /* Otherwise, if we are dealing with a color image then */
    sig_bit.red = true_red_bit_depth;
    sig_bit.green = true_green_bit_depth;
    sig_bit.blue = true_blue_bit_depth;
-   /* if the image has an alpha channel then */
+   /* If the image has an alpha channel then */
    sig_bit.alpha = true_alpha_bit_depth;
-   png_set_sBIT(png_ptr, info_ptr, sig_bit);
+   png_set_sBIT(png_ptr, info_ptr, &sig_bit);
 
 
    /* Optional gamma chunk is strongly suggested if you have any guess
@@ -678,9 +689,12 @@ void write_png(char *file_name /* , ... other image information ... */)
 #endif
    png_set_text(png_ptr, info_ptr, text_ptr, 3);
 
-   /* other optional chunks like cHRM, bKGD, tRNS, tIME, oFFs, pHYs, */
-   /* note that if sRGB is present the gAMA and cHRM chunks must be ignored
-    * on read and must be written in accordance with the sRGB profile */
+   /* Other optional chunks like cHRM, bKGD, tRNS, tIME, oFFs, pHYs */
+
+   /* Note that if sRGB is present the gAMA and cHRM chunks must be ignored
+    * on read and, if your application chooses to write them, they must
+    * be written in accordance with the sRGB profile
+    */
 
    /* Write the file header information.  REQUIRED */
    png_write_info(png_ptr, info_ptr);
@@ -692,7 +706,7 @@ void write_png(char *file_name /* , ... other image information ... */)
     *   write_my_chunk();
     *   png_write_info(png_ptr, info_ptr);
     *
-    * However, given the level of known- and unknown-chunk support in 1.1.0
+    * However, given the level of known- and unknown-chunk support in 1.2.0
     * and up, this should no longer be necessary.
     */
 
@@ -702,11 +716,11 @@ void write_png(char *file_name /* , ... other image information ... */)
     * at the end.
     */
 
-   /* set up the transformations you want.  Note that these are
+   /* Set up the transformations you want.  Note that these are
     * all optional.  Only call them if you want them.
     */
 
-   /* invert monochrome pixels */
+   /* Invert monochrome pixels */
    png_set_invert_mono(png_ptr);
 
    /* Shift the pixels up to a legal bit depth and fill in
@@ -714,10 +728,10 @@ void write_png(char *file_name /* , ... other image information ... */)
     */
    png_set_shift(png_ptr, &sig_bit);
 
-   /* pack pixels into bytes */
+   /* Pack pixels into bytes */
    png_set_packing(png_ptr);
 
-   /* swap location of alpha bytes from ARGB to RGBA */
+   /* Swap location of alpha bytes from ARGB to RGBA */
    png_set_swap_alpha(png_ptr);
 
    /* Get rid of filler (OR ALPHA) bytes, pack XRGB/RGBX/ARGB/RGBA into
@@ -725,16 +739,16 @@ void write_png(char *file_name /* , ... other image information ... */)
     */
    png_set_filler(png_ptr, 0, PNG_FILLER_BEFORE);
 
-   /* flip BGR pixels to RGB */
+   /* Flip BGR pixels to RGB */
    png_set_bgr(png_ptr);
 
-   /* swap bytes of 16-bit files to most significant byte first */
+   /* Swap bytes of 16-bit files to most significant byte first */
    png_set_swap(png_ptr);
 
-   /* swap bits of 1, 2, 4 bit packed pixel formats */
+   /* Swap bits of 1, 2, 4 bit packed pixel formats */
    png_set_packswap(png_ptr);
 
-   /* turn on interlace handling if you are not using png_write_image() */
+   /* Turn on interlace handling if you are not using png_write_image() */
    if (interlacing)
       number_passes = png_set_interlace_handling(png_ptr);
    else
@@ -755,12 +769,14 @@ void write_png(char *file_name /* , ... other image information ... */)
      row_pointers[k] = image + k*width*bytes_per_pixel;
 
    /* One of the following output methods is REQUIRED */
-#ifdef entire /* write out the entire image data in one call */
+
+#ifdef entire /* Write out the entire image data in one call */
    png_write_image(png_ptr, row_pointers);
 
-   /* the other way to write the image - deal with interlacing */
+   /* The other way to write the image - deal with interlacing */
+
+#else no_entire /* Write out the image data by one or more scanlines */
 
-#else no_entire /* write out the image data by one or more scanlines */
    /* The number of passes is either 1 for non-interlaced images,
     * or 7 for interlaced images.
     */
@@ -771,14 +787,12 @@ void write_png(char *file_name /* , ... other image information ... */)
 
       /* If you are only writing one row at a time, this works */
       for (y = 0; y < height; y++)
-      {
          png_write_rows(png_ptr, &row_pointers[y], 1);
-      }
    }
-#endif no_entire /* use only one output method */
+#endif no_entire /* Use only one output method */
 
    /* You can write optional chunks like tEXt, zTXt, and tIME at the end
-    * as well.  Shouldn't be necessary in 1.1.0 and up as all the public
+    * as well.  Shouldn't be necessary in 1.2.0 and up as all the public
     * chunks are supported and you can use png_set_unknown_chunks() to
     * register unknown chunks into the info structure to be written out.
     */
@@ -788,26 +802,33 @@ void write_png(char *file_name /* , ... other image information ... */)
 #endif hilevel
 
    /* If you png_malloced a palette, free it here (don't free info_ptr->palette,
-      as recommended in versions 1.0.5m and earlier of this example; if
-      libpng mallocs info_ptr->palette, libpng will free it).  If you
-      allocated it with malloc() instead of png_malloc(), use free() instead
-      of png_free(). */
+    * as recommended in versions 1.0.5m and earlier of this example; if
+    * libpng mallocs info_ptr->palette, libpng will free it).  If you
+    * allocated it with malloc() instead of png_malloc(), use free() instead
+    * of png_free().
+    */
    png_free(png_ptr, palette);
-   palette=NULL;
+   palette = NULL;
 
    /* Similarly, if you png_malloced any data that you passed in with
-      png_set_something(), such as a hist or trans array, free it here,
-      when you can be sure that libpng is through with it. */
+    * png_set_something(), such as a hist or trans array, free it here,
+    * when you can be sure that libpng is through with it.
+    */
    png_free(png_ptr, trans);
-   trans=NULL;
+   trans = NULL;
+   /* Whenever you use png_free() it is a good idea to set the pointer to
+    * NULL in case your application inadvertently tries to png_free() it
+    * again.  When png_free() sees a NULL it returns without action, thus
+    * avoiding the double-free security problem.
+    */
 
-   /* clean up after the write, and free any memory allocated */
+   /* Clean up after the write, and free any memory allocated */
    png_destroy_write_struct(&png_ptr, &info_ptr);
 
-   /* close the file */
+   /* Close the file */
    fclose(fp);
 
-   /* that's it */
+   /* That's it */
    return (OK);
 }
 
diff --git a/src/3rdparty/libpng/libpng-1.2.29.txt b/src/3rdparty/libpng/libpng-1.2.40.txt
index 91b9806475..019c886b99 100644
--- a/src/3rdparty/libpng/libpng-1.2.29.txt
+++ b/src/3rdparty/libpng/libpng-1.2.40.txt
@@ -1,17 +1,19 @@
 libpng.txt - A description on how to use and modify libpng
 
- libpng version 1.2.29 - May 8, 2008
+ libpng version 1.2.40 - September 10, 2009
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
- Copyright (c) 1998-2008 Glenn Randers-Pehrson
- For conditions of distribution and use, see copyright
- notice in png.h.
+ Copyright (c) 1998-2009 Glenn Randers-Pehrson
+
+ This document is released under the libpng license.
+ For conditions of distribution and use, see the disclaimer
+ and license in png.h
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.2.29 - May 8, 2008
+ libpng versions 0.97, January 1998, through 1.2.40 - September 10, 2009
  Updated and distributed by Glenn Randers-Pehrson
- Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ Copyright (c) 1998-2009 Glenn Randers-Pehrson
 
  libpng 1.0 beta 6  version 0.96 May 28, 1997
  Updated and distributed by Andreas Dilger
@@ -141,9 +143,10 @@ so if it doesn't work, you don't have much to undo.  Of course, you
 will also want to insure that you are, in fact, dealing with a PNG
 file.  Libpng provides a simple check to see if a file is a PNG file.
 To use it, pass in the first 1 to 8 bytes of the file to the function
-png_sig_cmp(), and it will return 0 if the bytes match the corresponding
-bytes of the PNG signature, or nonzero otherwise.  Of course, the more bytes
-you pass in, the greater the accuracy of the prediction.
+png_sig_cmp(), and it will return 0 (false) if the bytes match the
+corresponding bytes of the PNG signature, or nonzero (true) otherwise.
+Of course, the more bytes you pass in, the greater the accuracy of the
+prediction.
 
 If you are intending to keep the file pointer open for use in libpng,
 you must ensure you don't read more than 8 bytes from the beginning
@@ -320,35 +323,14 @@ To inform libpng about your function, use
 
     png_set_read_status_fn(png_ptr, read_row_callback);
 
-Width and height limits
-
-The PNG specification allows the width and height of an image to be as
-large as 2^31-1 (0x7fffffff), or about 2.147 billion rows and columns.
-Since very few applications really need to process such large images,
-we have imposed an arbitrary 1-million limit on rows and columns.
-Larger images will be rejected immediately with a png_error() call. If
-you wish to override this limit, you can use
-
-   png_set_user_limits(png_ptr, width_max, height_max);
-
-to set your own limits, or use width_max = height_max = 0x7fffffffL
-to allow all valid dimensions (libpng may reject some very large images
-anyway because of potential buffer overflow conditions).
-
-You should put this statement after you create the PNG structure and
-before calling png_read_info(), png_read_png(), or png_process_data().
-If you need to retrieve the limits that are being applied, use
-
-   width_max = png_get_user_width_max(png_ptr);
-   height_max = png_get_user_height_max(png_ptr);
-
 Unknown-chunk handling
 
 Now you get to set the way the library processes unknown chunks in the
 input PNG stream. Both known and unknown chunks will be read.  Normal
 behavior is that known chunks will be parsed into information in
-various info_ptr members while unknown chunks will be discarded. To change
-this, you can call:
+various info_ptr members while unknown chunks will be discarded. This
+behavior can be wasteful if your application will never use some known
+chunk types. To change this, you can call:
 
     png_set_keep_unknown_chunks(png_ptr, keep,
         chunk_list, num_chunks);
@@ -406,6 +388,27 @@ callback function:
          (int)sizeof(unused_chunks)/5);
     #endif
 
+User limits
+
+The PNG specification allows the width and height of an image to be as
+large as 2^31-1 (0x7fffffff), or about 2.147 billion rows and columns.
+Since very few applications really need to process such large images,
+we have imposed an arbitrary 1-million limit on rows and columns.
+Larger images will be rejected immediately with a png_error() call. If
+you wish to override this limit, you can use
+
+   png_set_user_limits(png_ptr, width_max, height_max);
+
+to set your own limits, or use width_max = height_max = 0x7fffffffL
+to allow all valid dimensions (libpng may reject some very large images
+anyway because of potential buffer overflow conditions).
+
+You should put this statement after you create the PNG structure and
+before calling png_read_info(), png_read_png(), or png_process_data().
+If you need to retrieve the limits that are being applied, use
+
+   width_max = png_get_user_width_max(png_ptr);
+   height_max = png_get_user_height_max(png_ptr);
 
 The high-level read interface
 
@@ -472,6 +475,8 @@ row_pointers prior to calling png_read_png() with
    row_pointers = png_malloc(png_ptr,
       height*png_sizeof(png_bytep));
    for (int i=0; i<height, i++)
+      row_pointers[i]=NULL;  /* security precaution */
+   for (int i=0; i<height, i++)
       row_pointers[i]=png_malloc(png_ptr,
          width*pixel_size);
    png_set_rows(png_ptr, info_ptr, &row_pointers);
@@ -847,9 +852,6 @@ things.
 
 As of libpng version 1.2.9, png_set_expand_gray_1_2_4_to_8() was
 added.  It expands the sample depth without changing tRNS to alpha.
-At the same time, png_set_gray_1_2_4_to_8() was deprecated, and it
-will be removed from a future version.
-
 
 PNG can have files with 16 bits per channel.  If you only can handle
 8 bits per channel, this will strip the pixels down to 8 bit.
@@ -1701,7 +1703,7 @@ types.
        PNG_FILTER_NONE  | PNG_FILTER_VALUE_NONE |
        PNG_FILTER_SUB   | PNG_FILTER_VALUE_SUB  |
        PNG_FILTER_UP    | PNG_FILTER_VALUE_UP   |
-       PNG_FILTER_AVE   | PNG_FILTER_VALUE_AVE  |
+       PNG_FILTER_AVG   | PNG_FILTER_VALUE_AVG  |
        PNG_FILTER_PAETH | PNG_FILTER_VALUE_PAETH|
        PNG_ALL_FILTERS);
 
@@ -1791,10 +1793,14 @@ Some of the more important parts of the png_info are:
                      PNG_INTRAPIXEL_DIFFERENCING)
 
 If you call png_set_IHDR(), the call must appear before any of the
-other png_set_*() functions, which might require access to some of
+other png_set_*() functions, because they might require access to some of
 the IHDR settings.  The remaining png_set_*() functions can be called
 in any order.
 
+If you wish, you can reset the compression_type, interlace_type, or
+filter_method later by calling png_set_IHDR() again; if you do this, the
+width, height, bit_depth, and color_type must be the same in each call.
+
     png_set_PLTE(png_ptr, info_ptr, palette,
        num_palette);
     palette        - the palette for the file
@@ -1856,8 +1862,9 @@ in any order.
        trans_values);
     trans          - array of transparent entries for
                      palette (PNG_INFO_tRNS)
-    trans_values   - graylevel or color sample values of
-                     the single transparent color for
+    trans_values   - graylevel or color sample values
+                     (in order red, green, blue) of the
+                     single transparent color for
                      non-paletted images (PNG_INFO_tRNS)
     num_trans      - number of transparent entries
                      (PNG_INFO_tRNS)
@@ -2066,7 +2073,12 @@ transformations are permitted, enabled by the following masks.
     PNG_TRANSFORM_INVERT_ALPHA  Change alpha from opacity
                                 to transparency
     PNG_TRANSFORM_SWAP_ENDIAN   Byte-swap 16-bit samples
-    PNG_TRANSFORM_STRIP_FILLER  Strip out filler bytes.
+    PNG_TRANSFORM_STRIP_FILLER        Strip out filler
+                                      bytes (deprecated).
+    PNG_TRANSFORM_STRIP_FILLER_BEFORE Strip out leading
+                                      filler bytes
+    PNG_TRANSFORM_STRIP_FILLER_AFTER  Strip out trailing
+                                      filler bytes
 
 If you have valid image data in the info structure (you can use
 png_set_rows() to put image data in the info structure), simply do this:
@@ -2473,9 +2485,15 @@ The replacement I/O functions must have prototypes as follows:
         png_bytep data, png_size_t length);
     void user_flush_data(png_structp png_ptr);
 
+The user_read_data() function is responsible for detecting and
+handling end-of-data errors.
+
 Supplying NULL for the read, write, or flush functions sets them back
-to using the default C stream functions.  It is an error to read from
-a write stream, and vice versa.
+to using the default C stream functions, which expect the io_ptr to
+point to a standard *FILE structure.  It is probably a mistake
+to use NULL for one of write_data_fn and output_flush_fn but not both
+of them, unless you have built libpng with PNG_NO_WRITE_FLUSH defined.
+It is an error to read from a write stream, and vice versa.
 
 Error handling in libpng is done through png_error() and png_warning().
 Errors handled through png_error() are fatal, meaning that png_error()
@@ -2580,11 +2598,12 @@ you may also have to change the memory allocators (png_malloc, etc.).
 
 Configuring for compiler xxx:
 
-All includes for libpng are in pngconf.h.  If you need to add/change/delete
-an include, this is the place to do it.  The includes that are not
-needed outside libpng are protected by the PNG_INTERNAL definition,
-which is only defined for those routines inside libpng itself.  The
-files in libpng proper only include png.h, which includes pngconf.h.
+All includes for libpng are in pngconf.h.  If you need to add, change
+or delete an include, this is the place to do it.
+The includes that are not needed outside libpng are protected by the
+PNG_INTERNAL definition, which is only defined for those routines inside
+libpng itself.  The files in libpng proper only include png.h, which
+includes pngconf.h.
 
 Configuring zlib:
 
@@ -2653,7 +2672,7 @@ currently does not allocate the filter buffers until png_write_row()
 is called for the first time.)
 
     filters = PNG_FILTER_NONE | PNG_FILTER_SUB
-              PNG_FILTER_UP | PNG_FILTER_AVE |
+              PNG_FILTER_UP | PNG_FILTER_AVG |
               PNG_FILTER_PAETH | PNG_ALL_FILTERS;
 
     png_set_filter(png_ptr, PNG_FILTER_TYPE_BASE,
@@ -2775,7 +2794,7 @@ When PNG_DEBUG = 1, the macros are defined, but only png_debug statements
 having level = 0 will be printed.  There aren't any such statements in
 this version of libpng, but if you insert some they will be printed.
 
-VII.  MNG support
+VI.  MNG support
 
 The MNG specification (available at http://www.libpng.org/pub/mng) allows
 certain extensions to PNG for PNG images that are embedded in MNG datastreams.
@@ -2800,7 +2819,7 @@ or any other MNG chunks; your application must provide its own support for
 them.  You may wish to consider using libmng (available at
 http://www.libmng.com) instead.
 
-VIII.  Changes to Libpng from version 0.88
+VII.  Changes to Libpng from version 0.88
 
 It should be noted that versions of libpng later than 0.96 are not
 distributed by the original libpng author, Guy Schalnat, nor by
@@ -2849,15 +2868,202 @@ application:
 
    png_uint_32 application_vn = PNG_LIBPNG_VER;
 
-IX. Y2K Compliance in libpng
+VIII.  Changes to Libpng from version 1.0.x to 1.2.x
+
+Support for user memory management was enabled by default.  To
+accomplish this, the functions png_create_read_struct_2(),
+png_create_write_struct_2(), png_set_mem_fn(), png_get_mem_ptr(),
+png_malloc_default(), and png_free_default() were added.
+
+Support for certain MNG features was enabled.
+
+Support for numbered error messages was added.  However, we never got
+around to actually numbering the error messages.  The function
+png_set_strip_error_numbers() was added (Note: the prototype for this
+function was inadvertently removed from png.h in PNG_NO_ASSEMBLER_CODE
+builds of libpng-1.2.15.  It was restored in libpng-1.2.36).
+
+The png_malloc_warn() function was added at libpng-1.2.3.  This issues
+a png_warning and returns NULL instead of aborting when it fails to
+acquire the requested memory allocation.
+
+Support for setting user limits on image width and height was enabled
+by default.  The functions png_set_user_limits(), png_get_user_width_max(),
+and png_get_user_height_max() were added at libpng-1.2.6.
+
+The png_set_add_alpha() function was added at libpng-1.2.7.
+
+The function png_set_expand_gray_1_2_4_to_8() was added at libpng-1.2.9.
+Unlike png_set_gray_1_2_4_to_8(), the new function does not expand the
+tRNS chunk to alpha. The png_set_gray_1_2_4_to_8() function is
+deprecated.
+
+A number of macro definitions in support of runtime selection of
+assembler code features (especially Intel MMX code support) were
+added at libpng-1.2.0:
+
+    PNG_ASM_FLAG_MMX_SUPPORT_COMPILED
+    PNG_ASM_FLAG_MMX_SUPPORT_IN_CPU
+    PNG_ASM_FLAG_MMX_READ_COMBINE_ROW
+    PNG_ASM_FLAG_MMX_READ_INTERLACE
+    PNG_ASM_FLAG_MMX_READ_FILTER_SUB
+    PNG_ASM_FLAG_MMX_READ_FILTER_UP
+    PNG_ASM_FLAG_MMX_READ_FILTER_AVG
+    PNG_ASM_FLAG_MMX_READ_FILTER_PAETH
+    PNG_ASM_FLAGS_INITIALIZED
+    PNG_MMX_READ_FLAGS
+    PNG_MMX_FLAGS
+    PNG_MMX_WRITE_FLAGS
+    PNG_MMX_FLAGS
+
+We added the following functions in support of runtime
+selection of assembler code features:
+
+    png_get_mmx_flagmask()
+    png_set_mmx_thresholds()
+    png_get_asm_flags()
+    png_get_mmx_bitdepth_threshold()
+    png_get_mmx_rowbytes_threshold()
+    png_set_asm_flags()
+
+We replaced all of these functions with simple stubs in libpng-1.2.20,
+when the Intel assembler code was removed due to a licensing issue.
+
+IX.  (Omitted)
+
+X. Detecting libpng
+
+The png_get_io_ptr() function has been present since libpng-0.88, has never
+changed, and is unaffected by conditional compilation macros.  It is the
+best choice for use in configure scripts for detecting the presence of any
+libpng version since 0.88.  In an autoconf "configure.in" you could use
+
+    AC_CHECK_LIB(png, png_get_io_ptr, ...
+
+XI. Source code repository
+
+Since about February 2009, version 1.2.34, libpng has been under "git" source
+control.  The git repository was built from old libpng-x.y.z.tar.gz files
+going back to version 0.70.  You can access the git repository (read only)
+at
+
+    git://libpng.git.sourceforge.net/gitroot/libpng
+
+or you can browse it via "gitweb" at
+
+    http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng
+
+Patches can be sent to glennrp at users.sourceforge.net or to
+png-mng-implement at lists.sourceforge.net or you can upload them to
+the libpng bug tracker at
+
+    http://libpng.sourceforge.net
+
+XII. Coding style
+
+Our coding style is similar to the "Allman" style, with curly
+braces on separate lines:
+
+    if (condition)
+    {
+       action;
+    }
+
+    else if (another condition)
+    {
+       another action;
+    }
+
+The braces can be omitted from simple one-line actions:
+
+    if (condition)
+       return (0);
+
+We use 3-space indentation, except for continued statements which
+are usually indented the same as the first line of the statement
+plus four more spaces.
+
+Comments appear with the leading "/*" at the same indentation as
+the statement that follows the comment:
+
+    /* Single-line comment */
+    statement;
+
+    /* Multiple-line
+     * comment
+     */
+    statement;
+
+Very short comments can be placed at the end of the statement
+to which they pertain:
+
+    statement;    /* comment */
+
+We don't use C++ style ("//") comments. We have, however,
+used them in the past in some now-abandoned MMX assembler
+code.
+
+Functions and their curly braces are not indented, and
+exported functions are marked with PNGAPI:
+
+ /* This is a public function that is visible to
+  * application programers. It does thus-and-so.
+  */
+ void PNGAPI
+ png_exported_function(png_ptr, png_info, foo)
+ {
+    body;
+ }
+
+The prototypes for all exported functions appear in png.h,
+above the comment that says
+
+    /* Maintainer: Put new public prototypes here ... */
+
+We mark all non-exported functions with "/* PRIVATE */"":
+
+ void /* PRIVATE */
+ png_non_exported_function(png_ptr, png_info, foo)
+ {
+    body;
+ }
+
+The prototypes for non-exported functions (except for those in
+pngtest) appear in
+the PNG_INTERNAL section of png.h
+above the comment that says
+
+  /* Maintainer: Put new private prototypes here ^ and in libpngpf.3 */
+
+The names of all exported functions and variables begin
+with  "png_", and all publicly visible C preprocessor
+macros begin with "PNG_".
+
+We put a space after each comma and after each semicolon
+in "for" statments, and we put spaces before and after each
+C binary operator and after "for" or "while".  We don't
+put a space between a typecast and the expression being
+cast, nor do we put one between a function name and the
+left parenthesis that follows it:
+
+    for (i = 2; i > 0; --i)
+       x[i] = a(x) + (int)b;
+
+We prefer #ifdef and #ifndef to #if defined() and if !defined()
+when there is only one macro being tested.
+
+Other rules can be inferred by inspecting the libpng
+source.
+
+XIII. Y2K Compliance in libpng
 
-May 8, 2008
+September 10, 2009
 
 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.
 
 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.2.29 are Y2K compliant.  It is my belief that earlier
+upward through 1.2.40 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.
 
 Libpng only has three year fields.  One is a 2-byte unsigned integer that
diff --git a/src/3rdparty/libpng/libpng.3 b/src/3rdparty/libpng/libpng.3
index ef7fc5b2b3..65b368624e 100644
--- a/src/3rdparty/libpng/libpng.3
+++ b/src/3rdparty/libpng/libpng.3
@@ -1,404 +1,815 @@
-.TH LIBPNG 3 "May 8, 2008"
+.TH LIBPNG 3 "September 10, 2009"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.2.29
+libpng \- Portable Network Graphics (PNG) Reference Library 1.2.40
 .SH SYNOPSIS
-\fB
-#include <png.h>\fP
+\fI\fB
+
+\fB#include <png.h>\fP
+
+\fI\fB
 
 \fBpng_uint_32 png_access_version_number \fI(void\fP\fB);\fP
 
+\fI\fB
+
 \fBint png_check_sig (png_bytep \fP\fIsig\fP\fB, int \fInum\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_chunk_error (png_structp \fP\fIpng_ptr\fP\fB, png_const_charp \fIerror\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_chunk_warning (png_structp \fP\fIpng_ptr\fP\fB, png_const_charp \fImessage\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_convert_from_struct_tm (png_timep \fP\fIptime\fP\fB, struct tm FAR * \fIttime\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_convert_from_time_t (png_timep \fP\fIptime\fP\fB, time_t \fIttime\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_charp png_convert_to_rfc1123 (png_structp \fP\fIpng_ptr\fP\fB, png_timep \fIptime\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_infop png_create_info_struct (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_structp png_create_read_struct (png_const_charp \fP\fIuser_png_ver\fP\fB, png_voidp \fP\fIerror_ptr\fP\fB, png_error_ptr \fP\fIerror_fn\fP\fB, png_error_ptr \fIwarn_fn\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_structp png_create_read_struct_2(png_const_charp \fP\fIuser_png_ver\fP\fB, png_voidp \fP\fIerror_ptr\fP\fB, png_error_ptr \fP\fIerror_fn\fP\fB, png_error_ptr \fP\fIwarn_fn\fP\fB, png_voidp \fP\fImem_ptr\fP\fB, png_malloc_ptr \fP\fImalloc_fn\fP\fB, png_free_ptr \fIfree_fn\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_structp png_create_write_struct (png_const_charp \fP\fIuser_png_ver\fP\fB, png_voidp \fP\fIerror_ptr\fP\fB, png_error_ptr \fP\fIerror_fn\fP\fB, png_error_ptr \fIwarn_fn\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_structp png_create_write_struct_2(png_const_charp \fP\fIuser_png_ver\fP\fB, png_voidp \fP\fIerror_ptr\fP\fB, png_error_ptr \fP\fIerror_fn\fP\fB, png_error_ptr \fP\fIwarn_fn\fP\fB, png_voidp \fP\fImem_ptr\fP\fB, png_malloc_ptr \fP\fImalloc_fn\fP\fB, png_free_ptr \fIfree_fn\fP\fB);\fP
 
+\fI\fB
+
 \fBint png_debug(int \fP\fIlevel\fP\fB, png_const_charp \fImessage\fP\fB);\fP
 
+\fI\fB
+
 \fBint png_debug1(int \fP\fIlevel\fP\fB, png_const_charp \fP\fImessage\fP\fB, \fIp1\fP\fB);\fP
 
+\fI\fB
+
 \fBint png_debug2(int \fP\fIlevel\fP\fB, png_const_charp \fP\fImessage\fP\fB, \fP\fIp1\fP\fB, \fIp2\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_destroy_info_struct (png_structp \fP\fIpng_ptr\fP\fB, png_infopp \fIinfo_ptr_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_destroy_read_struct (png_structpp \fP\fIpng_ptr_ptr\fP\fB, png_infopp \fP\fIinfo_ptr_ptr\fP\fB, png_infopp \fIend_info_ptr_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_destroy_write_struct (png_structpp \fP\fIpng_ptr_ptr\fP\fB, png_infopp \fIinfo_ptr_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_error (png_structp \fP\fIpng_ptr\fP\fB, png_const_charp \fIerror\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_free (png_structp \fP\fIpng_ptr\fP\fB, png_voidp \fIptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_free_chunk_list (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_free_default(png_structp \fP\fIpng_ptr\fP\fB, png_voidp \fIptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_free_data (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, int \fInum\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_byte png_get_bit_depth (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_bKGD (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_color_16p \fI*background\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_byte png_get_channels (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_cHRM (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, double \fP\fI*white_x\fP\fB, double \fP\fI*white_y\fP\fB, double \fP\fI*red_x\fP\fB, double \fP\fI*red_y\fP\fB, double \fP\fI*green_x\fP\fB, double \fP\fI*green_y\fP\fB, double \fP\fI*blue_x\fP\fB, double \fI*blue_y\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_cHRM_fixed (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fP\fI*white_x\fP\fB, png_uint_32 \fP\fI*white_y\fP\fB, png_uint_32 \fP\fI*red_x\fP\fB, png_uint_32 \fP\fI*red_y\fP\fB, png_uint_32 \fP\fI*green_x\fP\fB, png_uint_32 \fP\fI*green_y\fP\fB, png_uint_32 \fP\fI*blue_x\fP\fB, png_uint_32 \fI*blue_y\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_byte png_get_color_type (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_byte png_get_compression_type (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_byte png_get_copyright (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_voidp png_get_error_ptr (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_byte png_get_filter_type (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_gAMA (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, double \fI*file_gamma\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_gAMA_fixed (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fI*int_file_gamma\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_byte png_get_header_ver (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_byte png_get_header_version (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_hIST (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_16p \fI*hist\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_iCCP (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_charpp \fP\fIname\fP\fB, int \fP\fI*compression_type\fP\fB, png_charpp \fP\fIprofile\fP\fB, png_uint_32 \fI*proflen\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_IHDR (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fP\fI*width\fP\fB, png_uint_32 \fP\fI*height\fP\fB, int \fP\fI*bit_depth\fP\fB, int \fP\fI*color_type\fP\fB, int \fP\fI*interlace_type\fP\fB, int \fP\fI*compression_type\fP\fB, int \fI*filter_type\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_image_height (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_image_width (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
-\fB#if !defined(PNG_1_0_X) png_int_32 png_get_int_32 (png_bytep buf); \fI#endif
+\fI\fB
+
+\fB#if \fI!defined(PNG_1_0_X)
+
+\fBpng_int_32 png_get_int_32 (png_bytep \fIbuf\fP\fB);\fP
+
+\fI\fB#endif
+
+\fI\fB
 
 \fBpng_byte png_get_interlace_type (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_voidp png_get_io_ptr (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_byte png_get_libpng_ver (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_voidp png_get_mem_ptr(png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_oFFs (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fP\fI*offset_x\fP\fB, png_uint_32 \fP\fI*offset_y\fP\fB, int \fI*unit_type\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_pCAL (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_charp \fP\fI*purpose\fP\fB, png_int_32 \fP\fI*X0\fP\fB, png_int_32 \fP\fI*X1\fP\fB, int \fP\fI*type\fP\fB, int \fP\fI*nparams\fP\fB, png_charp \fP\fI*units\fP\fB, png_charpp \fI*params\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_pHYs (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fP\fI*res_x\fP\fB, png_uint_32 \fP\fI*res_y\fP\fB, int \fI*unit_type\fP\fB);\fP
 
+\fI\fB
+
 \fBfloat png_get_pixel_aspect_ratio (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_pixels_per_meter (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_voidp png_get_progressive_ptr (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_PLTE (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_colorp \fP\fI*palette\fP\fB, int \fI*num_palette\fP\fB);\fP
 
-\fBpng_byte png_get_rgb_to_gray_status (png_structp png_ptr) png_uint_32 png_get_rowbytes (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
+\fI\fB
+
+\fBpng_byte png_get_rgb_to_gray_status (png_structp \fIpng_ptr)
+
+\fBpng_uint_32 png_get_rowbytes (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
+
+\fI\fB
 
 \fBpng_bytepp png_get_rows (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_sBIT (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_color_8p \fI*sig_bit\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_bytep png_get_signature (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_sPLT (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_spalette_p \fI*splt_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_sRGB (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, int \fI*intent\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_text (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_textp \fP\fI*text_ptr\fP\fB, int \fI*num_text\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_tIME (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_timep \fI*mod_time\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_tRNS (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_bytep \fP\fI*trans\fP\fB, int \fP\fI*num_trans\fP\fB, png_color_16p \fI*trans_values\fP\fB);\fP
 
-\fB#if !defined(PNG_1_0_X) png_uint_16 png_get_uint_16 (png_bytep \fIbuf\fP\fB);\fP
+\fI\fB
+
+\fB#if \fI!defined(PNG_1_0_X)
+
+\fBpng_uint_16 png_get_uint_16 (png_bytep \fIbuf\fP\fB);\fP
+
+\fI\fB
 
 \fBpng_uint_32 png_get_uint_31 (png_bytep \fIbuf\fP\fB);\fP
 
-\fBpng_uint_32 png_get_uint_32 (png_bytep buf); \fI#endif
+\fI\fB
+
+\fBpng_uint_32 png_get_uint_32 (png_bytep \fIbuf\fP\fB);\fP
+
+\fI\fB#endif
+
+\fI\fB
 
 \fBpng_uint_32 png_get_unknown_chunks (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_unknown_chunkpp \fIunknowns\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_voidp png_get_user_chunk_ptr (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_user_height_max( png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_voidp png_get_user_transform_ptr (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_user_width_max (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_valid (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIflag\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_int_32 png_get_x_offset_microns (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_int_32 png_get_x_offset_pixels (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_x_pixels_per_meter (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_int_32 png_get_y_offset_microns (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_int_32 png_get_y_offset_pixels (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_y_pixels_per_meter (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_get_compression_buffer_size (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBint png_handle_as_unknown (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fIchunk_name\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_init_io (png_structp \fP\fIpng_ptr\fP\fB, FILE \fI*fp\fP\fB);\fP
 
+\fI\fB
+
 \fBDEPRECATED: void png_info_init (png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBDEPRECATED: void png_info_init_2 (png_infopp \fP\fIptr_ptr\fP\fB, png_size_t \fIpng_info_struct_size\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_voidp png_malloc (png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fIsize\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_voidp png_malloc_default(png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fIsize\fP\fB);\fP
 
+\fI\fB
+
 \fBvoidp png_memcpy (png_voidp \fP\fIs1\fP\fB, png_voidp \fP\fIs2\fP\fB, png_size_t \fIsize\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_voidp png_memcpy_check (png_structp \fP\fIpng_ptr\fP\fB, png_voidp \fP\fIs1\fP\fB, png_voidp \fP\fIs2\fP\fB, png_uint_32 \fIsize\fP\fB);\fP
 
+\fI\fB
+
 \fBvoidp png_memset (png_voidp \fP\fIs1\fP\fB, int \fP\fIvalue\fP\fB, png_size_t \fIsize\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_voidp png_memset_check (png_structp \fP\fIpng_ptr\fP\fB, png_voidp \fP\fIs1\fP\fB, int \fP\fIvalue\fP\fB, png_uint_32 \fIsize\fP\fB);\fP
 
+\fI\fB
+
 \fBDEPRECATED: void png_permit_empty_plte (png_structp \fP\fIpng_ptr\fP\fB, int \fIempty_plte_permitted\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_process_data (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_bytep \fP\fIbuffer\fP\fB, png_size_t \fIbuffer_size\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_progressive_combine_row (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fP\fIold_row\fP\fB, png_bytep \fInew_row\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_read_destroy (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_infop \fIend_info_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_read_end (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_read_image (png_structp \fP\fIpng_ptr\fP\fB, png_bytepp \fIimage\fP\fB);\fP
 
+\fI\fB
+
 \fBDEPRECATED: void png_read_init (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBDEPRECATED: void png_read_init_2 (png_structpp \fP\fIptr_ptr\fP\fB, png_const_charp \fP\fIuser_png_ver\fP\fB, png_size_t \fP\fIpng_struct_size\fP\fB, png_size_t \fIpng_info_size\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_read_info (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_read_png (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, int \fP\fItransforms\fP\fB, png_voidp \fIparams\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_read_row (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fP\fIrow\fP\fB, png_bytep \fIdisplay_row\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_read_rows (png_structp \fP\fIpng_ptr\fP\fB, png_bytepp \fP\fIrow\fP\fB, png_bytepp \fP\fIdisplay_row\fP\fB, png_uint_32 \fInum_rows\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_read_update_info (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
-\fB#if !defined(PNG_1_0_X) png_save_int_32 (png_bytep \fP\fIbuf\fP\fB, png_int_32 \fIi\fP\fB);\fP
+\fI\fB
+
+\fB#if \fI!defined(PNG_1_0_X)
+
+\fBpng_save_int_32 (png_bytep \fP\fIbuf\fP\fB, png_int_32 \fIi\fP\fB);\fP
+
+\fI\fB
 
 \fBvoid png_save_uint_16 (png_bytep \fP\fIbuf\fP\fB, unsigned int \fIi\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_save_uint_32 (png_bytep \fP\fIbuf\fP\fB, png_uint_32 \fIi\fP\fB);\fP
 
-\fBvoid png_set_add_alpha (png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fP\fIfiller\fP\fB, int flags); \fI#endif
+\fI\fB
+
+\fBvoid png_set_add_alpha (png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fP\fIfiller\fP\fB, int \fIflags\fP\fB);\fP
+
+\fI\fB#endif
+
+\fI\fB
 
 \fBvoid png_set_background (png_structp \fP\fIpng_ptr\fP\fB, png_color_16p \fP\fIbackground_color\fP\fB, int \fP\fIbackground_gamma_code\fP\fB, int \fP\fIneed_expand\fP\fB, double \fIbackground_gamma\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_bgr (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_bKGD (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_color_16p \fIbackground\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_cHRM (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, double \fP\fIwhite_x\fP\fB, double \fP\fIwhite_y\fP\fB, double \fP\fIred_x\fP\fB, double \fP\fIred_y\fP\fB, double \fP\fIgreen_x\fP\fB, double \fP\fIgreen_y\fP\fB, double \fP\fIblue_x\fP\fB, double \fIblue_y\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_cHRM_fixed (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fP\fIwhite_x\fP\fB, png_uint_32 \fP\fIwhite_y\fP\fB, png_uint_32 \fP\fIred_x\fP\fB, png_uint_32 \fP\fIred_y\fP\fB, png_uint_32 \fP\fIgreen_x\fP\fB, png_uint_32 \fP\fIgreen_y\fP\fB, png_uint_32 \fP\fIblue_x\fP\fB, png_uint_32 \fIblue_y\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_compression_level (png_structp \fP\fIpng_ptr\fP\fB, int \fIlevel\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_compression_mem_level (png_structp \fP\fIpng_ptr\fP\fB, int \fImem_level\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_compression_method (png_structp \fP\fIpng_ptr\fP\fB, int \fImethod\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_compression_strategy (png_structp \fP\fIpng_ptr\fP\fB, int \fIstrategy\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_compression_window_bits (png_structp \fP\fIpng_ptr\fP\fB, int \fIwindow_bits\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_crc_action (png_structp \fP\fIpng_ptr\fP\fB, int \fP\fIcrit_action\fP\fB, int \fIancil_action\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_dither (png_structp \fP\fIpng_ptr\fP\fB, png_colorp \fP\fIpalette\fP\fB, int \fP\fInum_palette\fP\fB, int \fP\fImaximum_colors\fP\fB, png_uint_16p \fP\fIhistogram\fP\fB, int \fIfull_dither\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_error_fn (png_structp \fP\fIpng_ptr\fP\fB, png_voidp \fP\fIerror_ptr\fP\fB, png_error_ptr \fP\fIerror_fn\fP\fB, png_error_ptr \fIwarning_fn\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_expand (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_expand_gray_1_2_4_to_8(png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_filler (png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fP\fIfiller\fP\fB, int \fIflags\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_filter (png_structp \fP\fIpng_ptr\fP\fB, int \fP\fImethod\fP\fB, int \fIfilters\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_filter_heuristics (png_structp \fP\fIpng_ptr\fP\fB, int \fP\fIheuristic_method\fP\fB, int \fP\fInum_weights\fP\fB, png_doublep \fP\fIfilter_weights\fP\fB, png_doublep \fIfilter_costs\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_flush (png_structp \fP\fIpng_ptr\fP\fB, int \fInrows\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_gamma (png_structp \fP\fIpng_ptr\fP\fB, double \fP\fIscreen_gamma\fP\fB, double \fIdefault_file_gamma\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_gAMA (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, double \fIfile_gamma\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_gAMA_fixed (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIfile_gamma\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_gray_1_2_4_to_8(png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_gray_to_rgb (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_hIST (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_16p \fIhist\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_iCCP (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_charp \fP\fIname\fP\fB, int \fP\fIcompression_type\fP\fB, png_charp \fP\fIprofile\fP\fB, png_uint_32 \fIproflen\fP\fB);\fP
 
+\fI\fB
+
 \fBint png_set_interlace_handling (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_invalid (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, int \fImask\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_invert_alpha (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_invert_mono (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_IHDR (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fP\fIwidth\fP\fB, png_uint_32 \fP\fIheight\fP\fB, int \fP\fIbit_depth\fP\fB, int \fP\fIcolor_type\fP\fB, int \fP\fIinterlace_type\fP\fB, int \fP\fIcompression_type\fP\fB, int \fIfilter_type\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_keep_unknown_chunks (png_structp \fP\fIpng_ptr\fP\fB, int \fP\fIkeep\fP\fB, png_bytep \fP\fIchunk_list\fP\fB, int \fInum_chunks\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_mem_fn(png_structp \fP\fIpng_ptr\fP\fB, png_voidp \fP\fImem_ptr\fP\fB, png_malloc_ptr \fP\fImalloc_fn\fP\fB, png_free_ptr \fIfree_fn\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_oFFs (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fP\fIoffset_x\fP\fB, png_uint_32 \fP\fIoffset_y\fP\fB, int \fIunit_type\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_packing (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_packswap (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_palette_to_rgb(png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_pCAL (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_charp \fP\fIpurpose\fP\fB, png_int_32 \fP\fIX0\fP\fB, png_int_32 \fP\fIX1\fP\fB, int \fP\fItype\fP\fB, int \fP\fInparams\fP\fB, png_charp \fP\fIunits\fP\fB, png_charpp \fIparams\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_pHYs (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fP\fIres_x\fP\fB, png_uint_32 \fP\fIres_y\fP\fB, int \fIunit_type\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_progressive_read_fn (png_structp \fP\fIpng_ptr\fP\fB, png_voidp \fP\fIprogressive_ptr\fP\fB, png_progressive_info_ptr \fP\fIinfo_fn\fP\fB, png_progressive_row_ptr \fP\fIrow_fn\fP\fB, png_progressive_end_ptr \fIend_fn\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_PLTE (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_colorp \fP\fIpalette\fP\fB, int \fInum_palette\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_read_fn (png_structp \fP\fIpng_ptr\fP\fB, png_voidp \fP\fIio_ptr\fP\fB, png_rw_ptr \fIread_data_fn\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_read_status_fn (png_structp \fP\fIpng_ptr\fP\fB, png_read_status_ptr \fIread_row_fn\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_read_user_transform_fn (png_structp \fP\fIpng_ptr\fP\fB, png_user_transform_ptr \fIread_user_transform_fn\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_rgb_to_gray (png_structp \fP\fIpng_ptr\fP\fB, int \fP\fIerror_action\fP\fB, double \fP\fIred\fP\fB, double \fIgreen\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_rgb_to_gray_fixed (png_structp \fP\fIpng_ptr\fP\fB, int error_action png_fixed_point \fP\fIred\fP\fB, png_fixed_point \fIgreen\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_rows (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_bytepp \fIrow_pointers\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_sBIT (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_color_8p \fIsig_bit\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_sCAL (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_charp \fP\fIunit\fP\fB, double \fP\fIwidth\fP\fB, double \fIheight\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_shift (png_structp \fP\fIpng_ptr\fP\fB, png_color_8p \fItrue_bits\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_sig_bytes (png_structp \fP\fIpng_ptr\fP\fB, int \fInum_bytes\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_sPLT (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_spalette_p \fP\fIsplt_ptr\fP\fB, int \fInum_spalettes\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_sRGB (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, int \fIintent\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_sRGB_gAMA_and_cHRM (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, int \fIintent\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_strip_16 (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_strip_alpha (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_swap (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_swap_alpha (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_text (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_textp \fP\fItext_ptr\fP\fB, int \fInum_text\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_tIME (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_timep \fImod_time\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_tRNS (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_bytep \fP\fItrans\fP\fB, int \fP\fInum_trans\fP\fB, png_color_16p \fItrans_values\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_tRNS_to_alpha(png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBpng_uint_32 png_set_unknown_chunks (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_unknown_chunkp \fP\fIunknowns\fP\fB, int \fP\fInum\fP\fB, int \fIlocation\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_unknown_chunk_location(png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, int \fP\fIchunk\fP\fB, int \fIlocation\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_read_user_chunk_fn (png_structp \fP\fIpng_ptr\fP\fB, png_voidp \fP\fIuser_chunk_ptr\fP\fB, png_user_chunk_ptr \fIread_user_chunk_fn\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_user_limits (png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fP\fIuser_width_max\fP\fB, png_uint_32 \fIuser_height_max\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_user_transform_info (png_structp \fP\fIpng_ptr\fP\fB, png_voidp \fP\fIuser_transform_ptr\fP\fB, int \fP\fIuser_transform_depth\fP\fB, int \fIuser_transform_channels\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_write_fn (png_structp \fP\fIpng_ptr\fP\fB, png_voidp \fP\fIio_ptr\fP\fB, png_rw_ptr \fP\fIwrite_data_fn\fP\fB, png_flush_ptr \fIoutput_flush_fn\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_write_status_fn (png_structp \fP\fIpng_ptr\fP\fB, png_write_status_ptr \fIwrite_row_fn\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_write_user_transform_fn (png_structp \fP\fIpng_ptr\fP\fB, png_user_transform_ptr \fIwrite_user_transform_fn\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_set_compression_buffer_size(png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fIsize\fP\fB);\fP
 
+\fI\fB
+
 \fBint png_sig_cmp (png_bytep \fP\fIsig\fP\fB, png_size_t \fP\fIstart\fP\fB, png_size_t \fInum_to_check\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_start_read_image (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_warning (png_structp \fP\fIpng_ptr\fP\fB, png_const_charp \fImessage\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_write_chunk (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fP\fIchunk_name\fP\fB, png_bytep \fP\fIdata\fP\fB, png_size_t \fIlength\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_write_chunk_data (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fP\fIdata\fP\fB, png_size_t \fIlength\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_write_chunk_end (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_write_chunk_start (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fP\fIchunk_name\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_write_destroy (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_write_end (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_write_flush (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_write_image (png_structp \fP\fIpng_ptr\fP\fB, png_bytepp \fIimage\fP\fB);\fP
 
+\fI\fB
+
 \fBDEPRECATED: void png_write_init (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBDEPRECATED: void png_write_init_2 (png_structpp \fP\fIptr_ptr\fP\fB, png_const_charp \fP\fIuser_png_ver\fP\fB, png_size_t \fP\fIpng_struct_size\fP\fB, png_size_t \fIpng_info_size\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_write_info (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_write_info_before_PLTE (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_write_png (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, int \fP\fItransforms\fP\fB, png_voidp \fIparams\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_write_row (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fIrow\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_write_rows (png_structp \fP\fIpng_ptr\fP\fB, png_bytepp \fP\fIrow\fP\fB, png_uint_32 \fInum_rows\fP\fB);\fP
 
+\fI\fB
+
 \fBvoidpf png_zalloc (voidpf \fP\fIpng_ptr\fP\fB, uInt \fP\fIitems\fP\fB, uInt \fIsize\fP\fB);\fP
 
+\fI\fB
+
 \fBvoid png_zfree (voidpf \fP\fIpng_ptr\fP\fB, voidpf \fIptr\fP\fB);\fP
 
+\fI\fB
+
 .SH DESCRIPTION
 The
 .I libpng
@@ -410,18 +821,20 @@ Following is a copy of the libpng.txt file that accompanies libpng.
 .SH LIBPNG.TXT
 libpng.txt - A description on how to use and modify libpng
 
- libpng version 1.2.29 - May 8, 2008
+ libpng version 1.2.40 - September 10, 2009
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
- Copyright (c) 1998-2008 Glenn Randers-Pehrson
- For conditions of distribution and use, see copyright
- notice in png.h.
+ Copyright (c) 1998-2009 Glenn Randers-Pehrson
+
+ This document is released under the libpng license.
+ For conditions of distribution and use, see the disclaimer
+ and license in png.h
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.2.29 - May 8, 2008
+ libpng versions 0.97, January 1998, through 1.2.40 - September 10, 2009
  Updated and distributed by Glenn Randers-Pehrson
- Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ Copyright (c) 1998-2009 Glenn Randers-Pehrson
 
  libpng 1.0 beta 6  version 0.96 May 28, 1997
  Updated and distributed by Andreas Dilger
@@ -551,9 +964,10 @@ so if it doesn't work, you don't have much to undo.  Of course, you
 will also want to insure that you are, in fact, dealing with a PNG
 file.  Libpng provides a simple check to see if a file is a PNG file.
 To use it, pass in the first 1 to 8 bytes of the file to the function
-png_sig_cmp(), and it will return 0 if the bytes match the corresponding
-bytes of the PNG signature, or nonzero otherwise.  Of course, the more bytes
-you pass in, the greater the accuracy of the prediction.
+png_sig_cmp(), and it will return 0 (false) if the bytes match the
+corresponding bytes of the PNG signature, or nonzero (true) otherwise.
+Of course, the more bytes you pass in, the greater the accuracy of the
+prediction.
 
 If you are intending to keep the file pointer open for use in libpng,
 you must ensure you don't read more than 8 bytes from the beginning
@@ -730,35 +1144,14 @@ To inform libpng about your function, use
 
     png_set_read_status_fn(png_ptr, read_row_callback);
 
-.SS Width and height limits
-
-The PNG specification allows the width and height of an image to be as
-large as 2^31-1 (0x7fffffff), or about 2.147 billion rows and columns.
-Since very few applications really need to process such large images,
-we have imposed an arbitrary 1-million limit on rows and columns.
-Larger images will be rejected immediately with a png_error() call. If
-you wish to override this limit, you can use
-
-   png_set_user_limits(png_ptr, width_max, height_max);
-
-to set your own limits, or use width_max = height_max = 0x7fffffffL
-to allow all valid dimensions (libpng may reject some very large images
-anyway because of potential buffer overflow conditions).
-
-You should put this statement after you create the PNG structure and
-before calling png_read_info(), png_read_png(), or png_process_data().
-If you need to retrieve the limits that are being applied, use
-
-   width_max = png_get_user_width_max(png_ptr);
-   height_max = png_get_user_height_max(png_ptr);
-
 .SS Unknown-chunk handling
 
 Now you get to set the way the library processes unknown chunks in the
 input PNG stream. Both known and unknown chunks will be read.  Normal
 behavior is that known chunks will be parsed into information in
-various info_ptr members while unknown chunks will be discarded. To change
-this, you can call:
+various info_ptr members while unknown chunks will be discarded. This
+behavior can be wasteful if your application will never use some known
+chunk types. To change this, you can call:
 
     png_set_keep_unknown_chunks(png_ptr, keep,
         chunk_list, num_chunks);
@@ -816,6 +1209,27 @@ callback function:
          (int)sizeof(unused_chunks)/5);
     #endif
 
+.SS User limits
+
+The PNG specification allows the width and height of an image to be as
+large as 2^31-1 (0x7fffffff), or about 2.147 billion rows and columns.
+Since very few applications really need to process such large images,
+we have imposed an arbitrary 1-million limit on rows and columns.
+Larger images will be rejected immediately with a png_error() call. If
+you wish to override this limit, you can use
+
+   png_set_user_limits(png_ptr, width_max, height_max);
+
+to set your own limits, or use width_max = height_max = 0x7fffffffL
+to allow all valid dimensions (libpng may reject some very large images
+anyway because of potential buffer overflow conditions).
+
+You should put this statement after you create the PNG structure and
+before calling png_read_info(), png_read_png(), or png_process_data().
+If you need to retrieve the limits that are being applied, use
+
+   width_max = png_get_user_width_max(png_ptr);
+   height_max = png_get_user_height_max(png_ptr);
 
 .SS The high-level read interface
 
@@ -882,6 +1296,8 @@ row_pointers prior to calling png_read_png() with
    row_pointers = png_malloc(png_ptr,
       height*png_sizeof(png_bytep));
    for (int i=0; i<height, i++)
+      row_pointers[i]=NULL;  /* security precaution */
+   for (int i=0; i<height, i++)
       row_pointers[i]=png_malloc(png_ptr,
          width*pixel_size);
    png_set_rows(png_ptr, info_ptr, &row_pointers);
@@ -1257,9 +1673,6 @@ things.
 
 As of libpng version 1.2.9, png_set_expand_gray_1_2_4_to_8() was
 added.  It expands the sample depth without changing tRNS to alpha.
-At the same time, png_set_gray_1_2_4_to_8() was deprecated, and it
-will be removed from a future version.
-
 
 PNG can have files with 16 bits per channel.  If you only can handle
 8 bits per channel, this will strip the pixels down to 8 bit.
@@ -2111,7 +2524,7 @@ types.
        PNG_FILTER_NONE  | PNG_FILTER_VALUE_NONE |
        PNG_FILTER_SUB   | PNG_FILTER_VALUE_SUB  |
        PNG_FILTER_UP    | PNG_FILTER_VALUE_UP   |
-       PNG_FILTER_AVE   | PNG_FILTER_VALUE_AVE  |
+       PNG_FILTER_AVG   | PNG_FILTER_VALUE_AVG  |
        PNG_FILTER_PAETH | PNG_FILTER_VALUE_PAETH|
        PNG_ALL_FILTERS);
 
@@ -2201,10 +2614,14 @@ Some of the more important parts of the png_info are:
                      PNG_INTRAPIXEL_DIFFERENCING)
 
 If you call png_set_IHDR(), the call must appear before any of the
-other png_set_*() functions, which might require access to some of
+other png_set_*() functions, because they might require access to some of
 the IHDR settings.  The remaining png_set_*() functions can be called
 in any order.
 
+If you wish, you can reset the compression_type, interlace_type, or
+filter_method later by calling png_set_IHDR() again; if you do this, the
+width, height, bit_depth, and color_type must be the same in each call.
+
     png_set_PLTE(png_ptr, info_ptr, palette,
        num_palette);
     palette        - the palette for the file
@@ -2266,8 +2683,9 @@ in any order.
        trans_values);
     trans          - array of transparent entries for
                      palette (PNG_INFO_tRNS)
-    trans_values   - graylevel or color sample values of
-                     the single transparent color for
+    trans_values   - graylevel or color sample values
+                     (in order red, green, blue) of the
+                     single transparent color for
                      non-paletted images (PNG_INFO_tRNS)
     num_trans      - number of transparent entries
                      (PNG_INFO_tRNS)
@@ -2476,7 +2894,12 @@ transformations are permitted, enabled by the following masks.
     PNG_TRANSFORM_INVERT_ALPHA  Change alpha from opacity
                                 to transparency
     PNG_TRANSFORM_SWAP_ENDIAN   Byte-swap 16-bit samples
-    PNG_TRANSFORM_STRIP_FILLER  Strip out filler bytes.
+    PNG_TRANSFORM_STRIP_FILLER        Strip out filler
+                                      bytes (deprecated).
+    PNG_TRANSFORM_STRIP_FILLER_BEFORE Strip out leading
+                                      filler bytes
+    PNG_TRANSFORM_STRIP_FILLER_AFTER  Strip out trailing
+                                      filler bytes
 
 If you have valid image data in the info structure (you can use
 png_set_rows() to put image data in the info structure), simply do this:
@@ -2883,9 +3306,15 @@ The replacement I/O functions must have prototypes as follows:
         png_bytep data, png_size_t length);
     void user_flush_data(png_structp png_ptr);
 
+The user_read_data() function is responsible for detecting and
+handling end-of-data errors.
+
 Supplying NULL for the read, write, or flush functions sets them back
-to using the default C stream functions.  It is an error to read from
-a write stream, and vice versa.
+to using the default C stream functions, which expect the io_ptr to
+point to a standard *FILE structure.  It is probably a mistake
+to use NULL for one of write_data_fn and output_flush_fn but not both
+of them, unless you have built libpng with PNG_NO_WRITE_FLUSH defined.
+It is an error to read from a write stream, and vice versa.
 
 Error handling in libpng is done through png_error() and png_warning().
 Errors handled through png_error() are fatal, meaning that png_error()
@@ -2990,11 +3419,12 @@ you may also have to change the memory allocators (png_malloc, etc.).
 
 .SS Configuring for compiler xxx:
 
-All includes for libpng are in pngconf.h.  If you need to add/change/delete
-an include, this is the place to do it.  The includes that are not
-needed outside libpng are protected by the PNG_INTERNAL definition,
-which is only defined for those routines inside libpng itself.  The
-files in libpng proper only include png.h, which includes pngconf.h.
+All includes for libpng are in pngconf.h.  If you need to add, change
+or delete an include, this is the place to do it.
+The includes that are not needed outside libpng are protected by the
+PNG_INTERNAL definition, which is only defined for those routines inside
+libpng itself.  The files in libpng proper only include png.h, which
+includes pngconf.h.
 
 .SS Configuring zlib:
 
@@ -3063,7 +3493,7 @@ currently does not allocate the filter buffers until png_write_row()
 is called for the first time.)
 
     filters = PNG_FILTER_NONE | PNG_FILTER_SUB
-              PNG_FILTER_UP | PNG_FILTER_AVE |
+              PNG_FILTER_UP | PNG_FILTER_AVG |
               PNG_FILTER_PAETH | PNG_ALL_FILTERS;
 
     png_set_filter(png_ptr, PNG_FILTER_TYPE_BASE,
@@ -3185,7 +3615,7 @@ When PNG_DEBUG = 1, the macros are defined, but only png_debug statements
 having level = 0 will be printed.  There aren't any such statements in
 this version of libpng, but if you insert some they will be printed.
 
-.SH VII.  MNG support
+.SH VI.  MNG support
 
 The MNG specification (available at http://www.libpng.org/pub/mng) allows
 certain extensions to PNG for PNG images that are embedded in MNG datastreams.
@@ -3210,7 +3640,7 @@ or any other MNG chunks; your application must provide its own support for
 them.  You may wish to consider using libmng (available at
 http://www.libmng.com) instead.
 
-.SH VIII.  Changes to Libpng from version 0.88
+.SH VII.  Changes to Libpng from version 0.88
 
 It should be noted that versions of libpng later than 0.96 are not
 distributed by the original libpng author, Guy Schalnat, nor by
@@ -3259,15 +3689,202 @@ application:
 
    png_uint_32 application_vn = PNG_LIBPNG_VER;
 
-.SH IX. Y2K Compliance in libpng
+.SH VIII.  Changes to Libpng from version 1.0.x to 1.2.x
+
+Support for user memory management was enabled by default.  To
+accomplish this, the functions png_create_read_struct_2(),
+png_create_write_struct_2(), png_set_mem_fn(), png_get_mem_ptr(),
+png_malloc_default(), and png_free_default() were added.
+
+Support for certain MNG features was enabled.
+
+Support for numbered error messages was added.  However, we never got
+around to actually numbering the error messages.  The function
+png_set_strip_error_numbers() was added (Note: the prototype for this
+function was inadvertently removed from png.h in PNG_NO_ASSEMBLER_CODE
+builds of libpng-1.2.15.  It was restored in libpng-1.2.36).
+
+The png_malloc_warn() function was added at libpng-1.2.3.  This issues
+a png_warning and returns NULL instead of aborting when it fails to
+acquire the requested memory allocation.
+
+Support for setting user limits on image width and height was enabled
+by default.  The functions png_set_user_limits(), png_get_user_width_max(),
+and png_get_user_height_max() were added at libpng-1.2.6.
+
+The png_set_add_alpha() function was added at libpng-1.2.7.
+
+The function png_set_expand_gray_1_2_4_to_8() was added at libpng-1.2.9.
+Unlike png_set_gray_1_2_4_to_8(), the new function does not expand the
+tRNS chunk to alpha. The png_set_gray_1_2_4_to_8() function is
+deprecated.
+
+A number of macro definitions in support of runtime selection of
+assembler code features (especially Intel MMX code support) were
+added at libpng-1.2.0:
+
+    PNG_ASM_FLAG_MMX_SUPPORT_COMPILED
+    PNG_ASM_FLAG_MMX_SUPPORT_IN_CPU
+    PNG_ASM_FLAG_MMX_READ_COMBINE_ROW
+    PNG_ASM_FLAG_MMX_READ_INTERLACE
+    PNG_ASM_FLAG_MMX_READ_FILTER_SUB
+    PNG_ASM_FLAG_MMX_READ_FILTER_UP
+    PNG_ASM_FLAG_MMX_READ_FILTER_AVG
+    PNG_ASM_FLAG_MMX_READ_FILTER_PAETH
+    PNG_ASM_FLAGS_INITIALIZED
+    PNG_MMX_READ_FLAGS
+    PNG_MMX_FLAGS
+    PNG_MMX_WRITE_FLAGS
+    PNG_MMX_FLAGS
+
+We added the following functions in support of runtime
+selection of assembler code features:
+
+    png_get_mmx_flagmask()
+    png_set_mmx_thresholds()
+    png_get_asm_flags()
+    png_get_mmx_bitdepth_threshold()
+    png_get_mmx_rowbytes_threshold()
+    png_set_asm_flags()
+
+We replaced all of these functions with simple stubs in libpng-1.2.20,
+when the Intel assembler code was removed due to a licensing issue.
+
+.SH IX.  (Omitted)
+
+.SH X. Detecting libpng
+
+The png_get_io_ptr() function has been present since libpng-0.88, has never
+changed, and is unaffected by conditional compilation macros.  It is the
+best choice for use in configure scripts for detecting the presence of any
+libpng version since 0.88.  In an autoconf "configure.in" you could use
+
+    AC_CHECK_LIB(png, png_get_io_ptr, ...
+
+.SH XI. Source code repository
+
+Since about February 2009, version 1.2.34, libpng has been under "git" source
+control.  The git repository was built from old libpng-x.y.z.tar.gz files
+going back to version 0.70.  You can access the git repository (read only)
+at
+
+    git://libpng.git.sourceforge.net/gitroot/libpng
+
+or you can browse it via "gitweb" at
+
+    http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng
 
-May 8, 2008
+Patches can be sent to glennrp at users.sourceforge.net or to
+png-mng-implement at lists.sourceforge.net or you can upload them to
+the libpng bug tracker at
+
+    http://libpng.sourceforge.net
+
+.SH XII. Coding style
+
+Our coding style is similar to the "Allman" style, with curly
+braces on separate lines:
+
+    if (condition)
+    {
+       action;
+    }
+
+    else if (another condition)
+    {
+       another action;
+    }
+
+The braces can be omitted from simple one-line actions:
+
+    if (condition)
+       return (0);
+
+We use 3-space indentation, except for continued statements which
+are usually indented the same as the first line of the statement
+plus four more spaces.
+
+Comments appear with the leading "/*" at the same indentation as
+the statement that follows the comment:
+
+    /* Single-line comment */
+    statement;
+
+    /* Multiple-line
+     * comment
+     */
+    statement;
+
+Very short comments can be placed at the end of the statement
+to which they pertain:
+
+    statement;    /* comment */
+
+We don't use C++ style ("//") comments. We have, however,
+used them in the past in some now-abandoned MMX assembler
+code.
+
+Functions and their curly braces are not indented, and
+exported functions are marked with PNGAPI:
+
+ /* This is a public function that is visible to
+  * application programers. It does thus-and-so.
+  */
+ void PNGAPI
+ png_exported_function(png_ptr, png_info, foo)
+ {
+    body;
+ }
+
+The prototypes for all exported functions appear in png.h,
+above the comment that says
+
+    /* Maintainer: Put new public prototypes here ... */
+
+We mark all non-exported functions with "/* PRIVATE */"":
+
+ void /* PRIVATE */
+ png_non_exported_function(png_ptr, png_info, foo)
+ {
+    body;
+ }
+
+The prototypes for non-exported functions (except for those in
+pngtest) appear in
+the PNG_INTERNAL section of png.h
+above the comment that says
+
+  /* Maintainer: Put new private prototypes here ^ and in libpngpf.3 */
+
+The names of all exported functions and variables begin
+with  "png_", and all publicly visible C preprocessor
+macros begin with "PNG_".
+
+We put a space after each comma and after each semicolon
+in "for" statments, and we put spaces before and after each
+C binary operator and after "for" or "while".  We don't
+put a space between a typecast and the expression being
+cast, nor do we put one between a function name and the
+left parenthesis that follows it:
+
+    for (i = 2; i > 0; --i)
+       x[i] = a(x) + (int)b;
+
+We prefer #ifdef and #ifndef to #if defined() and if !defined()
+when there is only one macro being tested.
+
+Other rules can be inferred by inspecting the libpng
+source.
+
+.SH XIII. Y2K Compliance in libpng
+
+September 10, 2009
 
 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.
 
 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.2.29 are Y2K compliant.  It is my belief that earlier
+upward through 1.2.40 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.
 
 Libpng only has three year fields.  One is a 2-byte unsigned integer that
@@ -3499,6 +4116,56 @@ the first widely used release:
  1.2.29rc01          13    10229  12.so.0.29[.0]
  1.0.35              10    10035  10.so.0.35[.0]
  1.2.29              13    10229  12.so.0.29[.0]
+ 1.0.37              10    10037  10.so.0.37[.0]
+ 1.2.30beta01-04     13    10230  12.so.0.30[.0]
+ 1.0.38rc01-08       10    10038  10.so.0.38[.0]
+ 1.2.30rc01-08       13    10230  12.so.0.30[.0]
+ 1.0.38              10    10038  10.so.0.38[.0]
+ 1.2.30              13    10230  12.so.0.30[.0]
+ 1.0.39rc01-03       10    10039  10.so.0.39[.0]
+ 1.2.31rc01-03       13    10231  12.so.0.31[.0]
+ 1.0.39              10    10039  10.so.0.39[.0]
+ 1.2.31              13    10231  12.so.0.31[.0]
+ 1.2.32beta01-02     13    10232  12.so.0.32[.0]
+ 1.0.40rc01          10    10040  10.so.0.40[.0]
+ 1.2.32rc01          13    10232  12.so.0.32[.0]
+ 1.0.40              10    10040  10.so.0.40[.0]
+ 1.2.32              13    10232  12.so.0.32[.0]
+ 1.2.33beta01-02     13    10233  12.so.0.33[.0]
+ 1.2.33rc01-02       13    10233  12.so.0.33[.0]
+ 1.0.41rc01          10    10041  10.so.0.41[.0]
+ 1.2.33              13    10233  12.so.0.33[.0]
+ 1.0.41              10    10041  10.so.0.41[.0]
+ 1.2.34beta01-07     13    10234  12.so.0.34[.0]
+ 1.0.42rc01          10    10042  10.so.0.42[.0]
+ 1.2.34rc01          13    10234  12.so.0.34[.0]
+ 1.0.42              10    10042  10.so.0.42[.0]
+ 1.2.34              13    10234  12.so.0.34[.0]
+ 1.2.35beta01-03     13    10235  12.so.0.35[.0]
+ 1.0.43rc01-02       10    10043  10.so.0.43[.0]
+ 1.2.35rc01-02       13    10235  12.so.0.35[.0]
+ 1.0.43              10    10043  10.so.0.43[.0]
+ 1.2.35              13    10235  12.so.0.35[.0]
+ 1.2.36beta01-05     13    10236  12.so.0.36[.0]
+ 1.2.36rc01          13    10236  12.so.0.36[.0]
+ 1.0.44              10    10044  10.so.0.44[.0]
+ 1.2.36              13    10236  12.so.0.36[.0]
+ 1.2.37beta01-03     13    10237  12.so.0.37[.0]
+ 1.2.37rc01          13    10237  12.so.0.37[.0]
+ 1.2.37              13    10237  12.so.0.37[.0]
+ 1.2.45              10    10045  12.so.0.45[.0]
+ 1.0.46              10    10046  10.so.0.46[.0]
+ 1.2.38beta01        13    10238  12.so.0.38[.0]
+ 1.2.38rc01-03       13    10238  12.so.0.38[.0]
+ 1.0.47              10    10047  10.so.0.47[.0]
+ 1.2.38              13    10238  12.so.0.38[.0]
+ 1.2.39beta01-05     13    10239  12.so.0.39[.0]
+ 1.2.39rc01          13    10239  12.so.0.39[.0]
+ 1.0.48              10    10048  10.so.0.48[.0]
+ 1.2.39              13    10239  12.so.0.39[.0]
+ 1.2.40rc01          13    10240  12.so.0.40[.0]
+ 1.0.49              10    10049  10.so.0.49[.0]
+ 1.2.40              13    10240  12.so.0.40[.0]
 
 Henceforth the source version will match the shared-library minor
 and patch numbers; the shared-library major version number will be
@@ -3554,7 +4221,7 @@ possible without all of you.
 
 Thanks to Frank J. T. Wojcik for helping with the documentation.
 
-Libpng version 1.2.29 - May 8, 2008:
+Libpng version 1.2.40 - September 10, 2009:
 Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc.
 Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net).
 
@@ -3575,7 +4242,9 @@ included in the libpng distribution, the latter shall prevail.)
 If you modify libpng you may insert additional notices immediately following
 this sentence.
 
-libpng versions 1.2.6, August 15, 2004, through 1.2.29, May 8, 2008, are
+This code is released under the libpng license.
+
+libpng versions 1.2.6, August 15, 2004, through 1.2.40, September 10, 2009, are
 Copyright (c) 2004,2006-2008 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors
@@ -3674,7 +4343,7 @@ certification mark of the Open Source Initiative.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-May 8, 2008
+September 10, 2009
 
 .\" end of man page
 
diff --git a/src/3rdparty/libpng/libpngpf.3 b/src/3rdparty/libpng/libpngpf.3
index 423964f924..a1e030df05 100644
--- a/src/3rdparty/libpng/libpngpf.3
+++ b/src/3rdparty/libpng/libpngpf.3
@@ -1,266 +1,782 @@
-.TH LIBPNGPF 3 "May 8, 2008"
+.TH LIBPNGPF 3 "September 10, 2009"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.2.29
+libpng \- Portable Network Graphics (PNG) Reference Library 1.2.40
 (private functions)
 .SH SYNOPSIS
 \fB#include <png.h>\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_build_gamma_table (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_build_grayscale_palette (int \fP\fIbit_depth\fP\fB, png_colorp \fIpalette\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_calculate_crc (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fP\fIptr\fP\fB, png_size_t \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_check_chunk_name (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fIchunk_name\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBpng_size_t png_check_keyword (png_structp \fP\fIpng_ptr\fP\fB, png_charp \fP\fIkey\fP\fB, png_charpp \fInew_key\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_combine_row (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fP\fIrow\fP\fB, int \fImask\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_correct_palette (png_structp \fP\fIpng_ptr\fP\fB, png_colorp \fP\fIpalette\fP\fB, int \fInum_palette\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBint png_crc_error (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBint png_crc_finish (png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fIskip\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_crc_read (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fP\fIbuf\fP\fB, png_size_t \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBpng_voidp png_create_struct (int \fItype\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBpng_voidp png_create_struct_2 (int \fP\fItype\fP\fB, png_malloc_ptr \fP\fImalloc_fn\fP\fB, png_voidp \fImem_ptr\fP\fB);\fP
 
-\fBpng_charp png_decompress_chunk (png_structp \fP\fIpng_ptr\fP\fB, int \fP\fIcomp_type\fP\fB, png_charp \fP\fIchunkdata\fP\fB, png_size_t \fP\fIchunklength\fP\fB, png_size_t \fP\fIprefix_length\fP\fB, png_size_t \fI*data_length\fP\fB);\fP
+\fI\fB
+
+\fI\fB
+
+\fBvoid png_decompress_chunk (png_structp \fP\fIpng_ptr\fP\fB, int \fP\fIcomp_type\fP\fB, png_charp \fP\fIchunkdata\fP\fB, png_size_t \fP\fIchunklength\fP\fB, png_size_t \fP\fIprefix_length\fP\fB, png_size_t \fI*data_length\fP\fB);\fP
+
+\fI\fB
+
+\fI\fB
 
 \fBvoid png_destroy_struct (png_voidp \fIstruct_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_destroy_struct_2 (png_voidp \fP\fIstruct_ptr\fP\fB, png_free_ptr \fP\fIfree_fn\fP\fB, png_voidp \fImem_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_background (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fP\fIrow\fP\fB, png_color_16p \fP\fItrans_values\fP\fB, png_color_16p \fP\fIbackground\fP\fB, png_color_16p \fP\fIbackground_1\fP\fB, png_bytep \fP\fIgamma_table\fP\fB, png_bytep \fP\fIgamma_from_1\fP\fB, png_bytep \fP\fIgamma_to_1\fP\fB, png_uint_16pp \fP\fIgamma_16\fP\fB, png_uint_16pp \fP\fIgamma_16_from_1\fP\fB, png_uint_16pp \fP\fIgamma_16_to_1\fP\fB, int \fIgamma_shift\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_bgr (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fIrow\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_chop (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fIrow\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_dither (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fP\fIrow\fP\fB, png_bytep \fP\fIpalette_lookup\fP\fB, png_bytep \fIdither_lookup\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_expand (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fP\fIrow\fP\fB, png_color_16p \fItrans_value\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_expand_palette (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fP\fIrow\fP\fB, png_colorp \fP\fIpalette\fP\fB, png_bytep \fP\fItrans\fP\fB, int \fInum_trans\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_gamma (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fP\fIrow\fP\fB, png_bytep \fP\fIgamma_table\fP\fB, png_uint_16pp \fP\fIgamma_16_table\fP\fB, int \fIgamma_shift\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_gray_to_rgb (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fIrow\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_invert (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fIrow\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_pack (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fP\fIrow\fP\fB, png_uint_32 \fIbit_depth\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_packswap (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fIrow\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_read_filler (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fP\fIrow\fP\fB, png_uint_32 \fP\fIfiller\fP\fB, png_uint_32 \fIflags\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_read_interlace (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fP\fIrow\fP\fB, int \fP\fIpass\fP\fB, png_uint_32 \fItransformations\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_read_invert_alpha (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fIrow\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_read_swap_alpha (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fIrow\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_read_transformations (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBint png_do_rgb_to_gray (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fIrow\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_shift (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fP\fIrow\fP\fB, png_color_8p \fIbit_depth\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_strip_filler (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fP\fIrow\fP\fB, png_uint_32 \fIflags\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_swap (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fIrow\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_unpack (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fIrow\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_unshift (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fP\fIrow\fP\fB, png_color_8p \fIsig_bits\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_write_interlace (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fP\fIrow\fP\fB, int \fIpass\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_write_invert_alpha (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fIrow\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_write_swap_alpha (png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fIrow\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_do_write_transformations (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid *png_far_to_near (png_structp png_ptr,png_voidp \fP\fIptr\fP\fB, int \fIcheck\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_flush (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_bKGD (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_cHRM (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_gAMA (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_hIST (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_IEND (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_IHDR (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_iCCP (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_iTXt (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_oFFs (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_pCAL (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_pHYs (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_PLTE (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_sBIT (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_sCAL (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_sPLT (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_sRGB (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_tEXt (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_tIME (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_tRNS (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_unknown (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_handle_zTXt (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_info_destroy (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_init_mmx_flags (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_init_read_transformations (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_process_IDAT_data (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fP\fIbuffer\fP\fB, png_size_t \fIbuffer_length\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_process_some_data (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_check_crc (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_crc_finish (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_crc_skip (png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_fill_buffer (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fP\fIbuffer\fP\fB, png_size_t \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_handle_tEXt (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_handle_unknown (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_handle_zTXt (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_have_end (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_have_info (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_have_row (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fIrow\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_process_row (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_read_chunk (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_read_end (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_read_IDAT (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_read_sig (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_read_tEXt (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_read_zTXt (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_restore_buffer (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fP\fIbuffer\fP\fB, png_size_t \fIbuffer_length\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_push_save_buffer (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
+\fBpng_uint_32 png_read_chunk_header (png_structp \fIpng_ptr\fP\fB);\fP
+
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_read_data (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fP\fIdata\fP\fB, png_size_t \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_read_filter_row (png_structp \fP\fIpng_ptr\fP\fB, png_row_infop \fP\fIrow_info\fP\fB, png_bytep \fP\fIrow\fP\fB, png_bytep \fP\fIprev_row\fP\fB, int \fIfilter\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_read_finish_row (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_read_push_finish_row (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_read_start_row (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_read_transform_info (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_reset_crc (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBint png_set_text_2 (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_textp \fP\fItext_ptr\fP\fB, int \fInum_text\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_cHRM (png_structp \fP\fIpng_ptr\fP\fB, double \fP\fIwhite_x\fP\fB, double \fP\fIwhite_y\fP\fB, double \fP\fIred_x\fP\fB, double \fP\fIred_y\fP\fB, double \fP\fIgreen_x\fP\fB, double \fP\fIgreen_y\fP\fB, double \fP\fIblue_x\fP\fB, double \fIblue_y\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_cHRM_fixed (png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fP\fIwhite_x\fP\fB, png_uint_32 \fP\fIwhite_y\fP\fB, png_uint_32 \fP\fIred_x\fP\fB, png_uint_32 \fP\fIred_y\fP\fB, png_uint_32 \fP\fIgreen_x\fP\fB, png_uint_32 \fP\fIgreen_y\fP\fB, png_uint_32 \fP\fIblue_x\fP\fB, png_uint_32 \fIblue_y\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_data (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fP\fIdata\fP\fB, png_size_t \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_filtered_row (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fIfiltered_row\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_find_filter (png_structp \fP\fIpng_ptr\fP\fB, png_row_infop \fIrow_info\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_finish_row (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_gAMA (png_structp \fP\fIpng_ptr\fP\fB, double \fIfile_gamma\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_gAMA_fixed (png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fIint_file_gamma\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_hIST (png_structp \fP\fIpng_ptr\fP\fB, png_uint_16p \fP\fIhist\fP\fB, int \fInum_hist\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_iCCP (png_structp \fP\fIpng_ptr\fP\fB, png_charp \fP\fIname\fP\fB, int \fP\fIcompression_type\fP\fB, png_charp \fP\fIprofile\fP\fB, int \fIproflen\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_IDAT (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fP\fIdata\fP\fB, png_size_t \fIlength\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_IEND (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_IHDR (png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fP\fIwidth\fP\fB, png_uint_32 \fP\fIheight\fP\fB, int \fP\fIbit_depth\fP\fB, int \fP\fIcolor_type\fP\fB, int \fP\fIcompression_type\fP\fB, int \fP\fIfilter_type\fP\fB, int \fIinterlace_type\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_iTXt (png_structp \fP\fIpng_ptr\fP\fB, int \fP\fIcompression\fP\fB, png_charp \fP\fIkey\fP\fB, png_charp \fP\fIlang\fP\fB, png_charp \fP\fItranslated_key\fP\fB, png_charp \fItext\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_oFFs (png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fP\fIx_offset\fP\fB, png_uint_32 \fP\fIy_offset\fP\fB, int \fIunit_type\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_pCAL (png_structp \fP\fIpng_ptr\fP\fB, png_charp \fP\fIpurpose\fP\fB, png_int_32 \fP\fIX0\fP\fB, png_int_32 \fP\fIX1\fP\fB, int \fP\fItype\fP\fB, int \fP\fInparams\fP\fB, png_charp \fP\fIunits\fP\fB, png_charpp \fIparams\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_pHYs (png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fP\fIx_pixels_per_unit\fP\fB, png_uint_32 \fP\fIy_pixels_per_unit\fP\fB, int \fIunit_type\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_PLTE (png_structp \fP\fIpng_ptr\fP\fB, png_colorp \fP\fIpalette\fP\fB, png_uint_32 \fInum_pal\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_sBIT (png_structp \fP\fIpng_ptr\fP\fB, png_color_8p \fP\fIsbit\fP\fB, int \fIcolor_type\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_sCAL (png_structp \fP\fIpng_ptr\fP\fB, png_charp \fP\fIunit\fP\fB, double \fP\fIwidth\fP\fB, double \fIheight\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_sCAL_s (png_structp \fP\fIpng_ptr\fP\fB, png_charp \fP\fIunit\fP\fB, png_charp \fP\fIwidth\fP\fB, png_charp \fIheight\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_sig (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_sRGB (png_structp \fP\fIpng_ptr\fP\fB, int \fIintent\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_sPLT (png_structp \fP\fIpng_ptr\fP\fB, png_spalette_p \fIpalette\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_start_row (png_structp \fIpng_ptr\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_tEXt (png_structp \fP\fIpng_ptr\fP\fB, png_charp \fP\fIkey\fP\fB, png_charp \fP\fItext\fP\fB, png_size_t \fItext_len\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_tIME (png_structp \fP\fIpng_ptr\fP\fB, png_timep \fImod_time\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_tRNS (png_structp \fP\fIpng_ptr\fP\fB, png_bytep \fP\fItrans\fP\fB, png_color_16p \fP\fIvalues\fP\fB, int \fP\fInumber\fP\fB, int \fIcolor_type\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_write_zTXt (png_structp \fP\fIpng_ptr\fP\fB, png_charp \fP\fIkey\fP\fB, png_charp \fP\fItext\fP\fB, png_size_t \fP\fItext_len\fP\fB, int \fIcompression\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoidpf png_zalloc (voidpf \fP\fIpng_ptr\fP\fB, uInt \fP\fIitems\fP\fB, uInt \fIsize\fP\fB);\fP
 
+\fI\fB
+
+\fI\fB
+
 \fBvoid png_zfree (voidpf \fP\fIpng_ptr\fP\fB, voidpf \fIptr\fP\fB);\fP
 
 \fI\fB
 
+\fI\fB
+
 .SH DESCRIPTION
 The functions listed above are used privately by libpng
 and are not recommended for use by applications.  They are
diff --git a/src/3rdparty/libpng/png.5 b/src/3rdparty/libpng/png.5
index 832a6f4c54..30923ba115 100644
--- a/src/3rdparty/libpng/png.5
+++ b/src/3rdparty/libpng/png.5
@@ -1,4 +1,4 @@
-.TH PNG 5 "May 8, 2008"
+.TH PNG 5 "September 10, 2009"
 .SH NAME
 png \- Portable Network Graphics (PNG) format
 .SH DESCRIPTION
diff --git a/src/3rdparty/libpng/png.c b/src/3rdparty/libpng/png.c
index 63ae86e3c4..be1bd3a14d 100644
--- a/src/3rdparty/libpng/png.c
+++ b/src/3rdparty/libpng/png.c
@@ -1,11 +1,14 @@
 
 /* png.c - location for general purpose libpng functions
  *
- * Last changed in libpng 1.2.21 October 4, 2007
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2007 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.39 [August 13, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
+ *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
  */
 
 #define PNG_INTERNAL
@@ -13,7 +16,7 @@
 #include "png.h"
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef version_1_2_29 Your_png_h_is_not_version_1_2_29;
+typedef version_1_2_40 Your_png_h_is_not_version_1_2_40;
 
 /* Version information for C files.  This had better match the version
  * string defined in png.h.  */
@@ -53,18 +56,18 @@ PNG_tRNS;
 PNG_zTXt;
 
 #ifdef PNG_READ_SUPPORTED
-/* arrays to facilitate easy interlacing - use pass (0 - 6) as index */
+/* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
 
-/* start of interlace block */
+/* Start of interlace block */
 PNG_CONST int FARDATA png_pass_start[] = {0, 4, 0, 2, 0, 1, 0};
 
-/* offset to next interlace block */
+/* Offset to next interlace block */
 PNG_CONST int FARDATA png_pass_inc[] = {8, 8, 4, 4, 2, 2, 1};
 
-/* start of interlace block in the y direction */
+/* Start of interlace block in the y direction */
 PNG_CONST int FARDATA png_pass_ystart[] = {0, 0, 4, 0, 2, 0, 1};
 
-/* offset to next interlace block in the y direction */
+/* Offset to next interlace block in the y direction */
 PNG_CONST int FARDATA png_pass_yinc[] = {8, 8, 8, 4, 4, 2, 2};
 
 /* Height of interlace block.  This is not currently used - if you need
@@ -92,8 +95,9 @@ PNG_CONST int FARDATA png_pass_dsp_mask[]
 void PNGAPI
 png_set_sig_bytes(png_structp png_ptr, int num_bytes)
 {
-   if(png_ptr == NULL) return;
-   png_debug(1, "in png_set_sig_bytes\n");
+   if (png_ptr == NULL)
+      return;
+   png_debug(1, "in png_set_sig_bytes");
    if (num_bytes > 8)
       png_error(png_ptr, "Too many bytes for PNG signature.");
 
@@ -144,7 +148,7 @@ png_check_sig(png_bytep sig, int num)
 #ifdef PNG_1_0_X
 voidpf PNGAPI
 #else
-voidpf /* private */
+voidpf /* PRIVATE */
 #endif
 png_zalloc(voidpf png_ptr, uInt items, uInt size)
 {
@@ -153,7 +157,8 @@ png_zalloc(voidpf png_ptr, uInt items, uInt size)
    png_uint_32 save_flags=p->flags;
    png_uint_32 num_bytes;
 
-   if(png_ptr == NULL) return (NULL);
+   if (png_ptr == NULL)
+      return (NULL);
    if (items > PNG_UINT_32_MAX/size)
    {
      png_warning (p, "Potential overflow in png_zalloc()");
@@ -183,11 +188,11 @@ png_zalloc(voidpf png_ptr, uInt items, uInt size)
    return ((voidpf)ptr);
 }
 
-/* function to free memory for zlib */
+/* Function to free memory for zlib */
 #ifdef PNG_1_0_X
 void PNGAPI
 #else
-void /* private */
+void /* PRIVATE */
 #endif
 png_zfree(voidpf png_ptr, voidpf ptr)
 {
@@ -240,8 +245,9 @@ png_create_info_struct(png_structp png_ptr)
 {
    png_infop info_ptr;
 
-   png_debug(1, "in png_create_info_struct\n");
-   if(png_ptr == NULL) return (NULL);
+   png_debug(1, "in png_create_info_struct");
+   if (png_ptr == NULL)
+      return (NULL);
 #ifdef PNG_USER_MEM_SUPPORTED
    info_ptr = (png_infop)png_create_struct_2(PNG_STRUCT_INFO,
       png_ptr->malloc_fn, png_ptr->mem_ptr);
@@ -263,9 +269,10 @@ void PNGAPI
 png_destroy_info_struct(png_structp png_ptr, png_infopp info_ptr_ptr)
 {
    png_infop info_ptr = NULL;
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
 
-   png_debug(1, "in png_destroy_info_struct\n");
+   png_debug(1, "in png_destroy_info_struct");
    if (info_ptr_ptr != NULL)
       info_ptr = *info_ptr_ptr;
 
@@ -302,19 +309,20 @@ png_info_init_3(png_infopp ptr_ptr, png_size_t png_info_struct_size)
 {
    png_infop info_ptr = *ptr_ptr;
 
-   if(info_ptr == NULL) return;
+   if (info_ptr == NULL)
+      return;
 
-   png_debug(1, "in png_info_init_3\n");
+   png_debug(1, "in png_info_init_3");
 
-   if(png_sizeof(png_info) > png_info_struct_size)
-     {
-       png_destroy_struct(info_ptr);
-       info_ptr = (png_infop)png_create_struct(PNG_STRUCT_INFO);
-       *ptr_ptr = info_ptr;
-     }
+   if (png_sizeof(png_info) > png_info_struct_size)
+   {
+      png_destroy_struct(info_ptr);
+      info_ptr = (png_infop)png_create_struct(PNG_STRUCT_INFO);
+      *ptr_ptr = info_ptr;
+   }
 
-   /* set everything to 0 */
-   png_memset(info_ptr, 0, png_sizeof (png_info));
+   /* Set everything to 0 */
+   png_memset(info_ptr, 0, png_sizeof(png_info));
 }
 
 #ifdef PNG_FREE_ME_SUPPORTED
@@ -322,12 +330,12 @@ void PNGAPI
 png_data_freer(png_structp png_ptr, png_infop info_ptr,
    int freer, png_uint_32 mask)
 {
-   png_debug(1, "in png_data_freer\n");
+   png_debug(1, "in png_data_freer");
    if (png_ptr == NULL || info_ptr == NULL)
       return;
-   if(freer == PNG_DESTROY_WILL_FREE_DATA)
+   if (freer == PNG_DESTROY_WILL_FREE_DATA)
       info_ptr->free_me |= mask;
-   else if(freer == PNG_USER_WILL_FREE_DATA)
+   else if (freer == PNG_USER_WILL_FREE_DATA)
       info_ptr->free_me &= ~mask;
    else
       png_warning(png_ptr,
@@ -339,249 +347,250 @@ void PNGAPI
 png_free_data(png_structp png_ptr, png_infop info_ptr, png_uint_32 mask,
    int num)
 {
-   png_debug(1, "in png_free_data\n");
+   png_debug(1, "in png_free_data");
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
 #if defined(PNG_TEXT_SUPPORTED)
-/* free text item num or (if num == -1) all text items */
+   /* Free text item num or (if num == -1) all text items */
 #ifdef PNG_FREE_ME_SUPPORTED
-if ((mask & PNG_FREE_TEXT) & info_ptr->free_me)
+   if ((mask & PNG_FREE_TEXT) & info_ptr->free_me)
 #else
-if (mask & PNG_FREE_TEXT)
+   if (mask & PNG_FREE_TEXT)
 #endif
-{
-   if (num != -1)
-   {
-     if (info_ptr->text && info_ptr->text[num].key)
-     {
-         png_free(png_ptr, info_ptr->text[num].key);
-         info_ptr->text[num].key = NULL;
-     }
-   }
-   else
    {
-       int i;
-       for (i = 0; i < info_ptr->num_text; i++)
-           png_free_data(png_ptr, info_ptr, PNG_FREE_TEXT, i);
-       png_free(png_ptr, info_ptr->text);
-       info_ptr->text = NULL;
-       info_ptr->num_text=0;
+      if (num != -1)
+      {
+         if (info_ptr->text && info_ptr->text[num].key)
+         {
+            png_free(png_ptr, info_ptr->text[num].key);
+            info_ptr->text[num].key = NULL;
+         }
+      }
+      else
+      {
+         int i;
+         for (i = 0; i < info_ptr->num_text; i++)
+             png_free_data(png_ptr, info_ptr, PNG_FREE_TEXT, i);
+         png_free(png_ptr, info_ptr->text);
+         info_ptr->text = NULL;
+         info_ptr->num_text=0;
+      }
    }
-}
 #endif
 
 #if defined(PNG_tRNS_SUPPORTED)
-/* free any tRNS entry */
+   /* Free any tRNS entry */
 #ifdef PNG_FREE_ME_SUPPORTED
-if ((mask & PNG_FREE_TRNS) & info_ptr->free_me)
+   if ((mask & PNG_FREE_TRNS) & info_ptr->free_me)
 #else
-if ((mask & PNG_FREE_TRNS) && (png_ptr->flags & PNG_FLAG_FREE_TRNS))
+   if ((mask & PNG_FREE_TRNS) && (png_ptr->flags & PNG_FLAG_FREE_TRNS))
 #endif
-{
-    png_free(png_ptr, info_ptr->trans);
-    info_ptr->valid &= ~PNG_INFO_tRNS;
+   {
+      png_free(png_ptr, info_ptr->trans);
+      info_ptr->trans = NULL;
+      info_ptr->valid &= ~PNG_INFO_tRNS;
 #ifndef PNG_FREE_ME_SUPPORTED
-    png_ptr->flags &= ~PNG_FLAG_FREE_TRNS;
+      png_ptr->flags &= ~PNG_FLAG_FREE_TRNS;
 #endif
-    info_ptr->trans = NULL;
-}
+   }
 #endif
 
 #if defined(PNG_sCAL_SUPPORTED)
-/* free any sCAL entry */
+   /* Free any sCAL entry */
 #ifdef PNG_FREE_ME_SUPPORTED
-if ((mask & PNG_FREE_SCAL) & info_ptr->free_me)
+   if ((mask & PNG_FREE_SCAL) & info_ptr->free_me)
 #else
-if (mask & PNG_FREE_SCAL)
+   if (mask & PNG_FREE_SCAL)
 #endif
-{
+   {
 #if defined(PNG_FIXED_POINT_SUPPORTED) && !defined(PNG_FLOATING_POINT_SUPPORTED)
-    png_free(png_ptr, info_ptr->scal_s_width);
-    png_free(png_ptr, info_ptr->scal_s_height);
-    info_ptr->scal_s_width = NULL;
-    info_ptr->scal_s_height = NULL;
+      png_free(png_ptr, info_ptr->scal_s_width);
+      png_free(png_ptr, info_ptr->scal_s_height);
+      info_ptr->scal_s_width = NULL;
+      info_ptr->scal_s_height = NULL;
 #endif
-    info_ptr->valid &= ~PNG_INFO_sCAL;
-}
+      info_ptr->valid &= ~PNG_INFO_sCAL;
+   }
 #endif
 
 #if defined(PNG_pCAL_SUPPORTED)
-/* free any pCAL entry */
+   /* Free any pCAL entry */
 #ifdef PNG_FREE_ME_SUPPORTED
-if ((mask & PNG_FREE_PCAL) & info_ptr->free_me)
+   if ((mask & PNG_FREE_PCAL) & info_ptr->free_me)
 #else
-if (mask & PNG_FREE_PCAL)
+   if (mask & PNG_FREE_PCAL)
 #endif
-{
-    png_free(png_ptr, info_ptr->pcal_purpose);
-    png_free(png_ptr, info_ptr->pcal_units);
-    info_ptr->pcal_purpose = NULL;
-    info_ptr->pcal_units = NULL;
-    if (info_ptr->pcal_params != NULL)
-    {
-        int i;
-        for (i = 0; i < (int)info_ptr->pcal_nparams; i++)
-        {
-          png_free(png_ptr, info_ptr->pcal_params[i]);
-          info_ptr->pcal_params[i]=NULL;
-        }
-        png_free(png_ptr, info_ptr->pcal_params);
-        info_ptr->pcal_params = NULL;
-    }
-    info_ptr->valid &= ~PNG_INFO_pCAL;
-}
+   {
+      png_free(png_ptr, info_ptr->pcal_purpose);
+      png_free(png_ptr, info_ptr->pcal_units);
+      info_ptr->pcal_purpose = NULL;
+      info_ptr->pcal_units = NULL;
+      if (info_ptr->pcal_params != NULL)
+         {
+            int i;
+            for (i = 0; i < (int)info_ptr->pcal_nparams; i++)
+            {
+               png_free(png_ptr, info_ptr->pcal_params[i]);
+               info_ptr->pcal_params[i]=NULL;
+            }
+            png_free(png_ptr, info_ptr->pcal_params);
+            info_ptr->pcal_params = NULL;
+         }
+      info_ptr->valid &= ~PNG_INFO_pCAL;
+   }
 #endif
 
 #if defined(PNG_iCCP_SUPPORTED)
-/* free any iCCP entry */
+   /* Free any iCCP entry */
 #ifdef PNG_FREE_ME_SUPPORTED
-if ((mask & PNG_FREE_ICCP) & info_ptr->free_me)
+   if ((mask & PNG_FREE_ICCP) & info_ptr->free_me)
 #else
-if (mask & PNG_FREE_ICCP)
+   if (mask & PNG_FREE_ICCP)
 #endif
-{
-    png_free(png_ptr, info_ptr->iccp_name);
-    png_free(png_ptr, info_ptr->iccp_profile);
-    info_ptr->iccp_name = NULL;
-    info_ptr->iccp_profile = NULL;
-    info_ptr->valid &= ~PNG_INFO_iCCP;
-}
+   {
+      png_free(png_ptr, info_ptr->iccp_name);
+      png_free(png_ptr, info_ptr->iccp_profile);
+      info_ptr->iccp_name = NULL;
+      info_ptr->iccp_profile = NULL;
+      info_ptr->valid &= ~PNG_INFO_iCCP;
+   }
 #endif
 
 #if defined(PNG_sPLT_SUPPORTED)
-/* free a given sPLT entry, or (if num == -1) all sPLT entries */
+   /* Free a given sPLT entry, or (if num == -1) all sPLT entries */
 #ifdef PNG_FREE_ME_SUPPORTED
-if ((mask & PNG_FREE_SPLT) & info_ptr->free_me)
+   if ((mask & PNG_FREE_SPLT) & info_ptr->free_me)
 #else
-if (mask & PNG_FREE_SPLT)
+   if (mask & PNG_FREE_SPLT)
 #endif
-{
-   if (num != -1)
    {
-      if(info_ptr->splt_palettes)
+      if (num != -1)
       {
-          png_free(png_ptr, info_ptr->splt_palettes[num].name);
-          png_free(png_ptr, info_ptr->splt_palettes[num].entries);
-          info_ptr->splt_palettes[num].name = NULL;
-          info_ptr->splt_palettes[num].entries = NULL;
+         if (info_ptr->splt_palettes)
+         {
+            png_free(png_ptr, info_ptr->splt_palettes[num].name);
+            png_free(png_ptr, info_ptr->splt_palettes[num].entries);
+            info_ptr->splt_palettes[num].name = NULL;
+            info_ptr->splt_palettes[num].entries = NULL;
+         }
+      }
+      else
+      {
+         if (info_ptr->splt_palettes_num)
+         {
+            int i;
+            for (i = 0; i < (int)info_ptr->splt_palettes_num; i++)
+               png_free_data(png_ptr, info_ptr, PNG_FREE_SPLT, i);
+
+            png_free(png_ptr, info_ptr->splt_palettes);
+            info_ptr->splt_palettes = NULL;
+            info_ptr->splt_palettes_num = 0;
+         }
+         info_ptr->valid &= ~PNG_INFO_sPLT;
       }
    }
-   else
-   {
-       if(info_ptr->splt_palettes_num)
-       {
-         int i;
-         for (i = 0; i < (int)info_ptr->splt_palettes_num; i++)
-            png_free_data(png_ptr, info_ptr, PNG_FREE_SPLT, i);
-
-         png_free(png_ptr, info_ptr->splt_palettes);
-         info_ptr->splt_palettes = NULL;
-         info_ptr->splt_palettes_num = 0;
-       }
-       info_ptr->valid &= ~PNG_INFO_sPLT;
-   }
-}
 #endif
 
 #if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED)
-  if(png_ptr->unknown_chunk.data)
-  {
-    png_free(png_ptr, png_ptr->unknown_chunk.data);
-    png_ptr->unknown_chunk.data = NULL;
-  }
+   if (png_ptr->unknown_chunk.data)
+   {
+      png_free(png_ptr, png_ptr->unknown_chunk.data);
+      png_ptr->unknown_chunk.data = NULL;
+   }
+
 #ifdef PNG_FREE_ME_SUPPORTED
-if ((mask & PNG_FREE_UNKN) & info_ptr->free_me)
+   if ((mask & PNG_FREE_UNKN) & info_ptr->free_me)
 #else
-if (mask & PNG_FREE_UNKN)
+   if (mask & PNG_FREE_UNKN)
 #endif
-{
-   if (num != -1)
    {
-       if(info_ptr->unknown_chunks)
-       {
-          png_free(png_ptr, info_ptr->unknown_chunks[num].data);
-          info_ptr->unknown_chunks[num].data = NULL;
-       }
-   }
-   else
-   {
-       int i;
+      if (num != -1)
+      {
+          if (info_ptr->unknown_chunks)
+          {
+             png_free(png_ptr, info_ptr->unknown_chunks[num].data);
+             info_ptr->unknown_chunks[num].data = NULL;
+          }
+      }
+      else
+      {
+         int i;
 
-       if(info_ptr->unknown_chunks_num)
-       {
-         for (i = 0; i < (int)info_ptr->unknown_chunks_num; i++)
-            png_free_data(png_ptr, info_ptr, PNG_FREE_UNKN, i);
+         if (info_ptr->unknown_chunks_num)
+         {
+            for (i = 0; i < (int)info_ptr->unknown_chunks_num; i++)
+               png_free_data(png_ptr, info_ptr, PNG_FREE_UNKN, i);
 
-         png_free(png_ptr, info_ptr->unknown_chunks);
-         info_ptr->unknown_chunks = NULL;
-         info_ptr->unknown_chunks_num = 0;
-       }
+            png_free(png_ptr, info_ptr->unknown_chunks);
+            info_ptr->unknown_chunks = NULL;
+            info_ptr->unknown_chunks_num = 0;
+         }
+      }
    }
-}
 #endif
 
 #if defined(PNG_hIST_SUPPORTED)
-/* free any hIST entry */
+   /* Free any hIST entry */
 #ifdef PNG_FREE_ME_SUPPORTED
-if ((mask & PNG_FREE_HIST)  & info_ptr->free_me)
+   if ((mask & PNG_FREE_HIST)  & info_ptr->free_me)
 #else
-if ((mask & PNG_FREE_HIST) && (png_ptr->flags & PNG_FLAG_FREE_HIST))
+   if ((mask & PNG_FREE_HIST) && (png_ptr->flags & PNG_FLAG_FREE_HIST))
 #endif
-{
-    png_free(png_ptr, info_ptr->hist);
-    info_ptr->hist = NULL;
-    info_ptr->valid &= ~PNG_INFO_hIST;
+   {
+      png_free(png_ptr, info_ptr->hist);
+      info_ptr->hist = NULL;
+      info_ptr->valid &= ~PNG_INFO_hIST;
 #ifndef PNG_FREE_ME_SUPPORTED
-    png_ptr->flags &= ~PNG_FLAG_FREE_HIST;
+      png_ptr->flags &= ~PNG_FLAG_FREE_HIST;
 #endif
-}
+   }
 #endif
 
-/* free any PLTE entry that was internally allocated */
+   /* Free any PLTE entry that was internally allocated */
 #ifdef PNG_FREE_ME_SUPPORTED
-if ((mask & PNG_FREE_PLTE) & info_ptr->free_me)
+   if ((mask & PNG_FREE_PLTE) & info_ptr->free_me)
 #else
-if ((mask & PNG_FREE_PLTE) && (png_ptr->flags & PNG_FLAG_FREE_PLTE))
+   if ((mask & PNG_FREE_PLTE) && (png_ptr->flags & PNG_FLAG_FREE_PLTE))
 #endif
-{
-    png_zfree(png_ptr, info_ptr->palette);
-    info_ptr->palette = NULL;
-    info_ptr->valid &= ~PNG_INFO_PLTE;
+   {
+      png_zfree(png_ptr, info_ptr->palette);
+      info_ptr->palette = NULL;
+      info_ptr->valid &= ~PNG_INFO_PLTE;
 #ifndef PNG_FREE_ME_SUPPORTED
-    png_ptr->flags &= ~PNG_FLAG_FREE_PLTE;
+      png_ptr->flags &= ~PNG_FLAG_FREE_PLTE;
 #endif
-    info_ptr->num_palette = 0;
-}
+      info_ptr->num_palette = 0;
+   }
 
 #if defined(PNG_INFO_IMAGE_SUPPORTED)
-/* free any image bits attached to the info structure */
+   /* Free any image bits attached to the info structure */
 #ifdef PNG_FREE_ME_SUPPORTED
-if ((mask & PNG_FREE_ROWS) & info_ptr->free_me)
+   if ((mask & PNG_FREE_ROWS) & info_ptr->free_me)
 #else
-if (mask & PNG_FREE_ROWS)
+   if (mask & PNG_FREE_ROWS)
 #endif
-{
-    if(info_ptr->row_pointers)
-    {
-       int row;
-       for (row = 0; row < (int)info_ptr->height; row++)
-       {
-          png_free(png_ptr, info_ptr->row_pointers[row]);
-          info_ptr->row_pointers[row]=NULL;
-       }
-       png_free(png_ptr, info_ptr->row_pointers);
-       info_ptr->row_pointers=NULL;
-    }
-    info_ptr->valid &= ~PNG_INFO_IDAT;
-}
+   {
+      if (info_ptr->row_pointers)
+      {
+         int row;
+         for (row = 0; row < (int)info_ptr->height; row++)
+         {
+            png_free(png_ptr, info_ptr->row_pointers[row]);
+            info_ptr->row_pointers[row]=NULL;
+         }
+         png_free(png_ptr, info_ptr->row_pointers);
+         info_ptr->row_pointers=NULL;
+      }
+      info_ptr->valid &= ~PNG_INFO_IDAT;
+   }
 #endif
 
 #ifdef PNG_FREE_ME_SUPPORTED
-   if(num == -1)
-     info_ptr->free_me &= ~mask;
+   if (num == -1)
+      info_ptr->free_me &= ~mask;
    else
-     info_ptr->free_me &= ~(mask & ~PNG_FREE_MUL);
+      info_ptr->free_me &= ~(mask & ~PNG_FREE_MUL);
 #endif
 }
 
@@ -592,16 +601,16 @@ if (mask & PNG_FREE_ROWS)
 void /* PRIVATE */
 png_info_destroy(png_structp png_ptr, png_infop info_ptr)
 {
-   png_debug(1, "in png_info_destroy\n");
+   png_debug(1, "in png_info_destroy");
 
    png_free_data(png_ptr, info_ptr, PNG_FREE_ALL, -1);
 
-#if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED)
+#if defined(PNG_HANDLE_AS_UNKNOWN_SUPPORTED)
    if (png_ptr->num_chunk_list)
    {
-       png_free(png_ptr, png_ptr->chunk_list);
-       png_ptr->chunk_list=NULL;
-       png_ptr->num_chunk_list=0;
+      png_free(png_ptr, png_ptr->chunk_list);
+      png_ptr->chunk_list=NULL;
+      png_ptr->num_chunk_list = 0;
    }
 #endif
 
@@ -616,7 +625,8 @@ png_info_destroy(png_structp png_ptr, png_infop info_ptr)
 png_voidp PNGAPI
 png_get_io_ptr(png_structp png_ptr)
 {
-   if(png_ptr == NULL) return (NULL);
+   if (png_ptr == NULL)
+      return (NULL);
    return (png_ptr->io_ptr);
 }
 
@@ -631,8 +641,9 @@ png_get_io_ptr(png_structp png_ptr)
 void PNGAPI
 png_init_io(png_structp png_ptr, png_FILE_p fp)
 {
-   png_debug(1, "in png_init_io\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_init_io");
+   if (png_ptr == NULL)
+      return;
    png_ptr->io_ptr = (png_voidp)fp;
 }
 #endif
@@ -648,7 +659,8 @@ png_convert_to_rfc1123(png_structp png_ptr, png_timep ptime)
         {"Jan", "Feb", "Mar", "Apr", "May", "Jun",
          "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"};
 
-   if(png_ptr == NULL) return (NULL);
+   if (png_ptr == NULL)
+      return (NULL);
    if (png_ptr->time_buffer == NULL)
    {
       png_ptr->time_buffer = (png_charp)png_malloc(png_ptr, (png_uint_32)(29*
@@ -669,7 +681,7 @@ png_convert_to_rfc1123(png_structp png_ptr, png_timep ptime)
 #ifdef USE_FAR_KEYWORD
    {
       char near_time_buf[29];
-      png_snprintf6(near_time_buf,29,"%d %s %d %02d:%02d:%02d +0000",
+      png_snprintf6(near_time_buf, 29, "%d %s %d %02d:%02d:%02d +0000",
           ptime->day % 32, short_months[(ptime->month - 1) % 12],
           ptime->year, ptime->hour % 24, ptime->minute % 60,
           ptime->second % 61);
@@ -677,7 +689,7 @@ png_convert_to_rfc1123(png_structp png_ptr, png_timep ptime)
           29*png_sizeof(char));
    }
 #else
-   png_snprintf6(png_ptr->time_buffer,29,"%d %s %d %02d:%02d:%02d +0000",
+   png_snprintf6(png_ptr->time_buffer, 29, "%d %s %d %02d:%02d:%02d +0000",
        ptime->day % 32, short_months[(ptime->month - 1) % 12],
        ptime->year, ptime->hour % 24, ptime->minute % 60,
        ptime->second % 61);
@@ -692,9 +704,9 @@ png_convert_to_rfc1123(png_structp png_ptr, png_timep ptime)
 png_charp PNGAPI
 png_get_copyright(png_structp png_ptr)
 {
-   png_ptr = png_ptr;  /* silence compiler warning about unused png_ptr */
-   return ((png_charp) "\n libpng version 1.2.29 - May 8, 2008\n\
-   Copyright (c) 1998-2008 Glenn Randers-Pehrson\n\
+   png_ptr = png_ptr;  /* Silence compiler warning about unused png_ptr */
+   return ((png_charp) "\n libpng version 1.2.40 - September 10, 2009\n\
+   Copyright (c) 1998-2009 Glenn Randers-Pehrson\n\
    Copyright (c) 1996-1997 Andreas Dilger\n\
    Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.\n");
 }
@@ -711,7 +723,7 @@ png_charp PNGAPI
 png_get_libpng_ver(png_structp png_ptr)
 {
    /* Version of *.c files used when building libpng */
-   png_ptr = png_ptr;  /* silence compiler warning about unused png_ptr */
+   png_ptr = png_ptr;  /* Silence compiler warning about unused png_ptr */
    return ((png_charp) PNG_LIBPNG_VER_STRING);
 }
 
@@ -719,7 +731,7 @@ png_charp PNGAPI
 png_get_header_ver(png_structp png_ptr)
 {
    /* Version of *.h files used when building libpng */
-   png_ptr = png_ptr;  /* silence compiler warning about unused png_ptr */
+   png_ptr = png_ptr;  /* Silence compiler warning about unused png_ptr */
    return ((png_charp) PNG_LIBPNG_VER_STRING);
 }
 
@@ -727,7 +739,7 @@ png_charp PNGAPI
 png_get_header_version(png_structp png_ptr)
 {
    /* Returns longer string containing both version and date */
-   png_ptr = png_ptr;  /* silence compiler warning about unused png_ptr */
+   png_ptr = png_ptr;  /* Silence compiler warning about unused png_ptr */
    return ((png_charp) PNG_HEADER_VERSION_STRING
 #ifndef PNG_READ_SUPPORTED
    "     (NO READ SUPPORT)"
@@ -740,15 +752,15 @@ png_get_header_version(png_structp png_ptr)
 int PNGAPI
 png_handle_as_unknown(png_structp png_ptr, png_bytep chunk_name)
 {
-   /* check chunk_name and return "keep" value if it's on the list, else 0 */
+   /* Check chunk_name and return "keep" value if it's on the list, else 0 */
    int i;
    png_bytep p;
-   if(png_ptr == NULL || chunk_name == NULL || png_ptr->num_chunk_list<=0)
+   if (png_ptr == NULL || chunk_name == NULL || png_ptr->num_chunk_list<=0)
       return 0;
-   p=png_ptr->chunk_list+png_ptr->num_chunk_list*5-5;
-   for (i = png_ptr->num_chunk_list; i; i--, p-=5)
+   p = png_ptr->chunk_list + png_ptr->num_chunk_list*5 - 5;
+   for (i = png_ptr->num_chunk_list; i; i--, p -= 5)
       if (!png_memcmp(chunk_name, p, 4))
-        return ((int)*(p+4));
+        return ((int)*(p + 4));
    return 0;
 }
 #endif
@@ -757,7 +769,8 @@ png_handle_as_unknown(png_structp png_ptr, png_bytep chunk_name)
 int PNGAPI
 png_reset_zstream(png_structp png_ptr)
 {
-   if (png_ptr == NULL) return Z_STREAM_ERROR;
+   if (png_ptr == NULL)
+      return Z_STREAM_ERROR;
    return (inflateReset(&png_ptr->zstream));
 }
 #endif /* defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) */
@@ -773,11 +786,11 @@ png_access_version_number(void)
 
 #if defined(PNG_READ_SUPPORTED) && defined(PNG_ASSEMBLER_CODE_SUPPORTED)
 #if !defined(PNG_1_0_X)
-/* this function was added to libpng 1.2.0 */
+/* This function was added to libpng 1.2.0 */
 int PNGAPI
 png_mmx_support(void)
 {
-   /* obsolete, to be removed from libpng-1.4.0 */
+   /* Obsolete, to be removed from libpng-1.4.0 */
     return -1;
 }
 #endif /* PNG_1_0_X */
@@ -790,9 +803,124 @@ png_mmx_support(void)
 png_size_t PNGAPI
 png_convert_size(size_t size)
 {
-  if (size > (png_size_t)-1)
-     PNG_ABORT();  /* We haven't got access to png_ptr, so no png_error() */
-  return ((png_size_t)size);
+   if (size > (png_size_t)-1)
+      PNG_ABORT();  /* We haven't got access to png_ptr, so no png_error() */
+   return ((png_size_t)size);
 }
 #endif /* PNG_SIZE_T */
+
+/* Added at libpng version 1.2.34 and 1.4.0 (moved from pngset.c) */
+#if defined(PNG_cHRM_SUPPORTED)
+#if !defined(PNG_NO_CHECK_cHRM)
+
+/*
+ *    Multiply two 32-bit numbers, V1 and V2, using 32-bit
+ *    arithmetic, to produce a 64 bit result in the HI/LO words.
+ *
+ *                  A B
+ *                x C D
+ *               ------
+ *              AD || BD
+ *        AC || CB || 0
+ *
+ *    where A and B are the high and low 16-bit words of V1,
+ *    C and D are the 16-bit words of V2, AD is the product of
+ *    A and D, and X || Y is (X << 16) + Y.
+*/
+
+void /* PRIVATE */
+png_64bit_product (long v1, long v2, unsigned long *hi_product,
+   unsigned long *lo_product)
+{
+   int a, b, c, d;
+   long lo, hi, x, y;
+
+   a = (v1 >> 16) & 0xffff;
+   b = v1 & 0xffff;
+   c = (v2 >> 16) & 0xffff;
+   d = v2 & 0xffff;
+
+   lo = b * d;                   /* BD */
+   x = a * d + c * b;            /* AD + CB */
+   y = ((lo >> 16) & 0xffff) + x;
+
+   lo = (lo & 0xffff) | ((y & 0xffff) << 16);
+   hi = (y >> 16) & 0xffff;
+
+   hi += a * c;                  /* AC */
+
+   *hi_product = (unsigned long)hi;
+   *lo_product = (unsigned long)lo;
+}
+
+int /* PRIVATE */
+png_check_cHRM_fixed(png_structp png_ptr,
+   png_fixed_point white_x, png_fixed_point white_y, png_fixed_point red_x,
+   png_fixed_point red_y, png_fixed_point green_x, png_fixed_point green_y,
+   png_fixed_point blue_x, png_fixed_point blue_y)
+{
+   int ret = 1;
+   unsigned long xy_hi,xy_lo,yx_hi,yx_lo;
+
+   png_debug(1, "in function png_check_cHRM_fixed");
+   if (png_ptr == NULL)
+      return 0;
+
+   if (white_x < 0 || white_y <= 0 ||
+         red_x < 0 ||   red_y <  0 ||
+       green_x < 0 || green_y <  0 ||
+        blue_x < 0 ||  blue_y <  0)
+   {
+      png_warning(png_ptr,
+        "Ignoring attempt to set negative chromaticity value");
+      ret = 0;
+   }
+   if (white_x > (png_fixed_point) PNG_UINT_31_MAX ||
+       white_y > (png_fixed_point) PNG_UINT_31_MAX ||
+         red_x > (png_fixed_point) PNG_UINT_31_MAX ||
+         red_y > (png_fixed_point) PNG_UINT_31_MAX ||
+       green_x > (png_fixed_point) PNG_UINT_31_MAX ||
+       green_y > (png_fixed_point) PNG_UINT_31_MAX ||
+        blue_x > (png_fixed_point) PNG_UINT_31_MAX ||
+        blue_y > (png_fixed_point) PNG_UINT_31_MAX )
+   {
+      png_warning(png_ptr,
+        "Ignoring attempt to set chromaticity value exceeding 21474.83");
+      ret = 0;
+   }
+   if (white_x > 100000L - white_y)
+   {
+      png_warning(png_ptr, "Invalid cHRM white point");
+      ret = 0;
+   }
+   if (red_x > 100000L - red_y)
+   {
+      png_warning(png_ptr, "Invalid cHRM red point");
+      ret = 0;
+   }
+   if (green_x > 100000L - green_y)
+   {
+      png_warning(png_ptr, "Invalid cHRM green point");
+      ret = 0;
+   }
+   if (blue_x > 100000L - blue_y)
+   {
+      png_warning(png_ptr, "Invalid cHRM blue point");
+      ret = 0;
+   }
+
+   png_64bit_product(green_x - red_x, blue_y - red_y, &xy_hi, &xy_lo);
+   png_64bit_product(green_y - red_y, blue_x - red_x, &yx_hi, &yx_lo);
+
+   if (xy_hi == yx_hi && xy_lo == yx_lo)
+   {
+      png_warning(png_ptr,
+         "Ignoring attempt to set cHRM RGB triangle with zero area");
+      ret = 0;
+   }
+
+   return ret;
+}
+#endif /* NO_PNG_CHECK_cHRM */
+#endif /* PNG_cHRM_SUPPORTED */
 #endif /* defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) */
diff --git a/src/3rdparty/libpng/png.h b/src/3rdparty/libpng/png.h
index 2e194b7a3d..d95339d7e4 100644
--- a/src/3rdparty/libpng/png.h
+++ b/src/3rdparty/libpng/png.h
@@ -1,14 +1,16 @@
 /* png.h - header file for PNG reference library
  *
- * libpng version 1.2.29 - May 8, 2008
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * libpng version 1.2.40 - September 10, 2009
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
+ * This code is released under the libpng license (See LICENSE, below)
+ *
  * Authors and maintainers:
  *  libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
  *  libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- *  libpng versions 0.97, January 1998, through 1.2.29 - May 8, 2008: Glenn
+ *  libpng versions 0.97, January 1998, through 1.2.40 - September 10, 2009: Glenn
  *  See also "Contributing Authors", below.
  *
  * Note about libpng version numbers:
@@ -192,6 +194,57 @@
  *    1.2.29rc01              13    10229  12.so.0.29[.0]
  *    1.0.35                  10    10035  10.so.0.35[.0]
  *    1.2.29                  13    10229  12.so.0.29[.0]
+ *    1.0.37                  10    10037  10.so.0.37[.0]
+ *    1.2.30beta01-04         13    10230  12.so.0.30[.0]
+ *    1.0.38rc01-08           10    10038  10.so.0.38[.0]
+ *    1.2.30rc01-08           13    10230  12.so.0.30[.0]
+ *    1.0.38                  10    10038  10.so.0.38[.0]
+ *    1.2.30                  13    10230  12.so.0.30[.0]
+ *    1.0.39rc01-03           10    10039  10.so.0.39[.0]
+ *    1.2.31rc01-03           13    10231  12.so.0.31[.0]
+ *    1.0.39                  10    10039  10.so.0.39[.0]
+ *    1.2.31                  13    10231  12.so.0.31[.0]
+ *    1.2.32beta01-02         13    10232  12.so.0.32[.0]
+ *    1.0.40rc01              10    10040  10.so.0.40[.0]
+ *    1.2.32rc01              13    10232  12.so.0.32[.0]
+ *    1.0.40                  10    10040  10.so.0.40[.0]
+ *    1.2.32                  13    10232  12.so.0.32[.0]
+ *    1.2.33beta01-02         13    10233  12.so.0.33[.0]
+ *    1.2.33rc01-02           13    10233  12.so.0.33[.0]
+ *    1.0.41rc01              10    10041  10.so.0.41[.0]
+ *    1.2.33                  13    10233  12.so.0.33[.0]
+ *    1.0.41                  10    10041  10.so.0.41[.0]
+ *    1.2.34beta01-07         13    10234  12.so.0.34[.0]
+ *    1.0.42rc01              10    10042  10.so.0.42[.0]
+ *    1.2.34rc01              13    10234  12.so.0.34[.0]
+ *    1.0.42                  10    10042  10.so.0.42[.0]
+ *    1.2.34                  13    10234  12.so.0.34[.0]
+ *    1.2.35beta01-03         13    10235  12.so.0.35[.0]
+ *    1.0.43rc01-02           10    10043  10.so.0.43[.0]
+ *    1.2.35rc01-02           13    10235  12.so.0.35[.0]
+ *    1.0.43                  10    10043  10.so.0.43[.0]
+ *    1.2.35                  13    10235  12.so.0.35[.0]
+ *    1.2.36beta01-05         13    10236  12.so.0.36[.0]
+ *    1.2.36rc01              13    10236  12.so.0.36[.0]
+ *    1.0.44                  10    10044  10.so.0.44[.0]
+ *    1.2.36                  13    10236  12.so.0.36[.0]
+ *    1.2.37beta01-03         13    10237  12.so.0.37[.0]
+ *    1.2.37rc01              13    10237  12.so.0.37[.0]
+ *    1.2.37                  13    10237  12.so.0.37[.0]
+ *    1.2.45                  10    10045  12.so.0.45[.0]
+ *    1.0.46                  10    10046  10.so.0.46[.0]
+ *    1.2.38beta01            13    10238  12.so.0.38[.0]
+ *    1.2.38rc01-03           13    10238  12.so.0.38[.0]
+ *    1.0.47                  10    10047  10.so.0.47[.0]
+ *    1.2.38                  13    10238  12.so.0.38[.0]
+ *    1.2.39beta01-05         13    10239  12.so.0.39[.0]
+ *    1.2.39rc01              13    10239  12.so.0.39[.0]
+ *    1.0.48                  10    10048  10.so.0.48[.0]
+ *    1.2.39                  13    10239  12.so.0.39[.0]
+ *    1.2.40beta01            13    10240  12.so.0.40[.0]
+ *    1.2.40rc01              13    10240  12.so.0.40[.0]
+ *    1.0.49                  10    10049  10.so.0.49[.0]
+ *    1.2.40                  13    10240  12.so.0.40[.0]
  *
  *    Henceforth the source version will match the shared-library major
  *    and minor numbers; the shared-library major version number will be
@@ -221,8 +274,10 @@
  * If you modify libpng you may insert additional notices immediately following
  * this sentence.
  *
- * libpng versions 1.2.6, August 15, 2004, through 1.2.29, May 8, 2008, are
- * Copyright (c) 2004, 2006-2008 Glenn Randers-Pehrson, and are
+ * This code is released under the libpng license.
+ *
+ * libpng versions 1.2.6, August 15, 2004, through 1.2.40, September 10, 2009, are
+ * Copyright (c) 2004, 2006-2009 Glenn Randers-Pehrson, and are
  * distributed according to the same disclaimer and license as libpng-1.2.5
  * with the following individual added to the list of Contributing Authors:
  *
@@ -333,13 +388,13 @@
  * Y2K compliance in libpng:
  * =========================
  *
- *    May 8, 2008
+ *    September 10, 2009
  *
  *    Since the PNG Development group is an ad-hoc body, we can't make
  *    an official declaration.
  *
  *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.2.29 are Y2K compliant.  It is my belief that earlier
+ *    upward through 1.2.40 are Y2K compliant.  It is my belief that earlier
  *    versions were also Y2K compliant.
  *
  *    Libpng only has three year fields.  One is a 2-byte unsigned integer
@@ -395,9 +450,9 @@
  */
 
 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.2.29"
+#define PNG_LIBPNG_VER_STRING "1.2.40"
 #define PNG_HEADER_VERSION_STRING \
-   " libpng version 1.2.29 - May 8, 2008\n"
+   " libpng version 1.2.40 - September 10, 2009\n"
 
 #define PNG_LIBPNG_VER_SONUM   0
 #define PNG_LIBPNG_VER_DLLNUM  13
@@ -405,9 +460,10 @@
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   2
-#define PNG_LIBPNG_VER_RELEASE 29
+#define PNG_LIBPNG_VER_RELEASE 40
 /* This should match the numeric part of the final component of
- * PNG_LIBPNG_VER_STRING, omitting any leading zero: */
+ * PNG_LIBPNG_VER_STRING, omitting any leading zero:
+ */
 
 #define PNG_LIBPNG_VER_BUILD  0
 
@@ -417,7 +473,7 @@
 #define PNG_LIBPNG_BUILD_RC       3
 #define PNG_LIBPNG_BUILD_STABLE   4
 #define PNG_LIBPNG_BUILD_RELEASE_STATUS_MASK 7
-  
+
 /* Release-Specific Flags */
 #define PNG_LIBPNG_BUILD_PATCH    8 /* Can be OR'ed with
                                        PNG_LIBPNG_BUILD_STABLE only */
@@ -432,15 +488,16 @@
  * We must not include leading zeros.
  * Versions 0.7 through 1.0.0 were in the range 0 to 100 here (only
  * version 1.0.0 was mis-numbered 100 instead of 10000).  From
- * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release */
-#define PNG_LIBPNG_VER 10229 /* 1.2.29 */
+ * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release
+ */
+#define PNG_LIBPNG_VER 10240 /* 1.2.40 */
 
 #ifndef PNG_VERSION_INFO_ONLY
-/* include the compression library's header */
+/* Include the compression library's header */
 #include "zlib.h"
 #endif
 
-/* include all user configurable info, including optional assembler routines */
+/* Include all user configurable info, including optional assembler routines */
 #include "pngconf.h"
 
 /*
@@ -448,12 +505,12 @@
 /* Ref MSDN: Private as priority over Special
  * VS_FF_PRIVATEBUILD File *was not* built using standard release
  * procedures. If this value is given, the StringFileInfo block must
- * contain a PrivateBuild string. 
+ * contain a PrivateBuild string.
  *
  * VS_FF_SPECIALBUILD File *was* built by the original company using
  * standard release procedures but is a variation of the standard
  * file of the same version number. If this value is given, the
- * StringFileInfo block must contain a SpecialBuild string. 
+ * StringFileInfo block must contain a SpecialBuild string.
  */
 
 #if defined(PNG_USER_PRIVATEBUILD)
@@ -515,14 +572,14 @@ extern "C" {
 #define png_write_status_ptr_NULL NULL
 #endif
 
-/* variables declared in png.c - only it needs to define PNG_NO_EXTERN */
+/* Variables declared in png.c - only it needs to define PNG_NO_EXTERN */
 #if !defined(PNG_NO_EXTERN) || defined(PNG_ALWAYS_EXTERN)
 /* Version information for C files, stored in png.c.  This had better match
  * the version above.
  */
 #ifdef PNG_USE_GLOBAL_ARRAYS
 PNG_EXPORT_VAR (PNG_CONST char) png_libpng_ver[18];
-  /* need room for 99.99.99beta99z */
+  /* Need room for 99.99.99beta99z */
 #else
 #define png_libpng_ver png_get_header_ver(NULL)
 #endif
@@ -641,7 +698,8 @@ typedef png_text FAR * FAR * png_textpp;
 #endif
 
 /* Supported compression types for text in PNG files (tEXt, and zTXt).
- * The values of the PNG_TEXT_COMPRESSION_ defines should NOT be changed. */
+ * The values of the PNG_TEXT_COMPRESSION_ defines should NOT be changed.
+ */
 #define PNG_TEXT_COMPRESSION_NONE_WR -3
 #define PNG_TEXT_COMPRESSION_zTXt_WR -2
 #define PNG_TEXT_COMPRESSION_NONE    -1
@@ -668,7 +726,8 @@ typedef struct png_time_struct
 typedef png_time FAR * png_timep;
 typedef png_time FAR * FAR * png_timepp;
 
-#if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED)
+#if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED) || \
+ defined(PNG_HANDLE_AS_UNKNOWN_SUPPORTED)
 /* png_unknown_chunk is a structure to hold queued chunks for which there is
  * no specific support.  The idea is that we can use this to queue
  * up private chunks for output even though the library doesn't actually
@@ -730,7 +789,7 @@ typedef png_unknown_chunk FAR * FAR * png_unknown_chunkpp;
  */
 typedef struct png_info_struct
 {
-   /* the following are necessary for every PNG file */
+   /* The following are necessary for every PNG file */
    png_uint_32 width;       /* width of image in pixels (from IHDR) */
    png_uint_32 height;      /* height of image in pixels (from IHDR) */
    png_uint_32 valid;       /* valid chunk data (see PNG_INFO_ below) */
@@ -903,8 +962,9 @@ defined(PNG_READ_BACKGROUND_SUPPORTED)
    png_uint_32 free_me;     /* flags items libpng is responsible for freeing */
 #endif
 
-#if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED)
-   /* storage for unknown chunks that the library doesn't recognize. */
+#if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED) || \
+ defined(PNG_HANDLE_AS_UNKNOWN_SUPPORTED)
+   /* Storage for unknown chunks that the library doesn't recognize. */
    png_unknown_chunkp unknown_chunks;
    png_size_t unknown_chunks_num;
 #endif
@@ -919,7 +979,7 @@ defined(PNG_READ_BACKGROUND_SUPPORTED)
 #endif
 
 #if defined(PNG_sPLT_SUPPORTED)
-   /* data on sPLT chunks (there may be more than one). */
+   /* Data on sPLT chunks (there may be more than one). */
    png_sPLT_tp splt_palettes;
    png_uint_32 splt_palettes_num;
 #endif
@@ -1134,7 +1194,10 @@ typedef void (PNGAPI *png_unknown_chunk_ptr) PNGARG((png_structp));
 #define PNG_TRANSFORM_SWAP_ALPHA     0x0100    /* read and write */
 #define PNG_TRANSFORM_SWAP_ENDIAN    0x0200    /* read and write */
 #define PNG_TRANSFORM_INVERT_ALPHA   0x0400    /* read and write */
-#define PNG_TRANSFORM_STRIP_FILLER   0x0800    /* WRITE only */
+#define PNG_TRANSFORM_STRIP_FILLER   0x0800    /* write only, deprecated */
+/* Added to libpng-1.2.34 */
+#define PNG_TRANSFORM_STRIP_FILLER_BEFORE 0x0800  /* write only */
+#define PNG_TRANSFORM_STRIP_FILLER_AFTER  0x1000  /* write only */
 
 /* Flags for MNG supported features */
 #define PNG_FLAG_MNG_EMPTY_PLTE     0x01
@@ -1204,7 +1267,7 @@ struct png_struct_def
    png_uint_32 row_number;    /* current row in interlace pass */
    png_bytep prev_row;        /* buffer to save previous (unfiltered) row */
    png_bytep row_buf;         /* buffer to save current (unfiltered) row */
-#ifndef PNG_NO_WRITE_FILTERING
+#ifndef PNG_NO_WRITE_FILTER
    png_bytep sub_row;         /* buffer to save "sub" row when filtering */
    png_bytep up_row;          /* buffer to save "up" row when filtering */
    png_bytep avg_row;         /* buffer to save "avg" row when filtering */
@@ -1251,7 +1314,7 @@ struct png_struct_def
 #endif /* PNG_bKGD_SUPPORTED */
 
 #if defined(PNG_WRITE_FLUSH_SUPPORTED)
-   png_flush_ptr output_flush_fn;/* Function for flushing output */
+   png_flush_ptr output_flush_fn; /* Function for flushing output */
    png_uint_32 flush_dist;    /* how many rows apart to flush, 0 - no flush */
    png_uint_32 flush_rows;    /* number of rows written since last flush */
 #endif
@@ -1349,7 +1412,7 @@ struct png_struct_def
 /* New members added in libpng-1.0.6 */
 
 #ifdef PNG_FREE_ME_SUPPORTED
-   png_uint_32 free_me;       /* flags items libpng is responsible for freeing */
+   png_uint_32 free_me;   /* flags items libpng is responsible for freeing */
 #endif
 
 #if defined(PNG_USER_CHUNKS_SUPPORTED)
@@ -1357,7 +1420,7 @@ struct png_struct_def
    png_user_chunk_ptr read_user_chunk_fn; /* user read chunk handler */
 #endif
 
-#if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED)
+#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
    int num_chunk_list;
    png_bytep chunk_list;
 #endif
@@ -1375,7 +1438,7 @@ struct png_struct_def
 #if defined(PNG_MNG_FEATURES_SUPPORTED) || \
     defined(PNG_READ_EMPTY_PLTE_SUPPORTED) || \
     defined(PNG_WRITE_EMPTY_PLTE_SUPPORTED)
-/* changed from png_byte to png_uint_32 at version 1.2.0 */
+/* Changed from png_byte to png_uint_32 at version 1.2.0 */
 #ifdef PNG_1_0_X
    png_byte mng_features_permitted;
 #else
@@ -1411,21 +1474,21 @@ struct png_struct_def
 
 /* New members added in libpng-1.0.2 but first enabled by default in 1.2.0 */
 #ifdef PNG_USER_MEM_SUPPORTED
-   png_voidp mem_ptr;                /* user supplied struct for mem functions */
-   png_malloc_ptr malloc_fn;         /* function for allocating memory */
-   png_free_ptr free_fn;             /* function for freeing memory */
+   png_voidp mem_ptr;            /* user supplied struct for mem functions */
+   png_malloc_ptr malloc_fn;     /* function for allocating memory */
+   png_free_ptr free_fn;         /* function for freeing memory */
 #endif
 
 /* New member added in libpng-1.0.13 and 1.2.0 */
-   png_bytep big_row_buf;         /* buffer to save current (unfiltered) row */
+   png_bytep big_row_buf;        /* buffer to save current (unfiltered) row */
 
 #if defined(PNG_READ_DITHER_SUPPORTED)
 /* The following three members were added at version 1.0.14 and 1.2.4 */
-   png_bytep dither_sort;            /* working sort array */
-   png_bytep index_to_palette;       /* where the original index currently is */
-                                     /* in the palette */
-   png_bytep palette_to_index;       /* which original index points to this */
-                                     /* palette color */
+   png_bytep dither_sort;        /* working sort array */
+   png_bytep index_to_palette;   /* where the original index currently is */
+                                 /* in the palette */
+   png_bytep palette_to_index;   /* which original index points to this */
+                                 /* palette color */
 #endif
 
 /* New members added in libpng-1.0.16 and 1.2.6 */
@@ -1438,19 +1501,23 @@ struct png_struct_def
 
 /* New member added in libpng-1.0.25 and 1.2.17 */
 #if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED)
-   /* storage for unknown chunk that the library doesn't recognize. */
+   /* Storage for unknown chunk that the library doesn't recognize. */
    png_unknown_chunk unknown_chunk;
 #endif
 
 /* New members added in libpng-1.2.26 */
   png_uint_32 old_big_row_buf_size, old_prev_row_size;
+
+/* New member added in libpng-1.2.30 */
+  png_charp chunkdata;  /* buffer for reading chunk data */
+
 };
 
 
 /* This triggers a compiler error in png.c, if png.c and png.h
  * do not agree upon the version number.
  */
-typedef png_structp version_1_2_29;
+typedef png_structp version_1_2_40;
 
 typedef png_struct FAR * FAR * png_structpp;
 
@@ -1554,7 +1621,7 @@ extern PNG_EXPORT(void,png_write_info) PNGARG((png_structp png_ptr,
    png_infop info_ptr));
 
 #ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED
-/* read the information before the actual image data. */
+/* Read the information before the actual image data. */
 extern PNG_EXPORT(void,png_read_info) PNGARG((png_structp png_ptr,
    png_infop info_ptr));
 #endif
@@ -1567,11 +1634,11 @@ extern PNG_EXPORT(png_charp,png_convert_to_rfc1123)
 #if !defined(_WIN32_WCE)
 /* "time.h" functions are not supported on WindowsCE */
 #if defined(PNG_WRITE_tIME_SUPPORTED)
-/* convert from a struct tm to png_time */
+/* Convert from a struct tm to png_time */
 extern PNG_EXPORT(void,png_convert_from_struct_tm) PNGARG((png_timep ptime,
    struct tm FAR * ttime));
 
-/* convert from time_t to png_time.  Uses gmtime() */
+/* Convert from time_t to png_time.  Uses gmtime() */
 extern PNG_EXPORT(void,png_convert_from_time_t) PNGARG((png_timep ptime,
    time_t ttime));
 #endif /* PNG_WRITE_tIME_SUPPORTED */
@@ -1691,7 +1758,7 @@ extern PNG_EXPORT(void,png_set_background) PNGARG((png_structp png_ptr,
 #endif
 
 #if defined(PNG_READ_16_TO_8_SUPPORTED)
-/* strip the second byte of information from a 16-bit depth file. */
+/* Strip the second byte of information from a 16-bit depth file. */
 extern PNG_EXPORT(void,png_set_strip_16) PNGARG((png_structp png_ptr));
 #endif
 
@@ -1727,74 +1794,74 @@ extern PNG_EXPORT(void,png_set_flush) PNGARG((png_structp png_ptr, int nrows));
 extern PNG_EXPORT(void,png_write_flush) PNGARG((png_structp png_ptr));
 #endif
 
-/* optional update palette with requested transformations */
+/* Optional update palette with requested transformations */
 extern PNG_EXPORT(void,png_start_read_image) PNGARG((png_structp png_ptr));
 
-/* optional call to update the users info structure */
+/* Optional call to update the users info structure */
 extern PNG_EXPORT(void,png_read_update_info) PNGARG((png_structp png_ptr,
    png_infop info_ptr));
 
 #ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED
-/* read one or more rows of image data. */
+/* Read one or more rows of image data. */
 extern PNG_EXPORT(void,png_read_rows) PNGARG((png_structp png_ptr,
    png_bytepp row, png_bytepp display_row, png_uint_32 num_rows));
 #endif
 
 #ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED
-/* read a row of data. */
+/* Read a row of data. */
 extern PNG_EXPORT(void,png_read_row) PNGARG((png_structp png_ptr,
    png_bytep row,
    png_bytep display_row));
 #endif
 
 #ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED
-/* read the whole image into memory at once. */
+/* Read the whole image into memory at once. */
 extern PNG_EXPORT(void,png_read_image) PNGARG((png_structp png_ptr,
    png_bytepp image));
 #endif
 
-/* write a row of image data */
+/* Write a row of image data */
 extern PNG_EXPORT(void,png_write_row) PNGARG((png_structp png_ptr,
    png_bytep row));
 
-/* write a few rows of image data */
+/* Write a few rows of image data */
 extern PNG_EXPORT(void,png_write_rows) PNGARG((png_structp png_ptr,
    png_bytepp row, png_uint_32 num_rows));
 
-/* write the image data */
+/* Write the image data */
 extern PNG_EXPORT(void,png_write_image) PNGARG((png_structp png_ptr,
    png_bytepp image));
 
-/* writes the end of the PNG file. */
+/* Writes the end of the PNG file. */
 extern PNG_EXPORT(void,png_write_end) PNGARG((png_structp png_ptr,
    png_infop info_ptr));
 
 #ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED
-/* read the end of the PNG file. */
+/* Read the end of the PNG file. */
 extern PNG_EXPORT(void,png_read_end) PNGARG((png_structp png_ptr,
    png_infop info_ptr));
 #endif
 
-/* free any memory associated with the png_info_struct */
+/* Free any memory associated with the png_info_struct */
 extern PNG_EXPORT(void,png_destroy_info_struct) PNGARG((png_structp png_ptr,
    png_infopp info_ptr_ptr));
 
-/* free any memory associated with the png_struct and the png_info_structs */
+/* Free any memory associated with the png_struct and the png_info_structs */
 extern PNG_EXPORT(void,png_destroy_read_struct) PNGARG((png_structpp
    png_ptr_ptr, png_infopp info_ptr_ptr, png_infopp end_info_ptr_ptr));
 
-/* free all memory used by the read (old method - NOT DLL EXPORTED) */
+/* Free all memory used by the read (old method - NOT DLL EXPORTED) */
 extern void png_read_destroy PNGARG((png_structp png_ptr, png_infop info_ptr,
    png_infop end_info_ptr));
 
-/* free any memory associated with the png_struct and the png_info_structs */
+/* Free any memory associated with the png_struct and the png_info_structs */
 extern PNG_EXPORT(void,png_destroy_write_struct)
    PNGARG((png_structpp png_ptr_ptr, png_infopp info_ptr_ptr));
 
-/* free any memory used in png_ptr struct (old method - NOT DLL EXPORTED) */
+/* Free any memory used in png_ptr struct (old method - NOT DLL EXPORTED) */
 extern void png_write_destroy PNGARG((png_structp png_ptr));
 
-/* set the libpng method of handling chunk CRC errors */
+/* Set the libpng method of handling chunk CRC errors */
 extern PNG_EXPORT(void,png_set_crc_action) PNGARG((png_structp png_ptr,
    int crit_action, int ancil_action));
 
@@ -1822,7 +1889,7 @@ extern PNG_EXPORT(void,png_set_crc_action) PNGARG((png_structp png_ptr,
  * header file (zlib.h) for an explination of the compression functions.
  */
 
-/* set the filtering method(s) used by libpng.  Currently, the only valid
+/* Set the filtering method(s) used by libpng.  Currently, the only valid
  * value for "method" is 0.
  */
 extern PNG_EXPORT(void,png_set_filter) PNGARG((png_structp png_ptr, int method,
@@ -1950,6 +2017,11 @@ extern PNG_EXPORT(png_voidp,png_get_error_ptr) PNGARG((png_structp png_ptr));
  * If buffered output is not used, then output_flush_fn can be set to NULL.
  * If PNG_WRITE_FLUSH_SUPPORTED is not defined at libpng compile time
  * output_flush_fn will be ignored (and thus can be NULL).
+ * It is probably a mistake to use NULL for output_flush_fn if
+ * write_data_fn is not also NULL unless you have built libpng with
+ * PNG_WRITE_FLUSH_SUPPORTED undefined, because in this case libpng's
+ * default flush function, which uses the standard *FILE structure, will
+ * be used.
  */
 extern PNG_EXPORT(void,png_set_write_fn) PNGARG((png_structp png_ptr,
    png_voidp io_ptr, png_rw_ptr write_data_fn, png_flush_ptr output_flush_fn));
@@ -2014,15 +2086,15 @@ extern PNG_EXPORT(void,png_set_progressive_read_fn) PNGARG((png_structp png_ptr,
    png_progressive_info_ptr info_fn, png_progressive_row_ptr row_fn,
    png_progressive_end_ptr end_fn));
 
-/* returns the user pointer associated with the push read functions */
+/* Returns the user pointer associated with the push read functions */
 extern PNG_EXPORT(png_voidp,png_get_progressive_ptr)
    PNGARG((png_structp png_ptr));
 
-/* function to be called when data becomes available */
+/* Function to be called when data becomes available */
 extern PNG_EXPORT(void,png_process_data) PNGARG((png_structp png_ptr,
    png_infop info_ptr, png_bytep buffer, png_size_t buffer_size));
 
-/* function that combines rows.  Not very much different than the
+/* Function that combines rows.  Not very much different than the
  * png_combine_row() call.  Is this even used?????
  */
 extern PNG_EXPORT(void,png_progressive_combine_row) PNGARG((png_structp png_ptr,
@@ -2040,7 +2112,7 @@ extern PNG_EXPORT(png_voidp,png_malloc_warn) PNGARG((png_structp png_ptr,
    png_uint_32 size));
 #endif
 
-/* frees a pointer allocated by png_malloc() */
+/* Frees a pointer allocated by png_malloc() */
 extern PNG_EXPORT(void,png_free) PNGARG((png_structp png_ptr, png_voidp ptr));
 
 #if defined(PNG_1_0_X)
@@ -2057,11 +2129,12 @@ extern PNG_EXPORT(void,png_free_data) PNGARG((png_structp png_ptr,
    png_infop info_ptr, png_uint_32 free_me, int num));
 #ifdef PNG_FREE_ME_SUPPORTED
 /* Reassign responsibility for freeing existing data, whether allocated
- * by libpng or by the application */
+ * by libpng or by the application
+ */
 extern PNG_EXPORT(void,png_data_freer) PNGARG((png_structp png_ptr,
    png_infop info_ptr, int freer, png_uint_32 mask));
 #endif
-/* assignments for png_data_freer */
+/* Assignments for png_data_freer */
 #define PNG_DESTROY_WILL_FREE_DATA 1
 #define PNG_SET_WILL_FREE_DATA 1
 #define PNG_USER_WILL_FREE_DATA 2
@@ -2145,11 +2218,13 @@ png_infop info_ptr));
 
 #if defined(PNG_INFO_IMAGE_SUPPORTED)
 /* Returns row_pointers, which is an array of pointers to scanlines that was
-returned from png_read_png(). */
+ * returned from png_read_png().
+ */
 extern PNG_EXPORT(png_bytepp,png_get_rows) PNGARG((png_structp png_ptr,
 png_infop info_ptr));
 /* Set row_pointers, which is an array of pointers to scanlines for use
-by png_write_png(). */
+ * by png_write_png().
+ */
 extern PNG_EXPORT(void,png_set_rows) PNGARG((png_structp png_ptr,
    png_infop info_ptr, png_bytepp row_pointers));
 #endif
@@ -2450,8 +2525,8 @@ extern PNG_EXPORT(void,png_set_sCAL_s) PNGARG((png_structp png_ptr,
 #endif
 #endif /* PNG_sCAL_SUPPORTED || PNG_WRITE_sCAL_SUPPORTED */
 
-#if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED)
-/* provide a list of chunks and how they are to be handled, if the built-in
+#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
+/* Provide a list of chunks and how they are to be handled, if the built-in
    handling or default unknown chunk handling is not desired.  Any chunks not
    listed will be handled in the default manner.  The IHDR and IEND chunks
    must not be listed.
@@ -2462,6 +2537,10 @@ extern PNG_EXPORT(void,png_set_sCAL_s) PNGARG((png_structp png_ptr,
 */
 extern PNG_EXPORT(void, png_set_keep_unknown_chunks) PNGARG((png_structp
    png_ptr, int keep, png_bytep chunk_list, int num_chunks));
+PNG_EXPORT(int,png_handle_as_unknown) PNGARG((png_structp png_ptr, png_bytep
+   chunk_name));
+#endif
+#if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED)
 extern PNG_EXPORT(void, png_set_unknown_chunks) PNGARG((png_structp png_ptr,
    png_infop info_ptr, png_unknown_chunkp unknowns, int num_unknowns));
 extern PNG_EXPORT(void, png_set_unknown_chunk_location)
@@ -2469,14 +2548,11 @@ extern PNG_EXPORT(void, png_set_unknown_chunk_location)
 extern PNG_EXPORT(png_uint_32,png_get_unknown_chunks) PNGARG((png_structp
    png_ptr, png_infop info_ptr, png_unknown_chunkpp entries));
 #endif
-#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
-PNG_EXPORT(int,png_handle_as_unknown) PNGARG((png_structp png_ptr, png_bytep
-   chunk_name));
-#endif
 
 /* Png_free_data() will turn off the "valid" flag for anything it frees.
-   If you need to turn it off for a chunk that your application has freed,
-   you can use png_set_invalid(png_ptr, info_ptr, PNG_INFO_CHNK); */
+ * If you need to turn it off for a chunk that your application has freed,
+ * you can use png_set_invalid(png_ptr, info_ptr, PNG_INFO_CHNK);
+ */
 extern PNG_EXPORT(void, png_set_invalid) PNGARG((png_structp png_ptr,
    png_infop info_ptr, int mask));
 
@@ -2502,34 +2578,90 @@ extern PNG_EXPORT(void, png_write_png) PNGARG((png_structp png_ptr,
 #if !defined(PNG_DEBUG_FILE) && defined(_MSC_VER)
 #include <crtdbg.h>
 #if (PNG_DEBUG > 1)
-#define png_debug(l,m)  _RPT0(_CRT_WARN,m)
-#define png_debug1(l,m,p1)  _RPT1(_CRT_WARN,m,p1)
-#define png_debug2(l,m,p1,p2) _RPT2(_CRT_WARN,m,p1,p2)
+#ifndef _DEBUG
+#  define _DEBUG
+#endif
+#ifndef png_debug
+#define png_debug(l,m)  _RPT0(_CRT_WARN,m PNG_STRING_NEWLINE)
+#endif
+#ifndef png_debug1
+#define png_debug1(l,m,p1)  _RPT1(_CRT_WARN,m PNG_STRING_NEWLINE,p1)
+#endif
+#ifndef png_debug2
+#define png_debug2(l,m,p1,p2) _RPT2(_CRT_WARN,m PNG_STRING_NEWLINE,p1,p2)
+#endif
 #endif
 #else /* PNG_DEBUG_FILE || !_MSC_VER */
 #ifndef PNG_DEBUG_FILE
 #define PNG_DEBUG_FILE stderr
 #endif /* PNG_DEBUG_FILE */
+
 #if (PNG_DEBUG > 1)
-#define png_debug(l,m) \
-{ \
-     int num_tabs=l; \
-     fprintf(PNG_DEBUG_FILE,"%s"m,(num_tabs==1 ? "\t" : \
-       (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":"")))); \
-}
-#define png_debug1(l,m,p1) \
-{ \
-     int num_tabs=l; \
-     fprintf(PNG_DEBUG_FILE,"%s"m,(num_tabs==1 ? "\t" : \
-       (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))),p1); \
-}
-#define png_debug2(l,m,p1,p2) \
-{ \
-     int num_tabs=l; \
-     fprintf(PNG_DEBUG_FILE,"%s"m,(num_tabs==1 ? "\t" : \
-       (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))),p1,p2); \
-}
+/* Note: ["%s"m PNG_STRING_NEWLINE] probably does not work on non-ISO
+ * compilers.
+ */
+#  ifdef __STDC__
+#    ifndef png_debug
+#      define png_debug(l,m) \
+       { \
+       int num_tabs=l; \
+       fprintf(PNG_DEBUG_FILE,"%s"m PNG_STRING_NEWLINE,(num_tabs==1 ? "\t" : \
+         (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":"")))); \
+       }
+#    endif
+#    ifndef png_debug1
+#      define png_debug1(l,m,p1) \
+       { \
+       int num_tabs=l; \
+       fprintf(PNG_DEBUG_FILE,"%s"m PNG_STRING_NEWLINE,(num_tabs==1 ? "\t" : \
+         (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))),p1); \
+       }
+#    endif
+#    ifndef png_debug2
+#      define png_debug2(l,m,p1,p2) \
+       { \
+       int num_tabs=l; \
+       fprintf(PNG_DEBUG_FILE,"%s"m PNG_STRING_NEWLINE,(num_tabs==1 ? "\t" : \
+         (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))),p1,p2); \
+       }
+#    endif
+#  else /* __STDC __ */
+#    ifndef png_debug
+#      define png_debug(l,m) \
+       { \
+       int num_tabs=l; \
+       char format[256]; \
+       snprintf(format,256,"%s%s%s",(num_tabs==1 ? "\t" : \
+         (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))), \
+         m,PNG_STRING_NEWLINE); \
+       fprintf(PNG_DEBUG_FILE,format); \
+       }
+#    endif
+#    ifndef png_debug1
+#      define png_debug1(l,m,p1) \
+       { \
+       int num_tabs=l; \
+       char format[256]; \
+       snprintf(format,256,"%s%s%s",(num_tabs==1 ? "\t" : \
+         (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))), \
+         m,PNG_STRING_NEWLINE); \
+       fprintf(PNG_DEBUG_FILE,format,p1); \
+       }
+#    endif
+#    ifndef png_debug2
+#      define png_debug2(l,m,p1,p2) \
+       { \
+       int num_tabs=l; \
+       char format[256]; \
+       snprintf(format,256,"%s%s%s",(num_tabs==1 ? "\t" : \
+         (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))), \
+         m,PNG_STRING_NEWLINE); \
+       fprintf(PNG_DEBUG_FILE,format,p1,p2); \
+       }
+#    endif
+#  endif /* __STDC __ */
 #endif /* (PNG_DEBUG > 1) */
+
 #endif /* _MSC_VER */
 #endif /* (PNG_DEBUG > 0) */
 #endif /* PNG_DEBUG */
@@ -2624,17 +2756,17 @@ extern PNG_EXPORT(void,png_set_mmx_thresholds)
 #if !defined(PNG_1_0_X)
 /* png.c, pnggccrd.c, or pngvcrd.c */
 extern PNG_EXPORT(int,png_mmx_support) PNGARG((void));
+#endif /* PNG_1_0_X */
 #endif /* PNG_ASSEMBLER_CODE_SUPPORTED */
 
 /* Strip the prepended error numbers ("#nnn ") from error and warning
- * messages before passing them to the error or warning handler. */
+ * messages before passing them to the error or warning handler.
+ */
 #ifdef PNG_ERROR_NUMBERS_SUPPORTED
 extern PNG_EXPORT(void,png_set_strip_error_numbers) PNGARG((png_structp
    png_ptr, png_uint_32 strip_mode));
 #endif
 
-#endif /* PNG_1_0_X */
-
 /* Added at libpng-1.2.6 */
 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
 extern PNG_EXPORT(void,png_set_user_limits) PNGARG((png_structp
@@ -2645,7 +2777,10 @@ extern PNG_EXPORT(png_uint_32,png_get_user_height_max) PNGARG((png_structp
    png_ptr));
 #endif
 
-/* Maintainer: Put new public prototypes here ^, in libpng.3, and project defs */
+
+/* Maintainer: Put new public prototypes here ^, in libpng.3, and in
+ * project defs
+ */
 
 #ifdef PNG_READ_COMPOSITE_NODIV_SUPPORTED
 /* With these routines we avoid an integer divide, which will be slower on
@@ -2674,7 +2809,7 @@ extern PNG_EXPORT(png_uint_32,png_get_user_height_max) PNGARG((png_structp
                         (png_uint_32)(alpha)) + (png_uint_32)32768L);        \
        (composite) = (png_uint_16)((temp + (temp >> 16)) >> 16); }
 
-#else  /* standard method using integer division */
+#else  /* Standard method using integer division */
 
 #  define png_composite(composite, fg, alpha, bg)                            \
      (composite) = (png_byte)(((png_uint_16)(fg) * (png_uint_16)(alpha) +    \
@@ -2757,7 +2892,7 @@ extern PNG_EXPORT(void,png_save_uint_16)
 #define PNG_HAVE_PNG_SIGNATURE    0x1000
 #define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000 /* Have another chunk after IDAT */
 
-/* flags for the transformations the PNG library does on the image data */
+/* Flags for the transformations the PNG library does on the image data */
 #define PNG_BGR                0x0001
 #define PNG_INTERLACE          0x0002
 #define PNG_PACK               0x0004
@@ -2791,7 +2926,7 @@ extern PNG_EXPORT(void,png_save_uint_16)
                        /*  0x20000000L  unused */
                        /*  0x40000000L  unused */
 
-/* flags for png_create_struct */
+/* Flags for png_create_struct */
 #define PNG_STRUCT_PNG   0x0001
 #define PNG_STRUCT_INFO  0x0002
 
@@ -2801,7 +2936,7 @@ extern PNG_EXPORT(void,png_save_uint_16)
 #define PNG_COST_SHIFT 3
 #define PNG_COST_FACTOR (1<<(PNG_COST_SHIFT))
 
-/* flags for the png_ptr->flags rather than declaring a byte for each one */
+/* Flags for the png_ptr->flags rather than declaring a byte for each one */
 #define PNG_FLAG_ZLIB_CUSTOM_STRATEGY     0x0001
 #define PNG_FLAG_ZLIB_CUSTOM_LEVEL        0x0002
 #define PNG_FLAG_ZLIB_CUSTOM_MEM_LEVEL    0x0004
@@ -2843,7 +2978,7 @@ extern PNG_EXPORT(void,png_save_uint_16)
 #define PNG_FLAG_CRC_MASK           (PNG_FLAG_CRC_ANCILLARY_MASK | \
                                      PNG_FLAG_CRC_CRITICAL_MASK)
 
-/* save typing and make code easier to understand */
+/* Save typing and make code easier to understand */
 
 #define PNG_COLOR_DIST(c1, c2) (abs((int)((c1).red) - (int)((c2).red)) + \
    abs((int)((c1).green) - (int)((c2).green)) + \
@@ -2856,15 +2991,16 @@ extern PNG_EXPORT(void,png_save_uint_16)
     (( ((width) * ((png_uint_32)(pixel_bits))) + 7) >> 3) )
 
 /* PNG_OUT_OF_RANGE returns true if value is outside the range
-   ideal-delta..ideal+delta.  Each argument is evaluated twice.
-   "ideal" and "delta" should be constants, normally simple
-   integers, "value" a variable. Added to libpng-1.2.6 JB */
+ * ideal-delta..ideal+delta.  Each argument is evaluated twice.
+ * "ideal" and "delta" should be constants, normally simple
+ * integers, "value" a variable. Added to libpng-1.2.6 JB
+ */
 #define PNG_OUT_OF_RANGE(value, ideal, delta) \
         ( (value) < (ideal)-(delta) || (value) > (ideal)+(delta) )
 
-/* variables declared in png.c - only it needs to define PNG_NO_EXTERN */
+/* Variables declared in png.c - only it needs to define PNG_NO_EXTERN */
 #if !defined(PNG_NO_EXTERN) || defined(PNG_ALWAYS_EXTERN)
-/* place to hold the signature string for a PNG file. */
+/* Place to hold the signature string for a PNG file. */
 #ifdef PNG_USE_GLOBAL_ARRAYS
    PNG_EXPORT_VAR (PNG_CONST png_byte FARDATA) png_sig[8];
 #else
@@ -2983,7 +3119,8 @@ PNG_EXTERN void png_zfree PNGARG((voidpf png_ptr, voidpf ptr));
 #endif
 
 /* Next four functions are used internally as callbacks.  PNGAPI is required
- * but not PNG_EXPORT.  PNGAPI added at libpng version 1.2.3. */
+ * but not PNG_EXPORT.  PNGAPI added at libpng version 1.2.3.
+ */
 
 PNG_EXTERN void PNGAPI png_default_read_data PNGARG((png_structp png_ptr,
    png_bytep data, png_size_t length));
@@ -3026,8 +3163,8 @@ PNG_EXTERN void png_crc_read PNGARG((png_structp png_ptr, png_bytep buf,
 /* Decompress data in a chunk that uses compression */
 #if defined(PNG_zTXt_SUPPORTED) || defined(PNG_iTXt_SUPPORTED) || \
     defined(PNG_iCCP_SUPPORTED) || defined(PNG_sPLT_SUPPORTED)
-PNG_EXTERN png_charp png_decompress_chunk PNGARG((png_structp png_ptr,
-   int comp_type, png_charp chunkdata, png_size_t chunklength,
+PNG_EXTERN void png_decompress_chunk PNGARG((png_structp png_ptr,
+   int comp_type, png_size_t chunklength,
    png_size_t prefix_length, png_size_t *data_length));
 #endif
 
@@ -3048,10 +3185,10 @@ PNG_EXTERN void png_calculate_crc PNGARG((png_structp png_ptr, png_bytep ptr,
 PNG_EXTERN void png_flush PNGARG((png_structp png_ptr));
 #endif
 
-/* simple function to write the signature */
+/* Simple function to write the signature */
 PNG_EXTERN void png_write_sig PNGARG((png_structp png_ptr));
 
-/* write various chunks */
+/* Write various chunks */
 
 /* Write the IHDR chunk, and update the png_struct with the necessary
  * information.
@@ -3203,12 +3340,12 @@ PNG_EXTERN void png_write_start_row PNGARG((png_structp png_ptr));
 PNG_EXTERN void png_build_gamma_table PNGARG((png_structp png_ptr));
 #endif
 
-/* combine a row of data, dealing with alpha, etc. if requested */
+/* Combine a row of data, dealing with alpha, etc. if requested */
 PNG_EXTERN void png_combine_row PNGARG((png_structp png_ptr, png_bytep row,
    int mask));
 
 #if defined(PNG_READ_INTERLACING_SUPPORTED)
-/* expand an interlaced row */
+/* Expand an interlaced row */
 /* OLD pre-1.0.9 interface:
 PNG_EXTERN void png_do_read_interlace PNGARG((png_row_infop row_info,
    png_bytep row, int pass, png_uint_32 transformations));
@@ -3219,12 +3356,12 @@ PNG_EXTERN void png_do_read_interlace PNGARG((png_structp png_ptr));
 /* GRR TO DO (2.0 or whenever):  simplify other internal calling interfaces */
 
 #if defined(PNG_WRITE_INTERLACING_SUPPORTED)
-/* grab pixels out of a row for an interlaced pass */
+/* Grab pixels out of a row for an interlaced pass */
 PNG_EXTERN void png_do_write_interlace PNGARG((png_row_infop row_info,
    png_bytep row, int pass));
 #endif
 
-/* unfilter a row */
+/* Unfilter a row */
 PNG_EXTERN void png_read_filter_row PNGARG((png_structp png_ptr,
    png_row_infop row_info, png_bytep row, png_bytep prev_row, int filter));
 
@@ -3235,16 +3372,16 @@ PNG_EXTERN void png_write_find_filter PNGARG((png_structp png_ptr,
 /* Write out the filtered row. */
 PNG_EXTERN void png_write_filtered_row PNGARG((png_structp png_ptr,
    png_bytep filtered_row));
-/* finish a row while reading, dealing with interlacing passes, etc. */
+/* Finish a row while reading, dealing with interlacing passes, etc. */
 PNG_EXTERN void png_read_finish_row PNGARG((png_structp png_ptr));
 
-/* initialize the row buffers, etc. */
+/* Initialize the row buffers, etc. */
 PNG_EXTERN void png_read_start_row PNGARG((png_structp png_ptr));
-/* optional call to update the users info structure */
+/* Optional call to update the users info structure */
 PNG_EXTERN void png_read_transform_info PNGARG((png_structp png_ptr,
    png_infop info_ptr));
 
-/* these are the functions that do the transformations */
+/* These are the functions that do the transformations */
 #if defined(PNG_READ_FILLER_SUPPORTED)
 PNG_EXTERN void png_do_read_filler PNGARG((png_row_infop row_info,
    png_bytep row, png_uint_32 filler, png_uint_32 flags));
@@ -3366,7 +3503,7 @@ PNG_EXTERN void png_do_expand PNGARG((png_row_infop row_info,
  * then calls the appropriate callback for the chunk if it is valid.
  */
 
-/* decode the IHDR chunk */
+/* Decode the IHDR chunk */
 PNG_EXTERN void png_handle_IHDR PNGARG((png_structp png_ptr, png_infop info_ptr,
    png_uint_32 length));
 PNG_EXTERN void png_handle_PLTE PNGARG((png_structp png_ptr, png_infop info_ptr,
@@ -3465,7 +3602,7 @@ PNG_EXTERN void png_handle_unknown PNGARG((png_structp png_ptr,
 PNG_EXTERN void png_check_chunk_name PNGARG((png_structp png_ptr,
    png_bytep chunk_name));
 
-/* handle the transformations for reading and writing */
+/* Handle the transformations for reading and writing */
 PNG_EXTERN void png_do_read_transformations PNGARG((png_structp png_ptr));
 PNG_EXTERN void png_do_write_transformations PNGARG((png_structp png_ptr));
 
@@ -3556,6 +3693,26 @@ png_infop info_ptr, png_uint_32 *res_x, png_uint_32 *res_y, int *unit_type));
 #endif /* PNG_pHYs_SUPPORTED */
 #endif  /* PNG_INCH_CONVERSIONS && PNG_FLOATING_POINT_SUPPORTED */
 
+/* Read the chunk header (length + type name) */
+PNG_EXTERN png_uint_32 png_read_chunk_header PNGARG((png_structp png_ptr));
+
+/* Added at libpng version 1.2.34 */
+#if defined(PNG_cHRM_SUPPORTED)
+PNG_EXTERN int png_check_cHRM_fixed  PNGARG((png_structp png_ptr,
+   png_fixed_point int_white_x, png_fixed_point int_white_y,
+   png_fixed_point int_red_x, png_fixed_point int_red_y, png_fixed_point
+   int_green_x, png_fixed_point int_green_y, png_fixed_point int_blue_x,
+   png_fixed_point int_blue_y));
+#endif
+
+#if defined(PNG_cHRM_SUPPORTED)
+#if !defined(PNG_NO_CHECK_cHRM)
+/* Added at libpng version 1.2.34 */
+PNG_EXTERN void png_64bit_product (long v1, long v2, unsigned long *hi_product,
+   unsigned long *lo_product);
+#endif
+#endif
+
 /* Maintainer: Put new private prototypes here ^ and in libpngpf.3 */
 
 #endif /* PNG_INTERNAL */
@@ -3565,5 +3722,5 @@ png_infop info_ptr, png_uint_32 *res_x, png_uint_32 *res_y, int *unit_type));
 #endif
 
 #endif /* PNG_VERSION_INFO_ONLY */
-/* do not put anything past this line */
+/* Do not put anything past this line */
 #endif /* PNG_H */
diff --git a/src/3rdparty/libpng/pngconf.h b/src/3rdparty/libpng/pngconf.h
index 066be020b0..c1c1d92818 100644
--- a/src/3rdparty/libpng/pngconf.h
+++ b/src/3rdparty/libpng/pngconf.h
@@ -1,11 +1,14 @@
 
 /* pngconf.h - machine configurable file for libpng
  *
- * libpng version 1.2.29 - May 8, 2008
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * libpng version 1.2.40 - September 10, 2009
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
+ *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
  */
 
 /* Any machine specific code is near the front of this file, so if you
@@ -19,7 +22,7 @@
 
 #define PNG_1_2_X
 
-/* 
+/*
  * PNG_USER_CONFIG has to be defined on the compiler command line. This
  * includes the resource compiler for Windows DLL configurations.
  */
@@ -39,7 +42,7 @@
 
 /*
  * Added at libpng-1.2.8
- *  
+ *
  * If you create a private DLL you need to define in "pngusr.h" the followings:
  * #define PNG_USER_PRIVATEBUILD <Describes by whom and why this version of
  *        the DLL was built>
@@ -50,8 +53,8 @@
  *        number and must match your private DLL name>
  *  e.g. // private DLL "libpng13gx.dll"
  *       #define PNG_USER_DLLFNAME_POSTFIX "gx"
- * 
- * The following macros are also at your disposal if you want to complete the 
+ *
+ * The following macros are also at your disposal if you want to complete the
  * DLL VERSIONINFO structure.
  * - PNG_USER_VERSIONINFO_COMMENTS
  * - PNG_USER_VERSIONINFO_COMPANYNAME
@@ -147,9 +150,9 @@
  * 'Cygwin' defines/defaults:
  *   PNG_BUILD_DLL -- (ignored) building the dll
  *   (no define)   -- (ignored) building an application, linking to the dll
- *   PNG_STATIC    -- (ignored) building the static lib, or building an 
+ *   PNG_STATIC    -- (ignored) building the static lib, or building an
  *                    application that links to the static lib.
- *   ALL_STATIC    -- (ignored) building various static libs, or building an 
+ *   ALL_STATIC    -- (ignored) building various static libs, or building an
  *                    application that links to the static libs.
  * Thus,
  * a cygwin user should define either PNG_BUILD_DLL or PNG_STATIC, and
@@ -162,12 +165,12 @@
  *   PNG_BUILD_DLL
  *   PNG_STATIC
  *   (nothing) == PNG_USE_DLL
- * 
+ *
  * CYGWIN (2002-01-20): The preceding is now obsolete. With the advent
- *   of auto-import in binutils, we no longer need to worry about 
+ *   of auto-import in binutils, we no longer need to worry about
  *   __declspec(dllexport) / __declspec(dllimport) and friends.  Therefore,
  *   we don't need to worry about PNG_STATIC or ALL_STATIC when it comes
- *   to __declspec() stuff.  However, we DO need to worry about 
+ *   to __declspec() stuff.  However, we DO need to worry about
  *   PNG_BUILD_DLL and PNG_STATIC because those change some defaults
  *   such as CONSOLE_IO and whether GLOBAL_ARRAYS are allowed.
  */
@@ -211,8 +214,8 @@
 #        if !defined(PNG_DLL)
 #          define PNG_DLL
 #        endif
-#      endif  
-#    endif  
+#      endif
+#    endif
 #  endif
 #endif
 
@@ -233,12 +236,11 @@
 #  include <windows.h>
    /* Console I/O functions are not supported on WindowsCE */
 #  define PNG_NO_CONSOLE_IO
+   /* abort() may not be supported on some/all Windows CE platforms */
+#  define PNG_ABORT() exit(-1)
 #  ifdef PNG_DEBUG
 #    undef PNG_DEBUG
 #  endif
-#  ifndef PNG_ABORT
-#    define PNG_ABORT() exit(3)
-#  endif
 #endif
 
 #ifdef PNG_BUILD_DLL
@@ -315,21 +317,29 @@
 #ifdef PNG_SETJMP_SUPPORTED
 /* This is an attempt to force a single setjmp behaviour on Linux.  If
  * the X config stuff didn't define _BSD_SOURCE we wouldn't need this.
+ *
+ * You can bypass this test if you know that your application uses exactly
+ * the same setjmp.h that was included when libpng was built.  Only define
+ * PNG_SKIP_SETJMP_CHECK while building your application, prior to the
+ * application's '#include "png.h"'. Don't define PNG_SKIP_SETJMP_CHECK
+ * while building a separate libpng library for general use.
  */
 
-#  ifdef __linux__
-#    ifdef _BSD_SOURCE
-#      define PNG_SAVE_BSD_SOURCE
-#      undef _BSD_SOURCE
-#    endif
-#    ifdef _SETJMP_H
-     /* If you encounter a compiler error here, see the explanation
-      * near the end of INSTALL.
-      */
-         __pngconf.h__ already includes setjmp.h;
-         __dont__ include it again.;
-#    endif
-#  endif /* __linux__ */
+#  ifndef PNG_SKIP_SETJMP_CHECK
+#    ifdef __linux__
+#      ifdef _BSD_SOURCE
+#        define PNG_SAVE_BSD_SOURCE
+#        undef _BSD_SOURCE
+#      endif
+#      ifdef _SETJMP_H
+       /* If you encounter a compiler error here, see the explanation
+        * near the end of INSTALL.
+        */
+           __pngconf.h__ in libpng already includes setjmp.h;
+           __dont__ include it again.;
+#      endif
+#    endif /* __linux__ */
+#  endif /* PNG_SKIP_SETJMP_CHECK */
 
    /* include setjmp.h for error handling */
 #  include <setjmp.h>
@@ -480,7 +490,7 @@
  * iTXt support was added.  iTXt support was turned off by default through
  * libpng-1.2.x, to support old apps that malloc the png_text structure
  * instead of calling png_set_text() and letting libpng malloc it.  It
- * was turned on by default in libpng-1.3.0.
+ * will be turned on by default in libpng-1.4.0.
  */
 
 #if defined(PNG_1_0_X) || defined (PNG_1_2_X)
@@ -514,6 +524,7 @@
 #  define PNG_NO_FREE_ME
 #  define PNG_NO_READ_UNKNOWN_CHUNKS
 #  define PNG_NO_WRITE_UNKNOWN_CHUNKS
+#  define PNG_NO_HANDLE_AS_UNKNOWN
 #  define PNG_NO_READ_USER_CHUNKS
 #  define PNG_NO_READ_iCCP
 #  define PNG_NO_WRITE_iCCP
@@ -543,7 +554,7 @@
 #  define PNG_FREE_ME_SUPPORTED
 #endif
 
-#if defined(PNG_READ_SUPPORTED)
+#ifdef PNG_READ_SUPPORTED
 
 #if !defined(PNG_READ_TRANSFORMS_NOT_SUPPORTED) && \
       !defined(PNG_NO_READ_TRANSFORMS)
@@ -631,7 +642,7 @@
 
 #endif /* PNG_READ_SUPPORTED */
 
-#if defined(PNG_WRITE_SUPPORTED)
+#ifdef PNG_WRITE_SUPPORTED
 
 # if !defined(PNG_WRITE_TRANSFORMS_NOT_SUPPORTED) && \
     !defined(PNG_NO_WRITE_TRANSFORMS)
@@ -734,7 +745,7 @@
 #  define PNG_EASY_ACCESS_SUPPORTED
 #endif
 
-/* PNG_ASSEMBLER_CODE was enabled by default in version 1.2.0 
+/* PNG_ASSEMBLER_CODE was enabled by default in version 1.2.0
  * and removed from version 1.2.20.  The following will be removed
  * from libpng-1.4.0
 */
@@ -801,6 +812,11 @@
 #  define PNG_USER_HEIGHT_MAX 1000000L
 #endif
 
+/* Added at libpng-1.2.34 and 1.4.0 */
+#ifndef PNG_STRING_NEWLINE
+#define PNG_STRING_NEWLINE "\n"
+#endif
+
 /* These are currently experimental features, define them if you want */
 
 /* very little testing */
@@ -928,14 +944,22 @@
 #  define PNG_READ_zTXt_SUPPORTED
 #  define PNG_zTXt_SUPPORTED
 #endif
+#ifndef PNG_NO_READ_OPT_PLTE
+#  define PNG_READ_OPT_PLTE_SUPPORTED /* only affects support of the */
+#endif                      /* optional PLTE chunk in RGB and RGBA images */
+#if defined(PNG_READ_iTXt_SUPPORTED) || defined(PNG_READ_tEXt_SUPPORTED) || \
+    defined(PNG_READ_zTXt_SUPPORTED)
+#  define PNG_READ_TEXT_SUPPORTED
+#  define PNG_TEXT_SUPPORTED
+#endif
+
+#endif /* PNG_READ_ANCILLARY_CHUNKS_SUPPORTED */
+
 #ifndef PNG_NO_READ_UNKNOWN_CHUNKS
 #  define PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
 #  ifndef PNG_UNKNOWN_CHUNKS_SUPPORTED
 #    define PNG_UNKNOWN_CHUNKS_SUPPORTED
 #  endif
-#  ifndef PNG_NO_HANDLE_AS_UNKNOWN
-#    define PNG_HANDLE_AS_UNKNOWN_SUPPORTED
-#  endif
 #endif
 #if !defined(PNG_NO_READ_USER_CHUNKS) && \
      defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
@@ -948,17 +972,14 @@
 #    undef PNG_NO_HANDLE_AS_UNKNOWN
 #  endif
 #endif
-#ifndef PNG_NO_READ_OPT_PLTE
-#  define PNG_READ_OPT_PLTE_SUPPORTED /* only affects support of the */
-#endif                      /* optional PLTE chunk in RGB and RGBA images */
-#if defined(PNG_READ_iTXt_SUPPORTED) || defined(PNG_READ_tEXt_SUPPORTED) || \
-    defined(PNG_READ_zTXt_SUPPORTED)
-#  define PNG_READ_TEXT_SUPPORTED
-#  define PNG_TEXT_SUPPORTED
-#endif
 
-#endif /* PNG_READ_ANCILLARY_CHUNKS_SUPPORTED */
+#ifndef PNG_NO_HANDLE_AS_UNKNOWN
+#  ifndef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
+#    define PNG_HANDLE_AS_UNKNOWN_SUPPORTED
+#  endif
+#endif
 
+#ifdef PNG_WRITE_SUPPORTED
 #ifdef PNG_WRITE_ANCILLARY_CHUNKS_SUPPORTED
 
 #ifdef PNG_NO_WRITE_TEXT
@@ -1070,17 +1091,6 @@
 #    define PNG_zTXt_SUPPORTED
 #  endif
 #endif
-#ifndef PNG_NO_WRITE_UNKNOWN_CHUNKS
-#  define PNG_WRITE_UNKNOWN_CHUNKS_SUPPORTED
-#  ifndef PNG_UNKNOWN_CHUNKS_SUPPORTED
-#    define PNG_UNKNOWN_CHUNKS_SUPPORTED
-#  endif
-#  ifndef PNG_NO_HANDLE_AS_UNKNOWN
-#     ifndef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
-#       define PNG_HANDLE_AS_UNKNOWN_SUPPORTED
-#     endif
-#  endif
-#endif
 #if defined(PNG_WRITE_iTXt_SUPPORTED) || defined(PNG_WRITE_tEXt_SUPPORTED) || \
     defined(PNG_WRITE_zTXt_SUPPORTED)
 #  define PNG_WRITE_TEXT_SUPPORTED
@@ -1091,6 +1101,20 @@
 
 #endif /* PNG_WRITE_ANCILLARY_CHUNKS_SUPPORTED */
 
+#ifndef PNG_NO_WRITE_UNKNOWN_CHUNKS
+#  define PNG_WRITE_UNKNOWN_CHUNKS_SUPPORTED
+#  ifndef PNG_UNKNOWN_CHUNKS_SUPPORTED
+#    define PNG_UNKNOWN_CHUNKS_SUPPORTED
+#  endif
+#endif
+
+#ifndef PNG_NO_HANDLE_AS_UNKNOWN
+#  ifndef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
+#    define PNG_HANDLE_AS_UNKNOWN_SUPPORTED
+#  endif
+#endif
+#endif /* PNG_WRITE_SUPPORTED */
+
 /* Turn this off to disable png_read_png() and
  * png_write_png() and leave the row_pointers member
  * out of the info structure.
@@ -1126,10 +1150,10 @@ typedef unsigned char png_byte;
    change (I'm not sure if you will or not, so I thought I'd be safe) */
 #ifdef PNG_SIZE_T
    typedef PNG_SIZE_T png_size_t;
-#  define png_sizeof(x) png_convert_size(sizeof (x))
+#  define png_sizeof(x) png_convert_size(sizeof(x))
 #else
    typedef size_t png_size_t;
-#  define png_sizeof(x) sizeof (x)
+#  define png_sizeof(x) sizeof(x)
 #endif
 
 /* The following is needed for medium model support.  It cannot be in the
@@ -1236,7 +1260,7 @@ typedef char            FAR * FAR * FAR * png_charppp;
 
 #if defined(PNG_1_0_X) || defined(PNG_1_2_X)
 /* SPC -  Is this stuff deprecated? */
-/* It'll be removed as of libpng-1.3.0 - GR-P */
+/* It'll be removed as of libpng-1.4.0 - GR-P */
 /* libpng typedefs for types in zlib. If zlib changes
  * or another compression library is used, then change these.
  * Eliminates need to change all the source files.
@@ -1309,7 +1333,7 @@ typedef z_stream FAR *  png_zstreamp;
 #  define PNGAPI __cdecl
 #  undef PNG_IMPEXP
 #  define PNG_IMPEXP
-#endif  
+#endif
 
 /* If you define PNGAPI, e.g., with compiler option "-DPNGAPI=__stdcall",
  * you may get warnings regarding the linkage of png_zalloc and png_zfree.
diff --git a/src/3rdparty/libpng/pngerror.c b/src/3rdparty/libpng/pngerror.c
index b364fc00af..d68416b384 100644
--- a/src/3rdparty/libpng/pngerror.c
+++ b/src/3rdparty/libpng/pngerror.c
@@ -1,12 +1,15 @@
 
 /* pngerror.c - stub functions for i/o and memory allocation
  *
- * Last changed in libpng 1.2.22 [October 13, 2007]
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2007 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.37 [June 4, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
+ *
  * This file provides a location for all error handling.  Users who
  * need special error handling are expected to write replacement functions
  * and use png_set_error_fn() to use those functions.  See the instructions
@@ -15,8 +18,8 @@
 
 #define PNG_INTERNAL
 #include "png.h"
-
 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
+
 static void /* PRIVATE */
 png_default_error PNGARG((png_structp png_ptr,
   png_const_charp error_message));
@@ -44,28 +47,29 @@ png_error(png_structp png_ptr, png_const_charp error_message)
      {
        if (*error_message == '#')
        {
+           /* Strip "#nnnn " from beginning of error message. */
            int offset;
-           for (offset=1; offset<15; offset++)
-              if (*(error_message+offset) == ' ')
+           for (offset = 1; offset<15; offset++)
+              if (error_message[offset] == ' ')
                   break;
            if (png_ptr->flags&PNG_FLAG_STRIP_ERROR_TEXT)
            {
               int i;
-              for (i=0; i<offset-1; i++)
-                 msg[i]=error_message[i+1];
-              msg[i]='\0';
-              error_message=msg;
+              for (i = 0; i < offset - 1; i++)
+                 msg[i] = error_message[i + 1];
+              msg[i - 1] = '\0';
+              error_message = msg;
            }
            else
-              error_message+=offset;
+              error_message += offset;
        }
        else
        {
            if (png_ptr->flags&PNG_FLAG_STRIP_ERROR_TEXT)
            {
-              msg[0]='0';
-              msg[1]='\0';
-              error_message=msg;
+              msg[0] = '0';
+              msg[1] = '\0';
+              error_message = msg;
            }
        }
      }
@@ -110,16 +114,16 @@ png_warning(png_structp png_ptr, png_const_charp warning_message)
      {
        if (*warning_message == '#')
        {
-           for (offset=1; offset<15; offset++)
-              if (*(warning_message+offset) == ' ')
+           for (offset = 1; offset < 15; offset++)
+              if (warning_message[offset] == ' ')
                   break;
        }
      }
-     if (png_ptr != NULL && png_ptr->warning_fn != NULL)
-        (*(png_ptr->warning_fn))(png_ptr, warning_message+offset);
    }
+   if (png_ptr != NULL && png_ptr->warning_fn != NULL)
+      (*(png_ptr->warning_fn))(png_ptr, warning_message + offset);
    else
-      png_default_warning(png_ptr, warning_message+offset);
+      png_default_warning(png_ptr, warning_message + offset);
 }
 #endif /* PNG_NO_WARNINGS */
 
@@ -167,8 +171,8 @@ png_format_buffer(png_structp png_ptr, png_charp buffer, png_const_charp
    {
       buffer[iout++] = ':';
       buffer[iout++] = ' ';
-      png_memcpy(buffer+iout, error_message, PNG_MAX_ERROR_TEXT);
-      buffer[iout+PNG_MAX_ERROR_TEXT-1] = '\0';
+      png_memcpy(buffer + iout, error_message, PNG_MAX_ERROR_TEXT);
+      buffer[iout + PNG_MAX_ERROR_TEXT - 1] = '\0';
    }
 }
 
@@ -216,26 +220,35 @@ png_default_error(png_structp png_ptr, png_const_charp error_message)
 #ifdef PNG_ERROR_NUMBERS_SUPPORTED
    if (*error_message == '#')
    {
+     /* Strip "#nnnn " from beginning of error message. */
      int offset;
      char error_number[16];
-     for (offset=0; offset<15; offset++)
+     for (offset = 0; offset<15; offset++)
      {
-         error_number[offset] = *(error_message+offset+1);
-         if (*(error_message+offset) == ' ')
+         error_number[offset] = error_message[offset + 1];
+         if (error_message[offset] == ' ')
              break;
      }
-     if((offset > 1) && (offset < 15))
+     if ((offset > 1) && (offset < 15))
      {
-       error_number[offset-1]='\0';
-       fprintf(stderr, "libpng error no. %s: %s\n", error_number,
-          error_message+offset);
+       error_number[offset - 1] = '\0';
+       fprintf(stderr, "libpng error no. %s: %s",
+          error_number, error_message + offset + 1);
+       fprintf(stderr, PNG_STRING_NEWLINE);
      }
      else
-       fprintf(stderr, "libpng error: %s, offset=%d\n", error_message,offset);
+     {
+       fprintf(stderr, "libpng error: %s, offset=%d",
+          error_message, offset);
+       fprintf(stderr, PNG_STRING_NEWLINE);
+     }
    }
    else
 #endif
-   fprintf(stderr, "libpng error: %s\n", error_message);
+   {
+      fprintf(stderr, "libpng error: %s", error_message);
+      fprintf(stderr, PNG_STRING_NEWLINE);
+   }
 #endif
 
 #ifdef PNG_SETJMP_SUPPORTED
@@ -255,7 +268,7 @@ png_default_error(png_structp png_ptr, png_const_charp error_message)
    PNG_ABORT();
 #endif
 #ifdef PNG_NO_CONSOLE_IO
-   error_message = error_message; /* make compiler happy */
+   error_message = error_message; /* Make compiler happy */
 #endif
 }
 
@@ -274,28 +287,36 @@ png_default_warning(png_structp png_ptr, png_const_charp warning_message)
    {
      int offset;
      char warning_number[16];
-     for (offset=0; offset<15; offset++)
+     for (offset = 0; offset < 15; offset++)
      {
-        warning_number[offset]=*(warning_message+offset+1);
-        if (*(warning_message+offset) == ' ')
+        warning_number[offset] = warning_message[offset + 1];
+        if (warning_message[offset] == ' ')
             break;
      }
-     if((offset > 1) && (offset < 15))
+     if ((offset > 1) && (offset < 15))
      {
-       warning_number[offset-1]='\0';
-       fprintf(stderr, "libpng warning no. %s: %s\n", warning_number,
-          warning_message+offset);
+       warning_number[offset + 1] = '\0';
+       fprintf(stderr, "libpng warning no. %s: %s",
+          warning_number, warning_message + offset);
+       fprintf(stderr, PNG_STRING_NEWLINE);
      }
      else
-       fprintf(stderr, "libpng warning: %s\n", warning_message);
+     {
+       fprintf(stderr, "libpng warning: %s",
+          warning_message);
+       fprintf(stderr, PNG_STRING_NEWLINE);
+     }
    }
    else
 #  endif
-     fprintf(stderr, "libpng warning: %s\n", warning_message);
+   {
+     fprintf(stderr, "libpng warning: %s", warning_message);
+     fprintf(stderr, PNG_STRING_NEWLINE);
+   }
 #else
-   warning_message = warning_message; /* make compiler happy */
+   warning_message = warning_message; /* Make compiler happy */
 #endif
-   png_ptr = png_ptr; /* make compiler happy */
+   png_ptr = png_ptr; /* Make compiler happy */
 }
 #endif /* PNG_NO_WARNINGS */
 
@@ -333,7 +354,7 @@ png_get_error_ptr(png_structp png_ptr)
 void PNGAPI
 png_set_strip_error_numbers(png_structp png_ptr, png_uint_32 strip_mode)
 {
-   if(png_ptr != NULL)
+   if (png_ptr != NULL)
    {
      png_ptr->flags &=
        ((~(PNG_FLAG_STRIP_ERROR_NUMBERS|PNG_FLAG_STRIP_ERROR_TEXT))&strip_mode);
diff --git a/src/3rdparty/libpng/pngget.c b/src/3rdparty/libpng/pngget.c
index a0e90bb6a4..38e4f9eefe 100644
--- a/src/3rdparty/libpng/pngget.c
+++ b/src/3rdparty/libpng/pngget.c
@@ -1,16 +1,19 @@
 
 /* pngget.c - retrieval of values from info struct
  *
- * Last changed in libpng 1.2.15 January 5, 2007
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2007 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.37 [June 4, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
+ *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
+ *
  */
 
 #define PNG_INTERNAL
 #include "png.h"
-
 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
 
 png_uint_32 PNGAPI
@@ -18,6 +21,7 @@ png_get_valid(png_structp png_ptr, png_infop info_ptr, png_uint_32 flag)
 {
    if (png_ptr != NULL && info_ptr != NULL)
       return(info_ptr->valid & flag);
+
    else
       return(0);
 }
@@ -27,6 +31,7 @@ png_get_rowbytes(png_structp png_ptr, png_infop info_ptr)
 {
    if (png_ptr != NULL && info_ptr != NULL)
       return(info_ptr->rowbytes);
+
    else
       return(0);
 }
@@ -37,20 +42,20 @@ png_get_rows(png_structp png_ptr, png_infop info_ptr)
 {
    if (png_ptr != NULL && info_ptr != NULL)
       return(info_ptr->row_pointers);
+
    else
       return(0);
 }
 #endif
 
 #ifdef PNG_EASY_ACCESS_SUPPORTED
-/* easy access to info, added in libpng-0.99 */
+/* Easy access to info, added in libpng-0.99 */
 png_uint_32 PNGAPI
 png_get_image_width(png_structp png_ptr, png_infop info_ptr)
 {
    if (png_ptr != NULL && info_ptr != NULL)
-   {
       return info_ptr->width;
-   }
+
    return (0);
 }
 
@@ -58,9 +63,8 @@ png_uint_32 PNGAPI
 png_get_image_height(png_structp png_ptr, png_infop info_ptr)
 {
    if (png_ptr != NULL && info_ptr != NULL)
-   {
       return info_ptr->height;
-   }
+
    return (0);
 }
 
@@ -68,9 +72,8 @@ png_byte PNGAPI
 png_get_bit_depth(png_structp png_ptr, png_infop info_ptr)
 {
    if (png_ptr != NULL && info_ptr != NULL)
-   {
       return info_ptr->bit_depth;
-   }
+
    return (0);
 }
 
@@ -78,9 +81,8 @@ png_byte PNGAPI
 png_get_color_type(png_structp png_ptr, png_infop info_ptr)
 {
    if (png_ptr != NULL && info_ptr != NULL)
-   {
       return info_ptr->color_type;
-   }
+
    return (0);
 }
 
@@ -88,9 +90,8 @@ png_byte PNGAPI
 png_get_filter_type(png_structp png_ptr, png_infop info_ptr)
 {
    if (png_ptr != NULL && info_ptr != NULL)
-   {
       return info_ptr->filter_type;
-   }
+
    return (0);
 }
 
@@ -98,9 +99,8 @@ png_byte PNGAPI
 png_get_interlace_type(png_structp png_ptr, png_infop info_ptr)
 {
    if (png_ptr != NULL && info_ptr != NULL)
-   {
       return info_ptr->interlace_type;
-   }
+
    return (0);
 }
 
@@ -108,9 +108,8 @@ png_byte PNGAPI
 png_get_compression_type(png_structp png_ptr, png_infop info_ptr)
 {
    if (png_ptr != NULL && info_ptr != NULL)
-   {
       return info_ptr->compression_type;
-   }
+
    return (0);
 }
 
@@ -121,10 +120,13 @@ png_get_x_pixels_per_meter(png_structp png_ptr, png_infop info_ptr)
 #if defined(PNG_pHYs_SUPPORTED)
    if (info_ptr->valid & PNG_INFO_pHYs)
    {
-      png_debug1(1, "in %s retrieval function\n", "png_get_x_pixels_per_meter");
-      if(info_ptr->phys_unit_type != PNG_RESOLUTION_METER)
+      png_debug1(1, "in %s retrieval function", "png_get_x_pixels_per_meter");
+
+      if (info_ptr->phys_unit_type != PNG_RESOLUTION_METER)
           return (0);
-      else return (info_ptr->x_pixels_per_unit);
+
+      else
+          return (info_ptr->x_pixels_per_unit);
    }
 #else
    return (0);
@@ -139,10 +141,13 @@ png_get_y_pixels_per_meter(png_structp png_ptr, png_infop info_ptr)
 #if defined(PNG_pHYs_SUPPORTED)
    if (info_ptr->valid & PNG_INFO_pHYs)
    {
-      png_debug1(1, "in %s retrieval function\n", "png_get_y_pixels_per_meter");
-      if(info_ptr->phys_unit_type != PNG_RESOLUTION_METER)
+      png_debug1(1, "in %s retrieval function", "png_get_y_pixels_per_meter");
+
+      if (info_ptr->phys_unit_type != PNG_RESOLUTION_METER)
           return (0);
-      else return (info_ptr->y_pixels_per_unit);
+
+      else
+          return (info_ptr->y_pixels_per_unit);
    }
 #else
    return (0);
@@ -157,11 +162,14 @@ png_get_pixels_per_meter(png_structp png_ptr, png_infop info_ptr)
 #if defined(PNG_pHYs_SUPPORTED)
    if (info_ptr->valid & PNG_INFO_pHYs)
    {
-      png_debug1(1, "in %s retrieval function\n", "png_get_pixels_per_meter");
-      if(info_ptr->phys_unit_type != PNG_RESOLUTION_METER ||
+      png_debug1(1, "in %s retrieval function", "png_get_pixels_per_meter");
+
+      if (info_ptr->phys_unit_type != PNG_RESOLUTION_METER ||
          info_ptr->x_pixels_per_unit != info_ptr->y_pixels_per_unit)
           return (0);
-      else return (info_ptr->x_pixels_per_unit);
+
+      else
+          return (info_ptr->x_pixels_per_unit);
    }
 #else
    return (0);
@@ -175,9 +183,10 @@ png_get_pixel_aspect_ratio(png_structp png_ptr, png_infop info_ptr)
    {
    if (png_ptr != NULL && info_ptr != NULL)
 #if defined(PNG_pHYs_SUPPORTED)
+
    if (info_ptr->valid & PNG_INFO_pHYs)
    {
-      png_debug1(1, "in %s retrieval function\n", "png_get_aspect_ratio");
+      png_debug1(1, "in %s retrieval function", "png_get_aspect_ratio");
       if (info_ptr->x_pixels_per_unit == 0)
          return ((float)0.0);
       else
@@ -185,7 +194,7 @@ png_get_pixel_aspect_ratio(png_structp png_ptr, png_infop info_ptr)
             /(float)info_ptr->x_pixels_per_unit));
    }
 #else
-   return (0.0);
+      return (0.0);
 #endif
    return ((float)0.0);
 }
@@ -196,15 +205,19 @@ png_get_x_offset_microns(png_structp png_ptr, png_infop info_ptr)
 {
    if (png_ptr != NULL && info_ptr != NULL)
 #if defined(PNG_oFFs_SUPPORTED)
+
    if (info_ptr->valid & PNG_INFO_oFFs)
    {
-      png_debug1(1, "in %s retrieval function\n", "png_get_x_offset_microns");
-      if(info_ptr->offset_unit_type != PNG_OFFSET_MICROMETER)
+      png_debug1(1, "in %s retrieval function", "png_get_x_offset_microns");
+
+      if (info_ptr->offset_unit_type != PNG_OFFSET_MICROMETER)
           return (0);
-      else return (info_ptr->x_offset);
+
+      else
+          return (info_ptr->x_offset);
    }
 #else
-   return (0);
+      return (0);
 #endif
    return (0);
 }
@@ -213,13 +226,17 @@ png_int_32 PNGAPI
 png_get_y_offset_microns(png_structp png_ptr, png_infop info_ptr)
 {
    if (png_ptr != NULL && info_ptr != NULL)
+
 #if defined(PNG_oFFs_SUPPORTED)
    if (info_ptr->valid & PNG_INFO_oFFs)
    {
-      png_debug1(1, "in %s retrieval function\n", "png_get_y_offset_microns");
-      if(info_ptr->offset_unit_type != PNG_OFFSET_MICROMETER)
+      png_debug1(1, "in %s retrieval function", "png_get_y_offset_microns");
+
+      if (info_ptr->offset_unit_type != PNG_OFFSET_MICROMETER)
           return (0);
-      else return (info_ptr->y_offset);
+
+      else
+          return (info_ptr->y_offset);
    }
 #else
    return (0);
@@ -231,13 +248,17 @@ png_int_32 PNGAPI
 png_get_x_offset_pixels(png_structp png_ptr, png_infop info_ptr)
 {
    if (png_ptr != NULL && info_ptr != NULL)
+
 #if defined(PNG_oFFs_SUPPORTED)
    if (info_ptr->valid & PNG_INFO_oFFs)
    {
-      png_debug1(1, "in %s retrieval function\n", "png_get_x_offset_microns");
-      if(info_ptr->offset_unit_type != PNG_OFFSET_PIXEL)
+      png_debug1(1, "in %s retrieval function", "png_get_x_offset_microns");
+
+      if (info_ptr->offset_unit_type != PNG_OFFSET_PIXEL)
           return (0);
-      else return (info_ptr->x_offset);
+
+      else
+          return (info_ptr->x_offset);
    }
 #else
    return (0);
@@ -249,13 +270,17 @@ png_int_32 PNGAPI
 png_get_y_offset_pixels(png_structp png_ptr, png_infop info_ptr)
 {
    if (png_ptr != NULL && info_ptr != NULL)
+
 #if defined(PNG_oFFs_SUPPORTED)
    if (info_ptr->valid & PNG_INFO_oFFs)
    {
-      png_debug1(1, "in %s retrieval function\n", "png_get_y_offset_microns");
-      if(info_ptr->offset_unit_type != PNG_OFFSET_PIXEL)
+      png_debug1(1, "in %s retrieval function", "png_get_y_offset_microns");
+
+      if (info_ptr->offset_unit_type != PNG_OFFSET_PIXEL)
           return (0);
-      else return (info_ptr->y_offset);
+
+      else
+          return (info_ptr->y_offset);
    }
 #else
    return (0);
@@ -308,7 +333,7 @@ png_get_pHYs_dpi(png_structp png_ptr, png_infop info_ptr,
 
    if (png_ptr != NULL && info_ptr != NULL && (info_ptr->valid & PNG_INFO_pHYs))
    {
-      png_debug1(1, "in %s retrieval function\n", "pHYs");
+      png_debug1(1, "in %s retrieval function", "pHYs");
       if (res_x != NULL)
       {
          *res_x = info_ptr->x_pixels_per_unit;
@@ -323,7 +348,7 @@ png_get_pHYs_dpi(png_structp png_ptr, png_infop info_ptr,
       {
          *unit_type = (int)info_ptr->phys_unit_type;
          retval |= PNG_INFO_pHYs;
-         if(*unit_type == 1)
+         if (*unit_type == 1)
          {
             if (res_x != NULL) *res_x = (png_uint_32)(*res_x * .0254 + .50);
             if (res_y != NULL) *res_y = (png_uint_32)(*res_y * .0254 + .50);
@@ -365,7 +390,7 @@ png_get_bKGD(png_structp png_ptr, png_infop info_ptr,
    if (png_ptr != NULL && info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD)
       && background != NULL)
    {
-      png_debug1(1, "in %s retrieval function\n", "bKGD");
+      png_debug1(1, "in %s retrieval function", "bKGD");
       *background = &(info_ptr->background);
       return (PNG_INFO_bKGD);
    }
@@ -382,7 +407,7 @@ png_get_cHRM(png_structp png_ptr, png_infop info_ptr,
 {
    if (png_ptr != NULL && info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM))
    {
-      png_debug1(1, "in %s retrieval function\n", "cHRM");
+      png_debug1(1, "in %s retrieval function", "cHRM");
       if (white_x != NULL)
          *white_x = (double)info_ptr->x_white;
       if (white_y != NULL)
@@ -413,7 +438,7 @@ png_get_cHRM_fixed(png_structp png_ptr, png_infop info_ptr,
 {
    if (png_ptr != NULL && info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM))
    {
-      png_debug1(1, "in %s retrieval function\n", "cHRM");
+      png_debug1(1, "in %s retrieval function", "cHRM");
       if (white_x != NULL)
          *white_x = info_ptr->int_x_white;
       if (white_y != NULL)
@@ -445,7 +470,7 @@ png_get_gAMA(png_structp png_ptr, png_infop info_ptr, double *file_gamma)
    if (png_ptr != NULL && info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA)
       && file_gamma != NULL)
    {
-      png_debug1(1, "in %s retrieval function\n", "gAMA");
+      png_debug1(1, "in %s retrieval function", "gAMA");
       *file_gamma = (double)info_ptr->gamma;
       return (PNG_INFO_gAMA);
    }
@@ -460,7 +485,7 @@ png_get_gAMA_fixed(png_structp png_ptr, png_infop info_ptr,
    if (png_ptr != NULL && info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA)
       && int_file_gamma != NULL)
    {
-      png_debug1(1, "in %s retrieval function\n", "gAMA");
+      png_debug1(1, "in %s retrieval function", "gAMA");
       *int_file_gamma = info_ptr->int_gamma;
       return (PNG_INFO_gAMA);
    }
@@ -476,7 +501,7 @@ png_get_sRGB(png_structp png_ptr, png_infop info_ptr, int *file_srgb_intent)
    if (png_ptr != NULL && info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB)
       && file_srgb_intent != NULL)
    {
-      png_debug1(1, "in %s retrieval function\n", "sRGB");
+      png_debug1(1, "in %s retrieval function", "sRGB");
       *file_srgb_intent = (int)info_ptr->srgb_intent;
       return (PNG_INFO_sRGB);
    }
@@ -493,11 +518,12 @@ png_get_iCCP(png_structp png_ptr, png_infop info_ptr,
    if (png_ptr != NULL && info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP)
       && name != NULL && profile != NULL && proflen != NULL)
    {
-      png_debug1(1, "in %s retrieval function\n", "iCCP");
+      png_debug1(1, "in %s retrieval function", "iCCP");
       *name = info_ptr->iccp_name;
       *profile = info_ptr->iccp_profile;
-      /* compression_type is a dummy so the API won't have to change
-         if we introduce multiple compression types later. */
+      /* Compression_type is a dummy so the API won't have to change
+       * if we introduce multiple compression types later.
+       */
       *proflen = (int)info_ptr->iccp_proflen;
       *compression_type = (int)info_ptr->iccp_compression;
       return (PNG_INFO_iCCP);
@@ -527,7 +553,7 @@ png_get_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_16p *hist)
    if (png_ptr != NULL && info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST)
       && hist != NULL)
    {
-      png_debug1(1, "in %s retrieval function\n", "hIST");
+      png_debug1(1, "in %s retrieval function", "hIST");
       *hist = info_ptr->hist;
       return (PNG_INFO_hIST);
    }
@@ -545,27 +571,34 @@ png_get_IHDR(png_structp png_ptr, png_infop info_ptr,
    if (png_ptr != NULL && info_ptr != NULL && width != NULL && height != NULL &&
       bit_depth != NULL && color_type != NULL)
    {
-      png_debug1(1, "in %s retrieval function\n", "IHDR");
+      png_debug1(1, "in %s retrieval function", "IHDR");
       *width = info_ptr->width;
       *height = info_ptr->height;
       *bit_depth = info_ptr->bit_depth;
       if (info_ptr->bit_depth < 1 || info_ptr->bit_depth > 16)
-        png_error(png_ptr, "Invalid bit depth");
+         png_error(png_ptr, "Invalid bit depth");
+
       *color_type = info_ptr->color_type;
+
       if (info_ptr->color_type > 6)
-        png_error(png_ptr, "Invalid color type");
+         png_error(png_ptr, "Invalid color type");
+
       if (compression_type != NULL)
          *compression_type = info_ptr->compression_type;
+
       if (filter_type != NULL)
          *filter_type = info_ptr->filter_type;
+
       if (interlace_type != NULL)
          *interlace_type = info_ptr->interlace_type;
 
-      /* check for potential overflow of rowbytes */
+      /* Check for potential overflow of rowbytes */
       if (*width == 0 || *width > PNG_UINT_31_MAX)
         png_error(png_ptr, "Invalid image width");
+
       if (*height == 0 || *height > PNG_UINT_31_MAX)
         png_error(png_ptr, "Invalid image height");
+
       if (info_ptr->width > (PNG_UINT_32_MAX
                  >> 3)      /* 8-byte RGBA pixels */
                  - 64       /* bigrowbuf hack */
@@ -576,6 +609,7 @@ png_get_IHDR(png_structp png_ptr, png_infop info_ptr,
          png_warning(png_ptr,
             "Width too large for libpng to process image data.");
       }
+
       return (1);
    }
    return (0);
@@ -589,7 +623,7 @@ png_get_oFFs(png_structp png_ptr, png_infop info_ptr,
    if (png_ptr != NULL && info_ptr != NULL && (info_ptr->valid & PNG_INFO_oFFs)
       && offset_x != NULL && offset_y != NULL && unit_type != NULL)
    {
-      png_debug1(1, "in %s retrieval function\n", "oFFs");
+      png_debug1(1, "in %s retrieval function", "oFFs");
       *offset_x = info_ptr->x_offset;
       *offset_y = info_ptr->y_offset;
       *unit_type = (int)info_ptr->offset_unit_type;
@@ -606,10 +640,10 @@ png_get_pCAL(png_structp png_ptr, png_infop info_ptr,
    png_charp *units, png_charpp *params)
 {
    if (png_ptr != NULL && info_ptr != NULL && (info_ptr->valid & PNG_INFO_pCAL)
-      && purpose != NULL && X0 != NULL && X1 != NULL && type != NULL &&
-      nparams != NULL && units != NULL && params != NULL)
+       && purpose != NULL && X0 != NULL && X1 != NULL && type != NULL &&
+       nparams != NULL && units != NULL && params != NULL)
    {
-      png_debug1(1, "in %s retrieval function\n", "pCAL");
+      png_debug1(1, "in %s retrieval function", "pCAL");
       *purpose = info_ptr->pcal_purpose;
       *X0 = info_ptr->pcal_X0;
       *X1 = info_ptr->pcal_X1;
@@ -630,7 +664,7 @@ png_get_sCAL(png_structp png_ptr, png_infop info_ptr,
              int *unit, double *width, double *height)
 {
     if (png_ptr != NULL && info_ptr != NULL &&
-       (info_ptr->valid & PNG_INFO_sCAL))
+        (info_ptr->valid & PNG_INFO_sCAL))
     {
         *unit = info_ptr->scal_unit;
         *width = info_ptr->scal_pixel_width;
@@ -646,7 +680,7 @@ png_get_sCAL_s(png_structp png_ptr, png_infop info_ptr,
              int *unit, png_charpp width, png_charpp height)
 {
     if (png_ptr != NULL && info_ptr != NULL &&
-       (info_ptr->valid & PNG_INFO_sCAL))
+        (info_ptr->valid & PNG_INFO_sCAL))
     {
         *unit = info_ptr->scal_unit;
         *width = info_ptr->scal_s_width;
@@ -669,17 +703,20 @@ png_get_pHYs(png_structp png_ptr, png_infop info_ptr,
    if (png_ptr != NULL && info_ptr != NULL &&
       (info_ptr->valid & PNG_INFO_pHYs))
    {
-      png_debug1(1, "in %s retrieval function\n", "pHYs");
+      png_debug1(1, "in %s retrieval function", "pHYs");
+
       if (res_x != NULL)
       {
          *res_x = info_ptr->x_pixels_per_unit;
          retval |= PNG_INFO_pHYs;
       }
+
       if (res_y != NULL)
       {
          *res_y = info_ptr->y_pixels_per_unit;
          retval |= PNG_INFO_pHYs;
       }
+
       if (unit_type != NULL)
       {
          *unit_type = (int)info_ptr->phys_unit_type;
@@ -697,10 +734,10 @@ png_get_PLTE(png_structp png_ptr, png_infop info_ptr, png_colorp *palette,
    if (png_ptr != NULL && info_ptr != NULL && (info_ptr->valid & PNG_INFO_PLTE)
        && palette != NULL)
    {
-      png_debug1(1, "in %s retrieval function\n", "PLTE");
+      png_debug1(1, "in %s retrieval function", "PLTE");
       *palette = info_ptr->palette;
       *num_palette = info_ptr->num_palette;
-      png_debug1(3, "num_palette = %d\n", *num_palette);
+      png_debug1(3, "num_palette = %d", *num_palette);
       return (PNG_INFO_PLTE);
    }
    return (0);
@@ -713,7 +750,7 @@ png_get_sBIT(png_structp png_ptr, png_infop info_ptr, png_color_8p *sig_bit)
    if (png_ptr != NULL && info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT)
       && sig_bit != NULL)
    {
-      png_debug1(1, "in %s retrieval function\n", "sBIT");
+      png_debug1(1, "in %s retrieval function", "sBIT");
       *sig_bit = &(info_ptr->sig_bit);
       return (PNG_INFO_sBIT);
    }
@@ -728,13 +765,16 @@ png_get_text(png_structp png_ptr, png_infop info_ptr, png_textp *text_ptr,
 {
    if (png_ptr != NULL && info_ptr != NULL && info_ptr->num_text > 0)
    {
-      png_debug1(1, "in %s retrieval function\n",
+      png_debug1(1, "in %s retrieval function",
          (png_ptr->chunk_name[0] == '\0' ? "text"
              : (png_const_charp)png_ptr->chunk_name));
+
       if (text_ptr != NULL)
          *text_ptr = info_ptr->text;
+
       if (num_text != NULL)
          *num_text = info_ptr->num_text;
+
       return ((png_uint_32)info_ptr->num_text);
    }
    if (num_text != NULL)
@@ -750,7 +790,7 @@ png_get_tIME(png_structp png_ptr, png_infop info_ptr, png_timep *mod_time)
    if (png_ptr != NULL && info_ptr != NULL && (info_ptr->valid & PNG_INFO_tIME)
        && mod_time != NULL)
    {
-      png_debug1(1, "in %s retrieval function\n", "tIME");
+      png_debug1(1, "in %s retrieval function", "tIME");
       *mod_time = &(info_ptr->mod_time);
       return (PNG_INFO_tIME);
    }
@@ -766,7 +806,7 @@ png_get_tRNS(png_structp png_ptr, png_infop info_ptr,
    png_uint_32 retval = 0;
    if (png_ptr != NULL && info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS))
    {
-      png_debug1(1, "in %s retrieval function\n", "tRNS");
+      png_debug1(1, "in %s retrieval function", "tRNS");
       if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
       {
           if (trans != NULL)
@@ -774,6 +814,7 @@ png_get_tRNS(png_structp png_ptr, png_infop info_ptr,
              *trans = info_ptr->trans;
              retval |= PNG_INFO_tRNS;
           }
+
           if (trans_values != NULL)
              *trans_values = &(info_ptr->trans_values);
       }
@@ -784,10 +825,11 @@ png_get_tRNS(png_structp png_ptr, png_infop info_ptr,
              *trans_values = &(info_ptr->trans_values);
              retval |= PNG_INFO_tRNS;
           }
-          if(trans != NULL)
+
+          if (trans != NULL)
              *trans = NULL;
       }
-      if(num_trans != NULL)
+      if (num_trans != NULL)
       {
          *num_trans = info_ptr->num_trans;
          retval |= PNG_INFO_tRNS;
@@ -837,54 +879,54 @@ png_get_compression_buffer_size(png_structp png_ptr)
 
 #ifdef PNG_ASSEMBLER_CODE_SUPPORTED
 #ifndef PNG_1_0_X
-/* this function was added to libpng 1.2.0 and should exist by default */
+/* This function was added to libpng 1.2.0 and should exist by default */
 png_uint_32 PNGAPI
 png_get_asm_flags (png_structp png_ptr)
 {
-    /* obsolete, to be removed from libpng-1.4.0 */
+    /* Obsolete, to be removed from libpng-1.4.0 */
     return (png_ptr? 0L: 0L);
 }
 
-/* this function was added to libpng 1.2.0 and should exist by default */
+/* This function was added to libpng 1.2.0 and should exist by default */
 png_uint_32 PNGAPI
 png_get_asm_flagmask (int flag_select)
 {
-    /* obsolete, to be removed from libpng-1.4.0 */
+    /* Obsolete, to be removed from libpng-1.4.0 */
     flag_select=flag_select;
     return 0L;
 }
 
     /* GRR:  could add this:   && defined(PNG_MMX_CODE_SUPPORTED) */
-/* this function was added to libpng 1.2.0 */
+/* This function was added to libpng 1.2.0 */
 png_uint_32 PNGAPI
 png_get_mmx_flagmask (int flag_select, int *compilerID)
 {
-    /* obsolete, to be removed from libpng-1.4.0 */
+    /* Obsolete, to be removed from libpng-1.4.0 */
     flag_select=flag_select;
     *compilerID = -1;   /* unknown (i.e., no asm/MMX code compiled) */
     return 0L;
 }
 
-/* this function was added to libpng 1.2.0 */
+/* This function was added to libpng 1.2.0 */
 png_byte PNGAPI
 png_get_mmx_bitdepth_threshold (png_structp png_ptr)
 {
-    /* obsolete, to be removed from libpng-1.4.0 */
+    /* Obsolete, to be removed from libpng-1.4.0 */
     return (png_ptr? 0: 0);
 }
 
-/* this function was added to libpng 1.2.0 */
+/* This function was added to libpng 1.2.0 */
 png_uint_32 PNGAPI
 png_get_mmx_rowbytes_threshold (png_structp png_ptr)
 {
-    /* obsolete, to be removed from libpng-1.4.0 */
+    /* Obsolete, to be removed from libpng-1.4.0 */
     return (png_ptr? 0L: 0L);
 }
 #endif /* ?PNG_1_0_X */
 #endif /* ?PNG_ASSEMBLER_CODE_SUPPORTED */
 
 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
-/* these functions were added to libpng 1.2.6 */
+/* These functions were added to libpng 1.2.6 */
 png_uint_32 PNGAPI
 png_get_user_width_max (png_structp png_ptr)
 {
@@ -896,6 +938,6 @@ png_get_user_height_max (png_structp png_ptr)
     return (png_ptr? png_ptr->user_height_max : 0);
 }
 #endif /* ?PNG_SET_USER_LIMITS_SUPPORTED */
- 
+
 
 #endif /* PNG_READ_SUPPORTED || PNG_WRITE_SUPPORTED */
diff --git a/src/3rdparty/libpng/pngmem.c b/src/3rdparty/libpng/pngmem.c
index 13cc60c036..e190cc3bf7 100644
--- a/src/3rdparty/libpng/pngmem.c
+++ b/src/3rdparty/libpng/pngmem.c
@@ -1,12 +1,15 @@
 
 /* pngmem.c - stub functions for memory allocation
  *
- * Last changed in libpng 1.2.27 [April 29, 2008]
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.37 [June 4, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
+ *
  * This file provides a location for all memory allocation.  Users who
  * need special memory handling are expected to supply replacement
  * functions for png_malloc() and png_free(), and to use
@@ -16,12 +19,11 @@
 
 #define PNG_INTERNAL
 #include "png.h"
-
 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
 
 /* Borland DOS special memory handler */
 #if defined(__TURBOC__) && !defined(_Windows) && !defined(__FLAT__)
-/* if you change this, be sure to change the one in png.h also */
+/* If you change this, be sure to change the one in png.h also */
 
 /* Allocate memory for a png_struct.  The malloc and memset can be replaced
    by a single call to calloc() if this is thought to improve performance. */
@@ -41,14 +43,14 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr)
    png_voidp struct_ptr;
 
    if (type == PNG_STRUCT_INFO)
-     size = png_sizeof(png_info);
+      size = png_sizeof(png_info);
    else if (type == PNG_STRUCT_PNG)
-     size = png_sizeof(png_struct);
+      size = png_sizeof(png_struct);
    else
-     return (png_get_copyright(NULL));
+      return (png_get_copyright(NULL));
 
 #ifdef PNG_USER_MEM_SUPPORTED
-   if(malloc_fn != NULL)
+   if (malloc_fn != NULL)
    {
       png_struct dummy_struct;
       png_structp png_ptr = &dummy_struct;
@@ -57,7 +59,7 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr)
    }
    else
 #endif /* PNG_USER_MEM_SUPPORTED */
-      struct_ptr = (png_voidp)farmalloc(size);
+   struct_ptr = (png_voidp)farmalloc(size);
    if (struct_ptr != NULL)
       png_memset(struct_ptr, 0, size);
    return (struct_ptr);
@@ -80,7 +82,7 @@ png_destroy_struct_2(png_voidp struct_ptr, png_free_ptr free_fn,
    if (struct_ptr != NULL)
    {
 #ifdef PNG_USER_MEM_SUPPORTED
-      if(free_fn != NULL)
+      if (free_fn != NULL)
       {
          png_struct dummy_struct;
          png_structp png_ptr = &dummy_struct;
@@ -122,10 +124,10 @@ png_malloc(png_structp png_ptr, png_uint_32 size)
       return (NULL);
 
 #ifdef PNG_USER_MEM_SUPPORTED
-   if(png_ptr->malloc_fn != NULL)
-       ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size));
+   if (png_ptr->malloc_fn != NULL)
+      ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size));
    else
-       ret = (png_malloc_default(png_ptr, size));
+      ret = (png_malloc_default(png_ptr, size));
    if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
        png_error(png_ptr, "Out of memory!");
    return (ret);
@@ -150,12 +152,12 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size)
 #endif
 
    if (size != (size_t)size)
-     ret = NULL;
+      ret = NULL;
    else if (size == (png_uint_32)65536L)
    {
       if (png_ptr->offset_table == NULL)
       {
-         /* try to see if we need to do any of this fancy stuff */
+         /* Try to see if we need to do any of this fancy stuff */
          ret = farmalloc(size);
          if (ret == NULL || ((png_size_t)ret & 0xffff))
          {
@@ -171,7 +173,7 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size)
                ret = NULL;
             }
 
-            if(png_ptr->zlib_window_bits > 14)
+            if (png_ptr->zlib_window_bits > 14)
                num_blocks = (int)(1 << (png_ptr->zlib_window_bits - 14));
             else
                num_blocks = 1;
@@ -210,7 +212,7 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size)
 
             png_ptr->offset_table = table;
             png_ptr->offset_table_ptr = farmalloc(num_blocks *
-               png_sizeof (png_bytep));
+               png_sizeof(png_bytep));
 
             if (png_ptr->offset_table_ptr == NULL)
             {
@@ -270,9 +272,10 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size)
    return (ret);
 }
 
-/* free a pointer allocated by png_malloc().  In the default
-   configuration, png_ptr is not used, but is passed in case it
-   is needed.  If ptr is NULL, return without taking any action. */
+/* Free a pointer allocated by png_malloc().  In the default
+ * configuration, png_ptr is not used, but is passed in case it
+ * is needed.  If ptr is NULL, return without taking any action.
+ */
 void PNGAPI
 png_free(png_structp png_ptr, png_voidp ptr)
 {
@@ -285,7 +288,8 @@ png_free(png_structp png_ptr, png_voidp ptr)
       (*(png_ptr->free_fn))(png_ptr, ptr);
       return;
    }
-   else png_free_default(png_ptr, ptr);
+   else
+      png_free_default(png_ptr, ptr);
 }
 
 void PNGAPI
@@ -293,7 +297,8 @@ png_free_default(png_structp png_ptr, png_voidp ptr)
 {
 #endif /* PNG_USER_MEM_SUPPORTED */
 
-   if(png_ptr == NULL || ptr == NULL) return;
+   if (png_ptr == NULL || ptr == NULL)
+      return;
 
    if (png_ptr->offset_table != NULL)
    {
@@ -353,7 +358,7 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr)
       return (NULL);
 
 #ifdef PNG_USER_MEM_SUPPORTED
-   if(malloc_fn != NULL)
+   if (malloc_fn != NULL)
    {
       png_struct dummy_struct;
       png_structp png_ptr = &dummy_struct;
@@ -369,7 +374,7 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr)
    struct_ptr = (png_voidp)farmalloc(size);
 #else
 # if defined(_MSC_VER) && defined(MAXSEG_64K)
-   struct_ptr = (png_voidp)halloc(size,1);
+   struct_ptr = (png_voidp)halloc(size, 1);
 # else
    struct_ptr = (png_voidp)malloc(size);
 # endif
@@ -398,7 +403,7 @@ png_destroy_struct_2(png_voidp struct_ptr, png_free_ptr free_fn,
    if (struct_ptr != NULL)
    {
 #ifdef PNG_USER_MEM_SUPPORTED
-      if(free_fn != NULL)
+      if (free_fn != NULL)
       {
          png_struct dummy_struct;
          png_structp png_ptr = &dummy_struct;
@@ -420,10 +425,12 @@ png_destroy_struct_2(png_voidp struct_ptr, png_free_ptr free_fn,
 }
 
 /* Allocate memory.  For reasonable files, size should never exceed
-   64K.  However, zlib may allocate more then 64K if you don't tell
-   it not to.  See zconf.h and png.h for more information.  zlib does
-   need to allocate exactly 64K, so whatever you call here must
-   have the ability to do that. */
+ * 64K.  However, zlib may allocate more then 64K if you don't tell
+ * it not to.  See zconf.h and png.h for more information.  zlib does
+ * need to allocate exactly 64K, so whatever you call here must
+ * have the ability to do that.
+ */
+
 
 png_voidp PNGAPI
 png_malloc(png_structp png_ptr, png_uint_32 size)
@@ -434,10 +441,10 @@ png_malloc(png_structp png_ptr, png_uint_32 size)
    if (png_ptr == NULL || size == 0)
       return (NULL);
 
-   if(png_ptr->malloc_fn != NULL)
-       ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size));
+   if (png_ptr->malloc_fn != NULL)
+      ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size));
    else
-       ret = (png_malloc_default(png_ptr, size));
+      ret = (png_malloc_default(png_ptr, size));
    if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
        png_error(png_ptr, "Out of Memory!");
    return (ret);
@@ -464,23 +471,23 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size)
    }
 #endif
 
- /* Check for overflow */
+   /* Check for overflow */
 #if defined(__TURBOC__) && !defined(__FLAT__)
- if (size != (unsigned long)size)
-   ret = NULL;
- else
-   ret = farmalloc(size);
+   if (size != (unsigned long)size)
+      ret = NULL;
+   else
+      ret = farmalloc(size);
 #else
 # if defined(_MSC_VER) && defined(MAXSEG_64K)
- if (size != (unsigned long)size)
-   ret = NULL;
- else
-   ret = halloc(size, 1);
+   if (size != (unsigned long)size)
+      ret = NULL;
+   else
+      ret = halloc(size, 1);
 # else
- if (size != (size_t)size)
-   ret = NULL;
- else
-   ret = malloc((size_t)size);
+   if (size != (size_t)size)
+      ret = NULL;
+   else
+      ret = malloc((size_t)size);
 # endif
 #endif
 
@@ -493,7 +500,8 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size)
 }
 
 /* Free a pointer allocated by png_malloc().  If ptr is NULL, return
-   without taking any action. */
+ * without taking any action.
+ */
 void PNGAPI
 png_free(png_structp png_ptr, png_voidp ptr)
 {
@@ -506,7 +514,8 @@ png_free(png_structp png_ptr, png_voidp ptr)
       (*(png_ptr->free_fn))(png_ptr, ptr);
       return;
    }
-   else png_free_default(png_ptr, ptr);
+   else
+      png_free_default(png_ptr, ptr);
 }
 void PNGAPI
 png_free_default(png_structp png_ptr, png_voidp ptr)
@@ -542,9 +551,10 @@ png_malloc_warn(png_structp png_ptr, png_uint_32 size)
 {
    png_voidp ptr;
    png_uint_32 save_flags;
-   if(png_ptr == NULL) return (NULL);
+   if (png_ptr == NULL)
+      return (NULL);
 
-   save_flags=png_ptr->flags;
+   save_flags = png_ptr->flags;
    png_ptr->flags|=PNG_FLAG_MALLOC_NULL_MEM_OK;
    ptr = (png_voidp)png_malloc((png_structp)png_ptr, size);
    png_ptr->flags=save_flags;
@@ -560,7 +570,7 @@ png_memcpy_check (png_structp png_ptr, png_voidp s1, png_voidp s2,
 
    size = (png_size_t)length;
    if ((png_uint_32)size != length)
-      png_error(png_ptr,"Overflow in png_memcpy_check.");
+      png_error(png_ptr, "Overflow in png_memcpy_check.");
 
    return(png_memcpy (s1, s2, size));
 }
@@ -573,7 +583,7 @@ png_memset_check (png_structp png_ptr, png_voidp s1, int value,
 
    size = (png_size_t)length;
    if ((png_uint_32)size != length)
-      png_error(png_ptr,"Overflow in png_memset_check.");
+      png_error(png_ptr, "Overflow in png_memset_check.");
 
    return (png_memset (s1, value, size));
 
@@ -587,10 +597,11 @@ void PNGAPI
 png_set_mem_fn(png_structp png_ptr, png_voidp mem_ptr, png_malloc_ptr
   malloc_fn, png_free_ptr free_fn)
 {
-   if(png_ptr != NULL) {
-   png_ptr->mem_ptr = mem_ptr;
-   png_ptr->malloc_fn = malloc_fn;
-   png_ptr->free_fn = free_fn;
+   if (png_ptr != NULL)
+   {
+      png_ptr->mem_ptr = mem_ptr;
+      png_ptr->malloc_fn = malloc_fn;
+      png_ptr->free_fn = free_fn;
    }
 }
 
@@ -601,7 +612,8 @@ png_set_mem_fn(png_structp png_ptr, png_voidp mem_ptr, png_malloc_ptr
 png_voidp PNGAPI
 png_get_mem_ptr(png_structp png_ptr)
 {
-   if(png_ptr == NULL) return (NULL);
+   if (png_ptr == NULL)
+      return (NULL);
    return ((png_voidp)png_ptr->mem_ptr);
 }
 #endif /* PNG_USER_MEM_SUPPORTED */
diff --git a/src/3rdparty/libpng/pngpread.c b/src/3rdparty/libpng/pngpread.c
index aa7151c4b3..7adb7b854f 100644
--- a/src/3rdparty/libpng/pngpread.c
+++ b/src/3rdparty/libpng/pngpread.c
@@ -1,19 +1,21 @@
 
 /* pngpread.c - read a png file in push mode
  *
- * Last changed in libpng 1.2.27 [April 29, 2008]
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.38 [July 16, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
+ *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
  */
 
 #define PNG_INTERNAL
 #include "png.h"
-
 #ifdef PNG_PROGRESSIVE_READ_SUPPORTED
 
-/* push model modes */
+/* Push model modes */
 #define PNG_READ_SIG_MODE   0
 #define PNG_READ_CHUNK_MODE 1
 #define PNG_READ_IDAT_MODE  2
@@ -28,7 +30,9 @@ void PNGAPI
 png_process_data(png_structp png_ptr, png_infop info_ptr,
    png_bytep buffer, png_size_t buffer_size)
 {
-   if(png_ptr == NULL || info_ptr == NULL) return;
+   if (png_ptr == NULL || info_ptr == NULL)
+      return;
+
    png_push_restore_buffer(png_ptr, buffer, buffer_size);
 
    while (png_ptr->buffer_size)
@@ -43,7 +47,9 @@ png_process_data(png_structp png_ptr, png_infop info_ptr,
 void /* PRIVATE */
 png_process_some_data(png_structp png_ptr, png_infop info_ptr)
 {
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
+
    switch (png_ptr->process_mode)
    {
       case PNG_READ_SIG_MODE:
@@ -51,22 +57,26 @@ png_process_some_data(png_structp png_ptr, png_infop info_ptr)
          png_push_read_sig(png_ptr, info_ptr);
          break;
       }
+
       case PNG_READ_CHUNK_MODE:
       {
          png_push_read_chunk(png_ptr, info_ptr);
          break;
       }
+
       case PNG_READ_IDAT_MODE:
       {
          png_push_read_IDAT(png_ptr);
          break;
       }
+
 #if defined(PNG_READ_tEXt_SUPPORTED)
       case PNG_READ_tEXt_MODE:
       {
          png_push_read_tEXt(png_ptr, info_ptr);
          break;
       }
+
 #endif
 #if defined(PNG_READ_zTXt_SUPPORTED)
       case PNG_READ_zTXt_MODE:
@@ -74,6 +84,7 @@ png_process_some_data(png_structp png_ptr, png_infop info_ptr)
          png_push_read_zTXt(png_ptr, info_ptr);
          break;
       }
+
 #endif
 #if defined(PNG_READ_iTXt_SUPPORTED)
       case PNG_READ_iTXt_MODE:
@@ -81,12 +92,14 @@ png_process_some_data(png_structp png_ptr, png_infop info_ptr)
          png_push_read_iTXt(png_ptr, info_ptr);
          break;
       }
+
 #endif
       case PNG_SKIP_MODE:
       {
          png_push_crc_finish(png_ptr);
          break;
       }
+
       default:
       {
          png_ptr->buffer_size = 0;
@@ -114,7 +127,7 @@ png_push_read_sig(png_structp png_ptr, png_infop info_ptr)
 
    png_push_fill_buffer(png_ptr, &(info_ptr->signature[num_checked]),
       num_to_check);
-   png_ptr->sig_bytes = (png_byte)(png_ptr->sig_bytes+num_to_check);
+   png_ptr->sig_bytes = (png_byte)(png_ptr->sig_bytes + num_to_check);
 
    if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check))
    {
@@ -210,27 +223,31 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
       }
 
       png_push_fill_buffer(png_ptr, chunk_length, 4);
-      png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length);
+      png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length);
       png_reset_crc(png_ptr);
       png_crc_read(png_ptr, png_ptr->chunk_name, 4);
+      png_check_chunk_name(png_ptr, png_ptr->chunk_name);
       png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
    }
 
    if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
-     if(png_ptr->mode & PNG_AFTER_IDAT)
+     if (png_ptr->mode & PNG_AFTER_IDAT)
         png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT;
 
    if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4))
    {
+      if (png_ptr->push_length != 13)
+         png_error(png_ptr, "Invalid IHDR length");
+
       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
       {
-         if (png_ptr->push_length != 13)
-            png_error(png_ptr, "Invalid IHDR length");
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_IHDR(png_ptr, info_ptr, png_ptr->push_length);
    }
+
    else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4))
    {
       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
@@ -238,11 +255,13 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length);
 
       png_ptr->process_mode = PNG_READ_DONE_MODE;
       png_push_have_end(png_ptr, info_ptr);
    }
+
 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
    else if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name))
    {
@@ -251,20 +270,26 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
          png_ptr->mode |= PNG_HAVE_IDAT;
+
       png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length);
+
       if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4))
          png_ptr->mode |= PNG_HAVE_PLTE;
+
       else if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
       {
          if (!(png_ptr->mode & PNG_HAVE_IHDR))
             png_error(png_ptr, "Missing IHDR before IDAT");
+
          else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
                   !(png_ptr->mode & PNG_HAVE_PLTE))
             png_error(png_ptr, "Missing PLTE before IDAT");
       }
    }
+
 #endif
    else if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4))
    {
@@ -275,23 +300,26 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
       }
       png_handle_PLTE(png_ptr, info_ptr, png_ptr->push_length);
    }
+
    else if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
    {
       /* If we reach an IDAT chunk, this means we have read all of the
        * header chunks, and we can start reading the image (or if this
        * is called after the image has been read - we have an error).
        */
-     if (!(png_ptr->mode & PNG_HAVE_IHDR))
-       png_error(png_ptr, "Missing IHDR before IDAT");
-     else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
-         !(png_ptr->mode & PNG_HAVE_PLTE))
-       png_error(png_ptr, "Missing PLTE before IDAT");
+
+      if (!(png_ptr->mode & PNG_HAVE_IHDR))
+         png_error(png_ptr, "Missing IHDR before IDAT");
+
+      else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
+          !(png_ptr->mode & PNG_HAVE_PLTE))
+         png_error(png_ptr, "Missing PLTE before IDAT");
 
       if (png_ptr->mode & PNG_HAVE_IDAT)
       {
          if (!(png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT))
-           if (png_ptr->push_length == 0)
-              return;
+            if (png_ptr->push_length == 0)
+               return;
 
          if (png_ptr->mode & PNG_AFTER_IDAT)
             png_error(png_ptr, "Too many IDAT's found");
@@ -305,6 +333,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
       png_ptr->zstream.next_out = png_ptr->row_buf;
       return;
    }
+
 #if defined(PNG_READ_gAMA_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_gAMA, 4))
    {
@@ -313,8 +342,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_gAMA(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
 #if defined(PNG_READ_sBIT_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_sBIT, 4))
@@ -324,8 +355,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_sBIT(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
 #if defined(PNG_READ_cHRM_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_cHRM, 4))
@@ -335,8 +368,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_cHRM(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
 #if defined(PNG_READ_sRGB_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_sRGB, 4))
@@ -346,8 +381,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_sRGB(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
 #if defined(PNG_READ_iCCP_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_iCCP, 4))
@@ -357,8 +394,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_iCCP(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
 #if defined(PNG_READ_sPLT_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_sPLT, 4))
@@ -368,8 +407,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_sPLT(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
 #if defined(PNG_READ_tRNS_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_tRNS, 4))
@@ -379,8 +420,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_tRNS(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
 #if defined(PNG_READ_bKGD_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_bKGD, 4))
@@ -390,8 +433,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_bKGD(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
 #if defined(PNG_READ_hIST_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_hIST, 4))
@@ -401,8 +446,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_hIST(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
 #if defined(PNG_READ_pHYs_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_pHYs, 4))
@@ -412,8 +459,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_pHYs(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
 #if defined(PNG_READ_oFFs_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_oFFs, 4))
@@ -423,9 +472,11 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_oFFs(png_ptr, info_ptr, png_ptr->push_length);
    }
 #endif
+
 #if defined(PNG_READ_pCAL_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_pCAL, 4))
    {
@@ -434,8 +485,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_pCAL(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
 #if defined(PNG_READ_sCAL_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_sCAL, 4))
@@ -445,8 +498,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_sCAL(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
 #if defined(PNG_READ_tIME_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_tIME, 4))
@@ -456,8 +511,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_handle_tIME(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
 #if defined(PNG_READ_tEXt_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_tEXt, 4))
@@ -467,8 +524,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_push_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
 #if defined(PNG_READ_zTXt_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_zTXt, 4))
@@ -478,8 +537,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_push_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
 #if defined(PNG_READ_iTXt_SUPPORTED)
    else if (!png_memcmp(png_ptr->chunk_name, png_iTXt, 4))
@@ -489,8 +550,10 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
+
       png_push_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length);
    }
+
 #endif
    else
    {
@@ -565,7 +628,9 @@ png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length)
 {
    png_bytep ptr;
 
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
+
    ptr = buffer;
    if (png_ptr->save_buffer_size)
    {
@@ -589,6 +654,7 @@ png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length)
 
       if (length < png_ptr->current_buffer_size)
          save_size = length;
+
       else
          save_size = png_ptr->current_buffer_size;
 
@@ -606,7 +672,7 @@ png_push_save_buffer(png_structp png_ptr)
    {
       if (png_ptr->save_buffer_ptr != png_ptr->save_buffer)
       {
-         png_size_t i,istop;
+         png_size_t i, istop;
          png_bytep sp;
          png_bytep dp;
 
@@ -629,6 +695,7 @@ png_push_save_buffer(png_structp png_ptr)
       {
         png_error(png_ptr, "Potential overflow of save_buffer");
       }
+
       new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256;
       old_buffer = png_ptr->save_buffer;
       png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr,
@@ -675,7 +742,7 @@ png_push_read_IDAT(png_structp png_ptr)
       }
 
       png_push_fill_buffer(png_ptr, chunk_length, 4);
-      png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length);
+      png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length);
       png_reset_crc(png_ptr);
       png_crc_read(png_ptr, png_ptr->chunk_name, 4);
       png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
@@ -697,16 +764,19 @@ png_push_read_IDAT(png_structp png_ptr)
       if (png_ptr->idat_size < (png_uint_32)png_ptr->save_buffer_size)
       {
          save_size = (png_size_t)png_ptr->idat_size;
-         /* check for overflow */
-         if((png_uint_32)save_size != png_ptr->idat_size)
+
+         /* Check for overflow */
+         if ((png_uint_32)save_size != png_ptr->idat_size)
             png_error(png_ptr, "save_size overflowed in pngpread");
       }
       else
          save_size = png_ptr->save_buffer_size;
 
       png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size);
+
       if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
          png_process_IDAT_data(png_ptr, png_ptr->save_buffer_ptr, save_size);
+
       png_ptr->idat_size -= save_size;
       png_ptr->buffer_size -= save_size;
       png_ptr->save_buffer_size -= save_size;
@@ -719,8 +789,9 @@ png_push_read_IDAT(png_structp png_ptr)
       if (png_ptr->idat_size < (png_uint_32)png_ptr->current_buffer_size)
       {
          save_size = (png_size_t)png_ptr->idat_size;
-         /* check for overflow */
-         if((png_uint_32)save_size != png_ptr->idat_size)
+
+         /* Check for overflow */
+         if ((png_uint_32)save_size != png_ptr->idat_size)
             png_error(png_ptr, "save_size overflowed in pngpread");
       }
       else
@@ -760,7 +831,7 @@ png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,
 
    png_ptr->zstream.next_in = buffer;
    png_ptr->zstream.avail_in = (uInt)buffer_length;
-   for(;;)
+   for (;;)
    {
       ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
       if (ret != Z_OK)
@@ -769,6 +840,7 @@ png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,
          {
             if (png_ptr->zstream.avail_in)
                png_error(png_ptr, "Extra compressed data");
+
             if (!(png_ptr->zstream.avail_out))
             {
                png_push_process_row(png_ptr);
@@ -780,6 +852,7 @@ png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,
          }
          else if (ret == Z_BUF_ERROR)
             break;
+
          else
             png_error(png_ptr, "Decompression Error");
       }
@@ -801,6 +874,7 @@ png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,
          png_ptr->zstream.avail_out = (uInt)png_ptr->irowbytes;
          png_ptr->zstream.next_out = png_ptr->row_buf;
       }
+
       else
          break;
    }
@@ -829,7 +903,7 @@ png_push_process_row(png_structp png_ptr)
       png_do_read_transformations(png_ptr);
 
 #if defined(PNG_READ_INTERLACING_SUPPORTED)
-   /* blow up interlaced rows to full size */
+   /* Blow up interlaced rows to full size */
    if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE))
    {
       if (png_ptr->pass < 6)
@@ -847,9 +921,10 @@ png_push_process_row(png_structp png_ptr)
             for (i = 0; i < 8 && png_ptr->pass == 0; i++)
             {
                png_push_have_row(png_ptr, png_ptr->row_buf + 1);
-               png_read_push_finish_row(png_ptr); /* updates png_ptr->pass */
+               png_read_push_finish_row(png_ptr); /* Updates png_ptr->pass */
             }
-            if (png_ptr->pass == 2) /* pass 1 might be empty */
+
+            if (png_ptr->pass == 2) /* Pass 1 might be empty */
             {
                for (i = 0; i < 4 && png_ptr->pass == 2; i++)
                {
@@ -857,6 +932,7 @@ png_push_process_row(png_structp png_ptr)
                   png_read_push_finish_row(png_ptr);
                }
             }
+
             if (png_ptr->pass == 4 && png_ptr->height <= 4)
             {
                for (i = 0; i < 2 && png_ptr->pass == 4; i++)
@@ -865,13 +941,16 @@ png_push_process_row(png_structp png_ptr)
                   png_read_push_finish_row(png_ptr);
                }
             }
+
             if (png_ptr->pass == 6 && png_ptr->height <= 4)
             {
                 png_push_have_row(png_ptr, png_bytep_NULL);
                 png_read_push_finish_row(png_ptr);
             }
+
             break;
          }
+
          case 1:
          {
             int i;
@@ -880,7 +959,8 @@ png_push_process_row(png_structp png_ptr)
                png_push_have_row(png_ptr, png_ptr->row_buf + 1);
                png_read_push_finish_row(png_ptr);
             }
-            if (png_ptr->pass == 2) /* skip top 4 generated rows */
+
+            if (png_ptr->pass == 2) /* Skip top 4 generated rows */
             {
                for (i = 0; i < 4 && png_ptr->pass == 2; i++)
                {
@@ -888,22 +968,27 @@ png_push_process_row(png_structp png_ptr)
                   png_read_push_finish_row(png_ptr);
                }
             }
+
             break;
          }
+
          case 2:
          {
             int i;
+
             for (i = 0; i < 4 && png_ptr->pass == 2; i++)
             {
                png_push_have_row(png_ptr, png_ptr->row_buf + 1);
                png_read_push_finish_row(png_ptr);
             }
+
             for (i = 0; i < 4 && png_ptr->pass == 2; i++)
             {
                png_push_have_row(png_ptr, png_bytep_NULL);
                png_read_push_finish_row(png_ptr);
             }
-            if (png_ptr->pass == 4) /* pass 3 might be empty */
+
+            if (png_ptr->pass == 4) /* Pass 3 might be empty */
             {
                for (i = 0; i < 2 && png_ptr->pass == 4; i++)
                {
@@ -911,17 +996,21 @@ png_push_process_row(png_structp png_ptr)
                   png_read_push_finish_row(png_ptr);
                }
             }
+
             break;
          }
+
          case 3:
          {
             int i;
+
             for (i = 0; i < 4 && png_ptr->pass == 3; i++)
             {
                png_push_have_row(png_ptr, png_ptr->row_buf + 1);
                png_read_push_finish_row(png_ptr);
             }
-            if (png_ptr->pass == 4) /* skip top two generated rows */
+
+            if (png_ptr->pass == 4) /* Skip top two generated rows */
             {
                for (i = 0; i < 2 && png_ptr->pass == 4; i++)
                {
@@ -929,49 +1018,61 @@ png_push_process_row(png_structp png_ptr)
                   png_read_push_finish_row(png_ptr);
                }
             }
+
             break;
          }
+
          case 4:
          {
             int i;
+
             for (i = 0; i < 2 && png_ptr->pass == 4; i++)
             {
                png_push_have_row(png_ptr, png_ptr->row_buf + 1);
                png_read_push_finish_row(png_ptr);
             }
+
             for (i = 0; i < 2 && png_ptr->pass == 4; i++)
             {
                png_push_have_row(png_ptr, png_bytep_NULL);
                png_read_push_finish_row(png_ptr);
             }
-            if (png_ptr->pass == 6) /* pass 5 might be empty */
+
+            if (png_ptr->pass == 6) /* Pass 5 might be empty */
             {
                png_push_have_row(png_ptr, png_bytep_NULL);
                png_read_push_finish_row(png_ptr);
             }
+
             break;
          }
+
          case 5:
          {
             int i;
+
             for (i = 0; i < 2 && png_ptr->pass == 5; i++)
             {
                png_push_have_row(png_ptr, png_ptr->row_buf + 1);
                png_read_push_finish_row(png_ptr);
             }
-            if (png_ptr->pass == 6) /* skip top generated row */
+
+            if (png_ptr->pass == 6) /* Skip top generated row */
             {
                png_push_have_row(png_ptr, png_bytep_NULL);
                png_read_push_finish_row(png_ptr);
             }
+
             break;
          }
          case 6:
          {
             png_push_have_row(png_ptr, png_ptr->row_buf + 1);
             png_read_push_finish_row(png_ptr);
+
             if (png_ptr->pass != 6)
                break;
+
             png_push_have_row(png_ptr, png_bytep_NULL);
             png_read_push_finish_row(png_ptr);
          }
@@ -989,18 +1090,18 @@ void /* PRIVATE */
 png_read_push_finish_row(png_structp png_ptr)
 {
 #ifdef PNG_USE_LOCAL_ARRAYS
-   /* arrays to facilitate easy interlacing - use pass (0 - 6) as index */
+   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
 
-   /* start of interlace block */
+   /* Start of interlace block */
    PNG_CONST int FARDATA png_pass_start[] = {0, 4, 0, 2, 0, 1, 0};
 
-   /* offset to next interlace block */
+   /* Offset to next interlace block */
    PNG_CONST int FARDATA png_pass_inc[] = {8, 8, 4, 4, 2, 2, 1};
 
-   /* start of interlace block in the y direction */
+   /* Start of interlace block in the y direction */
    PNG_CONST int FARDATA png_pass_ystart[] = {0, 0, 4, 0, 2, 0, 1};
 
-   /* offset to next interlace block in the y direction */
+   /* Offset to next interlace block in the y direction */
    PNG_CONST int FARDATA png_pass_yinc[] = {8, 8, 8, 4, 4, 2, 2};
 
    /* Height of interlace block.  This is not currently used - if you need
@@ -1013,6 +1114,7 @@ png_read_push_finish_row(png_structp png_ptr)
    if (png_ptr->row_number < png_ptr->num_rows)
       return;
 
+#if defined(PNG_READ_INTERLACING_SUPPORTED)
    if (png_ptr->interlaced)
    {
       png_ptr->row_number = 0;
@@ -1020,40 +1122,37 @@ png_read_push_finish_row(png_structp png_ptr)
          png_ptr->rowbytes + 1);
       do
       {
-         int pass;
-         pass = png_ptr->pass;
-         pass++;
-         if ((pass == 1 && png_ptr->width < 5) ||
-             (pass == 3 && png_ptr->width < 3) ||
-             (pass == 5 && png_ptr->width < 2))
-           pass++;
-
-         if (pass > 7)
-            pass--;
-         png_ptr->pass = (png_byte) pass;
-         if (pass < 7)
-           {
-             png_ptr->iwidth = (png_ptr->width +
-                png_pass_inc[pass] - 1 -
-                png_pass_start[pass]) /
-                png_pass_inc[pass];
-
-             png_ptr->irowbytes = PNG_ROWBYTES(png_ptr->pixel_depth,
-                png_ptr->iwidth) + 1;
-
-             if (png_ptr->transformations & PNG_INTERLACE)
-                break;
-
-             png_ptr->num_rows = (png_ptr->height +
-                png_pass_yinc[pass] - 1 -
-                png_pass_ystart[pass]) /
-                png_pass_yinc[pass];
-           }
-         else
-           break;
+         png_ptr->pass++;
+         if ((png_ptr->pass == 1 && png_ptr->width < 5) ||
+             (png_ptr->pass == 3 && png_ptr->width < 3) ||
+             (png_ptr->pass == 5 && png_ptr->width < 2))
+           png_ptr->pass++;
+
+         if (png_ptr->pass > 7)
+            png_ptr->pass--;
+
+         if (png_ptr->pass >= 7)
+            break;
+
+         png_ptr->iwidth = (png_ptr->width +
+            png_pass_inc[png_ptr->pass] - 1 -
+            png_pass_start[png_ptr->pass]) /
+            png_pass_inc[png_ptr->pass];
+
+         png_ptr->irowbytes = PNG_ROWBYTES(png_ptr->pixel_depth,
+            png_ptr->iwidth) + 1;
+
+         if (png_ptr->transformations & PNG_INTERLACE)
+            break;
+
+         png_ptr->num_rows = (png_ptr->height +
+            png_pass_yinc[png_ptr->pass] - 1 -
+            png_pass_ystart[png_ptr->pass]) /
+            png_pass_yinc[png_ptr->pass];
 
       } while (png_ptr->iwidth == 0 || png_ptr->num_rows == 0);
    }
+#endif /* PNG_READ_INTERLACING_SUPPORTED */
 }
 
 #if defined(PNG_READ_tEXt_SUPPORTED)
@@ -1064,7 +1163,7 @@ png_push_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
    if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
       {
          png_error(png_ptr, "Out of place tEXt");
-         info_ptr = info_ptr; /* to quiet some compiler warnings */
+         info_ptr = info_ptr; /* To quiet some compiler warnings */
       }
 
 #ifdef PNG_MAX_MALLOC_64K
@@ -1079,7 +1178,7 @@ png_push_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
 #endif
 
    png_ptr->current_text = (png_charp)png_malloc(png_ptr,
-         (png_uint_32)(length+1));
+      (png_uint_32)(length + 1));
    png_ptr->current_text[length] = '\0';
    png_ptr->current_text_ptr = png_ptr->current_text;
    png_ptr->current_text_size = (png_size_t)length;
@@ -1096,8 +1195,10 @@ png_push_read_tEXt(png_structp png_ptr, png_infop info_ptr)
 
       if (png_ptr->buffer_size < png_ptr->current_text_left)
          text_size = png_ptr->buffer_size;
+
       else
          text_size = png_ptr->current_text_left;
+
       png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
       png_ptr->current_text_left -= text_size;
       png_ptr->current_text_ptr += text_size;
@@ -1125,7 +1226,7 @@ png_push_read_tEXt(png_structp png_ptr, png_infop info_ptr)
       key = png_ptr->current_text;
 
       for (text = key; *text; text++)
-         /* empty loop */ ;
+         /* Empty loop */ ;
 
       if (text < key + png_ptr->current_text_size)
          text++;
@@ -1160,7 +1261,7 @@ png_push_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
    if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
       {
          png_error(png_ptr, "Out of place zTXt");
-         info_ptr = info_ptr; /* to quiet some compiler warnings */
+         info_ptr = info_ptr; /* To quiet some compiler warnings */
       }
 
 #ifdef PNG_MAX_MALLOC_64K
@@ -1177,7 +1278,7 @@ png_push_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
 #endif
 
    png_ptr->current_text = (png_charp)png_malloc(png_ptr,
-       (png_uint_32)(length+1));
+      (png_uint_32)(length + 1));
    png_ptr->current_text[length] = '\0';
    png_ptr->current_text_ptr = png_ptr->current_text;
    png_ptr->current_text_size = (png_size_t)length;
@@ -1194,8 +1295,10 @@ png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr)
 
       if (png_ptr->buffer_size < (png_uint_32)png_ptr->current_text_left)
          text_size = png_ptr->buffer_size;
+
       else
          text_size = png_ptr->current_text_left;
+
       png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
       png_ptr->current_text_left -= text_size;
       png_ptr->current_text_ptr += text_size;
@@ -1219,7 +1322,7 @@ png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr)
       key = png_ptr->current_text;
 
       for (text = key; *text; text++)
-         /* empty loop */ ;
+         /* Empty loop */ ;
 
       /* zTXt can't have zero text */
       if (text >= key + png_ptr->current_text_size)
@@ -1231,7 +1334,7 @@ png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr)
 
       text++;
 
-      if (*text != PNG_TEXT_COMPRESSION_zTXt) /* check compression byte */
+      if (*text != PNG_TEXT_COMPRESSION_zTXt) /* Check compression byte */
       {
          png_ptr->current_text = NULL;
          png_free(png_ptr, key);
@@ -1268,13 +1371,17 @@ png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr)
             if (text == NULL)
             {
                text = (png_charp)png_malloc(png_ptr,
-                  (png_uint_32)(png_ptr->zbuf_size - png_ptr->zstream.avail_out
-                     + key_size + 1));
+                     (png_uint_32)(png_ptr->zbuf_size
+                     - png_ptr->zstream.avail_out + key_size + 1));
+
                png_memcpy(text + key_size, png_ptr->zbuf,
                   png_ptr->zbuf_size - png_ptr->zstream.avail_out);
+
                png_memcpy(text, key, key_size);
+
                text_size = key_size + png_ptr->zbuf_size -
                   png_ptr->zstream.avail_out;
+
                *(text + text_size) = '\0';
             }
             else
@@ -1283,12 +1390,15 @@ png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr)
 
                tmp = text;
                text = (png_charp)png_malloc(png_ptr, text_size +
-                  (png_uint_32)(png_ptr->zbuf_size - png_ptr->zstream.avail_out
-                   + 1));
+                  (png_uint_32)(png_ptr->zbuf_size 
+                  - png_ptr->zstream.avail_out + 1));
+
                png_memcpy(text, tmp, text_size);
                png_free(png_ptr, tmp);
+
                png_memcpy(text + text_size, png_ptr->zbuf,
                   png_ptr->zbuf_size - png_ptr->zstream.avail_out);
+
                text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;
                *(text + text_size) = '\0';
             }
@@ -1352,7 +1462,7 @@ png_push_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
    if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
       {
          png_error(png_ptr, "Out of place iTXt");
-         info_ptr = info_ptr; /* to quiet some compiler warnings */
+         info_ptr = info_ptr; /* To quiet some compiler warnings */
       }
 
 #ifdef PNG_MAX_MALLOC_64K
@@ -1367,7 +1477,7 @@ png_push_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
 #endif
 
    png_ptr->current_text = (png_charp)png_malloc(png_ptr,
-         (png_uint_32)(length+1));
+      (png_uint_32)(length + 1));
    png_ptr->current_text[length] = '\0';
    png_ptr->current_text_ptr = png_ptr->current_text;
    png_ptr->current_text_size = (png_size_t)length;
@@ -1385,8 +1495,10 @@ png_push_read_iTXt(png_structp png_ptr, png_infop info_ptr)
 
       if (png_ptr->buffer_size < png_ptr->current_text_left)
          text_size = png_ptr->buffer_size;
+
       else
          text_size = png_ptr->current_text_left;
+
       png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
       png_ptr->current_text_left -= text_size;
       png_ptr->current_text_ptr += text_size;
@@ -1417,23 +1529,25 @@ png_push_read_iTXt(png_structp png_ptr, png_infop info_ptr)
       key = png_ptr->current_text;
 
       for (lang = key; *lang; lang++)
-         /* empty loop */ ;
+         /* Empty loop */ ;
 
       if (lang < key + png_ptr->current_text_size - 3)
          lang++;
 
       comp_flag = *lang++;
-      lang++;     /* skip comp_type, always zero */
+      lang++;     /* Skip comp_type, always zero */
 
       for (lang_key = lang; *lang_key; lang_key++)
-         /* empty loop */ ;
-      lang_key++;        /* skip NUL separator */
+         /* Empty loop */ ;
+
+      lang_key++;        /* Skip NUL separator */
 
       text=lang_key;
+
       if (lang_key < key + png_ptr->current_text_size - 1)
       {
         for (; *text; text++)
-           /* empty loop */ ;
+           /* Empty loop */ ;
       }
 
       if (text < key + png_ptr->current_text_size)
@@ -1441,6 +1555,7 @@ png_push_read_iTXt(png_structp png_ptr, png_infop info_ptr)
 
       text_ptr = (png_textp)png_malloc(png_ptr,
          (png_uint_32)png_sizeof(png_text));
+
       text_ptr->compression = comp_flag + 2;
       text_ptr->key = key;
       text_ptr->lang = lang;
@@ -1468,22 +1583,21 @@ void /* PRIVATE */
 png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32
    length)
 {
-   png_uint_32 skip=0;
-   png_check_chunk_name(png_ptr, png_ptr->chunk_name);
+   png_uint_32 skip = 0;
 
    if (!(png_ptr->chunk_name[0] & 0x20))
    {
 #if defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
-     if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
-          PNG_HANDLE_CHUNK_ALWAYS
+      if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
+         PNG_HANDLE_CHUNK_ALWAYS
 #if defined(PNG_READ_USER_CHUNKS_SUPPORTED)
-          && png_ptr->read_user_chunk_fn == NULL
+         && png_ptr->read_user_chunk_fn == NULL
 #endif
-        )
+         )
 #endif
-        png_chunk_error(png_ptr, "unknown critical chunk");
+         png_chunk_error(png_ptr, "unknown critical chunk");
 
-     info_ptr = info_ptr; /* to quiet some compiler warnings */
+      info_ptr = info_ptr; /* To quiet some compiler warnings */
    }
 
 #if defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
@@ -1500,41 +1614,50 @@ png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32
       png_memcpy((png_charp)png_ptr->unknown_chunk.name,
                  (png_charp)png_ptr->chunk_name, 
                  png_sizeof(png_ptr->unknown_chunk.name));
-      png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name)-1]='\0';
+      png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name) - 1]
+        = '\0';
 
       png_ptr->unknown_chunk.size = (png_size_t)length;
+
       if (length == 0)
          png_ptr->unknown_chunk.data = NULL;
+
       else
       {
-         png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, length);
+         png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr,
+       (png_uint_32)length);
          png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length);
       }
+
 #if defined(PNG_READ_USER_CHUNKS_SUPPORTED)
-      if(png_ptr->read_user_chunk_fn != NULL)
+      if (png_ptr->read_user_chunk_fn != NULL)
       {
-         /* callback to user unknown chunk handler */
+         /* Callback to user unknown chunk handler */
          int ret;
          ret = (*(png_ptr->read_user_chunk_fn))
            (png_ptr, &png_ptr->unknown_chunk);
+
          if (ret < 0)
             png_chunk_error(png_ptr, "error in user chunk");
+
          if (ret == 0)
          {
             if (!(png_ptr->chunk_name[0] & 0x20))
-               if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
+               if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
                     PNG_HANDLE_CHUNK_ALWAYS)
                   png_chunk_error(png_ptr, "unknown critical chunk");
             png_set_unknown_chunks(png_ptr, info_ptr,
                &png_ptr->unknown_chunk, 1);
          }
       }
+
       else
 #endif
         png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1);
       png_free(png_ptr, png_ptr->unknown_chunk.data);
       png_ptr->unknown_chunk.data = NULL;
    }
+
    else
 #endif
       skip=length;
@@ -1571,7 +1694,9 @@ png_progressive_combine_row (png_structp png_ptr,
    PNG_CONST int FARDATA png_pass_dsp_mask[7] =
       {0xff, 0x0f, 0xff, 0x33, 0xff, 0x55, 0xff};
 #endif
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
+
    if (new_row != NULL)    /* new_row must == png_ptr->row_buf here. */
       png_combine_row(png_ptr, old_row, png_pass_dsp_mask[png_ptr->pass]);
 }
@@ -1581,7 +1706,9 @@ png_set_progressive_read_fn(png_structp png_ptr, png_voidp progressive_ptr,
    png_progressive_info_ptr info_fn, png_progressive_row_ptr row_fn,
    png_progressive_end_ptr end_fn)
 {
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
+
    png_ptr->info_fn = info_fn;
    png_ptr->row_fn = row_fn;
    png_ptr->end_fn = end_fn;
@@ -1592,7 +1719,9 @@ png_set_progressive_read_fn(png_structp png_ptr, png_voidp progressive_ptr,
 png_voidp PNGAPI
 png_get_progressive_ptr(png_structp png_ptr)
 {
-   if(png_ptr == NULL) return (NULL);
+   if (png_ptr == NULL)
+      return (NULL);
+
    return png_ptr->io_ptr;
 }
 #endif /* PNG_PROGRESSIVE_READ_SUPPORTED */
diff --git a/src/3rdparty/libpng/pngread.c b/src/3rdparty/libpng/pngread.c
index bd8bcd98ab..a4cbb3e226 100644
--- a/src/3rdparty/libpng/pngread.c
+++ b/src/3rdparty/libpng/pngread.c
@@ -1,19 +1,21 @@
 
 /* pngread.c - read a PNG file
  *
- * Last changed in libpng 1.2.25 [February 18, 2008]
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.37 [June 4, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
+ *
  * This file contains routines that an application calls directly to
  * read a PNG file or stream.
  */
 
 #define PNG_INTERNAL
 #include "png.h"
-
 #if defined(PNG_READ_SUPPORTED)
 
 /* Create a PNG structure for reading, and allocate any memory needed. */
@@ -35,6 +37,9 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
 {
 #endif /* PNG_USER_MEM_SUPPORTED */
 
+#ifdef PNG_SETJMP_SUPPORTED
+   volatile
+#endif
    png_structp png_ptr;
 
 #ifdef PNG_SETJMP_SUPPORTED
@@ -45,7 +50,7 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
 
    int i;
 
-   png_debug(1, "in png_create_read_struct\n");
+   png_debug(1, "in png_create_read_struct");
 #ifdef PNG_USER_MEM_SUPPORTED
    png_ptr = (png_structp)png_create_struct_2(PNG_STRUCT_PNG,
       (png_malloc_ptr)malloc_fn, (png_voidp)mem_ptr);
@@ -55,7 +60,7 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
    if (png_ptr == NULL)
       return (NULL);
 
-   /* added at libpng-1.2.6 */
+   /* Added at libpng-1.2.6 */
 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
    png_ptr->user_width_max=PNG_USER_WIDTH_MAX;
    png_ptr->user_height_max=PNG_USER_HEIGHT_MAX;
@@ -69,7 +74,7 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
 #endif
    {
       png_free(png_ptr, png_ptr->zbuf);
-      png_ptr->zbuf=NULL;
+      png_ptr->zbuf = NULL;
 #ifdef PNG_USER_MEM_SUPPORTED
       png_destroy_struct_2((png_voidp)png_ptr,
          (png_free_ptr)free_fn, (png_voidp)mem_ptr);
@@ -79,7 +84,7 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
       return (NULL);
    }
 #ifdef USE_FAR_KEYWORD
-   png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf));
+   png_memcpy(png_ptr->jmpbuf, jmpbuf, png_sizeof(jmp_buf));
 #endif
 #endif
 
@@ -89,18 +94,18 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
 
    png_set_error_fn(png_ptr, error_ptr, error_fn, warn_fn);
 
-   if(user_png_ver)
+   if (user_png_ver)
    {
-     i=0;
+     i = 0;
      do
      {
-       if(user_png_ver[i] != png_libpng_ver[i])
+       if (user_png_ver[i] != png_libpng_ver[i])
           png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;
      } while (png_libpng_ver[i++]);
    }
    else
         png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;
-   
+
 
    if (png_ptr->flags & PNG_FLAG_LIBRARY_MISMATCH)
    {
@@ -128,14 +133,14 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
         png_warning(png_ptr, msg);
 #endif
 #ifdef PNG_ERROR_NUMBERS_SUPPORTED
-        png_ptr->flags=0;
+        png_ptr->flags = 0;
 #endif
         png_error(png_ptr,
            "Incompatible libpng version in application and library");
      }
    }
 
-   /* initialize zbuf - compression buffer */
+   /* Initialize zbuf - compression buffer */
    png_ptr->zbuf_size = PNG_ZBUF_SIZE;
    png_ptr->zbuf = (png_bytep)png_malloc(png_ptr,
      (png_uint_32)png_ptr->zbuf_size);
@@ -164,7 +169,7 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
 #ifdef USE_FAR_KEYWORD
    if (setjmp(jmpbuf))
       PNG_ABORT();
-   png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf));
+   png_memcpy(png_ptr->jmpbuf, jmpbuf, png_sizeof(jmp_buf));
 #else
    if (setjmp(png_ptr->jmpbuf))
       PNG_ABORT();
@@ -190,13 +195,14 @@ png_read_init_2(png_structp png_ptr, png_const_charp user_png_ver,
    png_size_t png_struct_size, png_size_t png_info_size)
 {
    /* We only come here via pre-1.0.12-compiled applications */
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
 #if !defined(PNG_NO_STDIO) && !defined(_WIN32_WCE)
-   if(png_sizeof(png_struct) > png_struct_size ||
+   if (png_sizeof(png_struct) > png_struct_size ||
       png_sizeof(png_info) > png_info_size)
    {
       char msg[80];
-      png_ptr->warning_fn=NULL;
+      png_ptr->warning_fn = NULL;
       if (user_png_ver)
       {
         png_snprintf(msg, 80,
@@ -210,20 +216,20 @@ png_read_init_2(png_structp png_ptr, png_const_charp user_png_ver,
       png_warning(png_ptr, msg);
    }
 #endif
-   if(png_sizeof(png_struct) > png_struct_size)
+   if (png_sizeof(png_struct) > png_struct_size)
      {
-       png_ptr->error_fn=NULL;
+       png_ptr->error_fn = NULL;
 #ifdef PNG_ERROR_NUMBERS_SUPPORTED
-       png_ptr->flags=0;
+       png_ptr->flags = 0;
 #endif
        png_error(png_ptr,
        "The png struct allocated by the application for reading is too small.");
      }
-   if(png_sizeof(png_info) > png_info_size)
+   if (png_sizeof(png_info) > png_info_size)
      {
-       png_ptr->error_fn=NULL;
+       png_ptr->error_fn = NULL;
 #ifdef PNG_ERROR_NUMBERS_SUPPORTED
-       png_ptr->flags=0;
+       png_ptr->flags = 0;
 #endif
        png_error(png_ptr,
          "The info struct allocated by application for reading is too small.");
@@ -240,20 +246,21 @@ png_read_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver,
    jmp_buf tmp_jmp;  /* to save current jump buffer */
 #endif
 
-   int i=0;
+   int i = 0;
 
    png_structp png_ptr=*ptr_ptr;
 
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
 
    do
    {
-     if(user_png_ver[i] != png_libpng_ver[i])
+     if (user_png_ver[i] != png_libpng_ver[i])
      {
 #ifdef PNG_LEGACY_SUPPORTED
        png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;
 #else
-       png_ptr->warning_fn=NULL;
+       png_ptr->warning_fn = NULL;
        png_warning(png_ptr,
         "Application uses deprecated png_read_init() and should be recompiled.");
        break;
@@ -261,35 +268,35 @@ png_read_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver,
      }
    } while (png_libpng_ver[i++]);
 
-   png_debug(1, "in png_read_init_3\n");
+   png_debug(1, "in png_read_init_3");
 
 #ifdef PNG_SETJMP_SUPPORTED
-   /* save jump buffer and error functions */
-   png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf));
+   /* Save jump buffer and error functions */
+   png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof(jmp_buf));
 #endif
 
-   if(png_sizeof(png_struct) > png_struct_size)
-     {
-       png_destroy_struct(png_ptr);
-       *ptr_ptr = (png_structp)png_create_struct(PNG_STRUCT_PNG);
-       png_ptr = *ptr_ptr;
-     }
+   if (png_sizeof(png_struct) > png_struct_size)
+   {
+      png_destroy_struct(png_ptr);
+      *ptr_ptr = (png_structp)png_create_struct(PNG_STRUCT_PNG);
+      png_ptr = *ptr_ptr;
+   }
 
-   /* reset all variables to 0 */
-   png_memset(png_ptr, 0, png_sizeof (png_struct));
+   /* Reset all variables to 0 */
+   png_memset(png_ptr, 0, png_sizeof(png_struct));
 
 #ifdef PNG_SETJMP_SUPPORTED
-   /* restore jump buffer */
-   png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf));
+   /* Restore jump buffer */
+   png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof(jmp_buf));
 #endif
 
-   /* added at libpng-1.2.6 */
+   /* Added at libpng-1.2.6 */
 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
    png_ptr->user_width_max=PNG_USER_WIDTH_MAX;
    png_ptr->user_height_max=PNG_USER_HEIGHT_MAX;
 #endif
 
-   /* initialize zbuf - compression buffer */
+   /* Initialize zbuf - compression buffer */
    png_ptr->zbuf_size = PNG_ZBUF_SIZE;
    png_ptr->zbuf = (png_bytep)png_malloc(png_ptr,
      (png_uint_32)png_ptr->zbuf_size);
@@ -324,8 +331,9 @@ png_read_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver,
 void PNGAPI
 png_read_info(png_structp png_ptr, png_infop info_ptr)
 {
-   if(png_ptr == NULL || info_ptr == NULL) return;
-   png_debug(1, "in png_read_info\n");
+   if (png_ptr == NULL || info_ptr == NULL)
+      return;
+   png_debug(1, "in png_read_info");
    /* If we haven't checked all of the PNG signature bytes, do so now. */
    if (png_ptr->sig_bytes < 8)
    {
@@ -347,7 +355,7 @@ png_read_info(png_structp png_ptr, png_infop info_ptr)
          png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
    }
 
-   for(;;)
+   for (;;)
    {
 #ifdef PNG_USE_LOCAL_ARRAYS
       PNG_CONST PNG_IHDR;
@@ -406,38 +414,29 @@ png_read_info(png_structp png_ptr, png_infop info_ptr)
       PNG_CONST PNG_zTXt;
 #endif
 #endif /* PNG_USE_LOCAL_ARRAYS */
-      png_byte chunk_length[4];
-      png_uint_32 length;
-
-      png_read_data(png_ptr, chunk_length, 4);
-      length = png_get_uint_31(png_ptr,chunk_length);
-
-      png_reset_crc(png_ptr);
-      png_crc_read(png_ptr, png_ptr->chunk_name, 4);
-
-      png_debug2(0, "Reading %s chunk, length=%lu.\n", png_ptr->chunk_name,
-         length);
+      png_uint_32 length = png_read_chunk_header(png_ptr);
+      PNG_CONST png_bytep chunk_name = png_ptr->chunk_name;
 
       /* This should be a binary subdivision search or a hash for
        * matching the chunk name rather than a linear search.
        */
-      if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
-        if(png_ptr->mode & PNG_AFTER_IDAT)
+      if (!png_memcmp(chunk_name, png_IDAT, 4))
+        if (png_ptr->mode & PNG_AFTER_IDAT)
           png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT;
 
-      if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4))
+      if (!png_memcmp(chunk_name, png_IHDR, 4))
          png_handle_IHDR(png_ptr, info_ptr, length);
-      else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4))
+      else if (!png_memcmp(chunk_name, png_IEND, 4))
          png_handle_IEND(png_ptr, info_ptr, length);
 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
-      else if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name))
+      else if (png_handle_as_unknown(png_ptr, chunk_name))
       {
-         if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
+         if (!png_memcmp(chunk_name, png_IDAT, 4))
             png_ptr->mode |= PNG_HAVE_IDAT;
          png_handle_unknown(png_ptr, info_ptr, length);
-         if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4))
+         if (!png_memcmp(chunk_name, png_PLTE, 4))
             png_ptr->mode |= PNG_HAVE_PLTE;
-         else if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
+         else if (!png_memcmp(chunk_name, png_IDAT, 4))
          {
             if (!(png_ptr->mode & PNG_HAVE_IHDR))
                png_error(png_ptr, "Missing IHDR before IDAT");
@@ -448,9 +447,9 @@ png_read_info(png_structp png_ptr, png_infop info_ptr)
          }
       }
 #endif
-      else if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4))
+      else if (!png_memcmp(chunk_name, png_PLTE, 4))
          png_handle_PLTE(png_ptr, info_ptr, length);
-      else if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
+      else if (!png_memcmp(chunk_name, png_IDAT, 4))
       {
          if (!(png_ptr->mode & PNG_HAVE_IHDR))
             png_error(png_ptr, "Missing IHDR before IDAT");
@@ -463,71 +462,71 @@ png_read_info(png_structp png_ptr, png_infop info_ptr)
          break;
       }
 #if defined(PNG_READ_bKGD_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_bKGD, 4))
+      else if (!png_memcmp(chunk_name, png_bKGD, 4))
          png_handle_bKGD(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_cHRM_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_cHRM, 4))
+      else if (!png_memcmp(chunk_name, png_cHRM, 4))
          png_handle_cHRM(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_gAMA_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_gAMA, 4))
+      else if (!png_memcmp(chunk_name, png_gAMA, 4))
          png_handle_gAMA(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_hIST_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_hIST, 4))
+      else if (!png_memcmp(chunk_name, png_hIST, 4))
          png_handle_hIST(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_oFFs_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_oFFs, 4))
+      else if (!png_memcmp(chunk_name, png_oFFs, 4))
          png_handle_oFFs(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_pCAL_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_pCAL, 4))
+      else if (!png_memcmp(chunk_name, png_pCAL, 4))
          png_handle_pCAL(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_sCAL_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_sCAL, 4))
+      else if (!png_memcmp(chunk_name, png_sCAL, 4))
          png_handle_sCAL(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_pHYs_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_pHYs, 4))
+      else if (!png_memcmp(chunk_name, png_pHYs, 4))
          png_handle_pHYs(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_sBIT_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_sBIT, 4))
+      else if (!png_memcmp(chunk_name, png_sBIT, 4))
          png_handle_sBIT(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_sRGB_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_sRGB, 4))
+      else if (!png_memcmp(chunk_name, png_sRGB, 4))
          png_handle_sRGB(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_iCCP_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_iCCP, 4))
+      else if (!png_memcmp(chunk_name, png_iCCP, 4))
          png_handle_iCCP(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_sPLT_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_sPLT, 4))
+      else if (!png_memcmp(chunk_name, png_sPLT, 4))
          png_handle_sPLT(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_tEXt_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_tEXt, 4))
+      else if (!png_memcmp(chunk_name, png_tEXt, 4))
          png_handle_tEXt(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_tIME_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_tIME, 4))
+      else if (!png_memcmp(chunk_name, png_tIME, 4))
          png_handle_tIME(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_tRNS_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_tRNS, 4))
+      else if (!png_memcmp(chunk_name, png_tRNS, 4))
          png_handle_tRNS(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_zTXt_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_zTXt, 4))
+      else if (!png_memcmp(chunk_name, png_zTXt, 4))
          png_handle_zTXt(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_iTXt_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_iTXt, 4))
+      else if (!png_memcmp(chunk_name, png_iTXt, 4))
          png_handle_iTXt(png_ptr, info_ptr, length);
 #endif
       else
@@ -536,12 +535,13 @@ png_read_info(png_structp png_ptr, png_infop info_ptr)
 }
 #endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */
 
-/* optional call to update the users info_ptr structure */
+/* Optional call to update the users info_ptr structure */
 void PNGAPI
 png_read_update_info(png_structp png_ptr, png_infop info_ptr)
 {
-   png_debug(1, "in png_read_update_info\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_read_update_info");
+   if (png_ptr == NULL)
+      return;
    if (!(png_ptr->flags & PNG_FLAG_ROW_INIT))
       png_read_start_row(png_ptr);
    else
@@ -559,8 +559,9 @@ png_read_update_info(png_structp png_ptr, png_infop info_ptr)
 void PNGAPI
 png_start_read_image(png_structp png_ptr)
 {
-   png_debug(1, "in png_start_read_image\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_start_read_image");
+   if (png_ptr == NULL)
+      return;
    if (!(png_ptr->flags & PNG_FLAG_ROW_INIT))
       png_read_start_row(png_ptr);
 }
@@ -573,18 +574,19 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row)
 #ifdef PNG_USE_LOCAL_ARRAYS
    PNG_CONST PNG_IDAT;
    PNG_CONST int png_pass_dsp_mask[7] = {0xff, 0x0f, 0xff, 0x33, 0xff, 0x55,
-     0xff};
+      0xff};
    PNG_CONST int png_pass_mask[7] = {0x80, 0x08, 0x88, 0x22, 0xaa, 0x55, 0xff};
 #endif
    int ret;
-   if(png_ptr == NULL) return;
-   png_debug2(1, "in png_read_row (row %lu, pass %d)\n",
+   if (png_ptr == NULL)
+      return;
+   png_debug2(1, "in png_read_row (row %lu, pass %d)",
       png_ptr->row_number, png_ptr->pass);
    if (!(png_ptr->flags & PNG_FLAG_ROW_INIT))
       png_read_start_row(png_ptr);
    if (png_ptr->row_number == 0 && png_ptr->pass == 0)
    {
-   /* check for transforms that have been set but were defined out */
+   /* Check for transforms that have been set but were defined out */
 #if defined(PNG_WRITE_INVERT_SUPPORTED) && !defined(PNG_READ_INVERT_SUPPORTED)
    if (png_ptr->transformations & PNG_INVERT_MONO)
       png_warning(png_ptr, "PNG_READ_INVERT_SUPPORTED is not defined.");
@@ -616,7 +618,7 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row)
    }
 
 #if defined(PNG_READ_INTERLACING_SUPPORTED)
-   /* if interlaced and we do not need a new row, combine row and return */
+   /* If interlaced and we do not need a new row, combine row and return */
    if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE))
    {
       switch (png_ptr->pass)
@@ -703,15 +705,9 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row)
       {
          while (!png_ptr->idat_size)
          {
-            png_byte chunk_length[4];
-
             png_crc_finish(png_ptr, 0);
 
-            png_read_data(png_ptr, chunk_length, 4);
-            png_ptr->idat_size = png_get_uint_31(png_ptr,chunk_length);
-
-            png_reset_crc(png_ptr);
-            png_crc_read(png_ptr, png_ptr->chunk_name, 4);
+            png_ptr->idat_size = png_read_chunk_header(png_ptr);
             if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
                png_error(png_ptr, "Not enough image data");
          }
@@ -747,7 +743,7 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row)
    png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth,
        png_ptr->row_info.width);
 
-   if(png_ptr->row_buf[0])
+   if (png_ptr->row_buf[0])
    png_read_filter_row(png_ptr, &(png_ptr->row_info),
       png_ptr->row_buf + 1, png_ptr->prev_row + 1,
       (int)(png_ptr->row_buf[0]));
@@ -756,7 +752,7 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row)
       png_ptr->rowbytes + 1);
 
 #if defined(PNG_MNG_FEATURES_SUPPORTED)
-   if((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) &&
+   if ((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) &&
       (png_ptr->filter_type == PNG_INTRAPIXEL_DIFFERENCING))
    {
       /* Intrapixel differencing */
@@ -769,15 +765,15 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row)
       png_do_read_transformations(png_ptr);
 
 #if defined(PNG_READ_INTERLACING_SUPPORTED)
-   /* blow up interlaced rows to full size */
+   /* Blow up interlaced rows to full size */
    if (png_ptr->interlaced &&
       (png_ptr->transformations & PNG_INTERLACE))
    {
       if (png_ptr->pass < 6)
-/*       old interface (pre-1.0.9):
-         png_do_read_interlace(&(png_ptr->row_info),
-            png_ptr->row_buf + 1, png_ptr->pass, png_ptr->transformations);
- */
+         /* Old interface (pre-1.0.9):
+          * png_do_read_interlace(&(png_ptr->row_info),
+          *    png_ptr->row_buf + 1, png_ptr->pass, png_ptr->transformations);
+          */
          png_do_read_interlace(png_ptr);
 
       if (dsp_row != NULL)
@@ -835,8 +831,9 @@ png_read_rows(png_structp png_ptr, png_bytepp row,
    png_bytepp rp;
    png_bytepp dp;
 
-   png_debug(1, "in png_read_rows\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_read_rows");
+   if (png_ptr == NULL)
+      return;
    rp = row;
    dp = display_row;
    if (rp != NULL && dp != NULL)
@@ -847,14 +844,14 @@ png_read_rows(png_structp png_ptr, png_bytepp row,
 
          png_read_row(png_ptr, rptr, dptr);
       }
-   else if(rp != NULL)
+   else if (rp != NULL)
       for (i = 0; i < num_rows; i++)
       {
          png_bytep rptr = *rp;
          png_read_row(png_ptr, rptr, png_bytep_NULL);
          rp++;
       }
-   else if(dp != NULL)
+   else if (dp != NULL)
       for (i = 0; i < num_rows; i++)
       {
          png_bytep dptr = *dp;
@@ -880,12 +877,13 @@ png_read_rows(png_structp png_ptr, png_bytepp row,
 void PNGAPI
 png_read_image(png_structp png_ptr, png_bytepp image)
 {
-   png_uint_32 i,image_height;
+   png_uint_32 i, image_height;
    int pass, j;
    png_bytepp rp;
 
-   png_debug(1, "in png_read_image\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_read_image");
+   if (png_ptr == NULL)
+      return;
 
 #ifdef PNG_READ_INTERLACING_SUPPORTED
    pass = png_set_interlace_handling(png_ptr);
@@ -920,11 +918,9 @@ png_read_image(png_structp png_ptr, png_bytepp image)
 void PNGAPI
 png_read_end(png_structp png_ptr, png_infop info_ptr)
 {
-   png_byte chunk_length[4];
-   png_uint_32 length;
-
-   png_debug(1, "in png_read_end\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_read_end");
+   if (png_ptr == NULL)
+      return;
    png_crc_finish(png_ptr, 0); /* Finish off CRC from last IDAT chunk */
 
    do
@@ -986,33 +982,27 @@ png_read_end(png_structp png_ptr, png_infop info_ptr)
       PNG_CONST PNG_zTXt;
 #endif
 #endif /* PNG_USE_LOCAL_ARRAYS */
+      png_uint_32 length = png_read_chunk_header(png_ptr);
+      PNG_CONST png_bytep chunk_name = png_ptr->chunk_name;
 
-      png_read_data(png_ptr, chunk_length, 4);
-      length = png_get_uint_31(png_ptr,chunk_length);
-
-      png_reset_crc(png_ptr);
-      png_crc_read(png_ptr, png_ptr->chunk_name, 4);
-
-      png_debug1(0, "Reading %s chunk.\n", png_ptr->chunk_name);
-
-      if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4))
+      if (!png_memcmp(chunk_name, png_IHDR, 4))
          png_handle_IHDR(png_ptr, info_ptr, length);
-      else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4))
+      else if (!png_memcmp(chunk_name, png_IEND, 4))
          png_handle_IEND(png_ptr, info_ptr, length);
 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
-      else if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name))
+      else if (png_handle_as_unknown(png_ptr, chunk_name))
       {
-         if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
+         if (!png_memcmp(chunk_name, png_IDAT, 4))
          {
             if ((length > 0) || (png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT))
                png_error(png_ptr, "Too many IDAT's found");
          }
          png_handle_unknown(png_ptr, info_ptr, length);
-         if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4))
+         if (!png_memcmp(chunk_name, png_PLTE, 4))
             png_ptr->mode |= PNG_HAVE_PLTE;
       }
 #endif
-      else if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
+      else if (!png_memcmp(chunk_name, png_IDAT, 4))
       {
          /* Zero length IDATs are legal after the last IDAT has been
           * read, but not after other chunks have been read.
@@ -1021,74 +1011,74 @@ png_read_end(png_structp png_ptr, png_infop info_ptr)
             png_error(png_ptr, "Too many IDAT's found");
          png_crc_finish(png_ptr, length);
       }
-      else if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4))
+      else if (!png_memcmp(chunk_name, png_PLTE, 4))
          png_handle_PLTE(png_ptr, info_ptr, length);
 #if defined(PNG_READ_bKGD_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_bKGD, 4))
+      else if (!png_memcmp(chunk_name, png_bKGD, 4))
          png_handle_bKGD(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_cHRM_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_cHRM, 4))
+      else if (!png_memcmp(chunk_name, png_cHRM, 4))
          png_handle_cHRM(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_gAMA_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_gAMA, 4))
+      else if (!png_memcmp(chunk_name, png_gAMA, 4))
          png_handle_gAMA(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_hIST_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_hIST, 4))
+      else if (!png_memcmp(chunk_name, png_hIST, 4))
          png_handle_hIST(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_oFFs_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_oFFs, 4))
+      else if (!png_memcmp(chunk_name, png_oFFs, 4))
          png_handle_oFFs(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_pCAL_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_pCAL, 4))
+      else if (!png_memcmp(chunk_name, png_pCAL, 4))
          png_handle_pCAL(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_sCAL_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_sCAL, 4))
+      else if (!png_memcmp(chunk_name, png_sCAL, 4))
          png_handle_sCAL(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_pHYs_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_pHYs, 4))
+      else if (!png_memcmp(chunk_name, png_pHYs, 4))
          png_handle_pHYs(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_sBIT_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_sBIT, 4))
+      else if (!png_memcmp(chunk_name, png_sBIT, 4))
          png_handle_sBIT(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_sRGB_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_sRGB, 4))
+      else if (!png_memcmp(chunk_name, png_sRGB, 4))
          png_handle_sRGB(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_iCCP_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_iCCP, 4))
+      else if (!png_memcmp(chunk_name, png_iCCP, 4))
          png_handle_iCCP(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_sPLT_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_sPLT, 4))
+      else if (!png_memcmp(chunk_name, png_sPLT, 4))
          png_handle_sPLT(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_tEXt_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_tEXt, 4))
+      else if (!png_memcmp(chunk_name, png_tEXt, 4))
          png_handle_tEXt(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_tIME_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_tIME, 4))
+      else if (!png_memcmp(chunk_name, png_tIME, 4))
          png_handle_tIME(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_tRNS_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_tRNS, 4))
+      else if (!png_memcmp(chunk_name, png_tRNS, 4))
          png_handle_tRNS(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_zTXt_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_zTXt, 4))
+      else if (!png_memcmp(chunk_name, png_zTXt, 4))
          png_handle_zTXt(png_ptr, info_ptr, length);
 #endif
 #if defined(PNG_READ_iTXt_SUPPORTED)
-      else if (!png_memcmp(png_ptr->chunk_name, png_iTXt, 4))
+      else if (!png_memcmp(chunk_name, png_iTXt, 4))
          png_handle_iTXt(png_ptr, info_ptr, length);
 #endif
       else
@@ -1097,7 +1087,7 @@ png_read_end(png_structp png_ptr, png_infop info_ptr)
 }
 #endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */
 
-/* free all memory used by the read */
+/* Free all memory used by the read */
 void PNGAPI
 png_destroy_read_struct(png_structpp png_ptr_ptr, png_infopp info_ptr_ptr,
    png_infopp end_info_ptr_ptr)
@@ -1109,11 +1099,9 @@ png_destroy_read_struct(png_structpp png_ptr_ptr, png_infopp info_ptr_ptr,
    png_voidp mem_ptr = NULL;
 #endif
 
-   png_debug(1, "in png_destroy_read_struct\n");
+   png_debug(1, "in png_destroy_read_struct");
    if (png_ptr_ptr != NULL)
-   {
       png_ptr = *png_ptr_ptr;
-   }
    if (png_ptr == NULL)
       return;
 
@@ -1159,16 +1147,19 @@ png_destroy_read_struct(png_structpp png_ptr_ptr, png_infopp info_ptr_ptr,
       *end_info_ptr_ptr = NULL;
    }
 
+   if (png_ptr != NULL)
+   {
 #ifdef PNG_USER_MEM_SUPPORTED
-   png_destroy_struct_2((png_voidp)png_ptr, (png_free_ptr)free_fn,
-       (png_voidp)mem_ptr);
+      png_destroy_struct_2((png_voidp)png_ptr, (png_free_ptr)free_fn,
+          (png_voidp)mem_ptr);
 #else
-   png_destroy_struct((png_voidp)png_ptr);
+      png_destroy_struct((png_voidp)png_ptr);
 #endif
-   *png_ptr_ptr = NULL;
+      *png_ptr_ptr = NULL;
+   }
 }
 
-/* free all memory used by the read (old method) */
+/* Free all memory used by the read (old method) */
 void /* PRIVATE */
 png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr)
 {
@@ -1182,7 +1173,7 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr
    png_free_ptr free_fn;
 #endif
 
-   png_debug(1, "in png_read_destroy\n");
+   png_debug(1, "in png_read_destroy");
    if (info_ptr != NULL)
       png_info_destroy(png_ptr, info_ptr);
 
@@ -1192,6 +1183,7 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr
    png_free(png_ptr, png_ptr->zbuf);
    png_free(png_ptr, png_ptr->big_row_buf);
    png_free(png_ptr, png_ptr->prev_row);
+   png_free(png_ptr, png_ptr->chunkdata);
 #if defined(PNG_READ_DITHER_SUPPORTED)
    png_free(png_ptr, png_ptr->palette_lookup);
    png_free(png_ptr, png_ptr->dither_index);
@@ -1288,7 +1280,7 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr
     * being used again.
     */
 #ifdef PNG_SETJMP_SUPPORTED
-   png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf));
+   png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof(jmp_buf));
 #endif
 
    error_fn = png_ptr->error_fn;
@@ -1298,7 +1290,7 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr
    free_fn = png_ptr->free_fn;
 #endif
 
-   png_memset(png_ptr, 0, png_sizeof (png_struct));
+   png_memset(png_ptr, 0, png_sizeof(png_struct));
 
    png_ptr->error_fn = error_fn;
    png_ptr->warning_fn = warning_fn;
@@ -1308,7 +1300,7 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr
 #endif
 
 #ifdef PNG_SETJMP_SUPPORTED
-   png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf));
+   png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof(jmp_buf));
 #endif
 
 }
@@ -1316,7 +1308,8 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr
 void PNGAPI
 png_set_read_status_fn(png_structp png_ptr, png_read_status_ptr read_row_fn)
 {
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
    png_ptr->read_row_fn = read_row_fn;
 }
 
@@ -1330,9 +1323,10 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
 {
    int row;
 
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
 #if defined(PNG_READ_INVERT_ALPHA_SUPPORTED)
-   /* invert the alpha channel from opacity to transparency
+   /* Invert the alpha channel from opacity to transparency
     */
    if (transforms & PNG_TRANSFORM_INVERT_ALPHA)
        png_set_invert_alpha(png_ptr);
@@ -1343,15 +1337,15 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
     */
    png_read_info(png_ptr, info_ptr);
    if (info_ptr->height > PNG_UINT_32_MAX/png_sizeof(png_bytep))
-      png_error(png_ptr,"Image is too high to process with png_read_png()");
+      png_error(png_ptr, "Image is too high to process with png_read_png()");
 
    /* -------------- image transformations start here ------------------- */
 
 #if defined(PNG_READ_16_TO_8_SUPPORTED)
-   /* tell libpng to strip 16 bit/color files down to 8 bits per color
+   /* Tell libpng to strip 16 bit/color files down to 8 bits per color.
     */
    if (transforms & PNG_TRANSFORM_STRIP_16)
-       png_set_strip_16(png_ptr);
+      png_set_strip_16(png_ptr);
 #endif
 
 #if defined(PNG_READ_STRIP_ALPHA_SUPPORTED)
@@ -1359,7 +1353,7 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
     * the background (not recommended).
     */
    if (transforms & PNG_TRANSFORM_STRIP_ALPHA)
-       png_set_strip_alpha(png_ptr);
+      png_set_strip_alpha(png_ptr);
 #endif
 
 #if defined(PNG_READ_PACK_SUPPORTED) && !defined(PNG_READ_EXPAND_SUPPORTED)
@@ -1367,7 +1361,7 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
     * byte into separate bytes (useful for paletted and grayscale images).
     */
    if (transforms & PNG_TRANSFORM_PACKING)
-       png_set_packing(png_ptr);
+      png_set_packing(png_ptr);
 #endif
 
 #if defined(PNG_READ_PACKSWAP_SUPPORTED)
@@ -1375,7 +1369,7 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
     * (not useful if you are using png_set_packing).
     */
    if (transforms & PNG_TRANSFORM_PACKSWAP)
-       png_set_packswap(png_ptr);
+      png_set_packswap(png_ptr);
 #endif
 
 #if defined(PNG_READ_EXPAND_SUPPORTED)
@@ -1385,9 +1379,9 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
     * channels so the data will be available as RGBA quartets.
     */
    if (transforms & PNG_TRANSFORM_EXPAND)
-       if ((png_ptr->bit_depth < 8) ||
-           (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ||
-           (png_get_valid(png_ptr, info_ptr, PNG_INFO_tRNS)))
+      if ((png_ptr->bit_depth < 8) ||
+          (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ||
+          (png_get_valid(png_ptr, info_ptr, PNG_INFO_tRNS)))
          png_set_expand(png_ptr);
 #endif
 
@@ -1395,10 +1389,10 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
     */
 
 #if defined(PNG_READ_INVERT_SUPPORTED)
-   /* invert monochrome files to have 0 as white and 1 as black
+   /* Invert monochrome files to have 0 as white and 1 as black
     */
    if (transforms & PNG_TRANSFORM_INVERT_MONO)
-       png_set_invert_mono(png_ptr);
+      png_set_invert_mono(png_ptr);
 #endif
 
 #if defined(PNG_READ_SHIFT_SUPPORTED)
@@ -1417,24 +1411,24 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
 #endif
 
 #if defined(PNG_READ_BGR_SUPPORTED)
-   /* flip the RGB pixels to BGR (or RGBA to BGRA)
+   /* Flip the RGB pixels to BGR (or RGBA to BGRA)
     */
    if (transforms & PNG_TRANSFORM_BGR)
-       png_set_bgr(png_ptr);
+      png_set_bgr(png_ptr);
 #endif
 
 #if defined(PNG_READ_SWAP_ALPHA_SUPPORTED)
-   /* swap the RGBA or GA data to ARGB or AG (or BGRA to ABGR)
+   /* Swap the RGBA or GA data to ARGB or AG (or BGRA to ABGR)
     */
    if (transforms & PNG_TRANSFORM_SWAP_ALPHA)
        png_set_swap_alpha(png_ptr);
 #endif
 
 #if defined(PNG_READ_SWAP_SUPPORTED)
-   /* swap bytes of 16 bit files to least significant byte first
+   /* Swap bytes of 16 bit files to least significant byte first
     */
    if (transforms & PNG_TRANSFORM_SWAP_ENDIAN)
-       png_set_swap(png_ptr);
+      png_set_swap(png_ptr);
 #endif
 
    /* We don't handle adding filler bytes */
@@ -1450,27 +1444,27 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
 #ifdef PNG_FREE_ME_SUPPORTED
    png_free_data(png_ptr, info_ptr, PNG_FREE_ROWS, 0);
 #endif
-   if(info_ptr->row_pointers == NULL)
+   if (info_ptr->row_pointers == NULL)
    {
       info_ptr->row_pointers = (png_bytepp)png_malloc(png_ptr,
          info_ptr->height * png_sizeof(png_bytep));
+      png_memset(info_ptr->row_pointers, 0, info_ptr->height
+         * png_sizeof(png_bytep));
 #ifdef PNG_FREE_ME_SUPPORTED
       info_ptr->free_me |= PNG_FREE_ROWS;
 #endif
       for (row = 0; row < (int)info_ptr->height; row++)
-      {
          info_ptr->row_pointers[row] = (png_bytep)png_malloc(png_ptr,
             png_get_rowbytes(png_ptr, info_ptr));
-      }
    }
 
    png_read_image(png_ptr, info_ptr->row_pointers);
    info_ptr->valid |= PNG_INFO_IDAT;
 
-   /* read rest of file, and get additional chunks in info_ptr - REQUIRED */
+   /* Read rest of file, and get additional chunks in info_ptr - REQUIRED */
    png_read_end(png_ptr, info_ptr);
 
-   transforms = transforms; /* quiet compiler warnings */
+   transforms = transforms; /* Quiet compiler warnings */
    params = params;
 
 }
diff --git a/src/3rdparty/libpng/pngrio.c b/src/3rdparty/libpng/pngrio.c
index 7d2522f1f8..2267bca9a9 100644
--- a/src/3rdparty/libpng/pngrio.c
+++ b/src/3rdparty/libpng/pngrio.c
@@ -1,12 +1,15 @@
 
 /* pngrio.c - functions for data input
  *
- * Last changed in libpng 1.2.13 November 13, 2006
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2006 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.37 [June 4, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
+ *
  * This file provides a location for all input.  Users who need
  * special handling are expected to write a function that has the same
  * arguments as this and performs a similar function, but that possibly
@@ -17,18 +20,18 @@
 
 #define PNG_INTERNAL
 #include "png.h"
-
 #if defined(PNG_READ_SUPPORTED)
 
 /* Read the data from whatever input you are using.  The default routine
-   reads from a file pointer.  Note that this routine sometimes gets called
-   with very small lengths, so you should implement some kind of simple
-   buffering if you are using unbuffered reads.  This should never be asked
-   to read more then 64K on a 16 bit machine. */
+ * reads from a file pointer.  Note that this routine sometimes gets called
+ * with very small lengths, so you should implement some kind of simple
+ * buffering if you are using unbuffered reads.  This should never be asked
+ * to read more then 64K on a 16 bit machine.
+ */
 void /* PRIVATE */
 png_read_data(png_structp png_ptr, png_bytep data, png_size_t length)
 {
-   png_debug1(4,"reading %d bytes\n", (int)length);
+   png_debug1(4, "reading %d bytes", (int)length);
    if (png_ptr->read_data_fn != NULL)
       (*(png_ptr->read_data_fn))(png_ptr, data, length);
    else
@@ -37,16 +40,18 @@ png_read_data(png_structp png_ptr, png_bytep data, png_size_t length)
 
 #if !defined(PNG_NO_STDIO)
 /* This is the function that does the actual reading of data.  If you are
-   not reading from a standard C stream, you should create a replacement
-   read_data function and use it at run time with png_set_read_fn(), rather
-   than changing the library. */
+ * not reading from a standard C stream, you should create a replacement
+ * read_data function and use it at run time with png_set_read_fn(), rather
+ * than changing the library.
+ */
 #ifndef USE_FAR_KEYWORD
 void PNGAPI
 png_default_read_data(png_structp png_ptr, png_bytep data, png_size_t length)
 {
    png_size_t check;
 
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
    /* fread() returns 0 on error, so it is OK to store this in a png_size_t
     * instead of an int, which is what fread() actually returns.
     */
@@ -62,7 +67,7 @@ png_default_read_data(png_structp png_ptr, png_bytep data, png_size_t length)
       png_error(png_ptr, "Read Error");
 }
 #else
-/* this is the model-independent version. Since the standard I/O library
+/* This is the model-independent version. Since the standard I/O library
    can't handle far buffers in the medium and small models, we have to copy
    the data.
 */
@@ -77,7 +82,8 @@ png_default_read_data(png_structp png_ptr, png_bytep data, png_size_t length)
    png_byte *n_data;
    png_FILE_p io_ptr;
 
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
    /* Check if data really is near. If so, use usual code. */
    n_data = (png_byte *)CVT_PTR_NOCHECK(data);
    io_ptr = (png_FILE_p)CVT_PTR(png_ptr->io_ptr);
@@ -106,7 +112,7 @@ png_default_read_data(png_structp png_ptr, png_bytep data, png_size_t length)
          err = fread(buf, (png_size_t)1, read, io_ptr);
 #endif
          png_memcpy(data, buf, read); /* copy far buffer to near buffer */
-         if(err != read)
+         if (err != read)
             break;
          else
             check += err;
@@ -122,23 +128,27 @@ png_default_read_data(png_structp png_ptr, png_bytep data, png_size_t length)
 #endif
 
 /* This function allows the application to supply a new input function
-   for libpng if standard C streams aren't being used.
-
-   This function takes as its arguments:
-   png_ptr      - pointer to a png input data structure
-   io_ptr       - pointer to user supplied structure containing info about
-                  the input functions.  May be NULL.
-   read_data_fn - pointer to a new input function that takes as its
-                  arguments a pointer to a png_struct, a pointer to
-                  a location where input data can be stored, and a 32-bit
-                  unsigned int that is the number of bytes to be read.
-                  To exit and output any fatal error messages the new write
-                  function should call png_error(png_ptr, "Error msg"). */
+ * for libpng if standard C streams aren't being used.
+ *
+ * This function takes as its arguments:
+ * png_ptr      - pointer to a png input data structure
+ * io_ptr       - pointer to user supplied structure containing info about
+ *                the input functions.  May be NULL.
+ * read_data_fn - pointer to a new input function that takes as its
+ *                arguments a pointer to a png_struct, a pointer to
+ *                a location where input data can be stored, and a 32-bit
+ *                unsigned int that is the number of bytes to be read.
+ *                To exit and output any fatal error messages the new write
+ *                function should call png_error(png_ptr, "Error msg").
+ *                May be NULL, in which case libpng's default function will
+ *                be used.
+ */
 void PNGAPI
 png_set_read_fn(png_structp png_ptr, png_voidp io_ptr,
    png_rw_ptr read_data_fn)
 {
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
    png_ptr->io_ptr = io_ptr;
 
 #if !defined(PNG_NO_STDIO)
diff --git a/src/3rdparty/libpng/pngrtran.c b/src/3rdparty/libpng/pngrtran.c
index 873b22cf34..d7e6b4a95a 100644
--- a/src/3rdparty/libpng/pngrtran.c
+++ b/src/3rdparty/libpng/pngrtran.c
@@ -1,12 +1,15 @@
 
 /* pngrtran.c - transforms the data in a row for PNG readers
  *
- * Last changed in libpng 1.2.27 [April 29, 2008]
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.38 [July 16, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
+ *
  * This file contains functions optionally called by an application
  * in order to tell libpng how to handle data when reading a PNG.
  * Transformations that are used in both reading and writing are
@@ -15,32 +18,37 @@
 
 #define PNG_INTERNAL
 #include "png.h"
-
 #if defined(PNG_READ_SUPPORTED)
 
 /* Set the action on getting a CRC error for an ancillary or critical chunk. */
 void PNGAPI
 png_set_crc_action(png_structp png_ptr, int crit_action, int ancil_action)
 {
-   png_debug(1, "in png_set_crc_action\n");
+   png_debug(1, "in png_set_crc_action");
    /* Tell libpng how we react to CRC errors in critical chunks */
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
    switch (crit_action)
    {
-      case PNG_CRC_NO_CHANGE:                        /* leave setting as is */
+      case PNG_CRC_NO_CHANGE:                        /* Leave setting as is */
          break;
-      case PNG_CRC_WARN_USE:                               /* warn/use data */
+
+      case PNG_CRC_WARN_USE:                               /* Warn/use data */
          png_ptr->flags &= ~PNG_FLAG_CRC_CRITICAL_MASK;
          png_ptr->flags |= PNG_FLAG_CRC_CRITICAL_USE;
          break;
-      case PNG_CRC_QUIET_USE:                             /* quiet/use data */
+
+      case PNG_CRC_QUIET_USE:                             /* Quiet/use data */
          png_ptr->flags &= ~PNG_FLAG_CRC_CRITICAL_MASK;
          png_ptr->flags |= PNG_FLAG_CRC_CRITICAL_USE |
                            PNG_FLAG_CRC_CRITICAL_IGNORE;
          break;
-      case PNG_CRC_WARN_DISCARD:    /* not a valid action for critical data */
-         png_warning(png_ptr, "Can't discard critical data on CRC error.");
-      case PNG_CRC_ERROR_QUIT:                                /* error/quit */
+
+      case PNG_CRC_WARN_DISCARD:    /* Not a valid action for critical data */
+         png_warning(png_ptr,
+            "Can't discard critical data on CRC error.");
+      case PNG_CRC_ERROR_QUIT:                                /* Error/quit */
+
       case PNG_CRC_DEFAULT:
       default:
          png_ptr->flags &= ~PNG_FLAG_CRC_CRITICAL_MASK;
@@ -49,22 +57,27 @@ png_set_crc_action(png_structp png_ptr, int crit_action, int ancil_action)
 
    switch (ancil_action)
    {
-      case PNG_CRC_NO_CHANGE:                       /* leave setting as is */
+      case PNG_CRC_NO_CHANGE:                       /* Leave setting as is */
          break;
-      case PNG_CRC_WARN_USE:                              /* warn/use data */
+
+      case PNG_CRC_WARN_USE:                              /* Warn/use data */
          png_ptr->flags &= ~PNG_FLAG_CRC_ANCILLARY_MASK;
          png_ptr->flags |= PNG_FLAG_CRC_ANCILLARY_USE;
          break;
-      case PNG_CRC_QUIET_USE:                            /* quiet/use data */
+
+      case PNG_CRC_QUIET_USE:                            /* Quiet/use data */
          png_ptr->flags &= ~PNG_FLAG_CRC_ANCILLARY_MASK;
          png_ptr->flags |= PNG_FLAG_CRC_ANCILLARY_USE |
                            PNG_FLAG_CRC_ANCILLARY_NOWARN;
          break;
-      case PNG_CRC_ERROR_QUIT:                               /* error/quit */
+
+      case PNG_CRC_ERROR_QUIT:                               /* Error/quit */
          png_ptr->flags &= ~PNG_FLAG_CRC_ANCILLARY_MASK;
          png_ptr->flags |= PNG_FLAG_CRC_ANCILLARY_NOWARN;
          break;
-      case PNG_CRC_WARN_DISCARD:                      /* warn/discard data */
+
+      case PNG_CRC_WARN_DISCARD:                      /* Warn/discard data */
+
       case PNG_CRC_DEFAULT:
       default:
          png_ptr->flags &= ~PNG_FLAG_CRC_ANCILLARY_MASK;
@@ -74,14 +87,15 @@ png_set_crc_action(png_structp png_ptr, int crit_action, int ancil_action)
 
 #if defined(PNG_READ_BACKGROUND_SUPPORTED) && \
     defined(PNG_FLOATING_POINT_SUPPORTED)
-/* handle alpha and tRNS via a background color */
+/* Handle alpha and tRNS via a background color */
 void PNGAPI
 png_set_background(png_structp png_ptr,
    png_color_16p background_color, int background_gamma_code,
    int need_expand, double background_gamma)
 {
-   png_debug(1, "in png_set_background\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_background");
+   if (png_ptr == NULL)
+      return;
    if (background_gamma_code == PNG_BACKGROUND_GAMMA_UNKNOWN)
    {
       png_warning(png_ptr, "Application must supply a known background gamma");
@@ -98,12 +112,13 @@ png_set_background(png_structp png_ptr,
 #endif
 
 #if defined(PNG_READ_16_TO_8_SUPPORTED)
-/* strip 16 bit depth files to 8 bit depth */
+/* Strip 16 bit depth files to 8 bit depth */
 void PNGAPI
 png_set_strip_16(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_strip_16\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_strip_16");
+   if (png_ptr == NULL)
+      return;
    png_ptr->transformations |= PNG_16_TO_8;
 }
 #endif
@@ -112,8 +127,9 @@ png_set_strip_16(png_structp png_ptr)
 void PNGAPI
 png_set_strip_alpha(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_strip_alpha\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_strip_alpha");
+   if (png_ptr == NULL)
+      return;
    png_ptr->flags |= PNG_FLAG_STRIP_ALPHA;
 }
 #endif
@@ -142,8 +158,9 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
    int num_palette, int maximum_colors, png_uint_16p histogram,
    int full_dither)
 {
-   png_debug(1, "in png_set_dither\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_dither");
+   if (png_ptr == NULL)
+      return;
    png_ptr->transformations |= PNG_DITHER;
 
    if (!full_dither)
@@ -151,7 +168,7 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
       int i;
 
       png_ptr->dither_index = (png_bytep)png_malloc(png_ptr,
-         (png_uint_32)(num_palette * png_sizeof (png_byte)));
+         (png_uint_32)(num_palette * png_sizeof(png_byte)));
       for (i = 0; i < num_palette; i++)
          png_ptr->dither_index[i] = (png_byte)i;
    }
@@ -161,27 +178,29 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
       if (histogram != NULL)
       {
          /* This is easy enough, just throw out the least used colors.
-            Perhaps not the best solution, but good enough. */
+          * Perhaps not the best solution, but good enough.
+          */
 
          int i;
 
-         /* initialize an array to sort colors */
+         /* Initialize an array to sort colors */
          png_ptr->dither_sort = (png_bytep)png_malloc(png_ptr,
-            (png_uint_32)(num_palette * png_sizeof (png_byte)));
+            (png_uint_32)(num_palette * png_sizeof(png_byte)));
 
-         /* initialize the dither_sort array */
+         /* Initialize the dither_sort array */
          for (i = 0; i < num_palette; i++)
             png_ptr->dither_sort[i] = (png_byte)i;
 
          /* Find the least used palette entries by starting a
-            bubble sort, and running it until we have sorted
-            out enough colors.  Note that we don't care about
-            sorting all the colors, just finding which are
-            least used. */
+          * bubble sort, and running it until we have sorted
+          * out enough colors.  Note that we don't care about
+          * sorting all the colors, just finding which are
+          * least used.
+          */
 
          for (i = num_palette - 1; i >= maximum_colors; i--)
          {
-            int done; /* to stop early if the list is pre-sorted */
+            int done; /* To stop early if the list is pre-sorted */
             int j;
 
             done = 1;
@@ -202,13 +221,14 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
                break;
          }
 
-         /* swap the palette around, and set up a table, if necessary */
+         /* Swap the palette around, and set up a table, if necessary */
          if (full_dither)
          {
             int j = num_palette;
 
-            /* put all the useful colors within the max, but don't
-               move the others */
+            /* Put all the useful colors within the max, but don't
+             * move the others.
+             */
             for (i = 0; i < maximum_colors; i++)
             {
                if ((int)png_ptr->dither_sort[i] >= maximum_colors)
@@ -224,11 +244,12 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
          {
             int j = num_palette;
 
-            /* move all the used colors inside the max limit, and
-               develop a translation table */
+            /* Move all the used colors inside the max limit, and
+             * develop a translation table.
+             */
             for (i = 0; i < maximum_colors; i++)
             {
-               /* only move the colors we need to */
+               /* Only move the colors we need to */
                if ((int)png_ptr->dither_sort[i] >= maximum_colors)
                {
                   png_color tmp_color;
@@ -240,20 +261,20 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
                   tmp_color = palette[j];
                   palette[j] = palette[i];
                   palette[i] = tmp_color;
-                  /* indicate where the color went */
+                  /* Indicate where the color went */
                   png_ptr->dither_index[j] = (png_byte)i;
                   png_ptr->dither_index[i] = (png_byte)j;
                }
             }
 
-            /* find closest color for those colors we are not using */
+            /* Find closest color for those colors we are not using */
             for (i = 0; i < num_palette; i++)
             {
                if ((int)png_ptr->dither_index[i] >= maximum_colors)
                {
                   int min_d, k, min_k, d_index;
 
-                  /* find the closest color to one we threw out */
+                  /* Find the closest color to one we threw out */
                   d_index = png_ptr->dither_index[i];
                   min_d = PNG_COLOR_DIST(palette[d_index], palette[0]);
                   for (k = 1, min_k = 0; k < maximum_colors; k++)
@@ -268,39 +289,39 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
                         min_k = k;
                      }
                   }
-                  /* point to closest color */
+                  /* Point to closest color */
                   png_ptr->dither_index[i] = (png_byte)min_k;
                }
             }
          }
          png_free(png_ptr, png_ptr->dither_sort);
-         png_ptr->dither_sort=NULL;
+         png_ptr->dither_sort = NULL;
       }
       else
       {
          /* This is much harder to do simply (and quickly).  Perhaps
-            we need to go through a median cut routine, but those
-            don't always behave themselves with only a few colors
-            as input.  So we will just find the closest two colors,
-            and throw out one of them (chosen somewhat randomly).
-            [We don't understand this at all, so if someone wants to
-             work on improving it, be our guest - AED, GRP]
-            */
+          * we need to go through a median cut routine, but those
+          * don't always behave themselves with only a few colors
+          * as input.  So we will just find the closest two colors,
+          * and throw out one of them (chosen somewhat randomly).
+          * [We don't understand this at all, so if someone wants to
+          *  work on improving it, be our guest - AED, GRP]
+          */
          int i;
          int max_d;
          int num_new_palette;
          png_dsortp t;
          png_dsortpp hash;
 
-         t=NULL;
+         t = NULL;
 
-         /* initialize palette index arrays */
+         /* Initialize palette index arrays */
          png_ptr->index_to_palette = (png_bytep)png_malloc(png_ptr,
-            (png_uint_32)(num_palette * png_sizeof (png_byte)));
+            (png_uint_32)(num_palette * png_sizeof(png_byte)));
          png_ptr->palette_to_index = (png_bytep)png_malloc(png_ptr,
-            (png_uint_32)(num_palette * png_sizeof (png_byte)));
+            (png_uint_32)(num_palette * png_sizeof(png_byte)));
 
-         /* initialize the sort array */
+         /* Initialize the sort array */
          for (i = 0; i < num_palette; i++)
          {
             png_ptr->index_to_palette[i] = (png_byte)i;
@@ -308,21 +329,19 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
          }
 
          hash = (png_dsortpp)png_malloc(png_ptr, (png_uint_32)(769 *
-            png_sizeof (png_dsortp)));
-         for (i = 0; i < 769; i++)
-            hash[i] = NULL;
-/*         png_memset(hash, 0, 769 * png_sizeof (png_dsortp)); */
+            png_sizeof(png_dsortp)));
+         png_memset(hash, 0, 769 * png_sizeof(png_dsortp));
 
          num_new_palette = num_palette;
 
-         /* initial wild guess at how far apart the farthest pixel
-            pair we will be eliminating will be.  Larger
-            numbers mean more areas will be allocated, Smaller
-            numbers run the risk of not saving enough data, and
-            having to do this all over again.
-
-            I have not done extensive checking on this number.
-            */
+         /* Initial wild guess at how far apart the farthest pixel
+          * pair we will be eliminating will be.  Larger
+          * numbers mean more areas will be allocated, Smaller
+          * numbers run the risk of not saving enough data, and
+          * having to do this all over again.
+          *
+          * I have not done extensive checking on this number.
+          */
          max_d = 96;
 
          while (num_new_palette > maximum_colors)
@@ -436,8 +455,8 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
          png_free(png_ptr, hash);
          png_free(png_ptr, png_ptr->palette_to_index);
          png_free(png_ptr, png_ptr->index_to_palette);
-         png_ptr->palette_to_index=NULL;
-         png_ptr->index_to_palette=NULL;
+         png_ptr->palette_to_index = NULL;
+         png_ptr->index_to_palette = NULL;
       }
       num_palette = maximum_colors;
    }
@@ -457,12 +476,10 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
       int num_green = (1 << PNG_DITHER_GREEN_BITS);
       int num_blue = (1 << PNG_DITHER_BLUE_BITS);
       png_size_t num_entries = ((png_size_t)1 << total_bits);
-
       png_ptr->palette_lookup = (png_bytep )png_malloc(png_ptr,
-         (png_uint_32)(num_entries * png_sizeof (png_byte)));
-
+         (png_uint_32)(num_entries * png_sizeof(png_byte)));
       png_memset(png_ptr->palette_lookup, 0, num_entries *
-         png_sizeof (png_byte));
+         png_sizeof(png_byte));
 
       distance = (png_bytep)png_malloc(png_ptr, (png_uint_32)(num_entries *
          png_sizeof(png_byte)));
@@ -526,8 +543,9 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
 void PNGAPI
 png_set_gamma(png_structp png_ptr, double scrn_gamma, double file_gamma)
 {
-   png_debug(1, "in png_set_gamma\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_gamma");
+   if (png_ptr == NULL)
+      return;
    if ((fabs(scrn_gamma * file_gamma - 1.0) > PNG_GAMMA_THRESHOLD) ||
        (png_ptr->color_type & PNG_COLOR_MASK_ALPHA) ||
        (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE))
@@ -545,8 +563,9 @@ png_set_gamma(png_structp png_ptr, double scrn_gamma, double file_gamma)
 void PNGAPI
 png_set_expand(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_expand\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_expand");
+   if (png_ptr == NULL)
+      return;
    png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS);
    png_ptr->flags &= ~PNG_FLAG_ROW_INIT;
 }
@@ -572,8 +591,9 @@ png_set_expand(png_structp png_ptr)
 void PNGAPI
 png_set_palette_to_rgb(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_palette_to_rgb\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_palette_to_rgb");
+   if (png_ptr == NULL)
+      return;
    png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS);
    png_ptr->flags &= ~PNG_FLAG_ROW_INIT;
 }
@@ -583,8 +603,9 @@ png_set_palette_to_rgb(png_structp png_ptr)
 void PNGAPI
 png_set_expand_gray_1_2_4_to_8(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_expand_gray_1_2_4_to_8\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_expand_gray_1_2_4_to_8");
+   if (png_ptr == NULL)
+      return;
    png_ptr->transformations |= PNG_EXPAND;
    png_ptr->flags &= ~PNG_FLAG_ROW_INIT;
 }
@@ -596,8 +617,9 @@ png_set_expand_gray_1_2_4_to_8(png_structp png_ptr)
 void PNGAPI
 png_set_gray_1_2_4_to_8(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_gray_1_2_4_to_8\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_gray_1_2_4_to_8");
+   if (png_ptr == NULL)
+      return;
    png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS);
 }
 #endif
@@ -607,7 +629,7 @@ png_set_gray_1_2_4_to_8(png_structp png_ptr)
 void PNGAPI
 png_set_tRNS_to_alpha(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_tRNS_to_alpha\n");
+   png_debug(1, "in png_set_tRNS_to_alpha");
    png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS);
    png_ptr->flags &= ~PNG_FLAG_ROW_INIT;
 }
@@ -617,7 +639,7 @@ png_set_tRNS_to_alpha(png_structp png_ptr)
 void PNGAPI
 png_set_gray_to_rgb(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_gray_to_rgb\n");
+   png_debug(1, "in png_set_gray_to_rgb");
    png_ptr->transformations |= PNG_GRAY_TO_RGB;
    png_ptr->flags &= ~PNG_FLAG_ROW_INIT;
 }
@@ -633,10 +655,11 @@ void PNGAPI
 png_set_rgb_to_gray(png_structp png_ptr, int error_action, double red,
    double green)
 {
-      int red_fixed = (int)((float)red*100000.0 + 0.5);
-      int green_fixed = (int)((float)green*100000.0 + 0.5);
-      if(png_ptr == NULL) return;
-      png_set_rgb_to_gray_fixed(png_ptr, error_action, red_fixed, green_fixed);
+   int red_fixed = (int)((float)red*100000.0 + 0.5);
+   int green_fixed = (int)((float)green*100000.0 + 0.5);
+   if (png_ptr == NULL)
+      return;
+   png_set_rgb_to_gray_fixed(png_ptr, error_action, red_fixed, green_fixed);
 }
 #endif
 
@@ -644,14 +667,17 @@ void PNGAPI
 png_set_rgb_to_gray_fixed(png_structp png_ptr, int error_action,
    png_fixed_point red, png_fixed_point green)
 {
-   png_debug(1, "in png_set_rgb_to_gray\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_rgb_to_gray");
+   if (png_ptr == NULL)
+      return;
    switch(error_action)
    {
       case 1: png_ptr->transformations |= PNG_RGB_TO_GRAY;
               break;
+
       case 2: png_ptr->transformations |= PNG_RGB_TO_GRAY_WARN;
               break;
+
       case 3: png_ptr->transformations |= PNG_RGB_TO_GRAY_ERR;
    }
    if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
@@ -659,21 +685,22 @@ png_set_rgb_to_gray_fixed(png_structp png_ptr, int error_action,
       png_ptr->transformations |= PNG_EXPAND;
 #else
    {
-      png_warning(png_ptr, "Cannot do RGB_TO_GRAY without EXPAND_SUPPORTED.");
+      png_warning(png_ptr,
+        "Cannot do RGB_TO_GRAY without EXPAND_SUPPORTED.");
       png_ptr->transformations &= ~PNG_RGB_TO_GRAY;
    }
 #endif
    {
       png_uint_16 red_int, green_int;
-      if(red < 0 || green < 0)
+      if (red < 0 || green < 0)
       {
          red_int   =  6968; /* .212671 * 32768 + .5 */
          green_int = 23434; /* .715160 * 32768 + .5 */
       }
-      else if(red + green < 100000L)
+      else if (red + green < 100000L)
       {
-        red_int = (png_uint_16)(((png_uint_32)red*32768L)/100000L);
-        green_int = (png_uint_16)(((png_uint_32)green*32768L)/100000L);
+         red_int = (png_uint_16)(((png_uint_32)red*32768L)/100000L);
+         green_int = (png_uint_16)(((png_uint_32)green*32768L)/100000L);
       }
       else
       {
@@ -683,26 +710,28 @@ png_set_rgb_to_gray_fixed(png_structp png_ptr, int error_action,
       }
       png_ptr->rgb_to_gray_red_coeff   = red_int;
       png_ptr->rgb_to_gray_green_coeff = green_int;
-      png_ptr->rgb_to_gray_blue_coeff  = (png_uint_16)(32768-red_int-green_int);
+      png_ptr->rgb_to_gray_blue_coeff  =
+         (png_uint_16)(32768 - red_int - green_int);
    }
 }
 #endif
 
 #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) || \
-    defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED) || \
-    defined(PNG_LEGACY_SUPPORTED)
+    defined(PNG_LEGACY_SUPPORTED) || \
+    defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED)
 void PNGAPI
 png_set_read_user_transform_fn(png_structp png_ptr, png_user_transform_ptr
    read_user_transform_fn)
 {
-   png_debug(1, "in png_set_read_user_transform_fn\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_read_user_transform_fn");
+   if (png_ptr == NULL)
+      return;
 #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED)
    png_ptr->transformations |= PNG_USER_TRANSFORM;
    png_ptr->read_user_transform_fn = read_user_transform_fn;
 #endif
 #ifdef PNG_LEGACY_SUPPORTED
-   if(read_user_transform_fn)
+   if (read_user_transform_fn)
       png_warning(png_ptr,
         "This version of libpng does not support user transforms");
 #endif
@@ -715,9 +744,9 @@ png_set_read_user_transform_fn(png_structp png_ptr, png_user_transform_ptr
 void /* PRIVATE */
 png_init_read_transformations(png_structp png_ptr)
 {
-   png_debug(1, "in png_init_read_transformations\n");
+   png_debug(1, "in png_init_read_transformations");
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
-   if(png_ptr != NULL)
+   if (png_ptr != NULL)
 #endif
   {
 #if defined(PNG_READ_BACKGROUND_SUPPORTED) || defined(PNG_READ_SHIFT_SUPPORTED) \
@@ -729,8 +758,9 @@ png_init_read_transformations(png_structp png_ptr)
 
 #if defined(PNG_READ_GRAY_TO_RGB_SUPPORTED)
    /* Detect gray background and attempt to enable optimization
-    * for gray --> RGB case */
-   /* Note:  if PNG_BACKGROUND_EXPAND is set and color_type is either RGB or
+    * for gray --> RGB case
+    *
+    * Note:  if PNG_BACKGROUND_EXPAND is set and color_type is either RGB or
     * RGB_ALPHA (in which case need_expand is superfluous anyway), the
     * background color might actually be gray yet not be flagged as such.
     * This is not a problem for the current code, which uses
@@ -757,7 +787,7 @@ png_init_read_transformations(png_structp png_ptr)
    {
       if (!(color_type & PNG_COLOR_MASK_COLOR))  /* i.e., GRAY or GRAY_ALPHA */
       {
-         /* expand background and tRNS chunks */
+         /* Expand background and tRNS chunks */
          switch (png_ptr->bit_depth)
          {
             case 1:
@@ -771,6 +801,7 @@ png_init_read_transformations(png_structp png_ptr)
                    = png_ptr->trans_values.blue = png_ptr->trans_values.gray;
                }
                break;
+
             case 2:
                png_ptr->background.gray *= (png_uint_16)0x55;
                png_ptr->background.red = png_ptr->background.green
@@ -782,6 +813,7 @@ png_init_read_transformations(png_structp png_ptr)
                    = png_ptr->trans_values.blue = png_ptr->trans_values.gray;
                }
                break;
+
             case 4:
                png_ptr->background.gray *= (png_uint_16)0x11;
                png_ptr->background.red = png_ptr->background.green
@@ -793,7 +825,9 @@ png_init_read_transformations(png_structp png_ptr)
                    = png_ptr->trans_values.blue = png_ptr->trans_values.gray;
                }
                break;
+
             case 8:
+
             case 16:
                png_ptr->background.red = png_ptr->background.green
                  = png_ptr->background.blue = png_ptr->background.gray;
@@ -816,9 +850,10 @@ png_init_read_transformations(png_structp png_ptr)
            if (!(png_ptr->transformations & PNG_EXPAND_tRNS))
 #endif
            {
-           /* invert the alpha channel (in tRNS) unless the pixels are
-              going to be expanded, in which case leave it for later */
-              int i,istop;
+           /* Invert the alpha channel (in tRNS) unless the pixels are
+            * going to be expanded, in which case leave it for later
+            */
+              int i, istop;
               istop=(int)png_ptr->num_trans;
               for (i=0; i<istop; i++)
                  png_ptr->trans[i] = (png_byte)(255 - png_ptr->trans[i]);
@@ -839,12 +874,12 @@ png_init_read_transformations(png_structp png_ptr)
        && (fabs(png_ptr->screen_gamma * png_ptr->gamma - 1.0)
          < PNG_GAMMA_THRESHOLD))
    {
-    int i,k;
+    int i, k;
     k=0;
     for (i=0; i<png_ptr->num_trans; i++)
     {
       if (png_ptr->trans[i] != 0 && png_ptr->trans[i] != 0xff)
-        k=1; /* partial transparency is present */
+        k=1; /* Partial transparency is present */
     }
     if (k == 0)
       png_ptr->transformations &= ~PNG_GAMMA;
@@ -859,8 +894,7 @@ png_init_read_transformations(png_structp png_ptr)
       {
          if (color_type == PNG_COLOR_TYPE_PALETTE)
          {
-           /* could skip if no transparency and
-           */
+           /* Could skip if no transparency */
             png_color back, back_1;
             png_colorp palette = png_ptr->palette;
             int num_palette = png_ptr->num_palette;
@@ -885,10 +919,12 @@ png_init_read_transformations(png_structp png_ptr)
                      g = (png_ptr->screen_gamma);
                      gs = 1.0;
                      break;
+
                   case PNG_BACKGROUND_GAMMA_FILE:
                      g = 1.0 / (png_ptr->gamma);
                      gs = 1.0 / (png_ptr->gamma * png_ptr->screen_gamma);
                      break;
+
                   case PNG_BACKGROUND_GAMMA_UNIQUE:
                      g = 1.0 / (png_ptr->background_gamma);
                      gs = 1.0 / (png_ptr->background_gamma *
@@ -977,10 +1013,12 @@ png_init_read_transformations(png_structp png_ptr)
                   g = (png_ptr->screen_gamma);
                   gs = 1.0;
                   break;
+
                case PNG_BACKGROUND_GAMMA_FILE:
                   g = 1.0 / (png_ptr->gamma);
                   gs = 1.0 / (png_ptr->gamma * png_ptr->screen_gamma);
                   break;
+
                case PNG_BACKGROUND_GAMMA_UNIQUE:
                   g = 1.0 / (png_ptr->background_gamma);
                   gs = 1.0 / (png_ptr->background_gamma *
@@ -1022,7 +1060,7 @@ png_init_read_transformations(png_structp png_ptr)
          }
       }
       else
-      /* transformation does not include PNG_BACKGROUND */
+      /* Transformation does not include PNG_BACKGROUND */
 #endif /* PNG_READ_BACKGROUND_SUPPORTED */
       if (color_type == PNG_COLOR_TYPE_PALETTE)
       {
@@ -1110,7 +1148,7 @@ png_init_read_transformations(png_structp png_ptr)
  }
 #if !defined(PNG_READ_GAMMA_SUPPORTED) && !defined(PNG_READ_SHIFT_SUPPORTED) \
  && !defined(PNG_READ_BACKGROUND_SUPPORTED)
-   if(png_ptr)
+   if (png_ptr)
       return;
 #endif
 }
@@ -1122,7 +1160,7 @@ png_init_read_transformations(png_structp png_ptr)
 void /* PRIVATE */
 png_read_transform_info(png_structp png_ptr, png_infop info_ptr)
 {
-   png_debug(1, "in png_read_transform_info\n");
+   png_debug(1, "in png_read_transform_info");
 #if defined(PNG_READ_EXPAND_SUPPORTED)
    if (png_ptr->transformations & PNG_EXPAND)
    {
@@ -1142,10 +1180,6 @@ png_read_transform_info(png_structp png_ptr, png_infop info_ptr)
          {
             if (png_ptr->transformations & PNG_EXPAND_tRNS)
               info_ptr->color_type |= PNG_COLOR_MASK_ALPHA;
-#if 0 /* Removed from libpng-1.2.27 */
-            else
-              info_ptr->color_type |= PNG_COLOR_MASK_COLOR;
-#endif
          }
          if (info_ptr->bit_depth < 8)
             info_ptr->bit_depth = 8;
@@ -1194,8 +1228,8 @@ png_read_transform_info(png_structp png_ptr, png_infop info_ptr)
    if (png_ptr->transformations & PNG_DITHER)
    {
       if (((info_ptr->color_type == PNG_COLOR_TYPE_RGB) ||
-         (info_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)) &&
-         png_ptr->palette_lookup && info_ptr->bit_depth == 8)
+          (info_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)) &&
+          png_ptr->palette_lookup && info_ptr->bit_depth == 8)
       {
          info_ptr->color_type = PNG_COLOR_TYPE_PALETTE;
       }
@@ -1229,7 +1263,7 @@ png_read_transform_info(png_structp png_ptr, png_infop info_ptr)
        (info_ptr->color_type == PNG_COLOR_TYPE_GRAY)))
    {
       info_ptr->channels++;
-      /* if adding a true alpha channel not just filler */
+      /* If adding a true alpha channel not just filler */
 #if !defined(PNG_1_0_X)
       if (png_ptr->transformations & PNG_ADD_ALPHA)
         info_ptr->color_type |= PNG_COLOR_MASK_ALPHA;
@@ -1239,11 +1273,11 @@ png_read_transform_info(png_structp png_ptr, png_infop info_ptr)
 
 #if defined(PNG_USER_TRANSFORM_PTR_SUPPORTED) && \
 defined(PNG_READ_USER_TRANSFORM_SUPPORTED)
-   if(png_ptr->transformations & PNG_USER_TRANSFORM)
+   if (png_ptr->transformations & PNG_USER_TRANSFORM)
      {
-       if(info_ptr->bit_depth < png_ptr->user_transform_depth)
+       if (info_ptr->bit_depth < png_ptr->user_transform_depth)
          info_ptr->bit_depth = png_ptr->user_transform_depth;
-       if(info_ptr->channels < png_ptr->user_transform_channels)
+       if (info_ptr->channels < png_ptr->user_transform_channels)
          info_ptr->channels = png_ptr->user_transform_channels;
      }
 #endif
@@ -1251,10 +1285,10 @@ defined(PNG_READ_USER_TRANSFORM_SUPPORTED)
    info_ptr->pixel_depth = (png_byte)(info_ptr->channels *
       info_ptr->bit_depth);
 
-   info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth,info_ptr->width);
+   info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, info_ptr->width);
 
 #if !defined(PNG_READ_EXPAND_SUPPORTED)
-   if(png_ptr)
+   if (png_ptr)
       return;
 #endif
 }
@@ -1266,14 +1300,14 @@ defined(PNG_READ_USER_TRANSFORM_SUPPORTED)
 void /* PRIVATE */
 png_do_read_transformations(png_structp png_ptr)
 {
-   png_debug(1, "in png_do_read_transformations\n");
+   png_debug(1, "in png_do_read_transformations");
    if (png_ptr->row_buf == NULL)
    {
 #if !defined(PNG_NO_STDIO) && !defined(_WIN32_WCE)
       char msg[50];
 
       png_snprintf2(msg, 50,
-         "NULL row buffer for row %ld, pass %d", png_ptr->row_number,
+         "NULL row buffer for row %ld, pass %d", (long)png_ptr->row_number,
          png_ptr->pass);
       png_error(png_ptr, msg);
 #else
@@ -1284,7 +1318,8 @@ png_do_read_transformations(png_structp png_ptr)
    if (!(png_ptr->flags & PNG_FLAG_ROW_INIT))
       /* Application has failed to call either png_read_start_image()
        * or png_read_update_info() after setting transforms that expand
-       * pixels.  This check added to libpng-1.2.19 */
+       * pixels.  This check added to libpng-1.2.19
+       */
 #if (PNG_WARN_UNINITIALIZED_ROW==1)
       png_error(png_ptr, "Uninitialized row");
 #else
@@ -1324,52 +1359,54 @@ png_do_read_transformations(png_structp png_ptr)
    {
       int rgb_error =
          png_do_rgb_to_gray(png_ptr, &(png_ptr->row_info), png_ptr->row_buf + 1);
-      if(rgb_error)
+      if (rgb_error)
       {
          png_ptr->rgb_to_gray_status=1;
-         if((png_ptr->transformations & PNG_RGB_TO_GRAY) == 
+         if ((png_ptr->transformations & PNG_RGB_TO_GRAY) ==
              PNG_RGB_TO_GRAY_WARN)
             png_warning(png_ptr, "png_do_rgb_to_gray found nongray pixel");
-         if((png_ptr->transformations & PNG_RGB_TO_GRAY) ==
+         if ((png_ptr->transformations & PNG_RGB_TO_GRAY) ==
              PNG_RGB_TO_GRAY_ERR)
             png_error(png_ptr, "png_do_rgb_to_gray found nongray pixel");
       }
    }
 #endif
 
-/*
-From Andreas Dilger e-mail to png-implement, 26 March 1998:
-
-  In most cases, the "simple transparency" should be done prior to doing
-  gray-to-RGB, or you will have to test 3x as many bytes to check if a
-  pixel is transparent.  You would also need to make sure that the
-  transparency information is upgraded to RGB.
-
-  To summarize, the current flow is:
-  - Gray + simple transparency -> compare 1 or 2 gray bytes and composite
-                                  with background "in place" if transparent,
-                                  convert to RGB if necessary
-  - Gray + alpha -> composite with gray background and remove alpha bytes,
-                                  convert to RGB if necessary
-
-  To support RGB backgrounds for gray images we need:
-  - Gray + simple transparency -> convert to RGB + simple transparency, compare
-                                  3 or 6 bytes and composite with background
-                                  "in place" if transparent (3x compare/pixel
-                                  compared to doing composite with gray bkgrnd)
-  - Gray + alpha -> convert to RGB + alpha, composite with background and
-                                  remove alpha bytes (3x float operations/pixel
-                                  compared with composite on gray background)
-
-  Greg's change will do this.  The reason it wasn't done before is for
-  performance, as this increases the per-pixel operations.  If we would check
-  in advance if the background was gray or RGB, and position the gray-to-RGB
-  transform appropriately, then it would save a lot of work/time.
+/* From Andreas Dilger e-mail to png-implement, 26 March 1998:
+ *
+ *   In most cases, the "simple transparency" should be done prior to doing
+ *   gray-to-RGB, or you will have to test 3x as many bytes to check if a
+ *   pixel is transparent.  You would also need to make sure that the
+ *   transparency information is upgraded to RGB.
+ *
+ *   To summarize, the current flow is:
+ *   - Gray + simple transparency -> compare 1 or 2 gray bytes and composite
+ *                                   with background "in place" if transparent,
+ *                                   convert to RGB if necessary
+ *   - Gray + alpha -> composite with gray background and remove alpha bytes,
+ *                                   convert to RGB if necessary
+ *
+ *   To support RGB backgrounds for gray images we need:
+ *   - Gray + simple transparency -> convert to RGB + simple transparency,
+ *                                   compare 3 or 6 bytes and composite with
+ *                                   background "in place" if transparent
+ *                                   (3x compare/pixel compared to doing
+ *                                   composite with gray bkgrnd)
+ *   - Gray + alpha -> convert to RGB + alpha, composite with background and
+ *                                   remove alpha bytes (3x float
+ *                                   operations/pixel compared with composite
+ *                                   on gray background)
+ *
+ *  Greg's change will do this.  The reason it wasn't done before is for
+ *  performance, as this increases the per-pixel operations.  If we would check
+ *  in advance if the background was gray or RGB, and position the gray-to-RGB
+ *  transform appropriately, then it would save a lot of work/time.
  */
 
 #if defined(PNG_READ_GRAY_TO_RGB_SUPPORTED)
-   /* if gray -> RGB, do so now only if background is non-gray; else do later
-    * for performance reasons */
+   /* If gray -> RGB, do so now only if background is non-gray; else do later
+    * for performance reasons
+    */
    if ((png_ptr->transformations & PNG_GRAY_TO_RGB) &&
        !(png_ptr->mode & PNG_BACKGROUND_IS_GRAY))
       png_do_gray_to_rgb(&(png_ptr->row_info), png_ptr->row_buf + 1);
@@ -1394,14 +1431,14 @@ From Andreas Dilger e-mail to png-implement, 26 March 1998:
 #if defined(PNG_READ_GAMMA_SUPPORTED)
    if ((png_ptr->transformations & PNG_GAMMA) &&
 #if defined(PNG_READ_BACKGROUND_SUPPORTED)
-      !((png_ptr->transformations & PNG_BACKGROUND) &&
-      ((png_ptr->num_trans != 0) ||
-      (png_ptr->color_type & PNG_COLOR_MASK_ALPHA))) &&
+       !((png_ptr->transformations & PNG_BACKGROUND) &&
+       ((png_ptr->num_trans != 0) ||
+       (png_ptr->color_type & PNG_COLOR_MASK_ALPHA))) &&
 #endif
-      (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE))
+       (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE))
       png_do_gamma(&(png_ptr->row_info), png_ptr->row_buf + 1,
-         png_ptr->gamma_table, png_ptr->gamma_16_table,
-         png_ptr->gamma_shift);
+          png_ptr->gamma_table, png_ptr->gamma_16_table,
+          png_ptr->gamma_shift);
 #endif
 
 #if defined(PNG_READ_16_TO_8_SUPPORTED)
@@ -1414,7 +1451,7 @@ From Andreas Dilger e-mail to png-implement, 26 March 1998:
    {
       png_do_dither((png_row_infop)&(png_ptr->row_info), png_ptr->row_buf + 1,
          png_ptr->palette_lookup, png_ptr->dither_index);
-      if(png_ptr->row_info.rowbytes == (png_uint_32)0)
+      if (png_ptr->row_info.rowbytes == (png_uint_32)0)
          png_error(png_ptr, "png_do_dither returned rowbytes=0");
    }
 #endif
@@ -1446,7 +1483,7 @@ From Andreas Dilger e-mail to png-implement, 26 March 1998:
 #endif
 
 #if defined(PNG_READ_GRAY_TO_RGB_SUPPORTED)
-   /* if gray -> RGB, do so now only if we did not do so above */
+   /* If gray -> RGB, do so now only if we did not do so above */
    if ((png_ptr->transformations & PNG_GRAY_TO_RGB) &&
        (png_ptr->mode & PNG_BACKGROUND_IS_GRAY))
       png_do_gray_to_rgb(&(png_ptr->row_info), png_ptr->row_buf + 1);
@@ -1476,21 +1513,21 @@ From Andreas Dilger e-mail to png-implement, 26 March 1998:
 #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED)
    if (png_ptr->transformations & PNG_USER_TRANSFORM)
     {
-      if(png_ptr->read_user_transform_fn != NULL)
-        (*(png_ptr->read_user_transform_fn)) /* user read transform function */
-          (png_ptr,                    /* png_ptr */
-           &(png_ptr->row_info),       /* row_info:     */
-             /*  png_uint_32 width;          width of row */
-             /*  png_uint_32 rowbytes;       number of bytes in row */
-             /*  png_byte color_type;        color type of pixels */
-             /*  png_byte bit_depth;         bit depth of samples */
-             /*  png_byte channels;          number of channels (1-4) */
-             /*  png_byte pixel_depth;       bits per pixel (depth*channels) */
-           png_ptr->row_buf + 1);      /* start of pixel data for row */
+      if (png_ptr->read_user_transform_fn != NULL)
+         (*(png_ptr->read_user_transform_fn)) /* User read transform function */
+            (png_ptr,                    /* png_ptr */
+               &(png_ptr->row_info),     /* row_info: */
+               /*  png_uint_32 width;       width of row */
+               /*  png_uint_32 rowbytes;    number of bytes in row */
+               /*  png_byte color_type;     color type of pixels */
+               /*  png_byte bit_depth;      bit depth of samples */
+               /*  png_byte channels;       number of channels (1-4) */
+               /*  png_byte pixel_depth;    bits per pixel (depth*channels) */
+               png_ptr->row_buf + 1);    /* start of pixel data for row */
 #if defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
-      if(png_ptr->user_transform_depth)
+      if (png_ptr->user_transform_depth)
          png_ptr->row_info.bit_depth = png_ptr->user_transform_depth;
-      if(png_ptr->user_transform_channels)
+      if (png_ptr->user_transform_channels)
          png_ptr->row_info.channels = png_ptr->user_transform_channels;
 #endif
       png_ptr->row_info.pixel_depth = (png_byte)(png_ptr->row_info.bit_depth *
@@ -1512,7 +1549,7 @@ From Andreas Dilger e-mail to png-implement, 26 March 1998:
 void /* PRIVATE */
 png_do_unpack(png_row_infop row_info, png_bytep row)
 {
-   png_debug(1, "in png_do_unpack\n");
+   png_debug(1, "in png_do_unpack");
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
    if (row != NULL && row_info != NULL && row_info->bit_depth < 8)
 #else
@@ -1544,6 +1581,7 @@ png_do_unpack(png_row_infop row_info, png_bytep row)
             }
             break;
          }
+
          case 2:
          {
 
@@ -1565,6 +1603,7 @@ png_do_unpack(png_row_infop row_info, png_bytep row)
             }
             break;
          }
+
          case 4:
          {
             png_bytep sp = row + (png_size_t)((row_width - 1) >> 1);
@@ -1602,7 +1641,7 @@ png_do_unpack(png_row_infop row_info, png_bytep row)
 void /* PRIVATE */
 png_do_unshift(png_row_infop row_info, png_bytep row, png_color_8p sig_bits)
 {
-   png_debug(1, "in png_do_unshift\n");
+   png_debug(1, "in png_do_unshift");
    if (
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
        row != NULL && row_info != NULL && sig_bits != NULL &&
@@ -1656,6 +1695,7 @@ png_do_unshift(png_row_infop row_info, png_bytep row, png_color_8p sig_bits)
             }
             break;
          }
+
          case 4:
          {
             png_bytep bp = row;
@@ -1671,6 +1711,7 @@ png_do_unshift(png_row_infop row_info, png_bytep row, png_color_8p sig_bits)
             }
             break;
          }
+
          case 8:
          {
             png_bytep bp = row;
@@ -1683,6 +1724,7 @@ png_do_unshift(png_row_infop row_info, png_bytep row, png_color_8p sig_bits)
             }
             break;
          }
+
          case 16:
          {
             png_bytep bp = row;
@@ -1704,11 +1746,11 @@ png_do_unshift(png_row_infop row_info, png_bytep row, png_color_8p sig_bits)
 #endif
 
 #if defined(PNG_READ_16_TO_8_SUPPORTED)
-/* chop rows of bit depth 16 down to 8 */
+/* Chop rows of bit depth 16 down to 8 */
 void /* PRIVATE */
 png_do_chop(png_row_infop row_info, png_bytep row)
 {
-   png_debug(1, "in png_do_chop\n");
+   png_debug(1, "in png_do_chop");
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
    if (row != NULL && row_info != NULL && row_info->bit_depth == 16)
 #else
@@ -1728,14 +1770,17 @@ png_do_chop(png_row_infop row_info, png_bytep row)
        *
        * What the ideal calculation should be:
        *   *dp = (((((png_uint_32)(*sp) << 8) |
-       *          (png_uint_32)(*(sp + 1))) * 255 + 127) / (png_uint_32)65535L;
+       *          (png_uint_32)(*(sp + 1))) * 255 + 127)
+       *          / (png_uint_32)65535L;
        *
        * GRR: no, I think this is what it really should be:
        *   *dp = (((((png_uint_32)(*sp) << 8) |
-       *           (png_uint_32)(*(sp + 1))) + 128L) / (png_uint_32)257L;
+       *           (png_uint_32)(*(sp + 1))) + 128L)
+       *           / (png_uint_32)257L;
        *
        * GRR: here's the exact calculation with shifts:
-       *   temp = (((png_uint_32)(*sp) << 8) | (png_uint_32)(*(sp + 1))) + 128L;
+       *   temp = (((png_uint_32)(*sp) << 8) |
+       *           (png_uint_32)(*(sp + 1))) + 128L;
        *   *dp = (temp - (temp >> 8)) >> 8;
        *
        * Approximate calculation with shift/add instead of multiply/divide:
@@ -1762,7 +1807,7 @@ png_do_chop(png_row_infop row_info, png_bytep row)
 void /* PRIVATE */
 png_do_read_swap_alpha(png_row_infop row_info, png_bytep row)
 {
-   png_debug(1, "in png_do_read_swap_alpha\n");
+   png_debug(1, "in png_do_read_swap_alpha");
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
    if (row != NULL && row_info != NULL)
 #endif
@@ -1854,7 +1899,7 @@ png_do_read_swap_alpha(png_row_infop row_info, png_bytep row)
 void /* PRIVATE */
 png_do_read_invert_alpha(png_row_infop row_info, png_bytep row)
 {
-   png_debug(1, "in png_do_read_invert_alpha\n");
+   png_debug(1, "in png_do_read_invert_alpha");
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
    if (row != NULL && row_info != NULL)
 #endif
@@ -1960,14 +2005,14 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
    png_byte hi_filler = (png_byte)((filler>>8) & 0xff);
    png_byte lo_filler = (png_byte)(filler & 0xff);
 
-   png_debug(1, "in png_do_read_filler\n");
+   png_debug(1, "in png_do_read_filler");
    if (
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
        row != NULL  && row_info != NULL &&
 #endif
        row_info->color_type == PNG_COLOR_TYPE_GRAY)
    {
-      if(row_info->bit_depth == 8)
+      if (row_info->bit_depth == 8)
       {
          /* This changes the data from G to GX */
          if (flags & PNG_FLAG_FILLER_AFTER)
@@ -1999,7 +2044,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
             row_info->rowbytes = row_width * 2;
          }
       }
-      else if(row_info->bit_depth == 16)
+      else if (row_info->bit_depth == 16)
       {
          /* This changes the data from GG to GGXX */
          if (flags & PNG_FLAG_FILLER_AFTER)
@@ -2039,7 +2084,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
    } /* COLOR_TYPE == GRAY */
    else if (row_info->color_type == PNG_COLOR_TYPE_RGB)
    {
-      if(row_info->bit_depth == 8)
+      if (row_info->bit_depth == 8)
       {
          /* This changes the data from RGB to RGBX */
          if (flags & PNG_FLAG_FILLER_AFTER)
@@ -2075,7 +2120,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
             row_info->rowbytes = row_width * 4;
          }
       }
-      else if(row_info->bit_depth == 16)
+      else if (row_info->bit_depth == 16)
       {
          /* This changes the data from RRGGBB to RRGGBBXX */
          if (flags & PNG_FLAG_FILLER_AFTER)
@@ -2125,14 +2170,14 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
 #endif
 
 #if defined(PNG_READ_GRAY_TO_RGB_SUPPORTED)
-/* expand grayscale files to RGB, with or without alpha */
+/* Expand grayscale files to RGB, with or without alpha */
 void /* PRIVATE */
 png_do_gray_to_rgb(png_row_infop row_info, png_bytep row)
 {
    png_uint_32 i;
    png_uint_32 row_width = row_info->width;
 
-   png_debug(1, "in png_do_gray_to_rgb\n");
+   png_debug(1, "in png_do_gray_to_rgb");
    if (row_info->bit_depth >= 8 &&
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
        row != NULL && row_info != NULL &&
@@ -2202,16 +2247,18 @@ png_do_gray_to_rgb(png_row_infop row_info, png_bytep row)
       row_info->color_type |= PNG_COLOR_MASK_COLOR;
       row_info->pixel_depth = (png_byte)(row_info->channels *
          row_info->bit_depth);
-      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width);
+      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_width);
    }
 }
 #endif
 
 #if defined(PNG_READ_RGB_TO_GRAY_SUPPORTED)
-/* reduce RGB files to grayscale, with or without alpha
+/* Reduce RGB files to grayscale, with or without alpha
  * using the equation given in Poynton's ColorFAQ at
- * <http://www.inforamp.net/~poynton/>
- * Copyright (c) 1998-01-04 Charles Poynton poynton at inforamp.net
+ * <http://www.inforamp.net/~poynton/>  (THIS LINK IS DEAD June 2008)
+ * New link:
+ * <http://www.poynton.com/notes/colour_and_gamma/>
+ * Charles Poynton poynton at poynton.com
  *
  *     Y = 0.212671 * R + 0.715160 * G + 0.072169 * B
  *
@@ -2236,7 +2283,7 @@ png_do_rgb_to_gray(png_structp png_ptr, png_row_infop row_info, png_bytep row)
    png_uint_32 row_width = row_info->width;
    int rgb_error = 0;
 
-   png_debug(1, "in png_do_rgb_to_gray\n");
+   png_debug(1, "in png_do_rgb_to_gray");
    if (
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
        row != NULL && row_info != NULL &&
@@ -2262,14 +2309,14 @@ png_do_rgb_to_gray(png_structp png_ptr, png_row_infop row_info, png_bytep row)
                   png_byte red   = png_ptr->gamma_to_1[*(sp++)];
                   png_byte green = png_ptr->gamma_to_1[*(sp++)];
                   png_byte blue  = png_ptr->gamma_to_1[*(sp++)];
-                  if(red != green || red != blue)
+                  if (red != green || red != blue)
                   {
                      rgb_error |= 1;
                      *(dp++) = png_ptr->gamma_from_1[
-                       (rc*red+gc*green+bc*blue)>>15];
+                       (rc*red + gc*green + bc*blue)>>15];
                   }
                   else
-                     *(dp++) = *(sp-1);
+                     *(dp++) = *(sp - 1);
                }
             }
             else
@@ -2282,13 +2329,13 @@ png_do_rgb_to_gray(png_structp png_ptr, png_row_infop row_info, png_bytep row)
                   png_byte red   = *(sp++);
                   png_byte green = *(sp++);
                   png_byte blue  = *(sp++);
-                  if(red != green || red != blue)
+                  if (red != green || red != blue)
                   {
                      rgb_error |= 1;
-                     *(dp++) = (png_byte)((rc*red+gc*green+bc*blue)>>15);
+                     *(dp++) = (png_byte)((rc*red + gc*green + bc*blue)>>15);
                   }
                   else
-                     *(dp++) = *(sp-1);
+                     *(dp++) = *(sp - 1);
                }
             }
          }
@@ -2309,7 +2356,7 @@ png_do_rgb_to_gray(png_structp png_ptr, png_row_infop row_info, png_bytep row)
                   green = (png_uint_16)(((*(sp))<<8) | *(sp+1)); sp+=2;
                   blue  = (png_uint_16)(((*(sp))<<8) | *(sp+1)); sp+=2;
 
-                  if(red == green && red == blue)
+                  if (red == green && red == blue)
                      w = red;
                   else
                   {
@@ -2343,7 +2390,7 @@ png_do_rgb_to_gray(png_structp png_ptr, png_row_infop row_info, png_bytep row)
                   green = (png_uint_16)(((*(sp))<<8) | *(sp+1)); sp+=2;
                   blue  = (png_uint_16)(((*(sp))<<8) | *(sp+1)); sp+=2;
 
-                  if(red != green || red != blue)
+                  if (red != green || red != blue)
                      rgb_error |= 1;
                   gray16  = (png_uint_16)((rc*red + gc*green + bc*blue)>>15);
                   *(dp++) = (png_byte)((gray16>>8) & 0xff);
@@ -2366,7 +2413,7 @@ png_do_rgb_to_gray(png_structp png_ptr, png_row_infop row_info, png_bytep row)
                   png_byte red   = png_ptr->gamma_to_1[*(sp++)];
                   png_byte green = png_ptr->gamma_to_1[*(sp++)];
                   png_byte blue  = png_ptr->gamma_to_1[*(sp++)];
-                  if(red != green || red != blue)
+                  if (red != green || red != blue)
                      rgb_error |= 1;
                   *(dp++) =  png_ptr->gamma_from_1
                              [(rc*red + gc*green + bc*blue)>>15];
@@ -2383,7 +2430,7 @@ png_do_rgb_to_gray(png_structp png_ptr, png_row_infop row_info, png_bytep row)
                   png_byte red   = *(sp++);
                   png_byte green = *(sp++);
                   png_byte blue  = *(sp++);
-                  if(red != green || red != blue)
+                  if (red != green || red != blue)
                      rgb_error |= 1;
                   *(dp++) =  (png_byte)((rc*red + gc*green + bc*blue)>>15);
                   *(dp++) = *(sp++);  /* alpha */
@@ -2406,7 +2453,7 @@ png_do_rgb_to_gray(png_structp png_ptr, png_row_infop row_info, png_bytep row)
                   green = (png_uint_16)(((*(sp))<<8) | *(sp+1)); sp+=2;
                   blue  = (png_uint_16)(((*(sp))<<8) | *(sp+1)); sp+=2;
 
-                  if(red == green && red == blue)
+                  if (red == green && red == blue)
                      w = red;
                   else
                   {
@@ -2440,7 +2487,7 @@ png_do_rgb_to_gray(png_structp png_ptr, png_row_infop row_info, png_bytep row)
                   red   = (png_uint_16)((*(sp)<<8) | *(sp+1)); sp+=2;
                   green = (png_uint_16)((*(sp)<<8) | *(sp+1)); sp+=2;
                   blue  = (png_uint_16)((*(sp)<<8) | *(sp+1)); sp+=2;
-                  if(red != green || red != blue)
+                  if (red != green || red != blue)
                      rgb_error |= 1;
                   gray16  = (png_uint_16)((rc*red + gc*green + bc*blue)>>15);
                   *(dp++) = (png_byte)((gray16>>8) & 0xff);
@@ -2455,7 +2502,7 @@ png_do_rgb_to_gray(png_structp png_ptr, png_row_infop row_info, png_bytep row)
       row_info->color_type &= ~PNG_COLOR_MASK_COLOR;
       row_info->pixel_depth = (png_byte)(row_info->channels *
          row_info->bit_depth);
-      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width);
+      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_width);
    }
    return rgb_error;
 }
@@ -2474,7 +2521,7 @@ png_build_grayscale_palette(int bit_depth, png_colorp palette)
    int i;
    int v;
 
-   png_debug(1, "in png_do_build_grayscale_palette\n");
+   png_debug(1, "in png_do_build_grayscale_palette");
    if (palette == NULL)
       return;
 
@@ -2484,18 +2531,22 @@ png_build_grayscale_palette(int bit_depth, png_colorp palette)
          num_palette = 2;
          color_inc = 0xff;
          break;
+
       case 2:
          num_palette = 4;
          color_inc = 0x55;
          break;
+
       case 4:
          num_palette = 16;
          color_inc = 0x11;
          break;
+
       case 8:
          num_palette = 256;
          color_inc = 1;
          break;
+
       default:
          num_palette = 0;
          color_inc = 0;
@@ -2516,7 +2567,7 @@ void /* PRIVATE */
 png_correct_palette(png_structp png_ptr, png_colorp palette,
    int num_palette)
 {
-   png_debug(1, "in png_correct_palette\n");
+   png_debug(1, "in png_correct_palette");
 #if defined(PNG_READ_BACKGROUND_SUPPORTED) && \
     defined(PNG_READ_GAMMA_SUPPORTED) && defined(PNG_FLOATING_POINT_SUPPORTED)
    if (png_ptr->transformations & (PNG_GAMMA | PNG_BACKGROUND))
@@ -2673,7 +2724,7 @@ png_correct_palette(png_structp png_ptr, png_colorp palette,
             }
          }
       }
-      else /* assume grayscale palette (what else could it be?) */
+      else /* Assume grayscale palette (what else could it be?) */
       {
          int i;
 
@@ -2713,7 +2764,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
    png_uint_32 row_width=row_info->width;
    int shift;
 
-   png_debug(1, "in png_do_background\n");
+   png_debug(1, "in png_do_background");
    if (background != NULL &&
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
        row != NULL && row_info != NULL &&
@@ -2749,6 +2800,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
                   }
                   break;
                }
+
                case 2:
                {
 #if defined(PNG_READ_GAMMA_SUPPORTED)
@@ -2805,6 +2857,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
                   }
                   break;
                }
+
                case 4:
                {
 #if defined(PNG_READ_GAMMA_SUPPORTED)
@@ -2861,6 +2914,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
                   }
                   break;
                }
+
                case 8:
                {
 #if defined(PNG_READ_GAMMA_SUPPORTED)
@@ -2893,6 +2947,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
                   }
                   break;
                }
+
                case 16:
                {
 #if defined(PNG_READ_GAMMA_SUPPORTED)
@@ -2906,7 +2961,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
                         v = (png_uint_16)(((*sp) << 8) + *(sp + 1));
                         if (v == trans_values->gray)
                         {
-                           /* background is already in screen gamma */
+                           /* Background is already in screen gamma */
                            *sp = (png_byte)((background->gray >> 8) & 0xff);
                            *(sp + 1) = (png_byte)(background->gray & 0xff);
                         }
@@ -2939,6 +2994,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
             }
             break;
          }
+
          case PNG_COLOR_TYPE_RGB:
          {
             if (row_info->bit_depth == 8)
@@ -2996,7 +3052,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
                      if (r == trans_values->red && g == trans_values->green &&
                         b == trans_values->blue)
                      {
-                        /* background is already in screen gamma */
+                        /* Background is already in screen gamma */
                         *sp = (png_byte)((background->red >> 8) & 0xff);
                         *(sp + 1) = (png_byte)(background->red & 0xff);
                         *(sp + 2) = (png_byte)((background->green >> 8) & 0xff);
@@ -3043,6 +3099,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
             }
             break;
          }
+
          case PNG_COLOR_TYPE_GRAY_ALPHA:
          {
             if (row_info->bit_depth == 8)
@@ -3063,7 +3120,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
                      }
                      else if (a == 0)
                      {
-                        /* background is already in screen gamma */
+                        /* Background is already in screen gamma */
                         *dp = (png_byte)background->gray;
                      }
                      else
@@ -3130,7 +3187,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
                      else
 #endif
                      {
-                        /* background is already in screen gamma */
+                        /* Background is already in screen gamma */
                         *dp = (png_byte)((background->gray >> 8) & 0xff);
                         *(dp + 1) = (png_byte)(background->gray & 0xff);
                      }
@@ -3185,6 +3242,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
             }
             break;
          }
+
          case PNG_COLOR_TYPE_RGB_ALPHA:
          {
             if (row_info->bit_depth == 8)
@@ -3207,7 +3265,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
                      }
                      else if (a == 0)
                      {
-                        /* background is already in screen gamma */
+                        /* Background is already in screen gamma */
                         *dp = (png_byte)background->red;
                         *(dp + 1) = (png_byte)background->green;
                         *(dp + 2) = (png_byte)background->blue;
@@ -3288,7 +3346,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
                      }
                      else if (a == 0)
                      {
-                        /* background is already in screen gamma */
+                        /* Background is already in screen gamma */
                         *dp = (png_byte)((background->red >> 8) & 0xff);
                         *(dp + 1) = (png_byte)(background->red & 0xff);
                         *(dp + 2) = (png_byte)((background->green >> 8) & 0xff);
@@ -3373,7 +3431,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
          row_info->channels--;
          row_info->pixel_depth = (png_byte)(row_info->channels *
             row_info->bit_depth);
-         row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width);
+         row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_width);
       }
    }
 }
@@ -3395,7 +3453,7 @@ png_do_gamma(png_row_infop row_info, png_bytep row,
    png_uint_32 i;
    png_uint_32 row_width=row_info->width;
 
-   png_debug(1, "in png_do_gamma\n");
+   png_debug(1, "in png_do_gamma");
    if (
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
        row != NULL && row_info != NULL &&
@@ -3443,6 +3501,7 @@ png_do_gamma(png_row_infop row_info, png_bytep row,
             }
             break;
          }
+
          case PNG_COLOR_TYPE_RGB_ALPHA:
          {
             if (row_info->bit_depth == 8)
@@ -3480,6 +3539,7 @@ png_do_gamma(png_row_infop row_info, png_bytep row,
             }
             break;
          }
+
          case PNG_COLOR_TYPE_GRAY_ALPHA:
          {
             if (row_info->bit_depth == 8)
@@ -3504,6 +3564,7 @@ png_do_gamma(png_row_infop row_info, png_bytep row,
             }
             break;
          }
+
          case PNG_COLOR_TYPE_GRAY:
          {
             if (row_info->bit_depth == 2)
@@ -3524,6 +3585,7 @@ png_do_gamma(png_row_infop row_info, png_bytep row,
                   sp++;
                }
             }
+
             if (row_info->bit_depth == 4)
             {
                sp = row;
@@ -3537,6 +3599,7 @@ png_do_gamma(png_row_infop row_info, png_bytep row,
                   sp++;
                }
             }
+
             else if (row_info->bit_depth == 8)
             {
                sp = row;
@@ -3546,6 +3609,7 @@ png_do_gamma(png_row_infop row_info, png_bytep row,
                   sp++;
                }
             }
+
             else if (row_info->bit_depth == 16)
             {
                sp = row;
@@ -3577,7 +3641,7 @@ png_do_expand_palette(png_row_infop row_info, png_bytep row,
    png_uint_32 i;
    png_uint_32 row_width=row_info->width;
 
-   png_debug(1, "in png_do_expand_palette\n");
+   png_debug(1, "in png_do_expand_palette");
    if (
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
        row != NULL && row_info != NULL &&
@@ -3611,6 +3675,7 @@ png_do_expand_palette(png_row_infop row_info, png_bytep row,
                }
                break;
             }
+
             case 2:
             {
                sp = row + (png_size_t)((row_width - 1) >> 2);
@@ -3632,6 +3697,7 @@ png_do_expand_palette(png_row_infop row_info, png_bytep row,
                }
                break;
             }
+
             case 4:
             {
                sp = row + (png_size_t)((row_width - 1) >> 1);
@@ -3696,6 +3762,7 @@ png_do_expand_palette(png_row_infop row_info, png_bytep row,
                   *dp-- = palette[*sp].red;
                   sp--;
                }
+
                row_info->bit_depth = 8;
                row_info->pixel_depth = 24;
                row_info->rowbytes = row_width * 3;
@@ -3720,7 +3787,7 @@ png_do_expand(png_row_infop row_info, png_bytep row,
    png_uint_32 i;
    png_uint_32 row_width=row_info->width;
 
-   png_debug(1, "in png_do_expand\n");
+   png_debug(1, "in png_do_expand");
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
    if (row != NULL && row_info != NULL)
 #endif
@@ -3757,6 +3824,7 @@ png_do_expand(png_row_infop row_info, png_bytep row,
                   }
                   break;
                }
+
                case 2:
                {
                   gray = (png_uint_16)((gray&0x03)*0x55);
@@ -3780,6 +3848,7 @@ png_do_expand(png_row_infop row_info, png_bytep row,
                   }
                   break;
                }
+
                case 4:
                {
                   gray = (png_uint_16)((gray&0x0f)*0x11);
@@ -3803,6 +3872,7 @@ png_do_expand(png_row_infop row_info, png_bytep row,
                   break;
                }
             }
+
             row_info->bit_depth = 8;
             row_info->pixel_depth = 8;
             row_info->rowbytes = row_width;
@@ -3824,6 +3894,7 @@ png_do_expand(png_row_infop row_info, png_bytep row,
                   *dp-- = *sp--;
                }
             }
+
             else if (row_info->bit_depth == 16)
             {
                png_byte gray_high = (gray >> 8) & 0xff;
@@ -3832,7 +3903,7 @@ png_do_expand(png_row_infop row_info, png_bytep row,
                dp = row + (row_info->rowbytes << 1) - 1;
                for (i = 0; i < row_width; i++)
                {
-                  if (*(sp-1) == gray_high && *(sp) == gray_low) 
+                  if (*(sp - 1) == gray_high && *(sp) == gray_low)
                   {
                      *dp-- = 0;
                      *dp-- = 0;
@@ -3846,6 +3917,7 @@ png_do_expand(png_row_infop row_info, png_bytep row,
                   *dp-- = *sp--;
                }
             }
+
             row_info->color_type = PNG_COLOR_TYPE_GRAY_ALPHA;
             row_info->channels = 2;
             row_info->pixel_depth = (png_byte)(row_info->bit_depth << 1);
@@ -3911,7 +3983,7 @@ png_do_expand(png_row_infop row_info, png_bytep row,
          row_info->color_type = PNG_COLOR_TYPE_RGB_ALPHA;
          row_info->channels = 4;
          row_info->pixel_depth = (png_byte)(row_info->bit_depth << 2);
-         row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width);
+         row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_width);
       }
    }
 }
@@ -3926,7 +3998,7 @@ png_do_dither(png_row_infop row_info, png_bytep row,
    png_uint_32 i;
    png_uint_32 row_width=row_info->width;
 
-   png_debug(1, "in png_do_dither\n");
+   png_debug(1, "in png_do_dither");
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
    if (row != NULL && row_info != NULL)
 #endif
@@ -3943,13 +4015,13 @@ png_do_dither(png_row_infop row_info, png_bytep row,
             g = *sp++;
             b = *sp++;
 
-            /* this looks real messy, but the compiler will reduce
-               it down to a reasonable formula.  For example, with
-               5 bits per color, we get:
-               p = (((r >> 3) & 0x1f) << 10) |
-                  (((g >> 3) & 0x1f) << 5) |
-                  ((b >> 3) & 0x1f);
-               */
+            /* This looks real messy, but the compiler will reduce
+             * it down to a reasonable formula.  For example, with
+             * 5 bits per color, we get:
+             * p = (((r >> 3) & 0x1f) << 10) |
+             *    (((g >> 3) & 0x1f) << 5) |
+             *    ((b >> 3) & 0x1f);
+             */
             p = (((r >> (8 - PNG_DITHER_RED_BITS)) &
                ((1 << PNG_DITHER_RED_BITS) - 1)) <<
                (PNG_DITHER_GREEN_BITS + PNG_DITHER_BLUE_BITS)) |
@@ -3964,7 +4036,7 @@ png_do_dither(png_row_infop row_info, png_bytep row,
          row_info->color_type = PNG_COLOR_TYPE_PALETTE;
          row_info->channels = 1;
          row_info->pixel_depth = row_info->bit_depth;
-         row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width);
+         row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_width);
       }
       else if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA &&
          palette_lookup != NULL && row_info->bit_depth == 8)
@@ -3993,7 +4065,7 @@ png_do_dither(png_row_infop row_info, png_bytep row,
          row_info->color_type = PNG_COLOR_TYPE_PALETTE;
          row_info->channels = 1;
          row_info->pixel_depth = row_info->bit_depth;
-         row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width);
+         row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_width);
       }
       else if (row_info->color_type == PNG_COLOR_TYPE_PALETTE &&
          dither_lookup && row_info->bit_depth == 8)
@@ -4021,7 +4093,7 @@ static PNG_CONST int png_gamma_shift[] =
 void /* PRIVATE */
 png_build_gamma_table(png_structp png_ptr)
 {
-  png_debug(1, "in png_build_gamma_table\n");
+  png_debug(1, "in png_build_gamma_table");
 
   if (png_ptr->bit_depth <= 8)
   {
@@ -4030,6 +4102,7 @@ png_build_gamma_table(png_structp png_ptr)
 
      if (png_ptr->screen_gamma > .000001)
         g = 1.0 / (png_ptr->gamma * png_ptr->screen_gamma);
+
      else
         g = 1.0;
 
@@ -4062,10 +4135,11 @@ png_build_gamma_table(png_structp png_ptr)
         png_ptr->gamma_from_1 = (png_bytep)png_malloc(png_ptr,
            (png_uint_32)256);
 
-        if(png_ptr->screen_gamma > 0.000001)
+        if (png_ptr->screen_gamma > 0.000001)
            g = 1.0 / png_ptr->screen_gamma;
+
         else
-           g = png_ptr->gamma;   /* probably doing rgb_to_gray */
+           g = png_ptr->gamma;   /* Probably doing rgb_to_gray */
 
         for (i = 0; i < 256; i++)
         {
@@ -4086,8 +4160,10 @@ png_build_gamma_table(png_structp png_ptr)
      if (png_ptr->color_type & PNG_COLOR_MASK_COLOR)
      {
         sig_bit = (int)png_ptr->sig_bit.red;
+
         if ((int)png_ptr->sig_bit.green > sig_bit)
            sig_bit = png_ptr->sig_bit.green;
+
         if ((int)png_ptr->sig_bit.blue > sig_bit)
            sig_bit = png_ptr->sig_bit.blue;
      }
@@ -4098,6 +4174,7 @@ png_build_gamma_table(png_structp png_ptr)
 
      if (sig_bit > 0)
         shift = 16 - sig_bit;
+
      else
         shift = 0;
 
@@ -4109,6 +4186,7 @@ png_build_gamma_table(png_structp png_ptr)
 
      if (shift > 8)
         shift = 8;
+
      if (shift < 0)
         shift = 0;
 
@@ -4122,7 +4200,8 @@ png_build_gamma_table(png_structp png_ptr)
         g = 1.0;
 
      png_ptr->gamma_16_table = (png_uint_16pp)png_malloc(png_ptr,
-        (png_uint_32)(num * png_sizeof (png_uint_16p)));
+        (png_uint_32)(num * png_sizeof(png_uint_16p)));
+     png_memset(png_ptr->gamma_16_table, 0, num * png_sizeof(png_uint_16p));
 
      if (png_ptr->transformations & (PNG_16_TO_8 | PNG_BACKGROUND))
      {
@@ -4132,7 +4211,7 @@ png_build_gamma_table(png_structp png_ptr)
         for (i = 0; i < num; i++)
         {
            png_ptr->gamma_16_table[i] = (png_uint_16p)png_malloc(png_ptr,
-              (png_uint_32)(256 * png_sizeof (png_uint_16)));
+              (png_uint_32)(256 * png_sizeof(png_uint_16)));
         }
 
         g = 1.0 / g;
@@ -4162,9 +4241,10 @@ png_build_gamma_table(png_structp png_ptr)
         for (i = 0; i < num; i++)
         {
            png_ptr->gamma_16_table[i] = (png_uint_16p)png_malloc(png_ptr,
-              (png_uint_32)(256 * png_sizeof (png_uint_16)));
+              (png_uint_32)(256 * png_sizeof(png_uint_16)));
 
            ig = (((png_uint_32)i * (png_uint_32)png_gamma_shift[shift]) >> 4);
+
            for (j = 0; j < 256; j++)
            {
               png_ptr->gamma_16_table[i][j] =
@@ -4182,12 +4262,13 @@ png_build_gamma_table(png_structp png_ptr)
         g = 1.0 / (png_ptr->gamma);
 
         png_ptr->gamma_16_to_1 = (png_uint_16pp)png_malloc(png_ptr,
-           (png_uint_32)(num * png_sizeof (png_uint_16p )));
+           (png_uint_32)(num * png_sizeof(png_uint_16p )));
+        png_memset(png_ptr->gamma_16_to_1, 0, num * png_sizeof(png_uint_16p));
 
         for (i = 0; i < num; i++)
         {
            png_ptr->gamma_16_to_1[i] = (png_uint_16p)png_malloc(png_ptr,
-              (png_uint_32)(256 * png_sizeof (png_uint_16)));
+              (png_uint_32)(256 * png_sizeof(png_uint_16)));
 
            ig = (((png_uint_32)i *
               (png_uint_32)png_gamma_shift[shift]) >> 4);
@@ -4199,21 +4280,25 @@ png_build_gamma_table(png_structp png_ptr)
            }
         }
 
-        if(png_ptr->screen_gamma > 0.000001)
+        if (png_ptr->screen_gamma > 0.000001)
            g = 1.0 / png_ptr->screen_gamma;
+
         else
-           g = png_ptr->gamma;   /* probably doing rgb_to_gray */
+           g = png_ptr->gamma;   /* Probably doing rgb_to_gray */
 
         png_ptr->gamma_16_from_1 = (png_uint_16pp)png_malloc(png_ptr,
-           (png_uint_32)(num * png_sizeof (png_uint_16p)));
+           (png_uint_32)(num * png_sizeof(png_uint_16p)));
+        png_memset(png_ptr->gamma_16_from_1, 0,
+           num * png_sizeof(png_uint_16p));
 
         for (i = 0; i < num; i++)
         {
            png_ptr->gamma_16_from_1[i] = (png_uint_16p)png_malloc(png_ptr,
-              (png_uint_32)(256 * png_sizeof (png_uint_16)));
+              (png_uint_32)(256 * png_sizeof(png_uint_16)));
 
            ig = (((png_uint_32)i *
               (png_uint_32)png_gamma_shift[shift]) >> 4);
+
            for (j = 0; j < 256; j++)
            {
               png_ptr->gamma_16_from_1[i][j] =
@@ -4230,11 +4315,11 @@ png_build_gamma_table(png_structp png_ptr)
 #endif
 
 #if defined(PNG_MNG_FEATURES_SUPPORTED)
-/* undoes intrapixel differencing  */
+/* Undoes intrapixel differencing  */
 void /* PRIVATE */
 png_do_read_intrapixel(png_row_infop row_info, png_bytep row)
 {
-   png_debug(1, "in png_do_read_intrapixel\n");
+   png_debug(1, "in png_do_read_intrapixel");
    if (
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
        row != NULL && row_info != NULL &&
@@ -4250,8 +4335,10 @@ png_do_read_intrapixel(png_row_infop row_info, png_bytep row)
 
          if (row_info->color_type == PNG_COLOR_TYPE_RGB)
             bytes_per_pixel = 3;
+
          else if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
             bytes_per_pixel = 4;
+
          else
             return;
 
@@ -4268,18 +4355,20 @@ png_do_read_intrapixel(png_row_infop row_info, png_bytep row)
 
          if (row_info->color_type == PNG_COLOR_TYPE_RGB)
             bytes_per_pixel = 6;
+
          else if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
             bytes_per_pixel = 8;
+
          else
             return;
 
          for (i = 0, rp = row; i < row_width; i++, rp += bytes_per_pixel)
          {
-            png_uint_32 s0   = (*(rp  ) << 8) | *(rp+1);
-            png_uint_32 s1   = (*(rp+2) << 8) | *(rp+3);
-            png_uint_32 s2   = (*(rp+4) << 8) | *(rp+5);
-            png_uint_32 red  = (png_uint_32)((s0+s1+65536L) & 0xffffL);
-            png_uint_32 blue = (png_uint_32)((s2+s1+65536L) & 0xffffL);
+            png_uint_32 s0   = (*(rp    ) << 8) | *(rp + 1);
+            png_uint_32 s1   = (*(rp + 2) << 8) | *(rp + 3);
+            png_uint_32 s2   = (*(rp + 4) << 8) | *(rp + 5);
+            png_uint_32 red  = (png_uint_32)((s0 + s1 + 65536L) & 0xffffL);
+            png_uint_32 blue = (png_uint_32)((s2 + s1 + 65536L) & 0xffffL);
             *(rp  ) = (png_byte)((red >> 8) & 0xff);
             *(rp+1) = (png_byte)(red & 0xff);
             *(rp+4) = (png_byte)((blue >> 8) & 0xff);
diff --git a/src/3rdparty/libpng/pngrutil.c b/src/3rdparty/libpng/pngrutil.c
index 531cb0570e..f656dfbdfd 100644
--- a/src/3rdparty/libpng/pngrutil.c
+++ b/src/3rdparty/libpng/pngrutil.c
@@ -1,19 +1,21 @@
 
 /* pngrutil.c - utilities to read a PNG file
  *
- * Last changed in libpng 1.2.27 [April 29, 2008]
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.38 [July 16, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
+ *
  * This file contains routines that are only called from within
  * libpng itself during the course of reading an image.
  */
 
 #define PNG_INTERNAL
 #include "png.h"
-
 #if defined(PNG_READ_SUPPORTED)
 
 #if defined(_WIN32_WCE) && (_WIN32_WCE<0x500)
@@ -22,7 +24,7 @@
 
 #ifdef PNG_FLOATING_POINT_SUPPORTED
 #  if defined(WIN32_WCE_OLD)
-/* strtod() function is not supported on WindowsCE */
+/* The strtod() function is not supported on WindowsCE */
 __inline double png_strtod(png_structp png_ptr, PNG_CONST char *nptr, char **endptr)
 {
    double result = 0;
@@ -30,7 +32,7 @@ __inline double png_strtod(png_structp png_ptr, PNG_CONST char *nptr, char **end
    wchar_t *str, *end;
 
    len = MultiByteToWideChar(CP_ACP, 0, nptr, -1, NULL, 0);
-   str = (wchar_t *)png_malloc(png_ptr, len * sizeof(wchar_t));
+   str = (wchar_t *)png_malloc(png_ptr, len * png_sizeof(wchar_t));
    if ( NULL != str )
    {
       MultiByteToWideChar(CP_ACP, 0, nptr, -1, str, len);
@@ -49,7 +51,15 @@ __inline double png_strtod(png_structp png_ptr, PNG_CONST char *nptr, char **end
 png_uint_32 PNGAPI
 png_get_uint_31(png_structp png_ptr, png_bytep buf)
 {
+#ifdef PNG_READ_BIG_ENDIAN_SUPPORTED
    png_uint_32 i = png_get_uint_32(buf);
+#else
+   /* Avoid an extra function call by inlining the result. */
+   png_uint_32 i = ((png_uint_32)(*buf) << 24) +
+      ((png_uint_32)(*(buf + 1)) << 16) +
+      ((png_uint_32)(*(buf + 2)) << 8) +
+      (png_uint_32)(*(buf + 3));
+#endif
    if (i > PNG_UINT_31_MAX)
      png_error(png_ptr, "PNG unsigned integer out of range.");
    return (i);
@@ -69,7 +79,8 @@ png_get_uint_32(png_bytep buf)
 
 /* Grab a signed 32-bit integer from a buffer in big-endian format.  The
  * data is stored in the PNG file in two's complement format, and it is
- * assumed that the machine format for signed integers is the same. */
+ * assumed that the machine format for signed integers is the same.
+ */
 png_int_32 PNGAPI
 png_get_int_32(png_bytep buf)
 {
@@ -92,19 +103,50 @@ png_get_uint_16(png_bytep buf)
 }
 #endif /* PNG_READ_BIG_ENDIAN_SUPPORTED */
 
+/* Read the chunk header (length + type name).
+ * Put the type name into png_ptr->chunk_name, and return the length.
+ */
+png_uint_32 /* PRIVATE */
+png_read_chunk_header(png_structp png_ptr)
+{
+   png_byte buf[8];
+   png_uint_32 length;
+
+   /* Read the length and the chunk name */
+   png_read_data(png_ptr, buf, 8);
+   length = png_get_uint_31(png_ptr, buf);
+
+   /* Put the chunk name into png_ptr->chunk_name */
+   png_memcpy(png_ptr->chunk_name, buf + 4, 4);
+
+   png_debug2(0, "Reading %s chunk, length = %lu",
+      png_ptr->chunk_name, length);
+
+   /* Reset the crc and run it over the chunk name */
+   png_reset_crc(png_ptr);
+   png_calculate_crc(png_ptr, png_ptr->chunk_name, 4);
+
+   /* Check to see if chunk name is valid */
+   png_check_chunk_name(png_ptr, png_ptr->chunk_name);
+
+   return length;
+}
+
 /* Read data, and (optionally) run it through the CRC. */
 void /* PRIVATE */
 png_crc_read(png_structp png_ptr, png_bytep buf, png_size_t length)
 {
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
    png_read_data(png_ptr, buf, length);
    png_calculate_crc(png_ptr, buf, length);
 }
 
 /* Optionally skip data and then check the CRC.  Depending on whether we
-   are reading a ancillary or critical chunk, and how the program has set
-   things up, we may calculate the CRC on the data and print a message.
-   Returns '1' if there was a CRC error, '0' otherwise. */
+ * are reading a ancillary or critical chunk, and how the program has set
+ * things up, we may calculate the CRC on the data and print a message.
+ * Returns '1' if there was a CRC error, '0' otherwise.
+ */
 int /* PRIVATE */
 png_crc_finish(png_structp png_ptr, png_uint_32 skip)
 {
@@ -123,7 +165,7 @@ png_crc_finish(png_structp png_ptr, png_uint_32 skip)
    if (png_crc_error(png_ptr))
    {
       if (((png_ptr->chunk_name[0] & 0x20) &&                /* Ancillary */
-           !(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN)) ||
+          !(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN)) ||
           (!(png_ptr->chunk_name[0] & 0x20) &&             /* Critical  */
           (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE)))
       {
@@ -140,7 +182,8 @@ png_crc_finish(png_structp png_ptr, png_uint_32 skip)
 }
 
 /* Compare the CRC stored in the PNG file with that calculated by libpng from
-   the data it has read thus far. */
+ * the data it has read thus far.
+ */
 int /* PRIVATE */
 png_crc_error(png_structp png_ptr)
 {
@@ -180,9 +223,9 @@ png_crc_error(png_structp png_ptr)
  * holding the original prefix part and an uncompressed version of the
  * trailing part (the malloc area passed in is freed).
  */
-png_charp /* PRIVATE */
+void /* PRIVATE */
 png_decompress_chunk(png_structp png_ptr, int comp_type,
-                              png_charp chunkdata, png_size_t chunklength,
+                              png_size_t chunklength,
                               png_size_t prefix_size, png_size_t *newlength)
 {
    static PNG_CONST char msg[] = "Error decoding compressed text";
@@ -192,7 +235,7 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
    if (comp_type == PNG_COMPRESSION_TYPE_BASE)
    {
       int ret = Z_OK;
-      png_ptr->zstream.next_in = (png_bytep)(chunkdata + prefix_size);
+      png_ptr->zstream.next_in = (png_bytep)(png_ptr->chunkdata + prefix_size);
       png_ptr->zstream.avail_in = (uInt)(chunklength - prefix_size);
       png_ptr->zstream.next_out = png_ptr->zbuf;
       png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
@@ -218,18 +261,20 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
                text = (png_charp)png_malloc_warn(png_ptr, text_size);
                if (text ==  NULL)
                  {
-                    png_free(png_ptr,chunkdata);
-                    png_error(png_ptr,"Not enough memory to decompress chunk");
+                    png_free(png_ptr, png_ptr->chunkdata);
+                    png_ptr->chunkdata = NULL;
+                    png_error(png_ptr, "Not enough memory to decompress chunk");
                  }
-               png_memcpy(text, chunkdata, prefix_size);
+               png_memcpy(text, png_ptr->chunkdata, prefix_size);
             }
 
             text[text_size - 1] = 0x00;
 
             /* Copy what we can of the error message into the text chunk */
-            text_size = (png_size_t)(chunklength - (text - chunkdata) - 1);
-            text_size = png_sizeof(msg) > text_size ? text_size :
-               png_sizeof(msg);
+            text_size = (png_size_t)(chunklength -
+              (text - png_ptr->chunkdata) - 1);
+            if (text_size > png_sizeof(msg))
+               text_size = png_sizeof(msg);
             png_memcpy(text + prefix_size, msg, text_size);
             break;
          }
@@ -241,13 +286,15 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
                    png_ptr->zbuf_size - png_ptr->zstream.avail_out;
                text = (png_charp)png_malloc_warn(png_ptr, text_size + 1);
                if (text ==  NULL)
-                 {
-                    png_free(png_ptr,chunkdata);
-                    png_error(png_ptr,"Not enough memory to decompress chunk.");
-                 }
+               {
+                  png_free(png_ptr, png_ptr->chunkdata);
+                  png_ptr->chunkdata = NULL;
+                  png_error(png_ptr,
+                    "Not enough memory to decompress chunk.");
+               }
                png_memcpy(text + prefix_size, png_ptr->zbuf,
                     text_size - prefix_size);
-               png_memcpy(text, chunkdata, prefix_size);
+               png_memcpy(text, png_ptr->chunkdata, prefix_size);
                *(text + text_size) = 0x00;
             }
             else
@@ -261,8 +308,10 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
                if (text == NULL)
                {
                   png_free(png_ptr, tmp);
-                  png_free(png_ptr, chunkdata);
-                  png_error(png_ptr,"Not enough memory to decompress chunk..");
+                  png_free(png_ptr, png_ptr->chunkdata);
+                  png_ptr->chunkdata = NULL;
+                  png_error(png_ptr,
+                    "Not enough memory to decompress chunk..");
                }
                png_memcpy(text, tmp, text_size);
                png_free(png_ptr, tmp);
@@ -289,29 +338,33 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
             png_snprintf(umsg, 52,
                 "Buffer error in compressed datastream in %s chunk",
                 png_ptr->chunk_name);
+
          else if (ret == Z_DATA_ERROR)
             png_snprintf(umsg, 52,
                 "Data error in compressed datastream in %s chunk",
                 png_ptr->chunk_name);
+
          else
             png_snprintf(umsg, 52,
                 "Incomplete compressed datastream in %s chunk",
                 png_ptr->chunk_name);
+
          png_warning(png_ptr, umsg);
 #else
          png_warning(png_ptr,
             "Incomplete compressed datastream in chunk other than IDAT");
 #endif
-         text_size=prefix_size;
+         text_size = prefix_size;
          if (text ==  NULL)
          {
             text = (png_charp)png_malloc_warn(png_ptr, text_size+1);
             if (text == NULL)
               {
-                png_free(png_ptr, chunkdata);
-                png_error(png_ptr,"Not enough memory for text.");
+                png_free(png_ptr, png_ptr->chunkdata);
+                png_ptr->chunkdata = NULL;
+                png_error(png_ptr, "Not enough memory for text.");
               }
-            png_memcpy(text, chunkdata, prefix_size);
+            png_memcpy(text, png_ptr->chunkdata, prefix_size);
          }
          *(text + text_size) = 0x00;
       }
@@ -319,8 +372,8 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
       inflateReset(&png_ptr->zstream);
       png_ptr->zstream.avail_in = 0;
 
-      png_free(png_ptr, chunkdata);
-      chunkdata = text;
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = text;
       *newlength=text_size;
    }
    else /* if (comp_type != PNG_COMPRESSION_TYPE_BASE) */
@@ -328,22 +381,19 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
 #if !defined(PNG_NO_STDIO) && !defined(_WIN32_WCE)
       char umsg[50];
 
-      png_snprintf(umsg, 50,
-         "Unknown zTXt compression type %d", comp_type);
+      png_snprintf(umsg, 50, "Unknown zTXt compression type %d", comp_type);
       png_warning(png_ptr, umsg);
 #else
       png_warning(png_ptr, "Unknown zTXt compression type");
 #endif
 
-      *(chunkdata + prefix_size) = 0x00;
-      *newlength=prefix_size;
+      *(png_ptr->chunkdata + prefix_size) = 0x00;
+      *newlength = prefix_size;
    }
-
-   return chunkdata;
 }
 #endif
 
-/* read and check the IDHR chunk */
+/* Read and check the IDHR chunk */
 void /* PRIVATE */
 png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
@@ -352,12 +402,12 @@ png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    int bit_depth, color_type, compression_type, filter_type;
    int interlace_type;
 
-   png_debug(1, "in png_handle_IHDR\n");
+   png_debug(1, "in png_handle_IHDR");
 
    if (png_ptr->mode & PNG_HAVE_IHDR)
       png_error(png_ptr, "Out of place IHDR");
 
-   /* check the length */
+   /* Check the length */
    if (length != 13)
       png_error(png_ptr, "Invalid IHDR chunk");
 
@@ -374,7 +424,7 @@ png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    filter_type = buf[11];
    interlace_type = buf[12];
 
-   /* set internal variables */
+   /* Set internal variables */
    png_ptr->width = width;
    png_ptr->height = height;
    png_ptr->bit_depth = (png_byte)bit_depth;
@@ -385,36 +435,39 @@ png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 #endif
    png_ptr->compression_type = (png_byte)compression_type;
 
-   /* find number of channels */
+   /* Find number of channels */
    switch (png_ptr->color_type)
    {
       case PNG_COLOR_TYPE_GRAY:
       case PNG_COLOR_TYPE_PALETTE:
          png_ptr->channels = 1;
          break;
+
       case PNG_COLOR_TYPE_RGB:
          png_ptr->channels = 3;
          break;
+
       case PNG_COLOR_TYPE_GRAY_ALPHA:
          png_ptr->channels = 2;
          break;
+
       case PNG_COLOR_TYPE_RGB_ALPHA:
          png_ptr->channels = 4;
          break;
    }
 
-   /* set up other useful info */
+   /* Set up other useful info */
    png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth *
    png_ptr->channels);
-   png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth,png_ptr->width);
-   png_debug1(3,"bit_depth = %d\n", png_ptr->bit_depth);
-   png_debug1(3,"channels = %d\n", png_ptr->channels);
-   png_debug1(3,"rowbytes = %lu\n", png_ptr->rowbytes);
+   png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width);
+   png_debug1(3, "bit_depth = %d", png_ptr->bit_depth);
+   png_debug1(3, "channels = %d", png_ptr->channels);
+   png_debug1(3, "rowbytes = %lu", png_ptr->rowbytes);
    png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth,
       color_type, interlace_type, compression_type, filter_type);
 }
 
-/* read and check the palette */
+/* Read and check the palette */
 void /* PRIVATE */
 png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
@@ -424,16 +477,18 @@ png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    png_colorp pal_ptr;
 #endif
 
-   png_debug(1, "in png_handle_PLTE\n");
+   png_debug(1, "in png_handle_PLTE");
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before PLTE");
+
    else if (png_ptr->mode & PNG_HAVE_IDAT)
    {
       png_warning(png_ptr, "Invalid PLTE after IDAT");
       png_crc_finish(png_ptr, length);
       return;
    }
+
    else if (png_ptr->mode & PNG_HAVE_PLTE)
       png_error(png_ptr, "Duplicate PLTE chunk");
 
@@ -462,6 +517,7 @@ png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
          png_crc_finish(png_ptr, length);
          return;
       }
+
       else
       {
          png_error(png_ptr, "Invalid palette chunk");
@@ -486,7 +542,7 @@ png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       png_byte buf[3];
 
       png_crc_read(png_ptr, buf, 3);
-      /* don't depend upon png_color being any order */
+      /* Don't depend upon png_color being any order */
       palette[i].red = buf[0];
       palette[i].green = buf[1];
       palette[i].blue = buf[2];
@@ -494,9 +550,10 @@ png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 #endif
 
    /* If we actually NEED the PLTE chunk (ie for a paletted image), we do
-      whatever the normal CRC configuration tells us.  However, if we
-      have an RGB image, the PLTE can be considered ancillary, so
-      we will act as though it is. */
+    * whatever the normal CRC configuration tells us.  However, if we
+    * have an RGB image, the PLTE can be considered ancillary, so
+    * we will act as though it is.
+    */
 #if !defined(PNG_READ_OPT_PLTE_SUPPORTED)
    if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
 #endif
@@ -556,7 +613,7 @@ png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 void /* PRIVATE */
 png_handle_IEND(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
-   png_debug(1, "in png_handle_IEND\n");
+   png_debug(1, "in png_handle_IEND");
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR) || !(png_ptr->mode & PNG_HAVE_IDAT))
    {
@@ -571,7 +628,7 @@ png_handle_IEND(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    }
    png_crc_finish(png_ptr, length);
 
-   info_ptr =info_ptr; /* quiet compiler warnings about unused info_ptr */
+   info_ptr = info_ptr; /* Quiet compiler warnings about unused info_ptr */
 }
 
 #if defined(PNG_READ_gAMA_SUPPORTED)
@@ -584,7 +641,7 @@ png_handle_gAMA(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 #endif
    png_byte buf[4];
 
-   png_debug(1, "in png_handle_gAMA\n");
+   png_debug(1, "in png_handle_gAMA");
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before gAMA");
@@ -621,7 +678,7 @@ png_handle_gAMA(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       return;
 
    igamma = (png_fixed_point)png_get_uint_32(buf);
-   /* check for zero gamma */
+   /* Check for zero gamma */
    if (igamma == 0)
       {
          png_warning(png_ptr,
@@ -636,7 +693,7 @@ png_handle_gAMA(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
          png_warning(png_ptr,
            "Ignoring incorrect gAMA value when sRGB is also present");
 #ifndef PNG_NO_CONSOLE_IO
-         fprintf(stderr, "gamma = (%d/100000)\n", (int)igamma);
+         fprintf(stderr, "gamma = (%d/100000)", (int)igamma);
 #endif
          return;
       }
@@ -662,7 +719,7 @@ png_handle_sBIT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    png_size_t truelen;
    png_byte buf[4];
 
-   png_debug(1, "in png_handle_sBIT\n");
+   png_debug(1, "in png_handle_sBIT");
 
    buf[0] = buf[1] = buf[2] = buf[3] = 0;
 
@@ -725,7 +782,7 @@ png_handle_sBIT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 void /* PRIVATE */
 png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
-   png_byte buf[4];
+   png_byte buf[32];
 #ifdef PNG_FLOATING_POINT_SUPPORTED
    float white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y;
 #endif
@@ -734,7 +791,7 @@ png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 
    png_uint_32 uint_x, uint_y;
 
-   png_debug(1, "in png_handle_cHRM\n");
+   png_debug(1, "in png_handle_cHRM");
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before cHRM");
@@ -766,64 +823,27 @@ png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       return;
    }
 
-   png_crc_read(png_ptr, buf, 4);
-   uint_x = png_get_uint_32(buf);
-
-   png_crc_read(png_ptr, buf, 4);
-   uint_y = png_get_uint_32(buf);
-
-   if (uint_x > 80000L || uint_y > 80000L ||
-      uint_x + uint_y > 100000L)
-   {
-      png_warning(png_ptr, "Invalid cHRM white point");
-      png_crc_finish(png_ptr, 24);
+   png_crc_read(png_ptr, buf, 32);
+   if (png_crc_finish(png_ptr, 0))
       return;
-   }
-   int_x_white = (png_fixed_point)uint_x;
-   int_y_white = (png_fixed_point)uint_y;
 
-   png_crc_read(png_ptr, buf, 4);
    uint_x = png_get_uint_32(buf);
+   uint_y = png_get_uint_32(buf + 4);
+   int_x_white = (png_fixed_point)uint_x;
+   int_y_white = (png_fixed_point)uint_y;
 
-   png_crc_read(png_ptr, buf, 4);
-   uint_y = png_get_uint_32(buf);
-
-   if (uint_x + uint_y > 100000L)
-   {
-      png_warning(png_ptr, "Invalid cHRM red point");
-      png_crc_finish(png_ptr, 16);
-      return;
-   }
+   uint_x = png_get_uint_32(buf + 8);
+   uint_y = png_get_uint_32(buf + 12);
    int_x_red = (png_fixed_point)uint_x;
    int_y_red = (png_fixed_point)uint_y;
 
-   png_crc_read(png_ptr, buf, 4);
-   uint_x = png_get_uint_32(buf);
-
-   png_crc_read(png_ptr, buf, 4);
-   uint_y = png_get_uint_32(buf);
-
-   if (uint_x + uint_y > 100000L)
-   {
-      png_warning(png_ptr, "Invalid cHRM green point");
-      png_crc_finish(png_ptr, 8);
-      return;
-   }
+   uint_x = png_get_uint_32(buf + 16);
+   uint_y = png_get_uint_32(buf + 20);
    int_x_green = (png_fixed_point)uint_x;
    int_y_green = (png_fixed_point)uint_y;
 
-   png_crc_read(png_ptr, buf, 4);
-   uint_x = png_get_uint_32(buf);
-
-   png_crc_read(png_ptr, buf, 4);
-   uint_y = png_get_uint_32(buf);
-
-   if (uint_x + uint_y > 100000L)
-   {
-      png_warning(png_ptr, "Invalid cHRM blue point");
-      png_crc_finish(png_ptr, 0);
-      return;
-   }
+   uint_x = png_get_uint_32(buf + 24);
+   uint_y = png_get_uint_32(buf + 28);
    int_x_blue = (png_fixed_point)uint_x;
    int_y_blue = (png_fixed_point)uint_y;
 
@@ -854,19 +874,18 @@ png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
               "Ignoring incorrect cHRM value when sRGB is also present");
 #ifndef PNG_NO_CONSOLE_IO
 #ifdef PNG_FLOATING_POINT_SUPPORTED
-            fprintf(stderr,"wx=%f, wy=%f, rx=%f, ry=%f\n",
+            fprintf(stderr, "wx=%f, wy=%f, rx=%f, ry=%f\n",
                white_x, white_y, red_x, red_y);
-            fprintf(stderr,"gx=%f, gy=%f, bx=%f, by=%f\n",
+            fprintf(stderr, "gx=%f, gy=%f, bx=%f, by=%f\n",
                green_x, green_y, blue_x, blue_y);
 #else
-            fprintf(stderr,"wx=%ld, wy=%ld, rx=%ld, ry=%ld\n",
+            fprintf(stderr, "wx=%ld, wy=%ld, rx=%ld, ry=%ld\n",
                int_x_white, int_y_white, int_x_red, int_y_red);
-            fprintf(stderr,"gx=%ld, gy=%ld, bx=%ld, by=%ld\n",
+            fprintf(stderr, "gx=%ld, gy=%ld, bx=%ld, by=%ld\n",
                int_x_green, int_y_green, int_x_blue, int_y_blue);
 #endif
 #endif /* PNG_NO_CONSOLE_IO */
          }
-         png_crc_finish(png_ptr, 0);
          return;
       }
 #endif /* PNG_READ_sRGB_SUPPORTED */
@@ -880,8 +899,6 @@ png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       int_x_white, int_y_white, int_x_red, int_y_red, int_x_green,
       int_y_green, int_x_blue, int_y_blue);
 #endif
-   if (png_crc_finish(png_ptr, 0))
-      return;
 }
 #endif
 
@@ -892,7 +909,7 @@ png_handle_sRGB(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    int intent;
    png_byte buf[1];
 
-   png_debug(1, "in png_handle_sRGB\n");
+   png_debug(1, "in png_handle_sRGB");
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before sRGB");
@@ -925,7 +942,7 @@ png_handle_sRGB(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       return;
 
    intent = buf[0];
-   /* check for bad intent */
+   /* Check for bad intent */
    if (intent >= PNG_sRGB_INTENT_LAST)
    {
       png_warning(png_ptr, "Unknown sRGB intent");
@@ -949,10 +966,11 @@ png_handle_sRGB(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
            "Ignoring incorrect gAMA value when sRGB is also present");
 #ifndef PNG_NO_CONSOLE_IO
 #  ifdef PNG_FIXED_POINT_SUPPORTED
-         fprintf(stderr,"incorrect gamma=(%d/100000)\n",(int)png_ptr->int_gamma);
+         fprintf(stderr, "incorrect gamma=(%d/100000)\n",
+            (int)png_ptr->int_gamma);
 #  else
 #    ifdef PNG_FLOATING_POINT_SUPPORTED
-         fprintf(stderr,"incorrect gamma=%f\n",png_ptr->gamma);
+         fprintf(stderr, "incorrect gamma=%f\n", png_ptr->gamma);
 #    endif
 #  endif
 #endif
@@ -987,7 +1005,6 @@ void /* PRIVATE */
 png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 /* Note: this does not properly handle chunks that are > 64K under DOS */
 {
-   png_charp chunkdata;
    png_byte compression_type;
    png_bytep pC;
    png_charp profile;
@@ -995,7 +1012,7 @@ png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    png_uint_32 profile_size, profile_length;
    png_size_t slength, prefix_length, data_length;
 
-   png_debug(1, "in png_handle_iCCP\n");
+   png_debug(1, "in png_handle_iCCP");
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before iCCP");
@@ -1025,74 +1042,81 @@ png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    }
 #endif
 
-   chunkdata = (png_charp)png_malloc(png_ptr, length + 1);
+   png_free(png_ptr, png_ptr->chunkdata);
+   png_ptr->chunkdata = (png_charp)png_malloc(png_ptr, length + 1);
    slength = (png_size_t)length;
-   png_crc_read(png_ptr, (png_bytep)chunkdata, slength);
+   png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
 
    if (png_crc_finish(png_ptr, skip))
    {
-      png_free(png_ptr, chunkdata);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       return;
    }
 
-   chunkdata[slength] = 0x00;
+   png_ptr->chunkdata[slength] = 0x00;
 
-   for (profile = chunkdata; *profile; profile++)
-      /* empty loop to find end of name */ ;
+   for (profile = png_ptr->chunkdata; *profile; profile++)
+      /* Empty loop to find end of name */ ;
 
    ++profile;
 
-   /* there should be at least one zero (the compression type byte)
-      following the separator, and we should be on it  */
-   if ( profile >= chunkdata + slength - 1)
+   /* There should be at least one zero (the compression type byte)
+    * following the separator, and we should be on it
+    */
+   if ( profile >= png_ptr->chunkdata + slength - 1)
    {
-      png_free(png_ptr, chunkdata);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       png_warning(png_ptr, "Malformed iCCP chunk");
       return;
    }
 
-   /* compression_type should always be zero */
+   /* Compression_type should always be zero */
    compression_type = *profile++;
    if (compression_type)
    {
       png_warning(png_ptr, "Ignoring nonzero compression type in iCCP chunk");
-      compression_type=0x00;  /* Reset it to zero (libpng-1.0.6 through 1.0.8
+      compression_type = 0x00;  /* Reset it to zero (libpng-1.0.6 through 1.0.8
                                  wrote nonzero) */
    }
 
-   prefix_length = profile - chunkdata;
-   chunkdata = png_decompress_chunk(png_ptr, compression_type, chunkdata,
-                                    slength, prefix_length, &data_length);
+   prefix_length = profile - png_ptr->chunkdata;
+   png_decompress_chunk(png_ptr, compression_type,
+     slength, prefix_length, &data_length);
 
    profile_length = data_length - prefix_length;
 
    if ( prefix_length > data_length || profile_length < 4)
    {
-      png_free(png_ptr, chunkdata);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       png_warning(png_ptr, "Profile size field missing from iCCP chunk");
       return;
    }
 
    /* Check the profile_size recorded in the first 32 bits of the ICC profile */
-   pC = (png_bytep)(chunkdata+prefix_length);
-   profile_size = ((*(pC  ))<<24) |
-                  ((*(pC+1))<<16) |
-                  ((*(pC+2))<< 8) |
-                  ((*(pC+3))    );
+   pC = (png_bytep)(png_ptr->chunkdata + prefix_length);
+   profile_size = ((*(pC    ))<<24) |
+                  ((*(pC + 1))<<16) |
+                  ((*(pC + 2))<< 8) |
+                  ((*(pC + 3))    );
 
-   if(profile_size < profile_length)
+   if (profile_size < profile_length)
       profile_length = profile_size;
 
-   if(profile_size > profile_length)
+   if (profile_size > profile_length)
    {
-      png_free(png_ptr, chunkdata);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       png_warning(png_ptr, "Ignoring truncated iCCP profile.");
       return;
    }
 
-   png_set_iCCP(png_ptr, info_ptr, chunkdata, compression_type,
-                chunkdata + prefix_length, profile_length);
-   png_free(png_ptr, chunkdata);
+   png_set_iCCP(png_ptr, info_ptr, png_ptr->chunkdata,
+     compression_type, png_ptr->chunkdata + prefix_length, profile_length);
+   png_free(png_ptr, png_ptr->chunkdata);
+   png_ptr->chunkdata = NULL;
 }
 #endif /* PNG_READ_iCCP_SUPPORTED */
 
@@ -1101,7 +1125,6 @@ void /* PRIVATE */
 png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 /* Note: this does not properly handle chunks that are > 64K under DOS */
 {
-   png_bytep chunkdata;
    png_bytep entry_start;
    png_sPLT_t new_palette;
 #ifdef PNG_NO_POINTER_INDEXING
@@ -1111,7 +1134,8 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    png_uint_32 skip = 0;
    png_size_t slength;
 
-   png_debug(1, "in png_handle_sPLT\n");
+   png_debug(1, "in png_handle_sPLT");
+
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before sPLT");
@@ -1131,45 +1155,49 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    }
 #endif
 
-   chunkdata = (png_bytep)png_malloc(png_ptr, length + 1);
+   png_free(png_ptr, png_ptr->chunkdata);
+   png_ptr->chunkdata = (png_charp)png_malloc(png_ptr, length + 1);
    slength = (png_size_t)length;
-   png_crc_read(png_ptr, (png_bytep)chunkdata, slength);
+   png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
 
    if (png_crc_finish(png_ptr, skip))
    {
-      png_free(png_ptr, chunkdata);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       return;
    }
 
-   chunkdata[slength] = 0x00;
+   png_ptr->chunkdata[slength] = 0x00;
 
-   for (entry_start = chunkdata; *entry_start; entry_start++)
-      /* empty loop to find end of name */ ;
+   for (entry_start = (png_bytep)png_ptr->chunkdata; *entry_start; entry_start++)
+      /* Empty loop to find end of name */ ;
    ++entry_start;
 
-   /* a sample depth should follow the separator, and we should be on it  */
-   if (entry_start > chunkdata + slength - 2)
+   /* A sample depth should follow the separator, and we should be on it  */
+   if (entry_start > (png_bytep)png_ptr->chunkdata + slength - 2)
    {
-      png_free(png_ptr, chunkdata);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       png_warning(png_ptr, "malformed sPLT chunk");
       return;
    }
 
    new_palette.depth = *entry_start++;
    entry_size = (new_palette.depth == 8 ? 6 : 10);
-   data_length = (slength - (entry_start - chunkdata));
+   data_length = (slength - (entry_start - (png_bytep)png_ptr->chunkdata));
 
-   /* integrity-check the data length */
+   /* Integrity-check the data length */
    if (data_length % entry_size)
    {
-      png_free(png_ptr, chunkdata);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       png_warning(png_ptr, "sPLT chunk has bad length");
       return;
    }
 
    new_palette.nentries = (png_int_32) ( data_length / entry_size);
-   if ((png_uint_32) new_palette.nentries > (png_uint_32) (PNG_SIZE_MAX /
-       png_sizeof(png_sPLT_entry)))
+   if ((png_uint_32) new_palette.nentries >
+       (png_uint_32) (PNG_SIZE_MAX / png_sizeof(png_sPLT_entry)))
    {
        png_warning(png_ptr, "sPLT chunk too long");
        return;
@@ -1226,12 +1254,13 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    }
 #endif
 
-   /* discard all chunk data except the name and stash that */
-   new_palette.name = (png_charp)chunkdata;
+   /* Discard all chunk data except the name and stash that */
+   new_palette.name = png_ptr->chunkdata;
 
    png_set_sPLT(png_ptr, info_ptr, &new_palette, 1);
 
-   png_free(png_ptr, chunkdata);
+   png_free(png_ptr, png_ptr->chunkdata);
+   png_ptr->chunkdata = NULL;
    png_free(png_ptr, new_palette.entries);
 }
 #endif /* PNG_READ_sPLT_SUPPORTED */
@@ -1242,7 +1271,7 @@ png_handle_tRNS(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
    png_byte readbuf[PNG_MAX_PALETTE_LENGTH];
 
-   png_debug(1, "in png_handle_tRNS\n");
+   png_debug(1, "in png_handle_tRNS");
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before tRNS");
@@ -1338,7 +1367,7 @@ png_handle_bKGD(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    png_size_t truelen;
    png_byte buf[6];
 
-   png_debug(1, "in png_handle_bKGD\n");
+   png_debug(1, "in png_handle_bKGD");
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before bKGD");
@@ -1389,7 +1418,7 @@ png_handle_bKGD(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       png_ptr->background.index = buf[0];
       if (info_ptr && info_ptr->num_palette)
       {
-          if(buf[0] > info_ptr->num_palette)
+          if (buf[0] >= info_ptr->num_palette)
           {
              png_warning(png_ptr, "Incorrect bKGD chunk index value");
              return;
@@ -1427,7 +1456,7 @@ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    unsigned int num, i;
    png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
 
-   png_debug(1, "in png_handle_hIST\n");
+   png_debug(1, "in png_handle_hIST");
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before hIST");
@@ -1482,7 +1511,7 @@ png_handle_pHYs(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    png_uint_32 res_x, res_y;
    int unit_type;
 
-   png_debug(1, "in png_handle_pHYs\n");
+   png_debug(1, "in png_handle_pHYs");
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before pHYs");
@@ -1525,7 +1554,7 @@ png_handle_oFFs(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    png_int_32 offset_x, offset_y;
    int unit_type;
 
-   png_debug(1, "in png_handle_oFFs\n");
+   png_debug(1, "in png_handle_oFFs");
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before oFFs");
@@ -1561,11 +1590,10 @@ png_handle_oFFs(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 #endif
 
 #if defined(PNG_READ_pCAL_SUPPORTED)
-/* read the pCAL chunk (described in the PNG Extensions document) */
+/* Read the pCAL chunk (described in the PNG Extensions document) */
 void /* PRIVATE */
 png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
-   png_charp purpose;
    png_int_32 X0, X1;
    png_byte type, nparams;
    png_charp buf, units, endptr;
@@ -1573,7 +1601,7 @@ png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    png_size_t slength;
    int i;
 
-   png_debug(1, "in png_handle_pCAL\n");
+   png_debug(1, "in png_handle_pCAL");
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before pCAL");
@@ -1590,48 +1618,51 @@ png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       return;
    }
 
-   png_debug1(2, "Allocating and reading pCAL chunk data (%lu bytes)\n",
+   png_debug1(2, "Allocating and reading pCAL chunk data (%lu bytes)",
       length + 1);
-   purpose = (png_charp)png_malloc_warn(png_ptr, length + 1);
-   if (purpose == NULL)
+   png_free(png_ptr, png_ptr->chunkdata);
+   png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
+   if (png_ptr->chunkdata == NULL)
      {
        png_warning(png_ptr, "No memory for pCAL purpose.");
        return;
      }
    slength = (png_size_t)length;
-   png_crc_read(png_ptr, (png_bytep)purpose, slength);
+   png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
 
    if (png_crc_finish(png_ptr, 0))
    {
-      png_free(png_ptr, purpose);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       return;
    }
 
-   purpose[slength] = 0x00; /* null terminate the last string */
+   png_ptr->chunkdata[slength] = 0x00; /* Null terminate the last string */
 
-   png_debug(3, "Finding end of pCAL purpose string\n");
-   for (buf = purpose; *buf; buf++)
-      /* empty loop */ ;
+   png_debug(3, "Finding end of pCAL purpose string");
+   for (buf = png_ptr->chunkdata; *buf; buf++)
+      /* Empty loop */ ;
 
-   endptr = purpose + slength;
+   endptr = png_ptr->chunkdata + slength;
 
    /* We need to have at least 12 bytes after the purpose string
       in order to get the parameter information. */
    if (endptr <= buf + 12)
    {
       png_warning(png_ptr, "Invalid pCAL data");
-      png_free(png_ptr, purpose);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       return;
    }
 
-   png_debug(3, "Reading pCAL X0, X1, type, nparams, and units\n");
+   png_debug(3, "Reading pCAL X0, X1, type, nparams, and units");
    X0 = png_get_int_32((png_bytep)buf+1);
    X1 = png_get_int_32((png_bytep)buf+5);
    type = buf[9];
    nparams = buf[10];
    units = buf + 11;
 
-   png_debug(3, "Checking pCAL equation type and number of parameters\n");
+   png_debug(3, "Checking pCAL equation type and number of parameters");
    /* Check that we have the right number of parameters for known
       equation types. */
    if ((type == PNG_EQUATION_LINEAR && nparams != 2) ||
@@ -1640,7 +1671,8 @@ png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
        (type == PNG_EQUATION_HYPERBOLIC && nparams != 4))
    {
       png_warning(png_ptr, "Invalid pCAL parameters for equation type");
-      png_free(png_ptr, purpose);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       return;
    }
    else if (type >= PNG_EQUATION_LAST)
@@ -1651,12 +1683,13 @@ png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    for (buf = units; *buf; buf++)
       /* Empty loop to move past the units string. */ ;
 
-   png_debug(3, "Allocating pCAL parameters array\n");
-   params = (png_charpp)png_malloc_warn(png_ptr, (png_uint_32)(nparams
-      *png_sizeof(png_charp))) ;
+   png_debug(3, "Allocating pCAL parameters array");
+   params = (png_charpp)png_malloc_warn(png_ptr,
+      (png_uint_32)(nparams * png_sizeof(png_charp))) ;
    if (params == NULL)
      {
-       png_free(png_ptr, purpose);
+       png_free(png_ptr, png_ptr->chunkdata);
+       png_ptr->chunkdata = NULL;
        png_warning(png_ptr, "No memory for pCAL params.");
        return;
      }
@@ -1666,7 +1699,7 @@ png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    {
       buf++; /* Skip the null string terminator from previous parameter. */
 
-      png_debug1(3, "Reading pCAL parameter %d\n", i);
+      png_debug1(3, "Reading pCAL parameter %d", i);
       for (params[i] = buf; buf <= endptr && *buf != 0x00; buf++)
          /* Empty loop to move past each parameter string */ ;
 
@@ -1674,26 +1707,28 @@ png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       if (buf > endptr)
       {
          png_warning(png_ptr, "Invalid pCAL data");
-         png_free(png_ptr, purpose);
+         png_free(png_ptr, png_ptr->chunkdata);
+         png_ptr->chunkdata = NULL;
          png_free(png_ptr, params);
          return;
       }
    }
 
-   png_set_pCAL(png_ptr, info_ptr, purpose, X0, X1, type, nparams,
+   png_set_pCAL(png_ptr, info_ptr, png_ptr->chunkdata, X0, X1, type, nparams,
       units, params);
 
-   png_free(png_ptr, purpose);
+   png_free(png_ptr, png_ptr->chunkdata);
+   png_ptr->chunkdata = NULL;
    png_free(png_ptr, params);
 }
 #endif
 
 #if defined(PNG_READ_sCAL_SUPPORTED)
-/* read the sCAL chunk */
+/* Read the sCAL chunk */
 void /* PRIVATE */
 png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
-   png_charp buffer, ep;
+   png_charp ep;
 #ifdef PNG_FLOATING_POINT_SUPPORTED
    double width, height;
    png_charp vp;
@@ -1704,7 +1739,7 @@ png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 #endif
    png_size_t slength;
 
-   png_debug(1, "in png_handle_sCAL\n");
+   png_debug(1, "in png_handle_sCAL");
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before sCAL");
@@ -1721,88 +1756,91 @@ png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       return;
    }
 
-   png_debug1(2, "Allocating and reading sCAL chunk data (%lu bytes)\n",
+   png_debug1(2, "Allocating and reading sCAL chunk data (%lu bytes)",
       length + 1);
-   buffer = (png_charp)png_malloc_warn(png_ptr, length + 1);
-   if (buffer == NULL)
-     {
-       png_warning(png_ptr, "Out of memory while processing sCAL chunk");
-       return;
-     }
+   png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
+   if (png_ptr->chunkdata == NULL)
+   {
+      png_warning(png_ptr, "Out of memory while processing sCAL chunk");
+      return;
+   }
    slength = (png_size_t)length;
-   png_crc_read(png_ptr, (png_bytep)buffer, slength);
+   png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
 
    if (png_crc_finish(png_ptr, 0))
    {
-      png_free(png_ptr, buffer);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       return;
    }
 
-   buffer[slength] = 0x00; /* null terminate the last string */
+   png_ptr->chunkdata[slength] = 0x00; /* Null terminate the last string */
 
-   ep = buffer + 1;        /* skip unit byte */
+   ep = png_ptr->chunkdata + 1;        /* Skip unit byte */
 
 #ifdef PNG_FLOATING_POINT_SUPPORTED
    width = png_strtod(png_ptr, ep, &vp);
    if (*vp)
    {
-       png_warning(png_ptr, "malformed width string in sCAL chunk");
-       return;
+      png_warning(png_ptr, "malformed width string in sCAL chunk");
+      return;
    }
 #else
 #ifdef PNG_FIXED_POINT_SUPPORTED
    swidth = (png_charp)png_malloc_warn(png_ptr, png_strlen(ep) + 1);
    if (swidth == NULL)
-     {
-       png_warning(png_ptr, "Out of memory while processing sCAL chunk width");
-       return;
-     }
+   {
+      png_warning(png_ptr, "Out of memory while processing sCAL chunk width");
+      return;
+   }
    png_memcpy(swidth, ep, (png_size_t)png_strlen(ep));
 #endif
 #endif
 
-   for (ep = buffer; *ep; ep++)
-      /* empty loop */ ;
+   for (ep = png_ptr->chunkdata; *ep; ep++)
+      /* Empty loop */ ;
    ep++;
 
-   if (buffer + slength < ep)
+   if (png_ptr->chunkdata + slength < ep)
    {
-       png_warning(png_ptr, "Truncated sCAL chunk");
+      png_warning(png_ptr, "Truncated sCAL chunk");
 #if defined(PNG_FIXED_POINT_SUPPORTED) && \
     !defined(PNG_FLOATING_POINT_SUPPORTED)
-       png_free(png_ptr, swidth);
+      png_free(png_ptr, swidth);
 #endif
-      png_free(png_ptr, buffer);
-       return;
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
+      return;
    }
 
 #ifdef PNG_FLOATING_POINT_SUPPORTED
    height = png_strtod(png_ptr, ep, &vp);
    if (*vp)
    {
-       png_warning(png_ptr, "malformed height string in sCAL chunk");
-       return;
+      png_warning(png_ptr, "malformed height string in sCAL chunk");
+      return;
    }
 #else
 #ifdef PNG_FIXED_POINT_SUPPORTED
    sheight = (png_charp)png_malloc_warn(png_ptr, png_strlen(ep) + 1);
    if (sheight == NULL)
-     {
-       png_warning(png_ptr, "Out of memory while processing sCAL chunk height");
-       return;
-     }
+   {
+      png_warning(png_ptr, "Out of memory while processing sCAL chunk height");
+      return;
+   }
    png_memcpy(sheight, ep, (png_size_t)png_strlen(ep));
 #endif
 #endif
 
-   if (buffer + slength < ep
+   if (png_ptr->chunkdata + slength < ep
 #ifdef PNG_FLOATING_POINT_SUPPORTED
       || width <= 0. || height <= 0.
 #endif
       )
    {
       png_warning(png_ptr, "Invalid sCAL data");
-      png_free(png_ptr, buffer);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
 #if defined(PNG_FIXED_POINT_SUPPORTED) && !defined(PNG_FLOATING_POINT_SUPPORTED)
       png_free(png_ptr, swidth);
       png_free(png_ptr, sheight);
@@ -1812,14 +1850,15 @@ png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 
 
 #ifdef PNG_FLOATING_POINT_SUPPORTED
-   png_set_sCAL(png_ptr, info_ptr, buffer[0], width, height);
+   png_set_sCAL(png_ptr, info_ptr, png_ptr->chunkdata[0], width, height);
 #else
 #ifdef PNG_FIXED_POINT_SUPPORTED
-   png_set_sCAL_s(png_ptr, info_ptr, buffer[0], swidth, sheight);
+   png_set_sCAL_s(png_ptr, info_ptr, png_ptr->chunkdata[0], swidth, sheight);
 #endif
 #endif
 
-   png_free(png_ptr, buffer);
+   png_free(png_ptr, png_ptr->chunkdata);
+   png_ptr->chunkdata = NULL;
 #if defined(PNG_FIXED_POINT_SUPPORTED) && !defined(PNG_FLOATING_POINT_SUPPORTED)
    png_free(png_ptr, swidth);
    png_free(png_ptr, sheight);
@@ -1834,7 +1873,7 @@ png_handle_tIME(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    png_byte buf[7];
    png_time mod_time;
 
-   png_debug(1, "in png_handle_tIME\n");
+   png_debug(1, "in png_handle_tIME");
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Out of place tIME chunk");
@@ -1882,7 +1921,8 @@ png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    png_size_t slength;
    int ret;
 
-   png_debug(1, "in png_handle_tEXt\n");
+   png_debug(1, "in png_handle_tEXt");
+
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before tEXt");
@@ -1899,25 +1939,30 @@ png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    }
 #endif
 
-   key = (png_charp)png_malloc_warn(png_ptr, length + 1);
-   if (key == NULL)
+   png_free(png_ptr, png_ptr->chunkdata);
+
+   png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
+   if (png_ptr->chunkdata == NULL)
    {
      png_warning(png_ptr, "No memory to process text chunk.");
      return;
    }
    slength = (png_size_t)length;
-   png_crc_read(png_ptr, (png_bytep)key, slength);
+   png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
 
    if (png_crc_finish(png_ptr, skip))
    {
-      png_free(png_ptr, key);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       return;
    }
 
+   key = png_ptr->chunkdata;
+
    key[slength] = 0x00;
 
    for (text = key; *text; text++)
-      /* empty loop to find end of key */ ;
+      /* Empty loop to find end of key */ ;
 
    if (text != key + slength)
       text++;
@@ -1927,7 +1972,8 @@ png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    if (text_ptr == NULL)
    {
      png_warning(png_ptr, "Not enough memory to process text chunk.");
-     png_free(png_ptr, key);
+     png_free(png_ptr, png_ptr->chunkdata);
+     png_ptr->chunkdata = NULL;
      return;
    }
    text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;
@@ -1940,9 +1986,10 @@ png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    text_ptr->text = text;
    text_ptr->text_length = png_strlen(text);
 
-   ret=png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
+   ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
 
-   png_free(png_ptr, key);
+   png_free(png_ptr, png_ptr->chunkdata);
+   png_ptr->chunkdata = NULL;
    png_free(png_ptr, text_ptr);
    if (ret)
      png_warning(png_ptr, "Insufficient memory to process text chunk.");
@@ -1950,18 +1997,19 @@ png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 #endif
 
 #if defined(PNG_READ_zTXt_SUPPORTED)
-/* note: this does not correctly handle chunks that are > 64K under DOS */
+/* Note: this does not correctly handle chunks that are > 64K under DOS */
 void /* PRIVATE */
 png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
    png_textp text_ptr;
-   png_charp chunkdata;
    png_charp text;
    int comp_type;
    int ret;
    png_size_t slength, prefix_len, data_len;
 
-   png_debug(1, "in png_handle_zTXt\n");
+   png_debug(1, "in png_handle_zTXt");
+
+
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before zTXt");
 
@@ -1973,36 +2021,39 @@ png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       there is no hard and fast rule to tell us where to stop. */
    if (length > (png_uint_32)65535L)
    {
-     png_warning(png_ptr,"zTXt chunk too large to fit in memory");
+     png_warning(png_ptr, "zTXt chunk too large to fit in memory");
      png_crc_finish(png_ptr, length);
      return;
    }
 #endif
 
-   chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
-   if (chunkdata == NULL)
+   png_free(png_ptr, png_ptr->chunkdata);
+   png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
+   if (png_ptr->chunkdata == NULL)
    {
-     png_warning(png_ptr,"Out of memory processing zTXt chunk.");
+     png_warning(png_ptr, "Out of memory processing zTXt chunk.");
      return;
    }
    slength = (png_size_t)length;
-   png_crc_read(png_ptr, (png_bytep)chunkdata, slength);
+   png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
    if (png_crc_finish(png_ptr, 0))
    {
-      png_free(png_ptr, chunkdata);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       return;
    }
 
-   chunkdata[slength] = 0x00;
+   png_ptr->chunkdata[slength] = 0x00;
 
-   for (text = chunkdata; *text; text++)
-      /* empty loop */ ;
+   for (text = png_ptr->chunkdata; *text; text++)
+      /* Empty loop */ ;
 
    /* zTXt must have some text after the chunkdataword */
-   if (text >= chunkdata + slength - 2)
+   if (text >= png_ptr->chunkdata + slength - 2)
    {
       png_warning(png_ptr, "Truncated zTXt chunk");
-      png_free(png_ptr, chunkdata);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       return;
    }
    else
@@ -2013,54 +2064,56 @@ png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
           png_warning(png_ptr, "Unknown compression type in zTXt chunk");
           comp_type = PNG_TEXT_COMPRESSION_zTXt;
        }
-       text++;        /* skip the compression_method byte */
+       text++;        /* Skip the compression_method byte */
    }
-   prefix_len = text - chunkdata;
+   prefix_len = text - png_ptr->chunkdata;
 
-   chunkdata = (png_charp)png_decompress_chunk(png_ptr, comp_type, chunkdata,
-                                    (png_size_t)length, prefix_len, &data_len);
+   png_decompress_chunk(png_ptr, comp_type,
+     (png_size_t)length, prefix_len, &data_len);
 
    text_ptr = (png_textp)png_malloc_warn(png_ptr,
-     (png_uint_32)png_sizeof(png_text));
+      (png_uint_32)png_sizeof(png_text));
    if (text_ptr == NULL)
    {
-     png_warning(png_ptr,"Not enough memory to process zTXt chunk.");
-     png_free(png_ptr, chunkdata);
+     png_warning(png_ptr, "Not enough memory to process zTXt chunk.");
+     png_free(png_ptr, png_ptr->chunkdata);
+     png_ptr->chunkdata = NULL;
      return;
    }
    text_ptr->compression = comp_type;
-   text_ptr->key = chunkdata;
+   text_ptr->key = png_ptr->chunkdata;
 #ifdef PNG_iTXt_SUPPORTED
    text_ptr->lang = NULL;
    text_ptr->lang_key = NULL;
    text_ptr->itxt_length = 0;
 #endif
-   text_ptr->text = chunkdata + prefix_len;
+   text_ptr->text = png_ptr->chunkdata + prefix_len;
    text_ptr->text_length = data_len;
 
-   ret=png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
+   ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
 
    png_free(png_ptr, text_ptr);
-   png_free(png_ptr, chunkdata);
+   png_free(png_ptr, png_ptr->chunkdata);
+   png_ptr->chunkdata = NULL;
    if (ret)
      png_error(png_ptr, "Insufficient memory to store zTXt chunk.");
 }
 #endif
 
 #if defined(PNG_READ_iTXt_SUPPORTED)
-/* note: this does not correctly handle chunks that are > 64K under DOS */
+/* Note: this does not correctly handle chunks that are > 64K under DOS */
 void /* PRIVATE */
 png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
    png_textp text_ptr;
-   png_charp chunkdata;
    png_charp key, lang, text, lang_key;
    int comp_flag;
    int comp_type = 0;
    int ret;
    png_size_t slength, prefix_len, data_len;
 
-   png_debug(1, "in png_handle_iTXt\n");
+   png_debug(1, "in png_handle_iTXt");
+
 
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before iTXt");
@@ -2073,40 +2126,44 @@ png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       there is no hard and fast rule to tell us where to stop. */
    if (length > (png_uint_32)65535L)
    {
-     png_warning(png_ptr,"iTXt chunk too large to fit in memory");
+     png_warning(png_ptr, "iTXt chunk too large to fit in memory");
      png_crc_finish(png_ptr, length);
      return;
    }
 #endif
 
-   chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
-   if (chunkdata == NULL)
+   png_free(png_ptr, png_ptr->chunkdata);
+   png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
+   if (png_ptr->chunkdata == NULL)
    {
      png_warning(png_ptr, "No memory to process iTXt chunk.");
      return;
    }
    slength = (png_size_t)length;
-   png_crc_read(png_ptr, (png_bytep)chunkdata, slength);
+   png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
    if (png_crc_finish(png_ptr, 0))
    {
-      png_free(png_ptr, chunkdata);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       return;
    }
 
-   chunkdata[slength] = 0x00;
+   png_ptr->chunkdata[slength] = 0x00;
 
-   for (lang = chunkdata; *lang; lang++)
-      /* empty loop */ ;
-   lang++;        /* skip NUL separator */
+   for (lang = png_ptr->chunkdata; *lang; lang++)
+      /* Empty loop */ ;
+   lang++;        /* Skip NUL separator */
 
    /* iTXt must have a language tag (possibly empty), two compression bytes,
-      translated keyword (possibly empty), and possibly some text after the
-      keyword */
+    * translated keyword (possibly empty), and possibly some text after the
+    * keyword
+    */
 
-   if (lang >= chunkdata + slength - 3)
+   if (lang >= png_ptr->chunkdata + slength - 3)
    {
       png_warning(png_ptr, "Truncated iTXt chunk");
-      png_free(png_ptr, chunkdata);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       return;
    }
    else
@@ -2116,54 +2173,58 @@ png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    }
 
    for (lang_key = lang; *lang_key; lang_key++)
-      /* empty loop */ ;
-   lang_key++;        /* skip NUL separator */
+      /* Empty loop */ ;
+   lang_key++;        /* Skip NUL separator */
 
-   if (lang_key >= chunkdata + slength)
+   if (lang_key >= png_ptr->chunkdata + slength)
    {
       png_warning(png_ptr, "Truncated iTXt chunk");
-      png_free(png_ptr, chunkdata);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       return;
    }
 
    for (text = lang_key; *text; text++)
-      /* empty loop */ ;
-   text++;        /* skip NUL separator */
-   if (text >= chunkdata + slength)
+      /* Empty loop */ ;
+   text++;        /* Skip NUL separator */
+   if (text >= png_ptr->chunkdata + slength)
    {
       png_warning(png_ptr, "Malformed iTXt chunk");
-      png_free(png_ptr, chunkdata);
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
       return;
    }
 
-   prefix_len = text - chunkdata;
+   prefix_len = text - png_ptr->chunkdata;
 
-   key=chunkdata;
+   key=png_ptr->chunkdata;
    if (comp_flag)
-       chunkdata = png_decompress_chunk(png_ptr, comp_type, chunkdata,
-          (size_t)length, prefix_len, &data_len);
+       png_decompress_chunk(png_ptr, comp_type,
+         (size_t)length, prefix_len, &data_len);
    else
-       data_len=png_strlen(chunkdata + prefix_len);
+       data_len = png_strlen(png_ptr->chunkdata + prefix_len);
    text_ptr = (png_textp)png_malloc_warn(png_ptr,
       (png_uint_32)png_sizeof(png_text));
    if (text_ptr == NULL)
    {
-     png_warning(png_ptr,"Not enough memory to process iTXt chunk.");
-     png_free(png_ptr, chunkdata);
+     png_warning(png_ptr, "Not enough memory to process iTXt chunk.");
+     png_free(png_ptr, png_ptr->chunkdata);
+     png_ptr->chunkdata = NULL;
      return;
    }
    text_ptr->compression = (int)comp_flag + 1;
-   text_ptr->lang_key = chunkdata+(lang_key-key);
-   text_ptr->lang = chunkdata+(lang-key);
+   text_ptr->lang_key = png_ptr->chunkdata + (lang_key - key);
+   text_ptr->lang = png_ptr->chunkdata + (lang - key);
    text_ptr->itxt_length = data_len;
    text_ptr->text_length = 0;
-   text_ptr->key = chunkdata;
-   text_ptr->text = chunkdata + prefix_len;
+   text_ptr->key = png_ptr->chunkdata;
+   text_ptr->text = png_ptr->chunkdata + prefix_len;
 
-   ret=png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
+   ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
 
    png_free(png_ptr, text_ptr);
-   png_free(png_ptr, chunkdata);
+   png_free(png_ptr, png_ptr->chunkdata);
+   png_ptr->chunkdata = NULL;
    if (ret)
      png_error(png_ptr, "Insufficient memory to store iTXt chunk.");
 }
@@ -2179,23 +2240,22 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
    png_uint_32 skip = 0;
 
-   png_debug(1, "in png_handle_unknown\n");
+   png_debug(1, "in png_handle_unknown");
+
 
    if (png_ptr->mode & PNG_HAVE_IDAT)
    {
 #ifdef PNG_USE_LOCAL_ARRAYS
       PNG_CONST PNG_IDAT;
 #endif
-      if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4))  /* not an IDAT */
+      if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4))  /* Not an IDAT */
          png_ptr->mode |= PNG_AFTER_IDAT;
    }
 
-   png_check_chunk_name(png_ptr, png_ptr->chunk_name);
-
    if (!(png_ptr->chunk_name[0] & 0x20))
    {
-#if defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
-      if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
+#if defined(PNG_HANDLE_AS_UNKNOWN_SUPPORTED)
+      if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
            PNG_HANDLE_CHUNK_ALWAYS
 #if defined(PNG_READ_USER_CHUNKS_SUPPORTED)
            && png_ptr->read_user_chunk_fn == NULL
@@ -2206,8 +2266,11 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    }
 
 #if defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
-   if ((png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS) ||
-       (png_ptr->read_user_chunk_fn != NULL))
+   if ((png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS)
+#if defined(PNG_READ_USER_CHUNKS_SUPPORTED)
+       || (png_ptr->read_user_chunk_fn != NULL)
+#endif
+        )
    {
 #ifdef PNG_MAX_MALLOC_64K
        if (length > (png_uint_32)65535L)
@@ -2218,7 +2281,7 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
        }
 #endif
        png_memcpy((png_charp)png_ptr->unknown_chunk.name,
-                  (png_charp)png_ptr->chunk_name, 
+                  (png_charp)png_ptr->chunk_name,
                   png_sizeof(png_ptr->unknown_chunk.name));
        png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name)-1] = '\0';
        png_ptr->unknown_chunk.size = (png_size_t)length;
@@ -2230,9 +2293,9 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
          png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length);
        }
 #if defined(PNG_READ_USER_CHUNKS_SUPPORTED)
-       if(png_ptr->read_user_chunk_fn != NULL)
+       if (png_ptr->read_user_chunk_fn != NULL)
        {
-          /* callback to user unknown chunk handler */
+          /* Callback to user unknown chunk handler */
           int ret;
           ret = (*(png_ptr->read_user_chunk_fn))
             (png_ptr, &png_ptr->unknown_chunk);
@@ -2241,8 +2304,10 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
           if (ret == 0)
           {
              if (!(png_ptr->chunk_name[0] & 0x20))
-                if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
+#if defined(PNG_HANDLE_AS_UNKNOWN_SUPPORTED)
+                if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
                      PNG_HANDLE_CHUNK_ALWAYS)
+#endif
                    png_chunk_error(png_ptr, "unknown critical chunk");
              png_set_unknown_chunks(png_ptr, info_ptr,
                &png_ptr->unknown_chunk, 1);
@@ -2261,7 +2326,7 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    png_crc_finish(png_ptr, skip);
 
 #if !defined(PNG_READ_USER_CHUNKS_SUPPORTED)
-   info_ptr = info_ptr; /* quiet compiler warnings about unused info_ptr */
+   info_ptr = info_ptr; /* Quiet compiler warnings about unused info_ptr */
 #endif
 }
 
@@ -2276,7 +2341,7 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 void /* PRIVATE */
 png_check_chunk_name(png_structp png_ptr, png_bytep chunk_name)
 {
-   png_debug(1, "in png_check_chunk_name\n");
+   png_debug(1, "in png_check_chunk_name");
    if (isnonalpha(chunk_name[0]) || isnonalpha(chunk_name[1]) ||
        isnonalpha(chunk_name[2]) || isnonalpha(chunk_name[3]))
    {
@@ -2298,7 +2363,7 @@ png_check_chunk_name(png_structp png_ptr, png_bytep chunk_name)
 void /* PRIVATE */
 png_combine_row(png_structp png_ptr, png_bytep row, int mask)
 {
-   png_debug(1,"in png_combine_row\n");
+   png_debug(1, "in png_combine_row");
    if (mask == 0xff)
    {
       png_memcpy(row, png_ptr->row_buf + 1,
@@ -2509,12 +2574,12 @@ png_do_read_interlace(png_structp png_ptr)
    int pass = png_ptr->pass;
    png_uint_32 transformations = png_ptr->transformations;
 #ifdef PNG_USE_LOCAL_ARRAYS
-   /* arrays to facilitate easy interlacing - use pass (0 - 6) as index */
-   /* offset to next interlace block */
+   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
+   /* Offset to next interlace block */
    PNG_CONST int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
 #endif
 
-   png_debug(1,"in png_do_read_interlace\n");
+   png_debug(1, "in png_do_read_interlace");
    if (row != NULL && row_info != NULL)
    {
       png_uint_32 final_width;
@@ -2715,10 +2780,10 @@ png_do_read_interlace(png_structp png_ptr)
          }
       }
       row_info->width = final_width;
-      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,final_width);
+      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, final_width);
    }
 #if !defined(PNG_READ_PACKSWAP_SUPPORTED)
-   transformations = transformations; /* silence compiler warning */
+   transformations = transformations; /* Silence compiler warning */
 #endif
 }
 #endif /* PNG_READ_INTERLACING_SUPPORTED */
@@ -2727,8 +2792,8 @@ void /* PRIVATE */
 png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep row,
    png_bytep prev_row, int filter)
 {
-   png_debug(1, "in png_read_filter_row\n");
-   png_debug2(2,"row = %lu, filter = %d\n", png_ptr->row_number, filter);
+   png_debug(1, "in png_read_filter_row");
+   png_debug2(2, "row = %lu, filter = %d", png_ptr->row_number, filter);
    switch (filter)
    {
       case PNG_FILTER_VALUE_NONE:
@@ -2802,7 +2867,7 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep row,
             rp++;
          }
 
-         for (i = 0; i < istop; i++)   /* use leftover rp,pp */
+         for (i = 0; i < istop; i++)   /* Use leftover rp,pp */
          {
             int a, b, c, pa, pb, pc, p;
 
@@ -2832,7 +2897,7 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep row,
                   p = c;
              */
 
-            p = (pa <= pb && pa <=pc) ? a : (pb <= pc) ? b : c;
+            p = (pa <= pb && pa <= pc) ? a : (pb <= pc) ? b : c;
 
             *rp = (png_byte)(((int)(*rp) + p) & 0xff);
             rp++;
@@ -2841,33 +2906,34 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep row,
       }
       default:
          png_warning(png_ptr, "Ignoring bad adaptive filter type");
-         *row=0;
+         *row = 0;
          break;
    }
 }
 
+#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED
 void /* PRIVATE */
 png_read_finish_row(png_structp png_ptr)
 {
 #ifdef PNG_USE_LOCAL_ARRAYS
 #ifdef PNG_READ_INTERLACING_SUPPORTED
-   /* arrays to facilitate easy interlacing - use pass (0 - 6) as index */
+   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
 
-   /* start of interlace block */
+   /* Start of interlace block */
    PNG_CONST int png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
 
-   /* offset to next interlace block */
+   /* Offset to next interlace block */
    PNG_CONST int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
 
-   /* start of interlace block in the y direction */
+   /* Start of interlace block in the y direction */
    PNG_CONST int png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
 
-   /* offset to next interlace block in the y direction */
+   /* Offset to next interlace block in the y direction */
    PNG_CONST int png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
 #endif /* PNG_READ_INTERLACING_SUPPORTED */
 #endif
 
-   png_debug(1, "in png_read_finish_row\n");
+   png_debug(1, "in png_read_finish_row");
    png_ptr->row_number++;
    if (png_ptr->row_number < png_ptr->num_rows)
       return;
@@ -2919,7 +2985,7 @@ png_read_finish_row(png_structp png_ptr)
 
       png_ptr->zstream.next_out = (Byte *)&extra;
       png_ptr->zstream.avail_out = (uInt)1;
-      for(;;)
+      for (;;)
       {
          if (!(png_ptr->zstream.avail_in))
          {
@@ -2977,32 +3043,33 @@ png_read_finish_row(png_structp png_ptr)
 
    png_ptr->mode |= PNG_AFTER_IDAT;
 }
+#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */
 
 void /* PRIVATE */
 png_read_start_row(png_structp png_ptr)
 {
 #ifdef PNG_USE_LOCAL_ARRAYS
 #ifdef PNG_READ_INTERLACING_SUPPORTED
-   /* arrays to facilitate easy interlacing - use pass (0 - 6) as index */
+   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
 
-   /* start of interlace block */
+   /* Start of interlace block */
    PNG_CONST int png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
 
-   /* offset to next interlace block */
+   /* Offset to next interlace block */
    PNG_CONST int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
 
-   /* start of interlace block in the y direction */
+   /* Start of interlace block in the y direction */
    PNG_CONST int png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
 
-   /* offset to next interlace block in the y direction */
+   /* Offset to next interlace block in the y direction */
    PNG_CONST int png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
 #endif
 #endif
 
    int max_pixel_depth;
-   png_uint_32 row_bytes;
+   png_size_t row_bytes;
 
-   png_debug(1, "in png_read_start_row\n");
+   png_debug(1, "in png_read_start_row");
    png_ptr->zstream.avail_in = 0;
    png_init_read_transformations(png_ptr);
 #ifdef PNG_READ_INTERLACING_SUPPORTED
@@ -3019,11 +3086,8 @@ png_read_start_row(png_structp png_ptr)
          png_pass_start[png_ptr->pass]) /
          png_pass_inc[png_ptr->pass];
 
-         row_bytes = PNG_ROWBYTES(png_ptr->pixel_depth,png_ptr->iwidth) + 1;
-
-         png_ptr->irowbytes = (png_size_t)row_bytes;
-         if((png_uint_32)png_ptr->irowbytes != row_bytes)
-            png_error(png_ptr, "Rowbytes overflow in png_read_start_row");
+         png_ptr->irowbytes =
+            PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + 1;
    }
    else
 #endif /* PNG_READ_INTERLACING_SUPPORTED */
@@ -3125,58 +3189,63 @@ png_read_start_row(png_structp png_ptr)
 
 #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) && \
 defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
-   if(png_ptr->transformations & PNG_USER_TRANSFORM)
+   if (png_ptr->transformations & PNG_USER_TRANSFORM)
      {
-       int user_pixel_depth=png_ptr->user_transform_depth*
+       int user_pixel_depth = png_ptr->user_transform_depth*
          png_ptr->user_transform_channels;
-       if(user_pixel_depth > max_pixel_depth)
+       if (user_pixel_depth > max_pixel_depth)
          max_pixel_depth=user_pixel_depth;
      }
 #endif
 
-   /* align the width on the next larger 8 pixels.  Mainly used
-      for interlacing */
+   /* Align the width on the next larger 8 pixels.  Mainly used
+    * for interlacing
+    */
    row_bytes = ((png_ptr->width + 7) & ~((png_uint_32)7));
-   /* calculate the maximum bytes needed, adding a byte and a pixel
-      for safety's sake */
-   row_bytes = PNG_ROWBYTES(max_pixel_depth,row_bytes) +
+   /* Calculate the maximum bytes needed, adding a byte and a pixel
+    * for safety's sake
+    */
+   row_bytes = PNG_ROWBYTES(max_pixel_depth, row_bytes) +
       1 + ((max_pixel_depth + 7) >> 3);
 #ifdef PNG_MAX_MALLOC_64K
    if (row_bytes > (png_uint_32)65536L)
       png_error(png_ptr, "This image requires a row greater than 64KB");
 #endif
 
-   if(row_bytes + 64 > png_ptr->old_big_row_buf_size)
+   if (row_bytes + 64 > png_ptr->old_big_row_buf_size)
    {
-     png_free(png_ptr,png_ptr->big_row_buf);
-     png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes+64);
-     png_ptr->row_buf = png_ptr->big_row_buf+32;
-     png_ptr->old_big_row_buf_size = row_bytes+64;
+     png_free(png_ptr, png_ptr->big_row_buf);
+     png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + 64);
+     if (png_ptr->interlaced)
+       png_memset(png_ptr->big_row_buf, 0, row_bytes + 64);
+     png_ptr->row_buf = png_ptr->big_row_buf + 32;
+     png_ptr->old_big_row_buf_size = row_bytes + 64;
    }
 
 #ifdef PNG_MAX_MALLOC_64K
-   if ((png_uint_32)png_ptr->rowbytes + 1 > (png_uint_32)65536L)
+   if ((png_uint_32)row_bytes + 1 > (png_uint_32)65536L)
       png_error(png_ptr, "This image requires a row greater than 64KB");
 #endif
-   if ((png_uint_32)png_ptr->rowbytes > (png_uint_32)(PNG_SIZE_MAX - 1))
+   if ((png_uint_32)row_bytes > (png_uint_32)(PNG_SIZE_MAX - 1))
       png_error(png_ptr, "Row has too many bytes to allocate in memory.");
 
-   if(png_ptr->rowbytes+1 > png_ptr->old_prev_row_size)
+   if (row_bytes + 1 > png_ptr->old_prev_row_size)
    {
-     png_free(png_ptr,png_ptr->prev_row);
-     png_ptr->prev_row = (png_bytep)png_malloc(png_ptr, (png_uint_32)(
-        png_ptr->rowbytes + 1));
-     png_ptr->old_prev_row_size = png_ptr->rowbytes+1;
+      png_free(png_ptr, png_ptr->prev_row);
+      png_ptr->prev_row = (png_bytep)png_malloc(png_ptr, (png_uint_32)(
+        row_bytes + 1));
+      png_memset_check(png_ptr, png_ptr->prev_row, 0, row_bytes + 1);
+      png_ptr->old_prev_row_size = row_bytes + 1;
    }
 
-   png_memset_check(png_ptr, png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
+   png_ptr->rowbytes = row_bytes;
 
-   png_debug1(3, "width = %lu,\n", png_ptr->width);
-   png_debug1(3, "height = %lu,\n", png_ptr->height);
-   png_debug1(3, "iwidth = %lu,\n", png_ptr->iwidth);
-   png_debug1(3, "num_rows = %lu\n", png_ptr->num_rows);
-   png_debug1(3, "rowbytes = %lu,\n", png_ptr->rowbytes);
-   png_debug1(3, "irowbytes = %lu,\n", png_ptr->irowbytes);
+   png_debug1(3, "width = %lu,", png_ptr->width);
+   png_debug1(3, "height = %lu,", png_ptr->height);
+   png_debug1(3, "iwidth = %lu,", png_ptr->iwidth);
+   png_debug1(3, "num_rows = %lu,", png_ptr->num_rows);
+   png_debug1(3, "rowbytes = %lu,", png_ptr->rowbytes);
+   png_debug1(3, "irowbytes = %lu", png_ptr->irowbytes);
 
    png_ptr->flags |= PNG_FLAG_ROW_INIT;
 }
diff --git a/src/3rdparty/libpng/pngset.c b/src/3rdparty/libpng/pngset.c
index 8b25ca504c..9e1b885610 100644
--- a/src/3rdparty/libpng/pngset.c
+++ b/src/3rdparty/libpng/pngset.c
@@ -1,12 +1,15 @@
 
 /* pngset.c - storage of image information into info struct
  *
- * Last changed in libpng 1.2.27 [April 29, 2008]
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.40 [September 10, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
+ *
  * The functions here are used during reads to store data from the file
  * into the info struct, and during writes to store application data
  * into the info struct for writing into the file.  This abstracts the
@@ -15,14 +18,14 @@
 
 #define PNG_INTERNAL
 #include "png.h"
-
 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
 
 #if defined(PNG_bKGD_SUPPORTED)
 void PNGAPI
 png_set_bKGD(png_structp png_ptr, png_infop info_ptr, png_color_16p background)
 {
-   png_debug1(1, "in %s storage function\n", "bKGD");
+   png_debug1(1, "in %s storage function", "bKGD");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
@@ -38,34 +41,10 @@ png_set_cHRM(png_structp png_ptr, png_infop info_ptr,
    double white_x, double white_y, double red_x, double red_y,
    double green_x, double green_y, double blue_x, double blue_y)
 {
-   png_debug1(1, "in %s storage function\n", "cHRM");
+   png_debug1(1, "in %s storage function", "cHRM");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
-   if (!(white_x || white_y || red_x || red_y || green_x || green_y ||
-       blue_x || blue_y))
-   {
-      png_warning(png_ptr,
-        "Ignoring attempt to set all-zero chromaticity values");
-      return;
-   }
-   if (white_x < 0.0 || white_y < 0.0 ||
-         red_x < 0.0 ||   red_y < 0.0 ||
-       green_x < 0.0 || green_y < 0.0 ||
-        blue_x < 0.0 ||  blue_y < 0.0)
-   {
-      png_warning(png_ptr,
-        "Ignoring attempt to set negative chromaticity value");
-      return;
-   }
-   if (white_x > 21474.83 || white_y > 21474.83 ||
-         red_x > 21474.83 ||   red_y > 21474.83 ||
-       green_x > 21474.83 || green_y > 21474.83 ||
-        blue_x > 21474.83 ||  blue_y > 21474.83)
-   {
-      png_warning(png_ptr,
-        "Ignoring attempt to set chromaticity value exceeding 21474.83");
-      return;
-   }
 
    info_ptr->x_white = (float)white_x;
    info_ptr->y_white = (float)white_y;
@@ -87,7 +66,8 @@ png_set_cHRM(png_structp png_ptr, png_infop info_ptr,
 #endif
    info_ptr->valid |= PNG_INFO_cHRM;
 }
-#endif
+#endif /* PNG_FLOATING_POINT_SUPPORTED */
+
 #ifdef PNG_FIXED_POINT_SUPPORTED
 void PNGAPI
 png_set_cHRM_fixed(png_structp png_ptr, png_infop info_ptr,
@@ -95,69 +75,49 @@ png_set_cHRM_fixed(png_structp png_ptr, png_infop info_ptr,
    png_fixed_point red_y, png_fixed_point green_x, png_fixed_point green_y,
    png_fixed_point blue_x, png_fixed_point blue_y)
 {
-   png_debug1(1, "in %s storage function\n", "cHRM");
+   png_debug1(1, "in %s storage function", "cHRM fixed");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
-   if (!(white_x || white_y || red_x || red_y || green_x || green_y ||
-       blue_x || blue_y))
-   {
-      png_warning(png_ptr,
-        "Ignoring attempt to set all-zero chromaticity values");
-      return;
-   }
-   if (white_x < 0 || white_y < 0 ||
-         red_x < 0 ||   red_y < 0 ||
-       green_x < 0 || green_y < 0 ||
-        blue_x < 0 ||  blue_y < 0)
-   {
-      png_warning(png_ptr,
-        "Ignoring attempt to set negative chromaticity value");
-      return;
-   }
-   if (white_x > (png_fixed_point) PNG_UINT_31_MAX ||
-       white_y > (png_fixed_point) PNG_UINT_31_MAX ||
-         red_x > (png_fixed_point) PNG_UINT_31_MAX ||
-         red_y > (png_fixed_point) PNG_UINT_31_MAX ||
-       green_x > (png_fixed_point) PNG_UINT_31_MAX ||
-       green_y > (png_fixed_point) PNG_UINT_31_MAX ||
-        blue_x > (png_fixed_point) PNG_UINT_31_MAX ||
-        blue_y > (png_fixed_point) PNG_UINT_31_MAX )
+#if !defined(PNG_NO_CHECK_cHRM)
+   if (png_check_cHRM_fixed(png_ptr,
+      white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y))
+#endif
    {
-      png_warning(png_ptr,
-        "Ignoring attempt to set chromaticity value exceeding 21474.83");
-      return;
+      info_ptr->int_x_white = white_x;
+      info_ptr->int_y_white = white_y;
+      info_ptr->int_x_red   = red_x;
+      info_ptr->int_y_red   = red_y;
+      info_ptr->int_x_green = green_x;
+      info_ptr->int_y_green = green_y;
+      info_ptr->int_x_blue  = blue_x;
+      info_ptr->int_y_blue  = blue_y;
+#ifdef  PNG_FLOATING_POINT_SUPPORTED
+      info_ptr->x_white = (float)(white_x/100000.);
+      info_ptr->y_white = (float)(white_y/100000.);
+      info_ptr->x_red   = (float)(  red_x/100000.);
+      info_ptr->y_red   = (float)(  red_y/100000.);
+      info_ptr->x_green = (float)(green_x/100000.);
+      info_ptr->y_green = (float)(green_y/100000.);
+      info_ptr->x_blue  = (float)( blue_x/100000.);
+      info_ptr->y_blue  = (float)( blue_y/100000.);
+#endif
+      info_ptr->valid |= PNG_INFO_cHRM;
    }
-   info_ptr->int_x_white = white_x;
-   info_ptr->int_y_white = white_y;
-   info_ptr->int_x_red   = red_x;
-   info_ptr->int_y_red   = red_y;
-   info_ptr->int_x_green = green_x;
-   info_ptr->int_y_green = green_y;
-   info_ptr->int_x_blue  = blue_x;
-   info_ptr->int_y_blue  = blue_y;
-#ifdef PNG_FLOATING_POINT_SUPPORTED
-   info_ptr->x_white = (float)(white_x/100000.);
-   info_ptr->y_white = (float)(white_y/100000.);
-   info_ptr->x_red   = (float)(  red_x/100000.);
-   info_ptr->y_red   = (float)(  red_y/100000.);
-   info_ptr->x_green = (float)(green_x/100000.);
-   info_ptr->y_green = (float)(green_y/100000.);
-   info_ptr->x_blue  = (float)( blue_x/100000.);
-   info_ptr->y_blue  = (float)( blue_y/100000.);
-#endif
-   info_ptr->valid |= PNG_INFO_cHRM;
 }
-#endif
-#endif
+#endif /* PNG_FIXED_POINT_SUPPORTED */
+#endif /* PNG_cHRM_SUPPORTED */
 
 #if defined(PNG_gAMA_SUPPORTED)
 #ifdef PNG_FLOATING_POINT_SUPPORTED
 void PNGAPI
 png_set_gAMA(png_structp png_ptr, png_infop info_ptr, double file_gamma)
 {
-   double gamma;
-   png_debug1(1, "in %s storage function\n", "gAMA");
+   double png_gamma;
+
+   png_debug1(1, "in %s storage function", "gAMA");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
@@ -165,16 +125,16 @@ png_set_gAMA(png_structp png_ptr, png_infop info_ptr, double file_gamma)
    if (file_gamma > 21474.83)
    {
       png_warning(png_ptr, "Limiting gamma to 21474.83");
-      gamma=21474.83;
+      png_gamma=21474.83;
    }
    else
-      gamma=file_gamma;
-   info_ptr->gamma = (float)gamma;
+      png_gamma = file_gamma;
+   info_ptr->gamma = (float)png_gamma;
 #ifdef PNG_FIXED_POINT_SUPPORTED
-   info_ptr->int_gamma = (int)(gamma*100000.+.5);
+   info_ptr->int_gamma = (int)(png_gamma*100000.+.5);
 #endif
    info_ptr->valid |= PNG_INFO_gAMA;
-   if(gamma == 0.0)
+   if (png_gamma == 0.0)
       png_warning(png_ptr, "Setting gamma=0");
 }
 #endif
@@ -182,35 +142,36 @@ void PNGAPI
 png_set_gAMA_fixed(png_structp png_ptr, png_infop info_ptr, png_fixed_point
    int_gamma)
 {
-   png_fixed_point gamma;
+   png_fixed_point png_gamma;
+
+   png_debug1(1, "in %s storage function", "gAMA");
 
-   png_debug1(1, "in %s storage function\n", "gAMA");
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
-   if (int_gamma > (png_fixed_point) PNG_UINT_31_MAX)
+   if (int_gamma > (png_fixed_point)PNG_UINT_31_MAX)
    {
-     png_warning(png_ptr, "Limiting gamma to 21474.83");
-     gamma=PNG_UINT_31_MAX;
+      png_warning(png_ptr, "Limiting gamma to 21474.83");
+      png_gamma=PNG_UINT_31_MAX;
    }
    else
    {
-     if (int_gamma < 0)
-     {
-       png_warning(png_ptr, "Setting negative gamma to zero");
-       gamma=0;
-     }
-     else
-       gamma=int_gamma;
+      if (int_gamma < 0)
+      {
+         png_warning(png_ptr, "Setting negative gamma to zero");
+         png_gamma = 0;
+      }
+      else
+         png_gamma = int_gamma;
    }
 #ifdef PNG_FLOATING_POINT_SUPPORTED
-   info_ptr->gamma = (float)(gamma/100000.);
+   info_ptr->gamma = (float)(png_gamma/100000.);
 #endif
 #ifdef PNG_FIXED_POINT_SUPPORTED
-   info_ptr->int_gamma = gamma;
+   info_ptr->int_gamma = png_gamma;
 #endif
    info_ptr->valid |= PNG_INFO_gAMA;
-   if(gamma == 0)
+   if (png_gamma == 0)
       png_warning(png_ptr, "Setting gamma=0");
 }
 #endif
@@ -221,32 +182,35 @@ png_set_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_16p hist)
 {
    int i;
 
-   png_debug1(1, "in %s storage function\n", "hIST");
+   png_debug1(1, "in %s storage function", "hIST");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
+
    if (info_ptr->num_palette == 0 || info_ptr->num_palette
        > PNG_MAX_PALETTE_LENGTH)
    {
-       png_warning(png_ptr,
-          "Invalid palette size, hIST allocation skipped.");
-       return;
+      png_warning(png_ptr,
+         "Invalid palette size, hIST allocation skipped.");
+      return;
    }
 
 #ifdef PNG_FREE_ME_SUPPORTED
    png_free_data(png_ptr, info_ptr, PNG_FREE_HIST, 0);
 #endif
-   /* Changed from info->num_palette to PNG_MAX_PALETTE_LENGTH in version
-      1.2.1 */
+   /* Changed from info->num_palette to PNG_MAX_PALETTE_LENGTH in
+    * version 1.2.1
+    */
    png_ptr->hist = (png_uint_16p)png_malloc_warn(png_ptr,
-      (png_uint_32)(PNG_MAX_PALETTE_LENGTH * png_sizeof (png_uint_16)));
+      (png_uint_32)(PNG_MAX_PALETTE_LENGTH * png_sizeof(png_uint_16)));
    if (png_ptr->hist == NULL)
-     {
-       png_warning(png_ptr, "Insufficient memory for hIST chunk data.");
-       return;
-     }
+   {
+      png_warning(png_ptr, "Insufficient memory for hIST chunk data.");
+      return;
+   }
 
    for (i = 0; i < info_ptr->num_palette; i++)
-       png_ptr->hist[i] = hist[i];
+      png_ptr->hist[i] = hist[i];
    info_ptr->hist = png_ptr->hist;
    info_ptr->valid |= PNG_INFO_hIST;
 
@@ -264,11 +228,12 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr,
    int color_type, int interlace_type, int compression_type,
    int filter_type)
 {
-   png_debug1(1, "in %s storage function\n", "IHDR");
+   png_debug1(1, "in %s storage function", "IHDR");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
-   /* check for width and height valid values */
+   /* Check for width and height valid values */
    if (width == 0 || height == 0)
       png_error(png_ptr, "Image width or height is zero in IHDR");
 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
@@ -288,13 +253,13 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr,
                  - 8)       /* extra max_pixel_depth pad */
       png_warning(png_ptr, "Width is too large for libpng to process pixels");
 
-   /* check other values */
+   /* Check other values */
    if (bit_depth != 1 && bit_depth != 2 && bit_depth != 4 &&
-      bit_depth != 8 && bit_depth != 16)
+       bit_depth != 8 && bit_depth != 16)
       png_error(png_ptr, "Invalid bit depth in IHDR");
 
    if (color_type < 0 || color_type == 1 ||
-      color_type == 5 || color_type > 6)
+       color_type == 5 || color_type > 6)
       png_error(png_ptr, "Invalid color type in IHDR");
 
    if (((color_type == PNG_COLOR_TYPE_PALETTE) && bit_depth > 8) ||
@@ -319,21 +284,21 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr,
     * 4. The filter_method is 64 and
     * 5. The color_type is RGB or RGBA
     */
-   if((png_ptr->mode&PNG_HAVE_PNG_SIGNATURE)&&png_ptr->mng_features_permitted)
-      png_warning(png_ptr,"MNG features are not allowed in a PNG datastream");
-   if(filter_type != PNG_FILTER_TYPE_BASE)
+   if ((png_ptr->mode&PNG_HAVE_PNG_SIGNATURE)&&png_ptr->mng_features_permitted)
+      png_warning(png_ptr, "MNG features are not allowed in a PNG datastream");
+   if (filter_type != PNG_FILTER_TYPE_BASE)
    {
-     if(!((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) &&
-        (filter_type == PNG_INTRAPIXEL_DIFFERENCING) &&
-        ((png_ptr->mode&PNG_HAVE_PNG_SIGNATURE) == 0) &&
-        (color_type == PNG_COLOR_TYPE_RGB ||
+     if (!((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) &&
+         (filter_type == PNG_INTRAPIXEL_DIFFERENCING) &&
+         ((png_ptr->mode&PNG_HAVE_PNG_SIGNATURE) == 0) &&
+         (color_type == PNG_COLOR_TYPE_RGB ||
          color_type == PNG_COLOR_TYPE_RGB_ALPHA)))
         png_error(png_ptr, "Unknown filter method in IHDR");
-     if(png_ptr->mode&PNG_HAVE_PNG_SIGNATURE)
+     if (png_ptr->mode&PNG_HAVE_PNG_SIGNATURE)
         png_warning(png_ptr, "Invalid filter method in IHDR");
    }
 #else
-   if(filter_type != PNG_FILTER_TYPE_BASE)
+   if (filter_type != PNG_FILTER_TYPE_BASE)
       png_error(png_ptr, "Unknown filter method in IHDR");
 #endif
 
@@ -354,7 +319,7 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr,
       info_ptr->channels++;
    info_ptr->pixel_depth = (png_byte)(info_ptr->channels * info_ptr->bit_depth);
 
-   /* check for potential overflow */
+   /* Check for potential overflow */
    if (width > (PNG_UINT_32_MAX
                  >> 3)      /* 8-byte RGBA pixels */
                  - 64       /* bigrowbuf hack */
@@ -363,7 +328,7 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr,
                  - 8)       /* extra max_pixel_depth pad */
       info_ptr->rowbytes = (png_size_t)0;
    else
-      info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth,width);
+      info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, width);
 }
 
 #if defined(PNG_oFFs_SUPPORTED)
@@ -371,7 +336,8 @@ void PNGAPI
 png_set_oFFs(png_structp png_ptr, png_infop info_ptr,
    png_int_32 offset_x, png_int_32 offset_y, int unit_type)
 {
-   png_debug1(1, "in %s storage function\n", "oFFs");
+   png_debug1(1, "in %s storage function", "oFFs");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
@@ -391,56 +357,60 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr,
    png_uint_32 length;
    int i;
 
-   png_debug1(1, "in %s storage function\n", "pCAL");
+   png_debug1(1, "in %s storage function", "pCAL");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
    length = png_strlen(purpose) + 1;
-   png_debug1(3, "allocating purpose for info (%lu bytes)\n", length);
+   png_debug1(3, "allocating purpose for info (%lu bytes)",
+     (unsigned long)length);
    info_ptr->pcal_purpose = (png_charp)png_malloc_warn(png_ptr, length);
    if (info_ptr->pcal_purpose == NULL)
-     {
-       png_warning(png_ptr, "Insufficient memory for pCAL purpose.");
-       return;
-     }
+   {
+      png_warning(png_ptr, "Insufficient memory for pCAL purpose.");
+      return;
+   }
    png_memcpy(info_ptr->pcal_purpose, purpose, (png_size_t)length);
 
-   png_debug(3, "storing X0, X1, type, and nparams in info\n");
+   png_debug(3, "storing X0, X1, type, and nparams in info");
    info_ptr->pcal_X0 = X0;
    info_ptr->pcal_X1 = X1;
    info_ptr->pcal_type = (png_byte)type;
    info_ptr->pcal_nparams = (png_byte)nparams;
 
    length = png_strlen(units) + 1;
-   png_debug1(3, "allocating units for info (%lu bytes)\n", length);
+   png_debug1(3, "allocating units for info (%lu bytes)",
+     (unsigned long)length);
    info_ptr->pcal_units = (png_charp)png_malloc_warn(png_ptr, length);
    if (info_ptr->pcal_units == NULL)
-     {
-       png_warning(png_ptr, "Insufficient memory for pCAL units.");
-       return;
-     }
+   {
+      png_warning(png_ptr, "Insufficient memory for pCAL units.");
+      return;
+   }
    png_memcpy(info_ptr->pcal_units, units, (png_size_t)length);
 
    info_ptr->pcal_params = (png_charpp)png_malloc_warn(png_ptr,
       (png_uint_32)((nparams + 1) * png_sizeof(png_charp)));
    if (info_ptr->pcal_params == NULL)
-     {
-       png_warning(png_ptr, "Insufficient memory for pCAL params.");
-       return;
-     }
+   {
+      png_warning(png_ptr, "Insufficient memory for pCAL params.");
+      return;
+   }
 
-   info_ptr->pcal_params[nparams] = NULL;
+   png_memset(info_ptr->pcal_params, 0, (nparams + 1) * png_sizeof(png_charp));
 
    for (i = 0; i < nparams; i++)
    {
       length = png_strlen(params[i]) + 1;
-      png_debug2(3, "allocating parameter %d for info (%lu bytes)\n", i, length);
+      png_debug2(3, "allocating parameter %d for info (%lu bytes)", i,
+        (unsigned long)length);
       info_ptr->pcal_params[i] = (png_charp)png_malloc_warn(png_ptr, length);
       if (info_ptr->pcal_params[i] == NULL)
-        {
-          png_warning(png_ptr, "Insufficient memory for pCAL parameter.");
-          return;
-        }
+      {
+         png_warning(png_ptr, "Insufficient memory for pCAL parameter.");
+         return;
+      }
       png_memcpy(info_ptr->pcal_params[i], params[i], (png_size_t)length);
    }
 
@@ -457,7 +427,8 @@ void PNGAPI
 png_set_sCAL(png_structp png_ptr, png_infop info_ptr,
              int unit, double width, double height)
 {
-   png_debug1(1, "in %s storage function\n", "sCAL");
+   png_debug1(1, "in %s storage function", "sCAL");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
@@ -475,14 +446,16 @@ png_set_sCAL_s(png_structp png_ptr, png_infop info_ptr,
 {
    png_uint_32 length;
 
-   png_debug1(1, "in %s storage function\n", "sCAL");
+   png_debug1(1, "in %s storage function", "sCAL");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
    info_ptr->scal_unit = (png_byte)unit;
 
    length = png_strlen(swidth) + 1;
-   png_debug1(3, "allocating unit for info (%d bytes)\n", length);
+   png_debug1(3, "allocating unit for info (%u bytes)",
+      (unsigned int)length);
    info_ptr->scal_s_width = (png_charp)png_malloc_warn(png_ptr, length);
    if (info_ptr->scal_s_width == NULL)
    {
@@ -493,11 +466,13 @@ png_set_sCAL_s(png_structp png_ptr, png_infop info_ptr,
    png_memcpy(info_ptr->scal_s_width, swidth, (png_size_t)length);
 
    length = png_strlen(sheight) + 1;
-   png_debug1(3, "allocating unit for info (%d bytes)\n", length);
+   png_debug1(3, "allocating unit for info (%u bytes)",
+      (unsigned int)length);
    info_ptr->scal_s_height = (png_charp)png_malloc_warn(png_ptr, length);
    if (info_ptr->scal_s_height == NULL)
    {
       png_free (png_ptr, info_ptr->scal_s_width);
+      info_ptr->scal_s_width = NULL;
       png_warning(png_ptr,
        "Memory allocation failed while processing sCAL.");
       return;
@@ -517,7 +492,8 @@ void PNGAPI
 png_set_pHYs(png_structp png_ptr, png_infop info_ptr,
    png_uint_32 res_x, png_uint_32 res_y, int unit_type)
 {
-   png_debug1(1, "in %s storage function\n", "pHYs");
+   png_debug1(1, "in %s storage function", "pHYs");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
@@ -533,20 +509,21 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr,
    png_colorp palette, int num_palette)
 {
 
-   png_debug1(1, "in %s storage function\n", "PLTE");
+   png_debug1(1, "in %s storage function", "PLTE");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
    if (num_palette < 0 || num_palette > PNG_MAX_PALETTE_LENGTH)
-     {
-       if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
+   {
+      if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
          png_error(png_ptr, "Invalid palette length");
-       else
-       {
+      else
+      {
          png_warning(png_ptr, "Invalid palette length");
          return;
-       }
-     }
+      }
+   }
 
    /*
     * It may not actually be necessary to set png_ptr->palette here;
@@ -558,13 +535,14 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr,
 #endif
 
    /* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead
-      of num_palette entries,
-      in case of an invalid PNG file that has too-large sample values. */
+    * of num_palette entries, in case of an invalid PNG file that has
+    * too-large sample values.
+    */
    png_ptr->palette = (png_colorp)png_malloc(png_ptr,
       PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color));
    png_memset(png_ptr->palette, 0, PNG_MAX_PALETTE_LENGTH *
       png_sizeof(png_color));
-   png_memcpy(png_ptr->palette, palette, num_palette * png_sizeof (png_color));
+   png_memcpy(png_ptr->palette, palette, num_palette * png_sizeof(png_color));
    info_ptr->palette = png_ptr->palette;
    info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette;
 
@@ -582,11 +560,12 @@ void PNGAPI
 png_set_sBIT(png_structp png_ptr, png_infop info_ptr,
    png_color_8p sig_bit)
 {
-   png_debug1(1, "in %s storage function\n", "sBIT");
+   png_debug1(1, "in %s storage function", "sBIT");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
-   png_memcpy(&(info_ptr->sig_bit), sig_bit, png_sizeof (png_color_8));
+   png_memcpy(&(info_ptr->sig_bit), sig_bit, png_sizeof(png_color_8));
    info_ptr->valid |= PNG_INFO_sBIT;
 }
 #endif
@@ -595,7 +574,8 @@ png_set_sBIT(png_structp png_ptr, png_infop info_ptr,
 void PNGAPI
 png_set_sRGB(png_structp png_ptr, png_infop info_ptr, int intent)
 {
-   png_debug1(1, "in %s storage function\n", "sRGB");
+   png_debug1(1, "in %s storage function", "sRGB");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
@@ -619,12 +599,11 @@ png_set_sRGB_gAMA_and_cHRM(png_structp png_ptr, png_infop info_ptr,
 #ifdef PNG_FLOATING_POINT_SUPPORTED
    float white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y;
 #endif
-#ifdef PNG_FIXED_POINT_SUPPORTED
    png_fixed_point int_white_x, int_white_y, int_red_x, int_red_y, int_green_x,
       int_green_y, int_blue_x, int_blue_y;
 #endif
-#endif
-   png_debug1(1, "in %s storage function\n", "sRGB_gAMA_and_cHRM");
+   png_debug1(1, "in %s storage function", "sRGB_gAMA_and_cHRM");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
@@ -642,7 +621,6 @@ png_set_sRGB_gAMA_and_cHRM(png_structp png_ptr, png_infop info_ptr,
 #endif
 
 #if defined(PNG_cHRM_SUPPORTED)
-#ifdef PNG_FIXED_POINT_SUPPORTED
    int_white_x = 31270L;
    int_white_y = 32900L;
    int_red_x   = 64000L;
@@ -652,10 +630,6 @@ png_set_sRGB_gAMA_and_cHRM(png_structp png_ptr, png_infop info_ptr,
    int_blue_x  = 15000L;
    int_blue_y  =  6000L;
 
-   png_set_cHRM_fixed(png_ptr, info_ptr,
-      int_white_x, int_white_y, int_red_x, int_red_y, int_green_x, int_green_y,
-      int_blue_x, int_blue_y);
-#endif
 #ifdef PNG_FLOATING_POINT_SUPPORTED
    white_x = (float).3127;
    white_y = (float).3290;
@@ -665,13 +639,27 @@ png_set_sRGB_gAMA_and_cHRM(png_structp png_ptr, png_infop info_ptr,
    green_y = (float).60;
    blue_x  = (float).15;
    blue_y  = (float).06;
+#endif
 
-   png_set_cHRM(png_ptr, info_ptr,
-      white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y);
+#if !defined(PNG_NO_CHECK_cHRM)
+   if (png_check_cHRM_fixed(png_ptr,
+       int_white_x, int_white_y, int_red_x, int_red_y, int_green_x,
+       int_green_y, int_blue_x, int_blue_y))
 #endif
+   {
+#ifdef PNG_FIXED_POINT_SUPPORTED
+      png_set_cHRM_fixed(png_ptr, info_ptr,
+          int_white_x, int_white_y, int_red_x, int_red_y, int_green_x,
+          int_green_y, int_blue_x, int_blue_y);
 #endif
-}
+#ifdef PNG_FLOATING_POINT_SUPPORTED
+      png_set_cHRM(png_ptr, info_ptr,
+          white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y);
 #endif
+   }
+#endif /* cHRM */
+}
+#endif /* sRGB */
 
 
 #if defined(PNG_iCCP_SUPPORTED)
@@ -684,7 +672,8 @@ png_set_iCCP(png_structp png_ptr, png_infop info_ptr,
    png_charp new_iccp_profile;
    png_uint_32 length;
 
-   png_debug1(1, "in %s storage function\n", "iCCP");
+   png_debug1(1, "in %s storage function", "iCCP");
+
    if (png_ptr == NULL || info_ptr == NULL || name == NULL || profile == NULL)
       return;
 
@@ -700,7 +689,8 @@ png_set_iCCP(png_structp png_ptr, png_infop info_ptr,
    if (new_iccp_profile == NULL)
    {
       png_free (png_ptr, new_iccp_name);
-      png_warning(png_ptr, "Insufficient memory to process iCCP profile.");
+      png_warning(png_ptr,
+      "Insufficient memory to process iCCP profile.");
       return;
    }
    png_memcpy(new_iccp_profile, profile, (png_size_t)proflen);
@@ -723,21 +713,22 @@ png_set_iCCP(png_structp png_ptr, png_infop info_ptr,
 #if defined(PNG_TEXT_SUPPORTED)
 void PNGAPI
 png_set_text(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
-   int num_text)
+             int num_text)
 {
    int ret;
-   ret=png_set_text_2(png_ptr, info_ptr, text_ptr, num_text);
+   ret = png_set_text_2(png_ptr, info_ptr, text_ptr, num_text);
    if (ret)
-     png_error(png_ptr, "Insufficient memory to store text");
+      png_error(png_ptr, "Insufficient memory to store text");
 }
 
 int /* PRIVATE */
 png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
-   int num_text)
+               int num_text)
 {
    int i;
 
-   png_debug1(1, "in %s storage function\n", (png_ptr->chunk_name[0] == '\0' ?
+   png_debug1(1, "in %s storage function", ((png_ptr == NULL ||
+      png_ptr->chunk_name[0] == '\0') ?
       "text" : (png_const_charp)png_ptr->chunk_name));
 
    if (png_ptr == NULL || info_ptr == NULL || num_text == 0)
@@ -757,12 +748,12 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
          info_ptr->max_text = info_ptr->num_text + num_text + 8;
          old_text = info_ptr->text;
          info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
-            (png_uint_32)(info_ptr->max_text * png_sizeof (png_text)));
+            (png_uint_32)(info_ptr->max_text * png_sizeof(png_text)));
          if (info_ptr->text == NULL)
-           {
-             png_free(png_ptr, old_text);
-             return(1);
-           }
+         {
+            png_free(png_ptr, old_text);
+            return(1);
+         }
          png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max *
             png_sizeof(png_text)));
          png_free(png_ptr, old_text);
@@ -772,20 +763,20 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
          info_ptr->max_text = num_text + 8;
          info_ptr->num_text = 0;
          info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
-            (png_uint_32)(info_ptr->max_text * png_sizeof (png_text)));
+            (png_uint_32)(info_ptr->max_text * png_sizeof(png_text)));
          if (info_ptr->text == NULL)
-           return(1);
+            return(1);
 #ifdef PNG_FREE_ME_SUPPORTED
          info_ptr->free_me |= PNG_FREE_TEXT;
 #endif
       }
-      png_debug1(3, "allocated %d entries for info_ptr->text\n",
+      png_debug1(3, "allocated %d entries for info_ptr->text",
          info_ptr->max_text);
    }
    for (i = 0; i < num_text; i++)
    {
-      png_size_t text_length,key_len;
-      png_size_t lang_len,lang_key_len;
+      png_size_t text_length, key_len;
+      png_size_t lang_len, lang_key_len;
       png_textp textp = &(info_ptr->text[info_ptr->num_text]);
 
       if (text_ptr[i].key == NULL)
@@ -793,28 +784,28 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
 
       key_len = png_strlen(text_ptr[i].key);
 
-      if(text_ptr[i].compression <= 0)
+      if (text_ptr[i].compression <= 0)
       {
-        lang_len = 0;
-        lang_key_len = 0;
+         lang_len = 0;
+         lang_key_len = 0;
       }
       else
 #ifdef PNG_iTXt_SUPPORTED
       {
-        /* set iTXt data */
-        if (text_ptr[i].lang != NULL)
-          lang_len = png_strlen(text_ptr[i].lang);
-        else
-          lang_len = 0;
-        if (text_ptr[i].lang_key != NULL)
-          lang_key_len = png_strlen(text_ptr[i].lang_key);
-        else
-          lang_key_len = 0;
+         /* Set iTXt data */
+         if (text_ptr[i].lang != NULL)
+            lang_len = png_strlen(text_ptr[i].lang);
+         else
+            lang_len = 0;
+         if (text_ptr[i].lang_key != NULL)
+            lang_key_len = png_strlen(text_ptr[i].lang_key);
+         else
+            lang_key_len = 0;
       }
 #else
       {
-        png_warning(png_ptr, "iTXt chunk not supported.");
-        continue;
+         png_warning(png_ptr, "iTXt chunk not supported.");
+         continue;
       }
 #endif
 
@@ -822,7 +813,7 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
       {
          text_length = 0;
 #ifdef PNG_iTXt_SUPPORTED
-         if(text_ptr[i].compression > 0)
+         if (text_ptr[i].compression > 0)
             textp->compression = PNG_ITXT_COMPRESSION_NONE;
          else
 #endif
@@ -835,26 +826,27 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
       }
 
       textp->key = (png_charp)png_malloc_warn(png_ptr,
-         (png_uint_32)(key_len + text_length + lang_len + lang_key_len + 4));
+         (png_uint_32)
+         (key_len + text_length + lang_len + lang_key_len + 4));
       if (textp->key == NULL)
-        return(1);
-      png_debug2(2, "Allocated %lu bytes at %x in png_set_text\n",
-         (png_uint_32)(key_len + lang_len + lang_key_len + text_length + 4),
-         (int)textp->key);
-
-      png_memcpy(textp->key, text_ptr[i].key,
-         (png_size_t)(key_len));
-      *(textp->key+key_len) = '\0';
+         return(1);
+      png_debug2(2, "Allocated %lu bytes at %x in png_set_text",
+                 (png_uint_32)
+                 (key_len + lang_len + lang_key_len + text_length + 4),
+                 (int)textp->key);
+
+      png_memcpy(textp->key, text_ptr[i].key,(png_size_t)(key_len));
+      *(textp->key + key_len) = '\0';
 #ifdef PNG_iTXt_SUPPORTED
       if (text_ptr[i].compression > 0)
       {
-         textp->lang=textp->key + key_len + 1;
+         textp->lang = textp->key + key_len + 1;
          png_memcpy(textp->lang, text_ptr[i].lang, lang_len);
-         *(textp->lang+lang_len) = '\0';
-         textp->lang_key=textp->lang + lang_len + 1;
+         *(textp->lang + lang_len) = '\0';
+         textp->lang_key = textp->lang + lang_len + 1;
          png_memcpy(textp->lang_key, text_ptr[i].lang_key, lang_key_len);
-         *(textp->lang_key+lang_key_len) = '\0';
-         textp->text=textp->lang_key + lang_key_len + 1;
+         *(textp->lang_key + lang_key_len) = '\0';
+         textp->text = textp->lang_key + lang_key_len + 1;
       }
       else
 #endif
@@ -863,15 +855,15 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
          textp->lang=NULL;
          textp->lang_key=NULL;
 #endif
-         textp->text=textp->key + key_len + 1;
+         textp->text = textp->key + key_len + 1;
       }
-      if(text_length)
+      if (text_length)
          png_memcpy(textp->text, text_ptr[i].text,
             (png_size_t)(text_length));
-      *(textp->text+text_length) = '\0';
+      *(textp->text + text_length) = '\0';
 
 #ifdef PNG_iTXt_SUPPORTED
-      if(textp->compression > 0)
+      if (textp->compression > 0)
       {
          textp->text_length = 0;
          textp->itxt_length = text_length;
@@ -885,7 +877,7 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
 #endif
       }
       info_ptr->num_text++;
-      png_debug1(3, "transferred text chunk %d\n", info_ptr->num_text);
+      png_debug1(3, "transferred text chunk %d", info_ptr->num_text);
    }
    return(0);
 }
@@ -895,12 +887,13 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
 void PNGAPI
 png_set_tIME(png_structp png_ptr, png_infop info_ptr, png_timep mod_time)
 {
-   png_debug1(1, "in %s storage function\n", "tIME");
+   png_debug1(1, "in %s storage function", "tIME");
+
    if (png_ptr == NULL || info_ptr == NULL ||
        (png_ptr->mode & PNG_WROTE_tIME))
       return;
 
-   png_memcpy(&(info_ptr->mod_time), mod_time, png_sizeof (png_time));
+   png_memcpy(&(info_ptr->mod_time), mod_time, png_sizeof(png_time));
    info_ptr->valid |= PNG_INFO_tIME;
 }
 #endif
@@ -910,12 +903,11 @@ void PNGAPI
 png_set_tRNS(png_structp png_ptr, png_infop info_ptr,
    png_bytep trans, int num_trans, png_color_16p trans_values)
 {
-   png_debug1(1, "in %s storage function\n", "tRNS");
+   png_debug1(1, "in %s storage function", "tRNS");
+
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
-   png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
-
    if (trans != NULL)
    {
        /*
@@ -924,11 +916,15 @@ png_set_tRNS(png_structp png_ptr, png_infop info_ptr,
         * function used to do the allocation.
         */
 
+#ifdef PNG_FREE_ME_SUPPORTED
+       png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
+#endif
+
        /* Changed from num_trans to PNG_MAX_PALETTE_LENGTH in version 1.2.1 */
        png_ptr->trans = info_ptr->trans = (png_bytep)png_malloc(png_ptr,
            (png_uint_32)PNG_MAX_PALETTE_LENGTH);
        if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH)
-         png_memcpy(info_ptr->trans, trans, (png_size_t)num_trans);
+          png_memcpy(info_ptr->trans, trans, (png_size_t)num_trans);
    }
 
    if (trans_values != NULL)
@@ -940,12 +936,12 @@ png_set_tRNS(png_structp png_ptr, png_infop info_ptr,
           ((int)trans_values->red > sample_max ||
           (int)trans_values->green > sample_max ||
           (int)trans_values->blue > sample_max)))
-        png_warning(png_ptr,
-           "tRNS chunk has out-of-range samples for bit_depth");
+         png_warning(png_ptr,
+            "tRNS chunk has out-of-range samples for bit_depth");
       png_memcpy(&(info_ptr->trans_values), trans_values,
          png_sizeof(png_color_16));
       if (num_trans == 0)
-        num_trans = 1;
+         num_trans = 1;
    }
 
    info_ptr->num_trans = (png_uint_16)num_trans;
@@ -965,132 +961,141 @@ png_set_tRNS(png_structp png_ptr, png_infop info_ptr,
 void PNGAPI
 png_set_sPLT(png_structp png_ptr,
              png_infop info_ptr, png_sPLT_tp entries, int nentries)
+/*
+ *  entries        - array of png_sPLT_t structures
+ *                   to be added to the list of palettes
+ *                   in the info structure.
+ *  nentries       - number of palette structures to be
+ *                   added.
+ */
 {
-    png_sPLT_tp np;
-    int i;
+   png_sPLT_tp np;
+   int i;
 
-    if (png_ptr == NULL || info_ptr == NULL)
-       return;
+   if (png_ptr == NULL || info_ptr == NULL)
+      return;
 
-    np = (png_sPLT_tp)png_malloc_warn(png_ptr,
-        (info_ptr->splt_palettes_num + nentries) * png_sizeof(png_sPLT_t));
-    if (np == NULL)
-    {
+   np = (png_sPLT_tp)png_malloc_warn(png_ptr,
+       (info_ptr->splt_palettes_num + nentries) *
+        (png_uint_32)png_sizeof(png_sPLT_t));
+   if (np == NULL)
+   {
       png_warning(png_ptr, "No memory for sPLT palettes.");
-      return;
-    }
+     return;
+   }
 
-    png_memcpy(np, info_ptr->splt_palettes,
-           info_ptr->splt_palettes_num * png_sizeof(png_sPLT_t));
-    png_free(png_ptr, info_ptr->splt_palettes);
-    info_ptr->splt_palettes=NULL;
+   png_memcpy(np, info_ptr->splt_palettes,
+          info_ptr->splt_palettes_num * png_sizeof(png_sPLT_t));
+   png_free(png_ptr, info_ptr->splt_palettes);
+   info_ptr->splt_palettes=NULL;
 
-    for (i = 0; i < nentries; i++)
-    {
-        png_sPLT_tp to = np + info_ptr->splt_palettes_num + i;
-        png_sPLT_tp from = entries + i;
-        png_uint_32 length;
+   for (i = 0; i < nentries; i++)
+   {
+      png_sPLT_tp to = np + info_ptr->splt_palettes_num + i;
+      png_sPLT_tp from = entries + i;
+      png_uint_32 length;
 
-        length = png_strlen(from->name) + 1;
+      length = png_strlen(from->name) + 1;
         to->name = (png_charp)png_malloc_warn(png_ptr, length);
-        if (to->name == NULL)
-        {
-           png_warning(png_ptr,
-             "Out of memory while processing sPLT chunk");
-           continue;
-        }
-        png_memcpy(to->name, from->name, length);
-        to->entries = (png_sPLT_entryp)png_malloc_warn(png_ptr,
-            from->nentries * png_sizeof(png_sPLT_entry));
-        if (to->entries == NULL)
-        {
-           png_warning(png_ptr,
-             "Out of memory while processing sPLT chunk");
-           png_free(png_ptr,to->name);
-           to->name = NULL;
-           continue;
-        }
-        png_memcpy(to->entries, from->entries,
-            from->nentries * png_sizeof(png_sPLT_entry));
-        to->nentries = from->nentries;
-        to->depth = from->depth;
-    }
-
-    info_ptr->splt_palettes = np;
-    info_ptr->splt_palettes_num += nentries;
-    info_ptr->valid |= PNG_INFO_sPLT;
+      if (to->name == NULL)
+      {
+         png_warning(png_ptr,
+           "Out of memory while processing sPLT chunk");
+         continue;
+      }
+      png_memcpy(to->name, from->name, length);
+      to->entries = (png_sPLT_entryp)png_malloc_warn(png_ptr,
+            (png_uint_32)(from->nentries * png_sizeof(png_sPLT_entry)));
+      if (to->entries == NULL)
+      {
+         png_warning(png_ptr,
+           "Out of memory while processing sPLT chunk");
+         png_free(png_ptr, to->name);
+         to->name = NULL;
+         continue;
+      }
+      png_memcpy(to->entries, from->entries,
+          from->nentries * png_sizeof(png_sPLT_entry));
+      to->nentries = from->nentries;
+      to->depth = from->depth;
+   }
+
+   info_ptr->splt_palettes = np;
+   info_ptr->splt_palettes_num += nentries;
+   info_ptr->valid |= PNG_INFO_sPLT;
 #ifdef PNG_FREE_ME_SUPPORTED
-    info_ptr->free_me |= PNG_FREE_SPLT;
+   info_ptr->free_me |= PNG_FREE_SPLT;
 #endif
 }
 #endif /* PNG_sPLT_SUPPORTED */
 
-#if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED)
+#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
 void PNGAPI
 png_set_unknown_chunks(png_structp png_ptr,
    png_infop info_ptr, png_unknown_chunkp unknowns, int num_unknowns)
 {
-    png_unknown_chunkp np;
-    int i;
-
-    if (png_ptr == NULL || info_ptr == NULL || num_unknowns == 0)
-        return;
-
-    np = (png_unknown_chunkp)png_malloc_warn(png_ptr,
-        (info_ptr->unknown_chunks_num + num_unknowns) *
-        png_sizeof(png_unknown_chunk));
-    if (np == NULL)
-    {
-       png_warning(png_ptr,
-          "Out of memory while processing unknown chunk.");
-       return;
-    }
-
-    png_memcpy(np, info_ptr->unknown_chunks,
-           info_ptr->unknown_chunks_num * png_sizeof(png_unknown_chunk));
-    png_free(png_ptr, info_ptr->unknown_chunks);
-    info_ptr->unknown_chunks=NULL;
-
-    for (i = 0; i < num_unknowns; i++)
-    {
-       png_unknown_chunkp to = np + info_ptr->unknown_chunks_num + i;
-       png_unknown_chunkp from = unknowns + i;
-
-       png_memcpy((png_charp)to->name, 
-                  (png_charp)from->name, 
-                  png_sizeof(from->name));
-       to->name[png_sizeof(to->name)-1] = '\0';
-       to->size = from->size;
-       /* note our location in the read or write sequence */
-       to->location = (png_byte)(png_ptr->mode & 0xff);
-
-       if (from->size == 0)
-          to->data=NULL;
-       else
-       {
-          to->data = (png_bytep)png_malloc_warn(png_ptr, from->size);
-          if (to->data == NULL)
-          {
-             png_warning(png_ptr,
-              "Out of memory while processing unknown chunk.");
-             to->size=0;
-          }
-          else
-             png_memcpy(to->data, from->data, from->size);
-       }
-    }
-
-    info_ptr->unknown_chunks = np;
-    info_ptr->unknown_chunks_num += num_unknowns;
+   png_unknown_chunkp np;
+   int i;
+
+   if (png_ptr == NULL || info_ptr == NULL || num_unknowns == 0)
+      return;
+
+   np = (png_unknown_chunkp)png_malloc_warn(png_ptr,
+       (png_uint_32)((info_ptr->unknown_chunks_num + num_unknowns) *
+       png_sizeof(png_unknown_chunk)));
+   if (np == NULL)
+   {
+      png_warning(png_ptr,
+         "Out of memory while processing unknown chunk.");
+      return;
+   }
+
+   png_memcpy(np, info_ptr->unknown_chunks,
+          info_ptr->unknown_chunks_num * png_sizeof(png_unknown_chunk));
+   png_free(png_ptr, info_ptr->unknown_chunks);
+   info_ptr->unknown_chunks=NULL;
+
+   for (i = 0; i < num_unknowns; i++)
+   {
+      png_unknown_chunkp to = np + info_ptr->unknown_chunks_num + i;
+      png_unknown_chunkp from = unknowns + i;
+
+      png_memcpy((png_charp)to->name,
+                 (png_charp)from->name,
+                 png_sizeof(from->name));
+      to->name[png_sizeof(to->name)-1] = '\0';
+      to->size = from->size;
+      /* Note our location in the read or write sequence */
+      to->location = (png_byte)(png_ptr->mode & 0xff);
+
+      if (from->size == 0)
+         to->data=NULL;
+      else
+      {
+         to->data = (png_bytep)png_malloc_warn(png_ptr,
+           (png_uint_32)from->size);
+         if (to->data == NULL)
+         {
+            png_warning(png_ptr,
+             "Out of memory while processing unknown chunk.");
+            to->size = 0;
+         }
+         else
+            png_memcpy(to->data, from->data, from->size);
+      }
+   }
+
+   info_ptr->unknown_chunks = np;
+   info_ptr->unknown_chunks_num += num_unknowns;
 #ifdef PNG_FREE_ME_SUPPORTED
-    info_ptr->free_me |= PNG_FREE_UNKN;
+   info_ptr->free_me |= PNG_FREE_UNKN;
 #endif
 }
 void PNGAPI
 png_set_unknown_chunk_location(png_structp png_ptr, png_infop info_ptr,
    int chunk, int location)
 {
-   if(png_ptr != NULL && info_ptr != NULL && chunk >= 0 && chunk <
+   if (png_ptr != NULL && info_ptr != NULL && chunk >= 0 && chunk <
          (int)info_ptr->unknown_chunks_num)
       info_ptr->unknown_chunks[chunk].location = (png_byte)location;
 }
@@ -1104,7 +1109,9 @@ png_permit_empty_plte (png_structp png_ptr, int empty_plte_permitted)
 {
    /* This function is deprecated in favor of png_permit_mng_features()
       and will be removed from libpng-1.3.0 */
-   png_debug(1, "in png_permit_empty_plte, DEPRECATED.\n");
+
+   png_debug(1, "in png_permit_empty_plte, DEPRECATED.");
+
    if (png_ptr == NULL)
       return;
    png_ptr->mng_features_permitted = (png_byte)
@@ -1118,7 +1125,8 @@ png_permit_empty_plte (png_structp png_ptr, int empty_plte_permitted)
 png_uint_32 PNGAPI
 png_permit_mng_features (png_structp png_ptr, png_uint_32 mng_features)
 {
-   png_debug(1, "in png_permit_mng_features\n");
+   png_debug(1, "in png_permit_mng_features");
+
    if (png_ptr == NULL)
       return (png_uint_32)0;
    png_ptr->mng_features_permitted =
@@ -1132,43 +1140,44 @@ void PNGAPI
 png_set_keep_unknown_chunks(png_structp png_ptr, int keep, png_bytep
    chunk_list, int num_chunks)
 {
-    png_bytep new_list, p;
-    int i, old_num_chunks;
-    if (png_ptr == NULL)
-       return;
-    if (num_chunks == 0)
-    {
-      if(keep == PNG_HANDLE_CHUNK_ALWAYS || keep == PNG_HANDLE_CHUNK_IF_SAFE)
-        png_ptr->flags |= PNG_FLAG_KEEP_UNKNOWN_CHUNKS;
+   png_bytep new_list, p;
+   int i, old_num_chunks;
+   if (png_ptr == NULL)
+      return;
+   if (num_chunks == 0)
+   {
+      if (keep == PNG_HANDLE_CHUNK_ALWAYS || keep == PNG_HANDLE_CHUNK_IF_SAFE)
+         png_ptr->flags |= PNG_FLAG_KEEP_UNKNOWN_CHUNKS;
       else
-        png_ptr->flags &= ~PNG_FLAG_KEEP_UNKNOWN_CHUNKS;
+         png_ptr->flags &= ~PNG_FLAG_KEEP_UNKNOWN_CHUNKS;
 
-      if(keep == PNG_HANDLE_CHUNK_ALWAYS)
-        png_ptr->flags |= PNG_FLAG_KEEP_UNSAFE_CHUNKS;
+      if (keep == PNG_HANDLE_CHUNK_ALWAYS)
+         png_ptr->flags |= PNG_FLAG_KEEP_UNSAFE_CHUNKS;
       else
-        png_ptr->flags &= ~PNG_FLAG_KEEP_UNSAFE_CHUNKS;
+         png_ptr->flags &= ~PNG_FLAG_KEEP_UNSAFE_CHUNKS;
       return;
-    }
-    if (chunk_list == NULL)
+   }
+   if (chunk_list == NULL)
       return;
-    old_num_chunks=png_ptr->num_chunk_list;
-    new_list=(png_bytep)png_malloc(png_ptr,
-       (png_uint_32)(5*(num_chunks+old_num_chunks)));
-    if(png_ptr->chunk_list != NULL)
-    {
-       png_memcpy(new_list, png_ptr->chunk_list,
-          (png_size_t)(5*old_num_chunks));
-       png_free(png_ptr, png_ptr->chunk_list);
-       png_ptr->chunk_list=NULL;
-    }
-    png_memcpy(new_list+5*old_num_chunks, chunk_list,
-       (png_size_t)(5*num_chunks));
-    for (p=new_list+5*old_num_chunks+4, i=0; i<num_chunks; i++, p+=5)
-       *p=(png_byte)keep;
-    png_ptr->num_chunk_list=old_num_chunks+num_chunks;
-    png_ptr->chunk_list=new_list;
+   old_num_chunks = png_ptr->num_chunk_list;
+   new_list=(png_bytep)png_malloc(png_ptr,
+      (png_uint_32)
+      (5*(num_chunks + old_num_chunks)));
+   if (png_ptr->chunk_list != NULL)
+   {
+      png_memcpy(new_list, png_ptr->chunk_list,
+         (png_size_t)(5*old_num_chunks));
+      png_free(png_ptr, png_ptr->chunk_list);
+      png_ptr->chunk_list=NULL;
+   }
+   png_memcpy(new_list + 5*old_num_chunks, chunk_list,
+      (png_size_t)(5*num_chunks));
+   for (p = new_list + 5*old_num_chunks + 4, i = 0; i<num_chunks; i++, p += 5)
+      *p=(png_byte)keep;
+   png_ptr->num_chunk_list = old_num_chunks + num_chunks;
+   png_ptr->chunk_list = new_list;
 #ifdef PNG_FREE_ME_SUPPORTED
-    png_ptr->free_me |= PNG_FREE_LIST;
+   png_ptr->free_me |= PNG_FREE_LIST;
 #endif
 }
 #endif
@@ -1178,9 +1187,11 @@ void PNGAPI
 png_set_read_user_chunk_fn(png_structp png_ptr, png_voidp user_chunk_ptr,
    png_user_chunk_ptr read_user_chunk_fn)
 {
-   png_debug(1, "in png_set_read_user_chunk_fn\n");
+   png_debug(1, "in png_set_read_user_chunk_fn");
+
    if (png_ptr == NULL)
       return;
+
    png_ptr->read_user_chunk_fn = read_user_chunk_fn;
    png_ptr->user_chunk_ptr = user_chunk_ptr;
 }
@@ -1190,22 +1201,23 @@ png_set_read_user_chunk_fn(png_structp png_ptr, png_voidp user_chunk_ptr,
 void PNGAPI
 png_set_rows(png_structp png_ptr, png_infop info_ptr, png_bytepp row_pointers)
 {
-   png_debug1(1, "in %s storage function\n", "rows");
+   png_debug1(1, "in %s storage function", "rows");
 
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
-   if(info_ptr->row_pointers && (info_ptr->row_pointers != row_pointers))
+   if (info_ptr->row_pointers && (info_ptr->row_pointers != row_pointers))
       png_free_data(png_ptr, info_ptr, PNG_FREE_ROWS, 0);
    info_ptr->row_pointers = row_pointers;
-   if(row_pointers)
+   if (row_pointers)
       info_ptr->valid |= PNG_INFO_IDAT;
 }
 #endif
 
 #ifdef PNG_WRITE_SUPPORTED
 void PNGAPI
-png_set_compression_buffer_size(png_structp png_ptr, png_uint_32 size)
+png_set_compression_buffer_size(png_structp png_ptr,
+    png_uint_32 size)
 {
     if (png_ptr == NULL)
        return;
@@ -1227,16 +1239,17 @@ png_set_invalid(png_structp png_ptr, png_infop info_ptr, int mask)
 
 #ifndef PNG_1_0_X
 #ifdef PNG_ASSEMBLER_CODE_SUPPORTED
-/* function was added to libpng 1.2.0 and should always exist by default */
+/* Function was added to libpng 1.2.0 and should always exist by default */
 void PNGAPI
 png_set_asm_flags (png_structp png_ptr, png_uint_32 asm_flags)
 {
 /* Obsolete as of libpng-1.2.20 and will be removed from libpng-1.4.0 */
     if (png_ptr != NULL)
     png_ptr->asm_flags = 0;
+    asm_flags = asm_flags; /* Quiet the compiler */
 }
 
-/* this function was added to libpng 1.2.0 */
+/* This function was added to libpng 1.2.0 */
 void PNGAPI
 png_set_mmx_thresholds (png_structp png_ptr,
                         png_byte mmx_bitdepth_threshold,
@@ -1245,22 +1258,26 @@ png_set_mmx_thresholds (png_structp png_ptr,
 /* Obsolete as of libpng-1.2.20 and will be removed from libpng-1.4.0 */
     if (png_ptr == NULL)
        return;
+    /* Quiet the compiler */
+    mmx_bitdepth_threshold = mmx_bitdepth_threshold;
+    mmx_rowbytes_threshold = mmx_rowbytes_threshold;
 }
 #endif /* ?PNG_ASSEMBLER_CODE_SUPPORTED */
 
 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
-/* this function was added to libpng 1.2.6 */
+/* This function was added to libpng 1.2.6 */
 void PNGAPI
 png_set_user_limits (png_structp png_ptr, png_uint_32 user_width_max,
     png_uint_32 user_height_max)
 {
-    /* Images with dimensions larger than these limits will be
-     * rejected by png_set_IHDR().  To accept any PNG datastream
-     * regardless of dimensions, set both limits to 0x7ffffffL.
-     */
-    if(png_ptr == NULL) return;
-    png_ptr->user_width_max = user_width_max;
-    png_ptr->user_height_max = user_height_max;
+   /* Images with dimensions larger than these limits will be
+    * rejected by png_set_IHDR().  To accept any PNG datastream
+    * regardless of dimensions, set both limits to 0x7ffffffL.
+    */
+   if (png_ptr == NULL)
+      return;
+   png_ptr->user_width_max = user_width_max;
+   png_ptr->user_height_max = user_height_max;
 }
 #endif /* ?PNG_SET_USER_LIMITS_SUPPORTED */
 
diff --git a/src/3rdparty/libpng/pngtest.c b/src/3rdparty/libpng/pngtest.c
index 60980c2758..4142fd8204 100644
--- a/src/3rdparty/libpng/pngtest.c
+++ b/src/3rdparty/libpng/pngtest.c
@@ -1,12 +1,15 @@
 
 /* pngtest.c - a simple test program to test libpng
  *
- * Last changed in libpng 1.2.27 - [April 29, 2008]
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.37 [June 4, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
+ *
  * This program reads in a PNG image, writes it out again, and then
  * compares the two files.  If the files are identical, this shows that
  * the basic chunk handling, filtering, and (de)compression code is working
@@ -37,7 +40,7 @@
 #  include <windows.h>
 #  include <stdlib.h>
 #  define READFILE(file, data, length, check) \
-     if (ReadFile(file, data, length, &check,NULL)) check = 0
+     if (ReadFile(file, data, length, &check, NULL)) check = 0
 #  define WRITEFILE(file, data, length, check)) \
      if (WriteFile(file, data, length, &check, NULL)) check = 0
 #  define FCLOSE(file) CloseHandle(file)
@@ -45,9 +48,9 @@
 #  include <stdio.h>
 #  include <stdlib.h>
 #  define READFILE(file, data, length, check) \
-     check=(png_size_t)fread(data,(png_size_t)1,length,file)
+     check=(png_size_t)fread(data, (png_size_t)1, length, file)
 #  define WRITEFILE(file, data, length, check) \
-     check=(png_size_t)fwrite(data,(png_size_t)1, length, file)
+     check=(png_size_t)fwrite(data, (png_size_t)1, length, file)
 #  define FCLOSE(file) fclose(file)
 #endif
 
@@ -65,7 +68,7 @@
 #endif
 
 #if !PNG_DEBUG
-#  define SINGLE_ROWBUF_ALLOC  /* makes buffer overruns easier to nail */
+#  define SINGLE_ROWBUF_ALLOC  /* Makes buffer overruns easier to nail */
 #endif
 
 /* Turn on CPU timing
@@ -82,9 +85,9 @@ static float t_start, t_stop, t_decode, t_encode, t_misc;
 #endif
 
 #if defined(PNG_TIME_RFC1123_SUPPORTED)
-#define PNG_tIME_STRING_LENGTH 30
-static int tIME_chunk_present=0;
-static char tIME_string[PNG_tIME_STRING_LENGTH] = "no tIME chunk present in file";
+#define PNG_tIME_STRING_LENGTH 29
+static int tIME_chunk_present = 0;
+static char tIME_string[PNG_tIME_STRING_LENGTH] = "tIME chunk is not present";
 #endif
 
 static int verbose = 0;
@@ -95,14 +98,9 @@ int test_one_file PNGARG((PNG_CONST char *inname, PNG_CONST char *outname));
 #include <mem.h>
 #endif
 
-/* defined so I can write to a file on gui/windowing platforms */
+/* Defined so I can write to a file on gui/windowing platforms */
 /*  #define STDERR stderr  */
-#define STDERR stdout   /* for DOS */
-
-/* example of using row callbacks to make a simple progress meter */
-static int status_pass=1;
-static int status_dots_requested=0;
-static int status_dots=1;
+#define STDERR stdout   /* For DOS */
 
 /* In case a system header (e.g., on AIX) defined jmpbuf */
 #ifdef jmpbuf
@@ -114,6 +112,11 @@ static int status_dots=1;
 #  define png_jmpbuf(png_ptr) png_ptr->jmpbuf
 #endif
 
+/* Example of using row callbacks to make a simple progress meter */
+static int status_pass = 1;
+static int status_dots_requested = 0;
+static int status_dots = 1;
+
 void
 #ifdef PNG_1_0_X
 PNGAPI
@@ -125,20 +128,21 @@ PNGAPI
 #endif
 read_row_callback(png_structp png_ptr, png_uint_32 row_number, int pass)
 {
-    if(png_ptr == NULL || row_number > PNG_UINT_31_MAX) return;
-    if(status_pass != pass)
-    {
-       fprintf(stdout,"\n Pass %d: ",pass);
-       status_pass = pass;
-       status_dots = 31;
-    }
-    status_dots--;
-    if(status_dots == 0)
-    {
-       fprintf(stdout, "\n         ");
-       status_dots=30;
-    }
-    fprintf(stdout, "r");
+   if (png_ptr == NULL || row_number > PNG_UINT_31_MAX)
+      return;
+   if (status_pass != pass)
+   {
+      fprintf(stdout, "\n Pass %d: ", pass);
+      status_pass = pass;
+      status_dots = 31;
+   }
+   status_dots--;
+   if (status_dots == 0)
+   {
+      fprintf(stdout, "\n         ");
+      status_dots=30;
+   }
+   fprintf(stdout, "r");
 }
 
 void
@@ -152,15 +156,17 @@ PNGAPI
 #endif
 write_row_callback(png_structp png_ptr, png_uint_32 row_number, int pass)
 {
-    if(png_ptr == NULL || row_number > PNG_UINT_31_MAX || pass > 7) return;
-    fprintf(stdout, "w");
+   if (png_ptr == NULL || row_number > PNG_UINT_31_MAX || pass > 7)
+      return;
+   fprintf(stdout, "w");
 }
 
 
 #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED)
 /* Example of using user transform callback (we don't transform anything,
-   but merely examine the row filters.  We set this to 256 rather than
-   5 in case illegal filter values are present.) */
+ * but merely examine the row filters.  We set this to 256 rather than
+ * 5 in case illegal filter values are present.)
+ */
 static png_uint_32 filters_used[256];
 void
 #ifdef PNG_1_0_X
@@ -173,14 +179,15 @@ PNGAPI
 #endif
 count_filters(png_structp png_ptr, png_row_infop row_info, png_bytep data)
 {
-    if(png_ptr != NULL && row_info != NULL)
-      ++filters_used[*(data-1)];
+   if (png_ptr != NULL && row_info != NULL)
+      ++filters_used[*(data - 1)];
 }
 #endif
 
 #if defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED)
-/* example of using user transform callback (we don't transform anything,
-   but merely count the zero samples) */
+/* Example of using user transform callback (we don't transform anything,
+ * but merely count the zero samples)
+ */
 
 static png_uint_32 zero_samples;
 
@@ -196,9 +203,9 @@ PNGAPI
 count_zero_samples(png_structp png_ptr, png_row_infop row_info, png_bytep data)
 {
    png_bytep dp = data;
-   if(png_ptr == NULL)return;
+   if (png_ptr == NULL)return;
 
-   /* contents of row_info:
+   /* Contents of row_info:
     *  png_uint_32 width      width of row
     *  png_uint_32 rowbytes   number of bytes in row
     *  png_byte color_type    color type of pixels
@@ -207,74 +214,81 @@ count_zero_samples(png_structp png_ptr, png_row_infop row_info, png_bytep data)
     *  png_byte pixel_depth   bits per pixel (depth*channels)
     */
 
+    /* Counts the number of zero samples (or zero pixels if color_type is 3 */
 
-    /* counts the number of zero samples (or zero pixels if color_type is 3 */
-
-    if(row_info->color_type == 0 || row_info->color_type == 3)
+    if (row_info->color_type == 0 || row_info->color_type == 3)
     {
-       int pos=0;
+       int pos = 0;
        png_uint_32 n, nstop;
-       for (n=0, nstop=row_info->width; n<nstop; n++)
+       for (n = 0, nstop=row_info->width; n<nstop; n++)
        {
-          if(row_info->bit_depth == 1)
+          if (row_info->bit_depth == 1)
           {
-             if(((*dp << pos++ ) & 0x80) == 0) zero_samples++;
-             if(pos == 8)
+             if (((*dp << pos++ ) & 0x80) == 0)
+                zero_samples++;
+             if (pos == 8)
              {
                 pos = 0;
                 dp++;
              }
           }
-          if(row_info->bit_depth == 2)
+          if (row_info->bit_depth == 2)
           {
-             if(((*dp << (pos+=2)) & 0xc0) == 0) zero_samples++;
-             if(pos == 8)
+             if (((*dp << (pos+=2)) & 0xc0) == 0)
+                zero_samples++;
+             if (pos == 8)
              {
                 pos = 0;
                 dp++;
              }
           }
-          if(row_info->bit_depth == 4)
+          if (row_info->bit_depth == 4)
           {
-             if(((*dp << (pos+=4)) & 0xf0) == 0) zero_samples++;
-             if(pos == 8)
+             if (((*dp << (pos+=4)) & 0xf0) == 0)
+                zero_samples++;
+             if (pos == 8)
              {
                 pos = 0;
                 dp++;
              }
           }
-          if(row_info->bit_depth == 8)
-             if(*dp++ == 0) zero_samples++;
-          if(row_info->bit_depth == 16)
+          if (row_info->bit_depth == 8)
+             if (*dp++ == 0)
+                zero_samples++;
+          if (row_info->bit_depth == 16)
           {
-             if((*dp | *(dp+1)) == 0) zero_samples++;
+             if ((*dp | *(dp+1)) == 0)
+                zero_samples++;
              dp+=2;
           }
        }
     }
-    else /* other color types */
+    else /* Other color types */
     {
        png_uint_32 n, nstop;
        int channel;
        int color_channels = row_info->channels;
-       if(row_info->color_type > 3)color_channels--;
+       if (row_info->color_type > 3)color_channels--;
 
-       for (n=0, nstop=row_info->width; n<nstop; n++)
+       for (n = 0, nstop=row_info->width; n<nstop; n++)
        {
           for (channel = 0; channel < color_channels; channel++)
           {
-             if(row_info->bit_depth == 8)
-                if(*dp++ == 0) zero_samples++;
-             if(row_info->bit_depth == 16)
+             if (row_info->bit_depth == 8)
+                if (*dp++ == 0)
+                   zero_samples++;
+             if (row_info->bit_depth == 16)
              {
-                if((*dp | *(dp+1)) == 0) zero_samples++;
+                if ((*dp | *(dp+1)) == 0)
+                   zero_samples++;
                 dp+=2;
              }
           }
-          if(row_info->color_type > 3)
+          if (row_info->color_type > 3)
           {
              dp++;
-             if(row_info->bit_depth == 16)dp++;
+             if (row_info->bit_depth == 16)
+                dp++;
           }
        }
     }
@@ -285,12 +299,13 @@ static int wrote_question = 0;
 
 #if defined(PNG_NO_STDIO)
 /* START of code to validate stdio-free compilation */
-/* These copies of the default read/write functions come from pngrio.c and */
-/* pngwio.c.  They allow "don't include stdio" testing of the library. */
-/* This is the function that does the actual reading of data.  If you are
-   not reading from a standard C stream, you should create a replacement
-   read_data function and use it at run time with png_set_read_fn(), rather
-   than changing the library. */
+/* These copies of the default read/write functions come from pngrio.c and
+ * pngwio.c.  They allow "don't include stdio" testing of the library.
+ * This is the function that does the actual reading of data.  If you are
+ * not reading from a standard C stream, you should create a replacement
+ * read_data function and use it at run time with png_set_read_fn(), rather
+ * than changing the library.
+ */
 
 #ifndef USE_FAR_KEYWORD
 static void
@@ -309,7 +324,7 @@ pngtest_read_data(png_structp png_ptr, png_bytep data, png_size_t length)
    }
 }
 #else
-/* this is the model-independent version. Since the standard I/O library
+/* This is the model-independent version. Since the standard I/O library
    can't handle far buffers in the medium and small models, we have to copy
    the data.
 */
@@ -341,8 +356,8 @@ pngtest_read_data(png_structp png_ptr, png_bytep data, png_size_t length)
       {
          read = MIN(NEAR_BUF_SIZE, remaining);
          READFILE(io_ptr, buf, 1, err);
-         png_memcpy(data, buf, read); /* copy far buffer to near buffer */
-         if(err != read)
+         png_memcpy(data, buf, read); /* Copy far buffer to near buffer */
+         if (err != read)
             break;
          else
             check += err;
@@ -352,9 +367,7 @@ pngtest_read_data(png_structp png_ptr, png_bytep data, png_size_t length)
       while (remaining != 0);
    }
    if (check != length)
-   {
       png_error(png_ptr, "read Error");
-   }
 }
 #endif /* USE_FAR_KEYWORD */
 
@@ -362,19 +375,16 @@ pngtest_read_data(png_structp png_ptr, png_bytep data, png_size_t length)
 static void
 pngtest_flush(png_structp png_ptr)
 {
-#if !defined(_WIN32_WCE)
-   png_FILE_p io_ptr;
-   io_ptr = (png_FILE_p)CVT_PTR((png_ptr->io_ptr));
-   if (io_ptr != NULL)
-      fflush(io_ptr);
-#endif
+   /* Do nothing; fflush() is said to be just a waste of energy. */
+   png_ptr = png_ptr;  /* Stifle compiler warning */
 }
 #endif
 
 /* This is the function that does the actual writing of data.  If you are
-   not writing to a standard C stream, you should create a replacement
-   write_data function and use it at run time with png_set_write_fn(), rather
-   than changing the library. */
+ * not writing to a standard C stream, you should create a replacement
+ * write_data function and use it at run time with png_set_write_fn(), rather
+ * than changing the library.
+ */
 #ifndef USE_FAR_KEYWORD
 static void
 pngtest_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
@@ -388,7 +398,7 @@ pngtest_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
    }
 }
 #else
-/* this is the model-independent version. Since the standard I/O library
+/* This is the model-independent version. Since the standard I/O library
    can't handle far buffers in the medium and small models, we have to copy
    the data.
 */
@@ -419,7 +429,7 @@ pngtest_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
       do
       {
          written = MIN(NEAR_BUF_SIZE, remaining);
-         png_memcpy(buf, data, written); /* copy far buffer to near buffer */
+         png_memcpy(buf, data, written); /* Copy far buffer to near buffer */
          WRITEFILE(io_ptr, buf, written, err);
          if (err != written)
             break;
@@ -436,8 +446,6 @@ pngtest_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
    }
 }
 #endif /* USE_FAR_KEYWORD */
-#endif /* PNG_NO_STDIO */
-/* END of code to validate stdio-free compilation */
 
 /* This function is called when there is a warning, but the library thinks
  * it can continue anyway.  Replacement functions don't have to do anything
@@ -463,20 +471,24 @@ pngtest_error(png_structp png_ptr, png_const_charp message)
 {
    pngtest_warning(png_ptr, message);
    /* We can return because png_error calls the default handler, which is
-    * actually OK in this case. */
+    * actually OK in this case.
+    */
 }
+#endif /* PNG_NO_STDIO */
+/* END of code to validate stdio-free compilation */
 
 /* START of code to validate memory allocation and deallocation */
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
 
 /* Allocate memory.  For reasonable files, size should never exceed
-   64K.  However, zlib may allocate more then 64K if you don't tell
-   it not to.  See zconf.h and png.h for more information.  zlib does
-   need to allocate exactly 64K, so whatever you call here must
-   have the ability to do that.
-
-   This piece of code can be compiled to validate max 64K allocations
-   by setting MAXSEG_64K in zlib zconf.h *or* PNG_MAX_MALLOC_64K. */
+ * 64K.  However, zlib may allocate more then 64K if you don't tell
+ * it not to.  See zconf.h and png.h for more information.  zlib does
+ * need to allocate exactly 64K, so whatever you call here must
+ * have the ability to do that.
+ *
+ * This piece of code can be compiled to validate max 64K allocations
+ * by setting MAXSEG_64K in zlib zconf.h *or* PNG_MAX_MALLOC_64K.
+ */
 typedef struct memory_information
 {
    png_uint_32               size;
@@ -499,7 +511,8 @@ png_debug_malloc(png_structp png_ptr, png_uint_32 size)
 {
 
    /* png_malloc has already tested for NULL; png_create_struct calls
-      png_debug_malloc directly, with png_ptr == NULL which is OK */
+    * png_debug_malloc directly, with png_ptr == NULL which is OK
+    */
 
    if (size == 0)
       return (NULL);
@@ -511,7 +524,7 @@ png_debug_malloc(png_structp png_ptr, png_uint_32 size)
       memory_infop pinfo;
       png_set_mem_fn(png_ptr, NULL, NULL, NULL);
       pinfo = (memory_infop)png_malloc(png_ptr,
-         (png_uint_32)png_sizeof (*pinfo));
+         (png_uint_32)png_sizeof(*pinfo));
       pinfo->size = size;
       current_allocation += size;
       total_allocation += size;
@@ -520,8 +533,9 @@ png_debug_malloc(png_structp png_ptr, png_uint_32 size)
          maximum_allocation = current_allocation;
       pinfo->pointer = (png_voidp)png_malloc(png_ptr, size);
       /* Restore malloc_fn and free_fn */
-      png_set_mem_fn(png_ptr, png_voidp_NULL, (png_malloc_ptr)png_debug_malloc,
-         (png_free_ptr)png_debug_free);
+      png_set_mem_fn(png_ptr,
+          png_voidp_NULL, (png_malloc_ptr)png_debug_malloc,
+          (png_free_ptr)png_debug_free);
       if (size != 0 && pinfo->pointer == NULL)
       {
          current_allocation -= size;
@@ -533,9 +547,9 @@ png_debug_malloc(png_structp png_ptr, png_uint_32 size)
       pinformation = pinfo;
       /* Make sure the caller isn't assuming zeroed memory. */
       png_memset(pinfo->pointer, 0xdd, pinfo->size);
-      if(verbose)
-         printf("png_malloc %lu bytes at %x\n",(unsigned long)size,
-          pinfo->pointer);
+      if (verbose)
+         printf("png_malloc %lu bytes at %x\n", (unsigned long)size,
+            pinfo->pointer);
       return (png_voidp)(pinfo->pointer);
    }
 }
@@ -570,7 +584,7 @@ png_debug_free(png_structp png_ptr, png_voidp ptr)
                the memory that is to be freed. */
             png_memset(ptr, 0x55, pinfo->size);
             png_free_default(png_ptr, pinfo);
-            pinfo=NULL;
+            pinfo = NULL;
             break;
          }
          if (pinfo->next == NULL)
@@ -583,14 +597,82 @@ png_debug_free(png_structp png_ptr, png_voidp ptr)
    }
 
    /* Finally free the data. */
-   if(verbose)
-      printf("Freeing %x\n",ptr);
+   if (verbose)
+      printf("Freeing %x\n", ptr);
    png_free_default(png_ptr, ptr);
-   ptr=NULL;
+   ptr = NULL;
 }
 #endif /* PNG_USER_MEM_SUPPORTED && PNG_DEBUG */
 /* END of code to test memory allocation/deallocation */
 
+
+/* Demonstration of user chunk support of the sTER and vpAg chunks */
+#if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED)
+
+/* (sTER is a public chunk not yet known by libpng.  vpAg is a private
+chunk used in ImageMagick to store "virtual page" size).  */
+
+static png_uint_32 user_chunk_data[4];
+
+    /* 0: sTER mode + 1
+     * 1: vpAg width
+     * 2: vpAg height
+     * 3: vpAg units
+     */
+
+static int read_user_chunk_callback(png_struct *png_ptr,
+   png_unknown_chunkp chunk)
+{
+   png_uint_32
+     *my_user_chunk_data;
+
+   /* Return one of the following:
+    *    return (-n);  chunk had an error
+    *    return (0);  did not recognize
+    *    return (n);  success
+    *
+    * The unknown chunk structure contains the chunk data:
+    * png_byte name[5];
+    * png_byte *data;
+    * png_size_t size;
+    *
+    * Note that libpng has already taken care of the CRC handling.
+    */
+
+   if (chunk->name[0] == 115 && chunk->name[1] ==  84 &&     /* s  T */
+       chunk->name[2] ==  69 && chunk->name[3] ==  82)       /* E  R */
+      {
+         /* Found sTER chunk */
+         if (chunk->size != 1)
+            return (-1); /* Error return */
+         if (chunk->data[0] != 0 && chunk->data[0] != 1)
+            return (-1);  /* Invalid mode */
+         my_user_chunk_data=(png_uint_32 *) png_get_user_chunk_ptr(png_ptr);
+         my_user_chunk_data[0]=chunk->data[0]+1;
+         return (1);
+      }
+
+   if (chunk->name[0] != 118 || chunk->name[1] != 112 ||    /* v  p */
+       chunk->name[2] !=  65 || chunk->name[3] != 103)      /* A  g */
+      return (0); /* Did not recognize */
+
+   /* Found ImageMagick vpAg chunk */
+
+   if (chunk->size != 9)
+      return (-1); /* Error return */
+
+   my_user_chunk_data=(png_uint_32 *) png_get_user_chunk_ptr(png_ptr);
+
+   my_user_chunk_data[1]=png_get_uint_31(png_ptr, chunk->data);
+   my_user_chunk_data[2]=png_get_uint_31(png_ptr, chunk->data + 4);
+   my_user_chunk_data[3]=(png_uint_32)chunk->data[8];
+
+   return (1);
+
+}
+#endif
+/* END of code to demonstrate user chunk support */
+
 /* Test one file */
 int
 test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
@@ -649,30 +731,48 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       return (1);
    }
 
-   png_debug(0, "Allocating read and write structures\n");
+   png_debug(0, "Allocating read and write structures");
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
-   read_ptr = png_create_read_struct_2(PNG_LIBPNG_VER_STRING, png_voidp_NULL,
+   read_ptr =
+      png_create_read_struct_2(PNG_LIBPNG_VER_STRING, png_voidp_NULL,
       png_error_ptr_NULL, png_error_ptr_NULL, png_voidp_NULL,
       (png_malloc_ptr)png_debug_malloc, (png_free_ptr)png_debug_free);
 #else
-   read_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, png_voidp_NULL,
+   read_ptr =
+      png_create_read_struct(PNG_LIBPNG_VER_STRING, png_voidp_NULL,
       png_error_ptr_NULL, png_error_ptr_NULL);
 #endif
+#if defined(PNG_NO_STDIO)
    png_set_error_fn(read_ptr, (png_voidp)inname, pngtest_error,
        pngtest_warning);
+#endif
+
+#if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED)
+   user_chunk_data[0] = 0;
+   user_chunk_data[1] = 0;
+   user_chunk_data[2] = 0;
+   user_chunk_data[3] = 0;
+   png_set_read_user_chunk_fn(read_ptr, user_chunk_data,
+     read_user_chunk_callback);
+
+#endif
 #ifdef PNG_WRITE_SUPPORTED
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
-   write_ptr = png_create_write_struct_2(PNG_LIBPNG_VER_STRING, png_voidp_NULL,
+   write_ptr =
+      png_create_write_struct_2(PNG_LIBPNG_VER_STRING, png_voidp_NULL,
       png_error_ptr_NULL, png_error_ptr_NULL, png_voidp_NULL,
       (png_malloc_ptr)png_debug_malloc, (png_free_ptr)png_debug_free);
 #else
-   write_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING, png_voidp_NULL,
+   write_ptr =
+      png_create_write_struct(PNG_LIBPNG_VER_STRING, png_voidp_NULL,
       png_error_ptr_NULL, png_error_ptr_NULL);
 #endif
+#if defined(PNG_NO_STDIO)
    png_set_error_fn(write_ptr, (png_voidp)inname, pngtest_error,
        pngtest_warning);
 #endif
-   png_debug(0, "Allocating read_info, write_info and end_info structures\n");
+#endif
+   png_debug(0, "Allocating read_info, write_info and end_info structures");
    read_info_ptr = png_create_info_struct(read_ptr);
    end_info_ptr = png_create_info_struct(read_ptr);
 #ifdef PNG_WRITE_SUPPORTED
@@ -681,7 +781,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 #endif
 
 #ifdef PNG_SETJMP_SUPPORTED
-   png_debug(0, "Setting jmpbuf for read struct\n");
+   png_debug(0, "Setting jmpbuf for read struct");
 #ifdef USE_FAR_KEYWORD
    if (setjmp(jmpbuf))
 #else
@@ -690,6 +790,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
    {
       fprintf(STDERR, "%s -> %s: libpng read error\n", inname, outname);
       png_free(read_ptr, row_buf);
+      row_buf = NULL;
       png_destroy_read_struct(&read_ptr, &read_info_ptr, &end_info_ptr);
 #ifdef PNG_WRITE_SUPPORTED
       png_destroy_info_struct(write_ptr, &write_end_info_ptr);
@@ -700,11 +801,11 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       return (1);
    }
 #ifdef USE_FAR_KEYWORD
-   png_memcpy(png_jmpbuf(read_ptr),jmpbuf,png_sizeof(jmp_buf));
+   png_memcpy(png_jmpbuf(read_ptr), jmpbuf, png_sizeof(jmp_buf));
 #endif
 
 #ifdef PNG_WRITE_SUPPORTED
-   png_debug(0, "Setting jmpbuf for write struct\n");
+   png_debug(0, "Setting jmpbuf for write struct");
 #ifdef USE_FAR_KEYWORD
    if (setjmp(jmpbuf))
 #else
@@ -722,12 +823,12 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       return (1);
    }
 #ifdef USE_FAR_KEYWORD
-   png_memcpy(png_jmpbuf(write_ptr),jmpbuf,png_sizeof(jmp_buf));
+   png_memcpy(png_jmpbuf(write_ptr), jmpbuf, png_sizeof(jmp_buf));
 #endif
 #endif
 #endif
 
-   png_debug(0, "Initializing input and output streams\n");
+   png_debug(0, "Initializing input and output streams");
 #if !defined(PNG_NO_STDIO)
    png_init_io(read_ptr, fpin);
 #  ifdef PNG_WRITE_SUPPORTED
@@ -744,7 +845,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 #    endif
 #  endif
 #endif
-   if(status_dots_requested == 1)
+   if (status_dots_requested == 1)
    {
 #ifdef PNG_WRITE_SUPPORTED
       png_set_write_status_fn(write_ptr, write_row_callback);
@@ -761,14 +862,14 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 
 #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED)
    {
-     int i;
-     for(i=0; i<256; i++)
-        filters_used[i]=0;
-     png_set_read_user_transform_fn(read_ptr, count_filters);
+      int i;
+      for (i = 0; i<256; i++)
+         filters_used[i] = 0;
+      png_set_read_user_transform_fn(read_ptr, count_filters);
    }
 #endif
 #if defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED)
-   zero_samples=0;
+   zero_samples = 0;
    png_set_write_user_transform_fn(write_ptr, count_zero_samples);
 #endif
 
@@ -787,10 +888,10 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       png_bytep_NULL, 0);
 #endif
 
-   png_debug(0, "Reading info struct\n");
+   png_debug(0, "Reading info struct");
    png_read_info(read_ptr, read_info_ptr);
 
-   png_debug(0, "Transferring info struct\n");
+   png_debug(0, "Transferring info struct");
    {
       int interlace_type, compression_type, filter_type;
 
@@ -823,9 +924,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       png_fixed_point gamma;
 
       if (png_get_gAMA_fixed(read_ptr, read_info_ptr, &gamma))
-      {
          png_set_gAMA_fixed(write_ptr, write_info_ptr, gamma);
-      }
    }
 #endif
 #else /* Use floating point versions */
@@ -847,13 +946,11 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       double gamma;
 
       if (png_get_gAMA(read_ptr, read_info_ptr, &gamma))
-      {
          png_set_gAMA(write_ptr, write_info_ptr, gamma);
-      }
    }
 #endif
-#endif /* floating point */
-#endif /* fixed point */
+#endif /* Floating point */
+#endif /* Fixed point */
 #if defined(PNG_iCCP_SUPPORTED)
    {
       png_charp name;
@@ -874,9 +971,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       int intent;
 
       if (png_get_sRGB(read_ptr, read_info_ptr, &intent))
-      {
          png_set_sRGB(write_ptr, write_info_ptr, intent);
-      }
    }
 #endif
    {
@@ -884,9 +979,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       int num_palette;
 
       if (png_get_PLTE(read_ptr, read_info_ptr, &palette, &num_palette))
-      {
          png_set_PLTE(write_ptr, write_info_ptr, palette, num_palette);
-      }
    }
 #if defined(PNG_bKGD_SUPPORTED)
    {
@@ -903,9 +996,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       png_uint_16p hist;
 
       if (png_get_hIST(read_ptr, read_info_ptr, &hist))
-      {
          png_set_hIST(write_ptr, write_info_ptr, hist);
-      }
    }
 #endif
 #if defined(PNG_oFFs_SUPPORTED)
@@ -913,7 +1004,8 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       png_int_32 offset_x, offset_y;
       int unit_type;
 
-      if (png_get_oFFs(read_ptr, read_info_ptr,&offset_x,&offset_y,&unit_type))
+      if (png_get_oFFs(read_ptr, read_info_ptr, &offset_x, &offset_y,
+          &unit_type))
       {
          png_set_oFFs(write_ptr, write_info_ptr, offset_x, offset_y, unit_type);
       }
@@ -940,9 +1032,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       int unit_type;
 
       if (png_get_pHYs(read_ptr, read_info_ptr, &res_x, &res_y, &unit_type))
-      {
          png_set_pHYs(write_ptr, write_info_ptr, res_x, res_y, unit_type);
-      }
    }
 #endif
 #if defined(PNG_sBIT_SUPPORTED)
@@ -950,9 +1040,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       png_color_8p sig_bit;
 
       if (png_get_sBIT(read_ptr, read_info_ptr, &sig_bit))
-      {
          png_set_sBIT(write_ptr, write_info_ptr, sig_bit);
-      }
    }
 #endif
 #if defined(PNG_sCAL_SUPPORTED)
@@ -989,7 +1077,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 
       if (png_get_text(read_ptr, read_info_ptr, &text_ptr, &num_text) > 0)
       {
-         png_debug1(0, "Handling %d iTXt/tEXt/zTXt chunks\n", num_text);
+         png_debug1(0, "Handling %d iTXt/tEXt/zTXt chunks", num_text);
          png_set_text(write_ptr, write_info_ptr, text_ptr, num_text);
       }
    }
@@ -1002,13 +1090,14 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       {
          png_set_tIME(write_ptr, write_info_ptr, mod_time);
 #if defined(PNG_TIME_RFC1123_SUPPORTED)
-         /* we have to use png_memcpy instead of "=" because the string
-            pointed to by png_convert_to_rfc1123() gets free'ed before
-            we use it */
+         /* We have to use png_memcpy instead of "=" because the string
+          * pointed to by png_convert_to_rfc1123() gets free'ed before
+          * we use it.
+          */
          png_memcpy(tIME_string,
-                    png_convert_to_rfc1123(read_ptr, mod_time), 
+                    png_convert_to_rfc1123(read_ptr, mod_time),
                     png_sizeof(tIME_string));
-         tIME_string[png_sizeof(tIME_string)-1] = '\0';
+         tIME_string[png_sizeof(tIME_string) - 1] = '\0';
          tIME_chunk_present++;
 #endif /* PNG_TIME_RFC1123_SUPPORTED */
       }
@@ -1026,13 +1115,13 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
          int sample_max = (1 << read_info_ptr->bit_depth);
          /* libpng doesn't reject a tRNS chunk with out-of-range samples */
          if (!((read_info_ptr->color_type == PNG_COLOR_TYPE_GRAY &&
-            (int)trans_values->gray > sample_max) ||
-            (read_info_ptr->color_type == PNG_COLOR_TYPE_RGB &&
-            ((int)trans_values->red > sample_max ||
-            (int)trans_values->green > sample_max ||
-            (int)trans_values->blue > sample_max))))
-           png_set_tRNS(write_ptr, write_info_ptr, trans, num_trans,
-              trans_values);
+             (int)trans_values->gray > sample_max) ||
+             (read_info_ptr->color_type == PNG_COLOR_TYPE_RGB &&
+             ((int)trans_values->red > sample_max ||
+             (int)trans_values->green > sample_max ||
+             (int)trans_values->blue > sample_max))))
+            png_set_tRNS(write_ptr, write_info_ptr, trans, num_trans,
+               trans_values);
       }
    }
 #endif
@@ -1046,9 +1135,10 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
          png_size_t i;
          png_set_unknown_chunks(write_ptr, write_info_ptr, unknowns,
            num_unknowns);
-         /* copy the locations from the read_info_ptr.  The automatically
-            generated locations in write_info_ptr are wrong because we
-            haven't written anything yet */
+         /* Copy the locations from the read_info_ptr.  The automatically
+          * generated locations in write_info_ptr are wrong because we
+          * haven't written anything yet.
+          */
          for (i = 0; i < (png_size_t)num_unknowns; i++)
            png_set_unknown_chunk_location(write_ptr, write_info_ptr, i,
              unknowns[i].location);
@@ -1057,21 +1147,55 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 #endif
 
 #ifdef PNG_WRITE_SUPPORTED
-   png_debug(0, "\nWriting info struct\n");
+   png_debug(0, "Writing info struct");
 
 /* If we wanted, we could write info in two steps:
-   png_write_info_before_PLTE(write_ptr, write_info_ptr);
+ * png_write_info_before_PLTE(write_ptr, write_info_ptr);
  */
    png_write_info(write_ptr, write_info_ptr);
+
+#if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED)
+   if (user_chunk_data[0] != 0)
+   {
+      png_byte png_sTER[5] = {115,  84,  69,  82, '\0'};
+
+      unsigned char
+        ster_chunk_data[1];
+
+      if (verbose)
+         fprintf(STDERR, "\n stereo mode = %lu\n",
+           (unsigned long)(user_chunk_data[0] - 1));
+      ster_chunk_data[0]=(unsigned char)(user_chunk_data[0] - 1);
+      png_write_chunk(write_ptr, png_sTER, ster_chunk_data, 1);
+   }
+   if (user_chunk_data[1] != 0 || user_chunk_data[2] != 0)
+   {
+      png_byte png_vpAg[5] = {118, 112,  65, 103, '\0'};
+
+      unsigned char
+        vpag_chunk_data[9];
+
+      if (verbose)
+         fprintf(STDERR, " vpAg = %lu x %lu, units = %lu\n",
+           (unsigned long)user_chunk_data[1],
+           (unsigned long)user_chunk_data[2],
+           (unsigned long)user_chunk_data[3]);
+      png_save_uint_32(vpag_chunk_data, user_chunk_data[1]);
+      png_save_uint_32(vpag_chunk_data + 4, user_chunk_data[2]);
+      vpag_chunk_data[8] = (unsigned char)(user_chunk_data[3] & 0xff);
+      png_write_chunk(write_ptr, png_vpAg, vpag_chunk_data, 9);
+   }
+
+#endif
 #endif
 
 #ifdef SINGLE_ROWBUF_ALLOC
-   png_debug(0, "\nAllocating row buffer...");
+   png_debug(0, "Allocating row buffer...");
    row_buf = (png_bytep)png_malloc(read_ptr,
       png_get_rowbytes(read_ptr, read_info_ptr));
-   png_debug1(0, "0x%08lx\n\n", (unsigned long)row_buf);
+   png_debug1(0, "0x%08lx", (unsigned long)row_buf);
 #endif /* SINGLE_ROWBUF_ALLOC */
-   png_debug(0, "Writing row data\n");
+   png_debug(0, "Writing row data");
 
 #if defined(PNG_READ_INTERLACING_SUPPORTED) || \
   defined(PNG_WRITE_INTERLACING_SUPPORTED)
@@ -1080,7 +1204,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
    png_set_interlace_handling(write_ptr);
 #  endif
 #else
-   num_pass=1;
+   num_pass = 1;
 #endif
 
 #ifdef PNGTEST_TIMING
@@ -1090,14 +1214,14 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 #endif
    for (pass = 0; pass < num_pass; pass++)
    {
-      png_debug1(0, "Writing row data for pass %d\n",pass);
+      png_debug1(0, "Writing row data for pass %d", pass);
       for (y = 0; y < height; y++)
       {
 #ifndef SINGLE_ROWBUF_ALLOC
-         png_debug2(0, "\nAllocating row buffer (pass %d, y = %ld)...", pass,y);
+         png_debug2(0, "Allocating row buffer (pass %d, y = %ld)...", pass, y);
          row_buf = (png_bytep)png_malloc(read_ptr,
             png_get_rowbytes(read_ptr, read_info_ptr));
-         png_debug2(0, "0x%08lx (%ld bytes)\n", (unsigned long)row_buf,
+         png_debug2(0, "0x%08lx (%ld bytes)", (unsigned long)row_buf,
             png_get_rowbytes(read_ptr, read_info_ptr));
 #endif /* !SINGLE_ROWBUF_ALLOC */
          png_read_rows(read_ptr, (png_bytepp)&row_buf, png_bytepp_NULL, 1);
@@ -1117,8 +1241,9 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 #endif /* PNG_WRITE_SUPPORTED */
 
 #ifndef SINGLE_ROWBUF_ALLOC
-         png_debug2(0, "Freeing row buffer (pass %d, y = %ld)\n\n", pass, y);
+         png_debug2(0, "Freeing row buffer (pass %d, y = %ld)", pass, y);
          png_free(read_ptr, row_buf);
+         row_buf = NULL;
 #endif /* !SINGLE_ROWBUF_ALLOC */
       }
    }
@@ -1130,7 +1255,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
    png_free_data(write_ptr, write_info_ptr, PNG_FREE_UNKN, -1);
 #endif
 
-   png_debug(0, "Reading and writing end_info data\n");
+   png_debug(0, "Reading and writing end_info data");
 
    png_read_end(read_ptr, end_info_ptr);
 #if defined(PNG_TEXT_SUPPORTED)
@@ -1140,7 +1265,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 
       if (png_get_text(read_ptr, end_info_ptr, &text_ptr, &num_text) > 0)
       {
-         png_debug1(0, "Handling %d iTXt/tEXt/zTXt chunks\n", num_text);
+         png_debug1(0, "Handling %d iTXt/tEXt/zTXt chunks", num_text);
          png_set_text(write_ptr, write_end_info_ptr, text_ptr, num_text);
       }
    }
@@ -1153,13 +1278,13 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       {
          png_set_tIME(write_ptr, write_end_info_ptr, mod_time);
 #if defined(PNG_TIME_RFC1123_SUPPORTED)
-         /* we have to use png_memcpy instead of "=" because the string
+         /* We have to use png_memcpy instead of "=" because the string
             pointed to by png_convert_to_rfc1123() gets free'ed before
             we use it */
          png_memcpy(tIME_string,
                     png_convert_to_rfc1123(read_ptr, mod_time),
                     png_sizeof(tIME_string));
-         tIME_string[png_sizeof(tIME_string)-1] = '\0';
+         tIME_string[png_sizeof(tIME_string) - 1] = '\0';
          tIME_chunk_present++;
 #endif /* PNG_TIME_RFC1123_SUPPORTED */
       }
@@ -1176,9 +1301,10 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
          png_size_t i;
          png_set_unknown_chunks(write_ptr, write_end_info_ptr, unknowns,
            num_unknowns);
-         /* copy the locations from the read_info_ptr.  The automatically
-            generated locations in write_end_info_ptr are wrong because we
-            haven't written the end_info yet */
+         /* Copy the locations from the read_info_ptr.  The automatically
+          * generated locations in write_end_info_ptr are wrong because we
+          * haven't written the end_info yet.
+          */
          for (i = 0; i < (png_size_t)num_unknowns; i++)
            png_set_unknown_chunk_location(write_ptr, write_end_info_ptr, i,
              unknowns[i].location);
@@ -1190,36 +1316,36 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 #endif
 
 #ifdef PNG_EASY_ACCESS_SUPPORTED
-   if(verbose)
+   if (verbose)
    {
       png_uint_32 iwidth, iheight;
       iwidth = png_get_image_width(write_ptr, write_info_ptr);
       iheight = png_get_image_height(write_ptr, write_info_ptr);
-      fprintf(STDERR, "Image width = %lu, height = %lu\n",
+      fprintf(STDERR, "\n Image width = %lu, height = %lu\n",
          (unsigned long)iwidth, (unsigned long)iheight);
    }
 #endif
 
-   png_debug(0, "Destroying data structs\n");
+   png_debug(0, "Destroying data structs");
 #ifdef SINGLE_ROWBUF_ALLOC
-   png_debug(1, "destroying row_buf for read_ptr\n");
+   png_debug(1, "destroying row_buf for read_ptr");
    png_free(read_ptr, row_buf);
-   row_buf=NULL;
+   row_buf = NULL;
 #endif /* SINGLE_ROWBUF_ALLOC */
-   png_debug(1, "destroying read_ptr, read_info_ptr, end_info_ptr\n");
+   png_debug(1, "destroying read_ptr, read_info_ptr, end_info_ptr");
    png_destroy_read_struct(&read_ptr, &read_info_ptr, &end_info_ptr);
 #ifdef PNG_WRITE_SUPPORTED
-   png_debug(1, "destroying write_end_info_ptr\n");
+   png_debug(1, "destroying write_end_info_ptr");
    png_destroy_info_struct(write_ptr, &write_end_info_ptr);
-   png_debug(1, "destroying write_ptr, write_info_ptr\n");
+   png_debug(1, "destroying write_ptr, write_info_ptr");
    png_destroy_write_struct(&write_ptr, &write_info_ptr);
 #endif
-   png_debug(0, "Destruction complete.\n");
+   png_debug(0, "Destruction complete.");
 
    FCLOSE(fpin);
    FCLOSE(fpout);
 
-   png_debug(0, "Opening files for comparison\n");
+   png_debug(0, "Opening files for comparison");
 #if defined(_WIN32_WCE)
    MultiByteToWideChar(CP_ACP, 0, inname, -1, path, MAX_PATH);
    if ((fpin = CreateFile(path, GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, NULL)) == INVALID_HANDLE_VALUE)
@@ -1243,28 +1369,28 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       return (1);
    }
 
-   for(;;)
+   for (;;)
    {
       png_size_t num_in, num_out;
 
-      READFILE(fpin, inbuf, 1, num_in);
-      READFILE(fpout, outbuf, 1, num_out);
+         READFILE(fpin, inbuf, 1, num_in);
+         READFILE(fpout, outbuf, 1, num_out);
 
       if (num_in != num_out)
       {
          fprintf(STDERR, "\nFiles %s and %s are of a different size\n",
                  inname, outname);
-         if(wrote_question == 0)
+         if (wrote_question == 0)
          {
             fprintf(STDERR,
          "   Was %s written with the same maximum IDAT chunk size (%d bytes),",
-              inname,PNG_ZBUF_SIZE);
+              inname, PNG_ZBUF_SIZE);
             fprintf(STDERR,
               "\n   filtering heuristic (libpng default), compression");
             fprintf(STDERR,
               " level (zlib default),\n   and zlib version (%s)?\n\n",
               ZLIB_VERSION);
-            wrote_question=1;
+            wrote_question = 1;
          }
          FCLOSE(fpin);
          FCLOSE(fpout);
@@ -1277,17 +1403,17 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       if (png_memcmp(inbuf, outbuf, num_in))
       {
          fprintf(STDERR, "\nFiles %s and %s are different\n", inname, outname);
-         if(wrote_question == 0)
+         if (wrote_question == 0)
          {
             fprintf(STDERR,
          "   Was %s written with the same maximum IDAT chunk size (%d bytes),",
-                 inname,PNG_ZBUF_SIZE);
+                 inname, PNG_ZBUF_SIZE);
             fprintf(STDERR,
               "\n   filtering heuristic (libpng default), compression");
             fprintf(STDERR,
               " level (zlib default),\n   and zlib version (%s)?\n\n",
               ZLIB_VERSION);
-            wrote_question=1;
+            wrote_question = 1;
          }
          FCLOSE(fpin);
          FCLOSE(fpout);
@@ -1301,7 +1427,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
    return (0);
 }
 
-/* input and output filenames */
+/* Input and output filenames */
 #ifdef RISCOS
 static PNG_CONST char *inname = "pngtest/png";
 static PNG_CONST char *outname = "pngout/png";
@@ -1316,23 +1442,24 @@ main(int argc, char *argv[])
    int multiple = 0;
    int ierror = 0;
 
-   fprintf(STDERR, "Testing libpng version %s\n", PNG_LIBPNG_VER_STRING);
+   fprintf(STDERR, "\n Testing libpng version %s\n", PNG_LIBPNG_VER_STRING);
    fprintf(STDERR, "   with zlib   version %s\n", ZLIB_VERSION);
-   fprintf(STDERR,"%s",png_get_copyright(NULL));
+   fprintf(STDERR, "%s", png_get_copyright(NULL));
    /* Show the version of libpng used in building the library */
-   fprintf(STDERR," library (%lu):%s",
+   fprintf(STDERR, " library (%lu):%s",
       (unsigned long)png_access_version_number(),
       png_get_header_version(NULL));
    /* Show the version of libpng used in building the application */
-   fprintf(STDERR," pngtest (%lu):%s", (unsigned long)PNG_LIBPNG_VER,
+   fprintf(STDERR, " pngtest (%lu):%s", (unsigned long)PNG_LIBPNG_VER,
       PNG_HEADER_VERSION_STRING);
-   fprintf(STDERR," png_sizeof(png_struct)=%ld, png_sizeof(png_info)=%ld\n",
+   fprintf(STDERR, " sizeof(png_struct)=%ld, sizeof(png_info)=%ld\n",
                     (long)png_sizeof(png_struct), (long)png_sizeof(png_info));
 
    /* Do some consistency checking on the memory allocation settings, I'm
-      not sure this matters, but it is nice to know, the first of these
-      tests should be impossible because of the way the macros are set
-      in pngconf.h */
+    * not sure this matters, but it is nice to know, the first of these
+    * tests should be impossible because of the way the macros are set
+    * in pngconf.h
+    */
 #if defined(MAXSEG_64K) && !defined(PNG_MAX_MALLOC_64K)
       fprintf(STDERR, " NOTE: Zlib compiled for max 64k, libpng not\n");
 #endif
@@ -1377,10 +1504,10 @@ main(int argc, char *argv[])
       }
    }
 
-   if (!multiple && argc == 3+verbose)
-     outname = argv[2+verbose];
+   if (!multiple && argc == 3 + verbose)
+     outname = argv[2 + verbose];
 
-   if ((!multiple && argc > 3+verbose) || (multiple && argc < 2))
+   if ((!multiple && argc > 3 + verbose) || (multiple && argc < 2))
    {
      fprintf(STDERR,
        "usage: %s [infile.png] [outfile.png]\n\t%s -m {infile.png}\n",
@@ -1404,7 +1531,7 @@ main(int argc, char *argv[])
          int k;
 #endif
          int kerror;
-         fprintf(STDERR, "Testing %s:",argv[i]);
+         fprintf(STDERR, "\n Testing %s:", argv[i]);
          kerror = test_one_file(argv[i], outname);
          if (kerror == 0)
          {
@@ -1415,14 +1542,14 @@ main(int argc, char *argv[])
             fprintf(STDERR, " PASS\n");
 #endif
 #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED)
-            for (k=0; k<256; k++)
-               if(filters_used[k])
+            for (k = 0; k<256; k++)
+               if (filters_used[k])
                   fprintf(STDERR, " Filter %d was used %lu times\n",
-                     k,(unsigned long)filters_used[k]);
+                     k, (unsigned long)filters_used[k]);
 #endif
 #if defined(PNG_TIME_RFC1123_SUPPORTED)
-         if(tIME_chunk_present != 0)
-            fprintf(STDERR, " tIME = %s\n",tIME_string);
+         if (tIME_chunk_present != 0)
+            fprintf(STDERR, " tIME = %s\n", tIME_string);
          tIME_chunk_present = 0;
 #endif /* PNG_TIME_RFC1123_SUPPORTED */
          }
@@ -1434,7 +1561,7 @@ main(int argc, char *argv[])
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
          if (allocation_now != current_allocation)
             fprintf(STDERR, "MEMORY ERROR: %d bytes lost\n",
-               current_allocation-allocation_now);
+               current_allocation - allocation_now);
          if (current_allocation != 0)
          {
             memory_infop pinfo = pinformation;
@@ -1443,7 +1570,8 @@ main(int argc, char *argv[])
                current_allocation);
             while (pinfo != NULL)
             {
-               fprintf(STDERR, " %lu bytes at %x\n", (unsigned long)pinfo->size,
+               fprintf(STDERR, " %lu bytes at %x\n",
+                 (unsigned long)pinfo->size,
                  (unsigned int) pinfo->pointer);
                pinfo = pinfo->next;
             }
@@ -1464,20 +1592,20 @@ main(int argc, char *argv[])
    else
    {
       int i;
-      for (i=0; i<3; ++i)
+      for (i = 0; i<3; ++i)
       {
          int kerror;
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
          int allocation_now = current_allocation;
 #endif
          if (i == 1) status_dots_requested = 1;
-         else if(verbose == 0)status_dots_requested = 0;
+         else if (verbose == 0)status_dots_requested = 0;
          if (i == 0 || verbose == 1 || ierror != 0)
-            fprintf(STDERR, "Testing %s:",inname);
+            fprintf(STDERR, "\n Testing %s:", inname);
          kerror = test_one_file(inname, outname);
-         if(kerror == 0)
+         if (kerror == 0)
          {
-            if(verbose == 1 || i == 2)
+            if (verbose == 1 || i == 2)
             {
 #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED)
                 int k;
@@ -1489,28 +1617,29 @@ main(int argc, char *argv[])
                 fprintf(STDERR, " PASS\n");
 #endif
 #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED)
-                for (k=0; k<256; k++)
-                   if(filters_used[k])
+                for (k = 0; k<256; k++)
+                   if (filters_used[k])
                       fprintf(STDERR, " Filter %d was used %lu times\n",
-                         k,(unsigned long)filters_used[k]);
+                         k,
+                         (unsigned long)filters_used[k]);
 #endif
 #if defined(PNG_TIME_RFC1123_SUPPORTED)
-             if(tIME_chunk_present != 0)
-                fprintf(STDERR, " tIME = %s\n",tIME_string);
+             if (tIME_chunk_present != 0)
+                fprintf(STDERR, " tIME = %s\n", tIME_string);
 #endif /* PNG_TIME_RFC1123_SUPPORTED */
             }
          }
          else
          {
-            if(verbose == 0 && i != 2)
-               fprintf(STDERR, "Testing %s:",inname);
+            if (verbose == 0 && i != 2)
+               fprintf(STDERR, "\n Testing %s:", inname);
             fprintf(STDERR, " FAIL\n");
             ierror += kerror;
          }
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
          if (allocation_now != current_allocation)
              fprintf(STDERR, "MEMORY ERROR: %d bytes lost\n",
-               current_allocation-allocation_now);
+               current_allocation - allocation_now);
          if (current_allocation != 0)
          {
              memory_infop pinfo = pinformation;
@@ -1519,7 +1648,7 @@ main(int argc, char *argv[])
                 current_allocation);
              while (pinfo != NULL)
              {
-                fprintf(STDERR," %lu bytes at %x\n",
+                fprintf(STDERR, " %lu bytes at %x\n",
                    (unsigned long)pinfo->size, (unsigned int)pinfo->pointer);
                 pinfo = pinfo->next;
              }
@@ -1542,22 +1671,22 @@ main(int argc, char *argv[])
    t_stop = (float)clock();
    t_misc += (t_stop - t_start);
    t_start = t_stop;
-   fprintf(STDERR," CPU time used = %.3f seconds",
+   fprintf(STDERR, " CPU time used = %.3f seconds",
       (t_misc+t_decode+t_encode)/(float)CLOCKS_PER_SEC);
-   fprintf(STDERR," (decoding %.3f,\n",
+   fprintf(STDERR, " (decoding %.3f,\n",
       t_decode/(float)CLOCKS_PER_SEC);
-   fprintf(STDERR,"        encoding %.3f ,",
+   fprintf(STDERR, "        encoding %.3f ,",
       t_encode/(float)CLOCKS_PER_SEC);
-   fprintf(STDERR," other %.3f seconds)\n\n",
+   fprintf(STDERR, " other %.3f seconds)\n\n",
       t_misc/(float)CLOCKS_PER_SEC);
 #endif
 
    if (ierror == 0)
-      fprintf(STDERR, "libpng passes test\n");
+      fprintf(STDERR, " libpng passes test\n");
    else
-      fprintf(STDERR, "libpng FAILS test\n");
+      fprintf(STDERR, " libpng FAILS test\n");
    return (int)(ierror != 0);
 }
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef version_1_2_29 your_png_h_is_not_version_1_2_29;
+typedef version_1_2_40 your_png_h_is_not_version_1_2_40;
diff --git a/src/3rdparty/libpng/pngtrans.c b/src/3rdparty/libpng/pngtrans.c
index 1640095020..6e1870c596 100644
--- a/src/3rdparty/libpng/pngtrans.c
+++ b/src/3rdparty/libpng/pngtrans.c
@@ -1,47 +1,53 @@
 
 /* pngtrans.c - transforms the data in a row (used by both readers and writers)
  *
- * Last changed in libpng 1.2.17 May 15, 2007
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2007 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.36 [May 14, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
+ *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
  */
 
 #define PNG_INTERNAL
 #include "png.h"
-
 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
+
 #if defined(PNG_READ_BGR_SUPPORTED) || defined(PNG_WRITE_BGR_SUPPORTED)
-/* turn on BGR-to-RGB mapping */
+/* Turn on BGR-to-RGB mapping */
 void PNGAPI
 png_set_bgr(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_bgr\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_bgr");
+   if (png_ptr == NULL)
+      return;
    png_ptr->transformations |= PNG_BGR;
 }
 #endif
 
 #if defined(PNG_READ_SWAP_SUPPORTED) || defined(PNG_WRITE_SWAP_SUPPORTED)
-/* turn on 16 bit byte swapping */
+/* Turn on 16 bit byte swapping */
 void PNGAPI
 png_set_swap(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_swap\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_swap");
+   if (png_ptr == NULL)
+      return;
    if (png_ptr->bit_depth == 16)
       png_ptr->transformations |= PNG_SWAP_BYTES;
 }
 #endif
 
 #if defined(PNG_READ_PACK_SUPPORTED) || defined(PNG_WRITE_PACK_SUPPORTED)
-/* turn on pixel packing */
+/* Turn on pixel packing */
 void PNGAPI
 png_set_packing(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_packing\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_packing");
+   if (png_ptr == NULL)
+      return;
    if (png_ptr->bit_depth < 8)
    {
       png_ptr->transformations |= PNG_PACK;
@@ -51,12 +57,13 @@ png_set_packing(png_structp png_ptr)
 #endif
 
 #if defined(PNG_READ_PACKSWAP_SUPPORTED)||defined(PNG_WRITE_PACKSWAP_SUPPORTED)
-/* turn on packed pixel swapping */
+/* Turn on packed pixel swapping */
 void PNGAPI
 png_set_packswap(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_packswap\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_packswap");
+   if (png_ptr == NULL)
+      return;
    if (png_ptr->bit_depth < 8)
       png_ptr->transformations |= PNG_PACKSWAP;
 }
@@ -66,8 +73,9 @@ png_set_packswap(png_structp png_ptr)
 void PNGAPI
 png_set_shift(png_structp png_ptr, png_color_8p true_bits)
 {
-   png_debug(1, "in png_set_shift\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_shift");
+   if (png_ptr == NULL)
+      return;
    png_ptr->transformations |= PNG_SHIFT;
    png_ptr->shift = *true_bits;
 }
@@ -78,7 +86,7 @@ png_set_shift(png_structp png_ptr, png_color_8p true_bits)
 int PNGAPI
 png_set_interlace_handling(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_interlace handling\n");
+   png_debug(1, "in png_set_interlace handling");
    if (png_ptr && png_ptr->interlaced)
    {
       png_ptr->transformations |= PNG_INTERLACE;
@@ -98,8 +106,9 @@ png_set_interlace_handling(png_structp png_ptr)
 void PNGAPI
 png_set_filler(png_structp png_ptr, png_uint_32 filler, int filler_loc)
 {
-   png_debug(1, "in png_set_filler\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_filler");
+   if (png_ptr == NULL)
+      return;
    png_ptr->transformations |= PNG_FILLER;
    png_ptr->filler = (png_byte)filler;
    if (filler_loc == PNG_FILLER_AFTER)
@@ -131,8 +140,9 @@ png_set_filler(png_structp png_ptr, png_uint_32 filler, int filler_loc)
 void PNGAPI
 png_set_add_alpha(png_structp png_ptr, png_uint_32 filler, int filler_loc)
 {
-   png_debug(1, "in png_set_add_alpha\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_add_alpha");
+   if (png_ptr == NULL)
+      return;
    png_set_filler(png_ptr, filler, filler_loc);
    png_ptr->transformations |= PNG_ADD_ALPHA;
 }
@@ -145,8 +155,9 @@ png_set_add_alpha(png_structp png_ptr, png_uint_32 filler, int filler_loc)
 void PNGAPI
 png_set_swap_alpha(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_swap_alpha\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_swap_alpha");
+   if (png_ptr == NULL)
+      return;
    png_ptr->transformations |= PNG_SWAP_ALPHA;
 }
 #endif
@@ -156,8 +167,9 @@ png_set_swap_alpha(png_structp png_ptr)
 void PNGAPI
 png_set_invert_alpha(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_invert_alpha\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_invert_alpha");
+   if (png_ptr == NULL)
+      return;
    png_ptr->transformations |= PNG_INVERT_ALPHA;
 }
 #endif
@@ -166,16 +178,17 @@ png_set_invert_alpha(png_structp png_ptr)
 void PNGAPI
 png_set_invert_mono(png_structp png_ptr)
 {
-   png_debug(1, "in png_set_invert_mono\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_invert_mono");
+   if (png_ptr == NULL)
+      return;
    png_ptr->transformations |= PNG_INVERT_MONO;
 }
 
-/* invert monochrome grayscale data */
+/* Invert monochrome grayscale data */
 void /* PRIVATE */
 png_do_invert(png_row_infop row_info, png_bytep row)
 {
-   png_debug(1, "in png_do_invert\n");
+   png_debug(1, "in png_do_invert");
   /* This test removed from libpng version 1.0.13 and 1.2.0:
    *   if (row_info->bit_depth == 1 &&
    */
@@ -226,11 +239,11 @@ png_do_invert(png_row_infop row_info, png_bytep row)
 #endif
 
 #if defined(PNG_READ_SWAP_SUPPORTED) || defined(PNG_WRITE_SWAP_SUPPORTED)
-/* swaps byte order on 16 bit depth images */
+/* Swaps byte order on 16 bit depth images */
 void /* PRIVATE */
 png_do_swap(png_row_infop row_info, png_bytep row)
 {
-   png_debug(1, "in png_do_swap\n");
+   png_debug(1, "in png_do_swap");
    if (
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
        row != NULL && row_info != NULL &&
@@ -357,11 +370,11 @@ static PNG_CONST png_byte fourbppswaptable[256] = {
    0x8F, 0x9F, 0xAF, 0xBF, 0xCF, 0xDF, 0xEF, 0xFF
 };
 
-/* swaps pixel packing order within bytes */
+/* Swaps pixel packing order within bytes */
 void /* PRIVATE */
 png_do_packswap(png_row_infop row_info, png_bytep row)
 {
-   png_debug(1, "in png_do_packswap\n");
+   png_debug(1, "in png_do_packswap");
    if (
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
        row != NULL && row_info != NULL &&
@@ -389,11 +402,11 @@ png_do_packswap(png_row_infop row_info, png_bytep row)
 
 #if defined(PNG_WRITE_FILLER_SUPPORTED) || \
     defined(PNG_READ_STRIP_ALPHA_SUPPORTED)
-/* remove filler or alpha byte(s) */
+/* Remove filler or alpha byte(s) */
 void /* PRIVATE */
 png_do_strip_filler(png_row_infop row_info, png_bytep row, png_uint_32 flags)
 {
-   png_debug(1, "in png_do_strip_filler\n");
+   png_debug(1, "in png_do_strip_filler");
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
    if (row != NULL && row_info != NULL)
 #endif
@@ -404,9 +417,9 @@ png_do_strip_filler(png_row_infop row_info, png_bytep row, png_uint_32 flags)
       png_uint_32 i;
 
       if ((row_info->color_type == PNG_COLOR_TYPE_RGB ||
-         (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA &&
-         (flags & PNG_FLAG_STRIP_ALPHA))) &&
-         row_info->channels == 4)
+          (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA &&
+          (flags & PNG_FLAG_STRIP_ALPHA))) &&
+          row_info->channels == 4)
       {
          if (row_info->bit_depth == 8)
          {
@@ -547,11 +560,11 @@ png_do_strip_filler(png_row_infop row_info, png_bytep row, png_uint_32 flags)
 #endif
 
 #if defined(PNG_READ_BGR_SUPPORTED) || defined(PNG_WRITE_BGR_SUPPORTED)
-/* swaps red and blue bytes within a pixel */
+/* Swaps red and blue bytes within a pixel */
 void /* PRIVATE */
 png_do_bgr(png_row_infop row_info, png_bytep row)
 {
-   png_debug(1, "in png_do_bgr\n");
+   png_debug(1, "in png_do_bgr");
    if (
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
        row != NULL && row_info != NULL &&
@@ -624,20 +637,21 @@ png_do_bgr(png_row_infop row_info, png_bytep row)
 #endif /* PNG_READ_BGR_SUPPORTED or PNG_WRITE_BGR_SUPPORTED */
 
 #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) || \
-    defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED) || \
-    defined(PNG_LEGACY_SUPPORTED)
+    defined(PNG_LEGACY_SUPPORTED) || \
+    defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED)
 void PNGAPI
 png_set_user_transform_info(png_structp png_ptr, png_voidp
    user_transform_ptr, int user_transform_depth, int user_transform_channels)
 {
-   png_debug(1, "in png_set_user_transform_info\n");
-   if(png_ptr == NULL) return;
+   png_debug(1, "in png_set_user_transform_info");
+   if (png_ptr == NULL)
+      return;
 #if defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
    png_ptr->user_transform_ptr = user_transform_ptr;
    png_ptr->user_transform_depth = (png_byte)user_transform_depth;
    png_ptr->user_transform_channels = (png_byte)user_transform_channels;
 #else
-   if(user_transform_ptr || user_transform_depth || user_transform_channels)
+   if (user_transform_ptr || user_transform_depth || user_transform_channels)
       png_warning(png_ptr,
         "This version of libpng does not support user transform info");
 #endif
@@ -652,8 +666,9 @@ png_set_user_transform_info(png_structp png_ptr, png_voidp
 png_voidp PNGAPI
 png_get_user_transform_ptr(png_structp png_ptr)
 {
+   if (png_ptr == NULL)
+      return (NULL);
 #if defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
-   if (png_ptr == NULL) return (NULL);
    return ((png_voidp)png_ptr->user_transform_ptr);
 #else
    return (NULL);
diff --git a/src/3rdparty/libpng/pngwio.c b/src/3rdparty/libpng/pngwio.c
index 371a4fad62..f77b2dbd96 100644
--- a/src/3rdparty/libpng/pngwio.c
+++ b/src/3rdparty/libpng/pngwio.c
@@ -1,12 +1,15 @@
 
 /* pngwio.c - functions for data output
  *
- * Last changed in libpng 1.2.13 November 13, 2006
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2006 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.37 [June 4, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
+ *
  * This file provides a location for all output.  Users who need
  * special handling are expected to write functions that have the same
  * arguments as these and perform similar functions, but that possibly
@@ -20,10 +23,11 @@
 #ifdef PNG_WRITE_SUPPORTED
 
 /* Write the data to whatever output you are using.  The default routine
-   writes to a file pointer.  Note that this routine sometimes gets called
-   with very small lengths, so you should implement some kind of simple
-   buffering if you are using unbuffered writes.  This should never be asked
-   to write more than 64K on a 16 bit machine.  */
+ * writes to a file pointer.  Note that this routine sometimes gets called
+ * with very small lengths, so you should implement some kind of simple
+ * buffering if you are using unbuffered writes.  This should never be asked
+ * to write more than 64K on a 16 bit machine.
+ */
 
 void /* PRIVATE */
 png_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
@@ -36,16 +40,18 @@ png_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
 
 #if !defined(PNG_NO_STDIO)
 /* This is the function that does the actual writing of data.  If you are
-   not writing to a standard C stream, you should create a replacement
-   write_data function and use it at run time with png_set_write_fn(), rather
-   than changing the library. */
+ * not writing to a standard C stream, you should create a replacement
+ * write_data function and use it at run time with png_set_write_fn(), rather
+ * than changing the library.
+ */
 #ifndef USE_FAR_KEYWORD
 void PNGAPI
 png_default_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
 {
    png_uint_32 check;
 
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
 #if defined(_WIN32_WCE)
    if ( !WriteFile((HANDLE)(png_ptr->io_ptr), data, length, &check, NULL) )
       check = 0;
@@ -56,10 +62,10 @@ png_default_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
       png_error(png_ptr, "Write Error");
 }
 #else
-/* this is the model-independent version. Since the standard I/O library
-   can't handle far buffers in the medium and small models, we have to copy
-   the data.
-*/
+/* This is the model-independent version. Since the standard I/O library
+ * can't handle far buffers in the medium and small models, we have to copy
+ * the data.
+ */
 
 #define NEAR_BUF_SIZE 1024
 #define MIN(a,b) (a <= b ? a : b)
@@ -71,7 +77,8 @@ png_default_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
    png_byte *near_data;  /* Needs to be "png_byte *" instead of "png_bytep" */
    png_FILE_p io_ptr;
 
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
    /* Check if data really is near. If so, use usual code. */
    near_data = (png_byte *)CVT_PTR_NOCHECK(data);
    io_ptr = (png_FILE_p)CVT_PTR(png_ptr->io_ptr);
@@ -93,7 +100,7 @@ png_default_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
       do
       {
          written = MIN(NEAR_BUF_SIZE, remaining);
-         png_memcpy(buf, data, written); /* copy far buffer to near buffer */
+         png_memcpy(buf, data, written); /* Copy far buffer to near buffer */
 #if defined(_WIN32_WCE)
          if ( !WriteFile(io_ptr, buf, written, &err, NULL) )
             err = 0;
@@ -102,8 +109,10 @@ png_default_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
 #endif
          if (err != written)
             break;
+
          else
             check += err;
+
          data += written;
          remaining -= written;
       }
@@ -117,8 +126,9 @@ png_default_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
 #endif
 
 /* This function is called to output any data pending writing (normally
-   to disk).  After png_flush is called, there should be no data pending
-   writing in any buffers. */
+ * to disk).  After png_flush is called, there should be no data pending
+ * writing in any buffers.
+ */
 #if defined(PNG_WRITE_FLUSH_SUPPORTED)
 void /* PRIVATE */
 png_flush(png_structp png_ptr)
@@ -134,48 +144,58 @@ png_default_flush(png_structp png_ptr)
 #if !defined(_WIN32_WCE)
    png_FILE_p io_ptr;
 #endif
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
 #if !defined(_WIN32_WCE)
    io_ptr = (png_FILE_p)CVT_PTR((png_ptr->io_ptr));
-   if (io_ptr != NULL)
-      fflush(io_ptr);
+   fflush(io_ptr);
 #endif
 }
 #endif
 #endif
 
 /* This function allows the application to supply new output functions for
-   libpng if standard C streams aren't being used.
-
-   This function takes as its arguments:
-   png_ptr       - pointer to a png output data structure
-   io_ptr        - pointer to user supplied structure containing info about
-                   the output functions.  May be NULL.
-   write_data_fn - pointer to a new output function that takes as its
-                   arguments a pointer to a png_struct, a pointer to
-                   data to be written, and a 32-bit unsigned int that is
-                   the number of bytes to be written.  The new write
-                   function should call png_error(png_ptr, "Error msg")
-                   to exit and output any fatal error messages.
-   flush_data_fn - pointer to a new flush function that takes as its
-                   arguments a pointer to a png_struct.  After a call to
-                   the flush function, there should be no data in any buffers
-                   or pending transmission.  If the output method doesn't do
-                   any buffering of ouput, a function prototype must still be
-                   supplied although it doesn't have to do anything.  If
-                   PNG_WRITE_FLUSH_SUPPORTED is not defined at libpng compile
-                   time, output_flush_fn will be ignored, although it must be
-                   supplied for compatibility. */
+ * libpng if standard C streams aren't being used.
+ *
+ * This function takes as its arguments:
+ * png_ptr       - pointer to a png output data structure
+ * io_ptr        - pointer to user supplied structure containing info about
+ *                 the output functions.  May be NULL.
+ * write_data_fn - pointer to a new output function that takes as its
+ *                 arguments a pointer to a png_struct, a pointer to
+ *                 data to be written, and a 32-bit unsigned int that is
+ *                 the number of bytes to be written.  The new write
+ *                 function should call png_error(png_ptr, "Error msg")
+ *                 to exit and output any fatal error messages.  May be
+ *                 NULL, in which case libpng's default function will
+ *                 be used.
+ * flush_data_fn - pointer to a new flush function that takes as its
+ *                 arguments a pointer to a png_struct.  After a call to
+ *                 the flush function, there should be no data in any buffers
+ *                 or pending transmission.  If the output method doesn't do
+ *                 any buffering of ouput, a function prototype must still be
+ *                 supplied although it doesn't have to do anything.  If
+ *                 PNG_WRITE_FLUSH_SUPPORTED is not defined at libpng compile
+ *                 time, output_flush_fn will be ignored, although it must be
+ *                 supplied for compatibility.  May be NULL, in which case
+ *                 libpng's default function will be used, if
+ *                 PNG_WRITE_FLUSH_SUPPORTED is defined.  This is not
+ *                 a good idea if io_ptr does not point to a standard
+ *                 *FILE structure.
+ */
 void PNGAPI
 png_set_write_fn(png_structp png_ptr, png_voidp io_ptr,
    png_rw_ptr write_data_fn, png_flush_ptr output_flush_fn)
 {
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
+
    png_ptr->io_ptr = io_ptr;
 
 #if !defined(PNG_NO_STDIO)
    if (write_data_fn != NULL)
       png_ptr->write_data_fn = write_data_fn;
+
    else
       png_ptr->write_data_fn = png_default_write_data;
 #else
@@ -186,6 +206,7 @@ png_set_write_fn(png_structp png_ptr, png_voidp io_ptr,
 #if !defined(PNG_NO_STDIO)
    if (output_flush_fn != NULL)
       png_ptr->output_flush_fn = output_flush_fn;
+
    else
       png_ptr->output_flush_fn = png_default_flush;
 #else
@@ -206,27 +227,31 @@ png_set_write_fn(png_structp png_ptr, png_voidp io_ptr,
 
 #if defined(USE_FAR_KEYWORD)
 #if defined(_MSC_VER)
-void *png_far_to_near(png_structp png_ptr,png_voidp ptr, int check)
+void *png_far_to_near(png_structp png_ptr, png_voidp ptr, int check)
 {
    void *near_ptr;
    void FAR *far_ptr;
    FP_OFF(near_ptr) = FP_OFF(ptr);
    far_ptr = (void FAR *)near_ptr;
-   if(check != 0)
-      if(FP_SEG(ptr) != FP_SEG(far_ptr))
-         png_error(png_ptr,"segment lost in conversion");
+
+   if (check != 0)
+      if (FP_SEG(ptr) != FP_SEG(far_ptr))
+         png_error(png_ptr, "segment lost in conversion");
+
    return(near_ptr);
 }
 #  else
-void *png_far_to_near(png_structp png_ptr,png_voidp ptr, int check)
+void *png_far_to_near(png_structp png_ptr, png_voidp ptr, int check)
 {
    void *near_ptr;
    void FAR *far_ptr;
    near_ptr = (void FAR *)ptr;
    far_ptr = (void FAR *)near_ptr;
-   if(check != 0)
-      if(far_ptr != ptr)
-         png_error(png_ptr,"segment lost in conversion");
+
+   if (check != 0)
+      if (far_ptr != ptr)
+         png_error(png_ptr, "segment lost in conversion");
+
    return(near_ptr);
 }
 #   endif
diff --git a/src/3rdparty/libpng/pngwrite.c b/src/3rdparty/libpng/pngwrite.c
index 7d02ad7ddf..0987612d1f 100644
--- a/src/3rdparty/libpng/pngwrite.c
+++ b/src/3rdparty/libpng/pngwrite.c
@@ -1,14 +1,17 @@
 
 /* pngwrite.c - general routines to write a PNG file
  *
- * Last changed in libpng 1.2.27 [April 29, 2008]
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.37 [June 4, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
+ *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
  */
 
-/* get internal access to png.h */
+/* Get internal access to png.h */
 #define PNG_INTERNAL
 #include "png.h"
 #ifdef PNG_WRITE_SUPPORTED
@@ -25,20 +28,20 @@
 void PNGAPI
 png_write_info_before_PLTE(png_structp png_ptr, png_infop info_ptr)
 {
-   png_debug(1, "in png_write_info_before_PLTE\n");
+   png_debug(1, "in png_write_info_before_PLTE");
    if (png_ptr == NULL || info_ptr == NULL)
       return;
    if (!(png_ptr->mode & PNG_WROTE_INFO_BEFORE_PLTE))
    {
-   png_write_sig(png_ptr); /* write PNG signature */
+   png_write_sig(png_ptr); /* Write PNG signature */
 #if defined(PNG_MNG_FEATURES_SUPPORTED)
-   if((png_ptr->mode&PNG_HAVE_PNG_SIGNATURE)&&(png_ptr->mng_features_permitted))
+   if ((png_ptr->mode&PNG_HAVE_PNG_SIGNATURE)&&(png_ptr->mng_features_permitted))
    {
-      png_warning(png_ptr,"MNG features are not allowed in a PNG datastream");
+      png_warning(png_ptr, "MNG features are not allowed in a PNG datastream");
       png_ptr->mng_features_permitted=0;
    }
 #endif
-   /* write IHDR information. */
+   /* Write IHDR information. */
    png_write_IHDR(png_ptr, info_ptr->width, info_ptr->height,
       info_ptr->bit_depth, info_ptr->color_type, info_ptr->compression_type,
       info_ptr->filter_type,
@@ -47,8 +50,9 @@ png_write_info_before_PLTE(png_structp png_ptr, png_infop info_ptr)
 #else
       0);
 #endif
-   /* the rest of these check to see if the valid field has the appropriate
-      flag set, and if it does, writes the chunk. */
+   /* The rest of these check to see if the valid field has the appropriate
+    * flag set, and if it does, writes the chunk.
+    */
 #if defined(PNG_WRITE_gAMA_SUPPORTED)
    if (info_ptr->valid & PNG_INFO_gAMA)
    {
@@ -97,14 +101,14 @@ png_write_info_before_PLTE(png_structp png_ptr, png_infop info_ptr)
 #if defined(PNG_WRITE_UNKNOWN_CHUNKS_SUPPORTED)
    if (info_ptr->unknown_chunks_num)
    {
-       png_unknown_chunk *up;
+      png_unknown_chunk *up;
 
-       png_debug(5, "writing extra chunks\n");
+      png_debug(5, "writing extra chunks");
 
-       for (up = info_ptr->unknown_chunks;
-            up < info_ptr->unknown_chunks + info_ptr->unknown_chunks_num;
-            up++)
-       {
+      for (up = info_ptr->unknown_chunks;
+           up < info_ptr->unknown_chunks + info_ptr->unknown_chunks_num;
+           up++)
+      {
          int keep=png_handle_as_unknown(png_ptr, up->name);
          if (keep != PNG_HANDLE_CHUNK_NEVER &&
             up->location && !(up->location & PNG_HAVE_PLTE) &&
@@ -116,7 +120,7 @@ png_write_info_before_PLTE(png_structp png_ptr, png_infop info_ptr)
                png_warning(png_ptr, "Writing zero-length unknown chunk");
             png_write_chunk(png_ptr, up->name, up->data, up->size);
          }
-       }
+      }
    }
 #endif
       png_ptr->mode |= PNG_WROTE_INFO_BEFORE_PLTE;
@@ -130,7 +134,7 @@ png_write_info(png_structp png_ptr, png_infop info_ptr)
    int i;
 #endif
 
-   png_debug(1, "in png_write_info\n");
+   png_debug(1, "in png_write_info");
 
    if (png_ptr == NULL || info_ptr == NULL)
       return;
@@ -145,20 +149,20 @@ png_write_info(png_structp png_ptr, png_infop info_ptr)
 
 #if defined(PNG_WRITE_tRNS_SUPPORTED)
    if (info_ptr->valid & PNG_INFO_tRNS)
-      {
+   {
 #if defined(PNG_WRITE_INVERT_ALPHA_SUPPORTED)
-         /* invert the alpha channel (in tRNS) */
-         if ((png_ptr->transformations & PNG_INVERT_ALPHA) &&
-            info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
-         {
-            int j;
-            for (j=0; j<(int)info_ptr->num_trans; j++)
-               info_ptr->trans[j] = (png_byte)(255 - info_ptr->trans[j]);
-         }
+      /* Invert the alpha channel (in tRNS) */
+      if ((png_ptr->transformations & PNG_INVERT_ALPHA) &&
+         info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
+      {
+         int j;
+         for (j=0; j<(int)info_ptr->num_trans; j++)
+            info_ptr->trans[j] = (png_byte)(255 - info_ptr->trans[j]);
+      }
 #endif
       png_write_tRNS(png_ptr, info_ptr->trans, &(info_ptr->trans_values),
          info_ptr->num_trans, info_ptr->color_type);
-      }
+   }
 #endif
 #if defined(PNG_WRITE_bKGD_SUPPORTED)
    if (info_ptr->valid & PNG_INFO_bKGD)
@@ -179,49 +183,56 @@ png_write_info(png_structp png_ptr, png_infop info_ptr)
          info_ptr->pcal_X1, info_ptr->pcal_type, info_ptr->pcal_nparams,
          info_ptr->pcal_units, info_ptr->pcal_params);
 #endif
-#if defined(PNG_WRITE_sCAL_SUPPORTED)
+
+#if defined(PNG_sCAL_SUPPORTED)
    if (info_ptr->valid & PNG_INFO_sCAL)
+#if defined(PNG_WRITE_sCAL_SUPPORTED)
 #if defined(PNG_FLOATING_POINT_SUPPORTED) && !defined(PNG_NO_STDIO)
       png_write_sCAL(png_ptr, (int)info_ptr->scal_unit,
           info_ptr->scal_pixel_width, info_ptr->scal_pixel_height);
-#else
+#else /* !FLOATING_POINT */
 #ifdef PNG_FIXED_POINT_SUPPORTED
       png_write_sCAL_s(png_ptr, (int)info_ptr->scal_unit,
           info_ptr->scal_s_width, info_ptr->scal_s_height);
-#else
+#endif /* FIXED_POINT */
+#endif /* FLOATING_POINT */
+#else  /* !WRITE_sCAL */
       png_warning(png_ptr,
           "png_write_sCAL not supported; sCAL chunk not written.");
-#endif
-#endif
-#endif
+#endif /* WRITE_sCAL */
+#endif /* sCAL */
+
 #if defined(PNG_WRITE_pHYs_SUPPORTED)
    if (info_ptr->valid & PNG_INFO_pHYs)
       png_write_pHYs(png_ptr, info_ptr->x_pixels_per_unit,
          info_ptr->y_pixels_per_unit, info_ptr->phys_unit_type);
-#endif
+#endif /* pHYs */
+
 #if defined(PNG_WRITE_tIME_SUPPORTED)
    if (info_ptr->valid & PNG_INFO_tIME)
    {
       png_write_tIME(png_ptr, &(info_ptr->mod_time));
       png_ptr->mode |= PNG_WROTE_tIME;
    }
-#endif
+#endif /* tIME */
+
 #if defined(PNG_WRITE_sPLT_SUPPORTED)
    if (info_ptr->valid & PNG_INFO_sPLT)
      for (i = 0; i < (int)info_ptr->splt_palettes_num; i++)
        png_write_sPLT(png_ptr, info_ptr->splt_palettes + i);
-#endif
+#endif /* sPLT */
+
 #if defined(PNG_WRITE_TEXT_SUPPORTED)
    /* Check to see if we need to write text chunks */
    for (i = 0; i < info_ptr->num_text; i++)
    {
-      png_debug2(2, "Writing header text chunk %d, type %d\n", i,
+      png_debug2(2, "Writing header text chunk %d, type %d", i,
          info_ptr->text[i].compression);
-      /* an internationalized chunk? */
+      /* An internationalized chunk? */
       if (info_ptr->text[i].compression > 0)
       {
 #if defined(PNG_WRITE_iTXt_SUPPORTED)
-          /* write international chunk */
+          /* Write international chunk */
           png_write_iTXt(png_ptr,
                          info_ptr->text[i].compression,
                          info_ptr->text[i].key,
@@ -238,7 +249,7 @@ png_write_info(png_structp png_ptr, png_infop info_ptr)
       else if (info_ptr->text[i].compression == PNG_TEXT_COMPRESSION_zTXt)
       {
 #if defined(PNG_WRITE_zTXt_SUPPORTED)
-         /* write compressed chunk */
+         /* Write compressed chunk */
          png_write_zTXt(png_ptr, info_ptr->text[i].key,
             info_ptr->text[i].text, 0,
             info_ptr->text[i].compression);
@@ -251,24 +262,26 @@ png_write_info(png_structp png_ptr, png_infop info_ptr)
       else if (info_ptr->text[i].compression == PNG_TEXT_COMPRESSION_NONE)
       {
 #if defined(PNG_WRITE_tEXt_SUPPORTED)
-         /* write uncompressed chunk */
+         /* Write uncompressed chunk */
          png_write_tEXt(png_ptr, info_ptr->text[i].key,
                          info_ptr->text[i].text,
                          0);
+         /* Mark this chunk as written */
+         info_ptr->text[i].compression = PNG_TEXT_COMPRESSION_NONE_WR;
 #else
+         /* Can't get here */
          png_warning(png_ptr, "Unable to write uncompressed text");
 #endif
-         /* Mark this chunk as written */
-         info_ptr->text[i].compression = PNG_TEXT_COMPRESSION_NONE_WR;
       }
    }
-#endif
+#endif /* tEXt */
+
 #if defined(PNG_WRITE_UNKNOWN_CHUNKS_SUPPORTED)
    if (info_ptr->unknown_chunks_num)
    {
        png_unknown_chunk *up;
 
-       png_debug(5, "writing extra chunks\n");
+       png_debug(5, "writing extra chunks");
 
        for (up = info_ptr->unknown_chunks;
             up < info_ptr->unknown_chunks + info_ptr->unknown_chunks_num;
@@ -296,35 +309,35 @@ png_write_info(png_structp png_ptr, png_infop info_ptr)
 void PNGAPI
 png_write_end(png_structp png_ptr, png_infop info_ptr)
 {
-   png_debug(1, "in png_write_end\n");
+   png_debug(1, "in png_write_end");
    if (png_ptr == NULL)
       return;
    if (!(png_ptr->mode & PNG_HAVE_IDAT))
       png_error(png_ptr, "No IDATs written into file");
 
-   /* see if user wants us to write information chunks */
+   /* See if user wants us to write information chunks */
    if (info_ptr != NULL)
    {
 #if defined(PNG_WRITE_TEXT_SUPPORTED)
-      int i; /* local index variable */
+      int i; /* Local index variable */
 #endif
 #if defined(PNG_WRITE_tIME_SUPPORTED)
-      /* check to see if user has supplied a time chunk */
+      /* Check to see if user has supplied a time chunk */
       if ((info_ptr->valid & PNG_INFO_tIME) &&
          !(png_ptr->mode & PNG_WROTE_tIME))
          png_write_tIME(png_ptr, &(info_ptr->mod_time));
 #endif
 #if defined(PNG_WRITE_TEXT_SUPPORTED)
-      /* loop through comment chunks */
+      /* Loop through comment chunks */
       for (i = 0; i < info_ptr->num_text; i++)
       {
-         png_debug2(2, "Writing trailer text chunk %d, type %d\n", i,
+         png_debug2(2, "Writing trailer text chunk %d, type %d", i,
             info_ptr->text[i].compression);
-         /* an internationalized chunk? */
+         /* An internationalized chunk? */
          if (info_ptr->text[i].compression > 0)
          {
 #if defined(PNG_WRITE_iTXt_SUPPORTED)
-             /* write international chunk */
+             /* Write international chunk */
              png_write_iTXt(png_ptr,
                          info_ptr->text[i].compression,
                          info_ptr->text[i].key,
@@ -340,7 +353,7 @@ png_write_end(png_structp png_ptr, png_infop info_ptr)
          else if (info_ptr->text[i].compression >= PNG_TEXT_COMPRESSION_zTXt)
          {
 #if defined(PNG_WRITE_zTXt_SUPPORTED)
-            /* write compressed chunk */
+            /* Write compressed chunk */
             png_write_zTXt(png_ptr, info_ptr->text[i].key,
                info_ptr->text[i].text, 0,
                info_ptr->text[i].compression);
@@ -353,7 +366,7 @@ png_write_end(png_structp png_ptr, png_infop info_ptr)
          else if (info_ptr->text[i].compression == PNG_TEXT_COMPRESSION_NONE)
          {
 #if defined(PNG_WRITE_tEXt_SUPPORTED)
-            /* write uncompressed chunk */
+            /* Write uncompressed chunk */
             png_write_tEXt(png_ptr, info_ptr->text[i].key,
                info_ptr->text[i].text, 0);
 #else
@@ -370,7 +383,7 @@ png_write_end(png_structp png_ptr, png_infop info_ptr)
    {
        png_unknown_chunk *up;
 
-       png_debug(5, "writing extra chunks\n");
+       png_debug(5, "writing extra chunks");
 
        for (up = info_ptr->unknown_chunks;
             up < info_ptr->unknown_chunks + info_ptr->unknown_chunks_num;
@@ -391,8 +404,20 @@ png_write_end(png_structp png_ptr, png_infop info_ptr)
 
    png_ptr->mode |= PNG_AFTER_IDAT;
 
-   /* write end of PNG file */
+   /* Write end of PNG file */
    png_write_IEND(png_ptr);
+   /* This flush, added in libpng-1.0.8, removed from libpng-1.0.9beta03,
+    * and restored again in libpng-1.2.30, may cause some applications that
+    * do not set png_ptr->output_flush_fn to crash.  If your application
+    * experiences a problem, please try building libpng with
+    * PNG_WRITE_FLUSH_AFTER_IEND_SUPPORTED defined, and report the event to
+    * png-mng-implement at lists.sf.net .  This kludge will be removed
+    * from libpng-1.4.0.
+    */
+#if defined(PNG_WRITE_FLUSH_SUPPORTED) && \
+    defined(PNG_WRITE_FLUSH_AFTER_IEND_SUPPORTED)
+   png_flush(png_ptr);
+#endif
 }
 
 #if defined(PNG_WRITE_tIME_SUPPORTED)
@@ -401,7 +426,7 @@ png_write_end(png_structp png_ptr, png_infop info_ptr)
 void PNGAPI
 png_convert_from_struct_tm(png_timep ptime, struct tm FAR * ttime)
 {
-   png_debug(1, "in png_convert_from_struct_tm\n");
+   png_debug(1, "in png_convert_from_struct_tm");
    ptime->year = (png_uint_16)(1900 + ttime->tm_year);
    ptime->month = (png_byte)(ttime->tm_mon + 1);
    ptime->day = (png_byte)ttime->tm_mday;
@@ -415,7 +440,7 @@ png_convert_from_time_t(png_timep ptime, time_t ttime)
 {
    struct tm *tbuf;
 
-   png_debug(1, "in png_convert_from_time_t\n");
+   png_debug(1, "in png_convert_from_time_t");
    tbuf = gmtime(&ttime);
    png_convert_from_struct_tm(ptime, tbuf);
 }
@@ -439,14 +464,17 @@ png_create_write_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
    png_malloc_ptr malloc_fn, png_free_ptr free_fn)
 {
 #endif /* PNG_USER_MEM_SUPPORTED */
-   png_structp png_ptr;
+#ifdef PNG_SETJMP_SUPPORTED
+    volatile
+#endif
+    png_structp png_ptr;
 #ifdef PNG_SETJMP_SUPPORTED
 #ifdef USE_FAR_KEYWORD
    jmp_buf jmpbuf;
 #endif
 #endif
    int i;
-   png_debug(1, "in png_create_write_struct\n");
+   png_debug(1, "in png_create_write_struct");
 #ifdef PNG_USER_MEM_SUPPORTED
    png_ptr = (png_structp)png_create_struct_2(PNG_STRUCT_PNG,
       (png_malloc_ptr)malloc_fn, (png_voidp)mem_ptr);
@@ -456,7 +484,7 @@ png_create_write_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
    if (png_ptr == NULL)
       return (NULL);
 
-   /* added at libpng-1.2.6 */
+   /* Added at libpng-1.2.6 */
 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
    png_ptr->user_width_max=PNG_USER_WIDTH_MAX;
    png_ptr->user_height_max=PNG_USER_HEIGHT_MAX;
@@ -470,12 +498,12 @@ png_create_write_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
 #endif
    {
       png_free(png_ptr, png_ptr->zbuf);
-      png_ptr->zbuf=NULL;
+       png_ptr->zbuf=NULL;
       png_destroy_struct(png_ptr);
       return (NULL);
    }
 #ifdef USE_FAR_KEYWORD
-   png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf));
+   png_memcpy(png_ptr->jmpbuf, jmpbuf, png_sizeof(jmp_buf));
 #endif
 #endif
 
@@ -484,12 +512,12 @@ png_create_write_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
 #endif /* PNG_USER_MEM_SUPPORTED */
    png_set_error_fn(png_ptr, error_ptr, error_fn, warn_fn);
 
-   if(user_png_ver)
+   if (user_png_ver)
    {
      i=0;
      do
      {
-       if(user_png_ver[i] != png_libpng_ver[i])
+       if (user_png_ver[i] != png_libpng_ver[i])
           png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;
      } while (png_libpng_ver[i++]);
    }
@@ -527,7 +555,7 @@ png_create_write_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
      }
    }
 
-   /* initialize zbuf - compression buffer */
+   /* Initialize zbuf - compression buffer */
    png_ptr->zbuf_size = PNG_ZBUF_SIZE;
    png_ptr->zbuf = (png_bytep)png_malloc(png_ptr,
       (png_uint_32)png_ptr->zbuf_size);
@@ -547,7 +575,7 @@ png_create_write_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
 #ifdef USE_FAR_KEYWORD
    if (setjmp(jmpbuf))
       PNG_ABORT();
-   png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf));
+   png_memcpy(png_ptr->jmpbuf, jmpbuf, png_sizeof(jmp_buf));
 #else
    if (setjmp(png_ptr->jmpbuf))
       PNG_ABORT();
@@ -572,9 +600,9 @@ png_write_init_2(png_structp png_ptr, png_const_charp user_png_ver,
    png_size_t png_struct_size, png_size_t png_info_size)
 {
    /* We only come here via pre-1.0.12-compiled applications */
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL) return;
 #if !defined(PNG_NO_STDIO) && !defined(_WIN32_WCE)
-   if(png_sizeof(png_struct) > png_struct_size ||
+   if (png_sizeof(png_struct) > png_struct_size ||
       png_sizeof(png_info) > png_info_size)
    {
       char msg[80];
@@ -592,7 +620,7 @@ png_write_init_2(png_structp png_ptr, png_const_charp user_png_ver,
       png_warning(png_ptr, msg);
    }
 #endif
-   if(png_sizeof(png_struct) > png_struct_size)
+   if (png_sizeof(png_struct) > png_struct_size)
      {
        png_ptr->error_fn=NULL;
 #ifdef PNG_ERROR_NUMBERS_SUPPORTED
@@ -601,7 +629,7 @@ png_write_init_2(png_structp png_ptr, png_const_charp user_png_ver,
        png_error(png_ptr,
        "The png struct allocated by the application for writing is too small.");
      }
-   if(png_sizeof(png_info) > png_info_size)
+   if (png_sizeof(png_info) > png_info_size)
      {
        png_ptr->error_fn=NULL;
 #ifdef PNG_ERROR_NUMBERS_SUPPORTED
@@ -621,7 +649,7 @@ png_write_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver,
 {
    png_structp png_ptr=*ptr_ptr;
 #ifdef PNG_SETJMP_SUPPORTED
-   jmp_buf tmp_jmp; /* to save current jump buffer */
+   jmp_buf tmp_jmp; /* To save current jump buffer */
 #endif
 
    int i = 0;
@@ -638,17 +666,17 @@ png_write_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver,
 #else
        png_ptr->warning_fn=NULL;
        png_warning(png_ptr,
-     "Application uses deprecated png_write_init() and should be recompiled.");
+ "Application uses deprecated png_write_init() and should be recompiled.");
        break;
 #endif
      }
    } while (png_libpng_ver[i++]);
 
-   png_debug(1, "in png_write_init_3\n");
+   png_debug(1, "in png_write_init_3");
 
 #ifdef PNG_SETJMP_SUPPORTED
-   /* save jump buffer and error functions */
-   png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf));
+   /* Save jump buffer and error functions */
+   png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof(jmp_buf));
 #endif
 
    if (png_sizeof(png_struct) > png_struct_size)
@@ -658,24 +686,24 @@ png_write_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver,
        *ptr_ptr = png_ptr;
      }
 
-   /* reset all variables to 0 */
-   png_memset(png_ptr, 0, png_sizeof (png_struct));
+   /* Reset all variables to 0 */
+   png_memset(png_ptr, 0, png_sizeof(png_struct));
 
-   /* added at libpng-1.2.6 */
+   /* Added at libpng-1.2.6 */
 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
    png_ptr->user_width_max=PNG_USER_WIDTH_MAX;
    png_ptr->user_height_max=PNG_USER_HEIGHT_MAX;
 #endif
 
 #ifdef PNG_SETJMP_SUPPORTED
-   /* restore jump buffer */
-   png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf));
+   /* Restore jump buffer */
+   png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof(jmp_buf));
 #endif
 
    png_set_write_fn(png_ptr, png_voidp_NULL, png_rw_ptr_NULL,
       png_flush_ptr_NULL);
 
-   /* initialize zbuf - compression buffer */
+   /* Initialize zbuf - compression buffer */
    png_ptr->zbuf_size = PNG_ZBUF_SIZE;
    png_ptr->zbuf = (png_bytep)png_malloc(png_ptr,
       (png_uint_32)png_ptr->zbuf_size);
@@ -695,15 +723,15 @@ void PNGAPI
 png_write_rows(png_structp png_ptr, png_bytepp row,
    png_uint_32 num_rows)
 {
-   png_uint_32 i; /* row counter */
-   png_bytepp rp; /* row pointer */
+   png_uint_32 i; /* Row counter */
+   png_bytepp rp; /* Row pointer */
 
-   png_debug(1, "in png_write_rows\n");
+   png_debug(1, "in png_write_rows");
 
    if (png_ptr == NULL)
       return;
 
-   /* loop through the rows */
+   /* Loop through the rows */
    for (i = 0, rp = row; i < num_rows; i++, rp++)
    {
       png_write_row(png_ptr, *rp);
@@ -716,25 +744,26 @@ png_write_rows(png_structp png_ptr, png_bytepp row,
 void PNGAPI
 png_write_image(png_structp png_ptr, png_bytepp image)
 {
-   png_uint_32 i; /* row index */
-   int pass, num_pass; /* pass variables */
-   png_bytepp rp; /* points to current row */
+   png_uint_32 i; /* Row index */
+   int pass, num_pass; /* Pass variables */
+   png_bytepp rp; /* Points to current row */
 
    if (png_ptr == NULL)
       return;
 
-   png_debug(1, "in png_write_image\n");
+   png_debug(1, "in png_write_image");
 #if defined(PNG_WRITE_INTERLACING_SUPPORTED)
-   /* intialize interlace handling.  If image is not interlaced,
-      this will set pass to 1 */
+   /* Initialize interlace handling.  If image is not interlaced,
+    * this will set pass to 1
+    */
    num_pass = png_set_interlace_handling(png_ptr);
 #else
    num_pass = 1;
 #endif
-   /* loop through passes */
+   /* Loop through passes */
    for (pass = 0; pass < num_pass; pass++)
    {
-      /* loop through image */
+      /* Loop through image */
       for (i = 0, rp = image; i < png_ptr->height; i++, rp++)
       {
          png_write_row(png_ptr, *rp);
@@ -742,58 +771,58 @@ png_write_image(png_structp png_ptr, png_bytepp image)
    }
 }
 
-/* called by user to write a row of image data */
+/* Called by user to write a row of image data */
 void PNGAPI
 png_write_row(png_structp png_ptr, png_bytep row)
 {
    if (png_ptr == NULL)
       return;
-   png_debug2(1, "in png_write_row (row %ld, pass %d)\n",
+   png_debug2(1, "in png_write_row (row %ld, pass %d)",
       png_ptr->row_number, png_ptr->pass);
 
-   /* initialize transformations and other stuff if first time */
+   /* Initialize transformations and other stuff if first time */
    if (png_ptr->row_number == 0 && png_ptr->pass == 0)
    {
-   /* make sure we wrote the header info */
-   if (!(png_ptr->mode & PNG_WROTE_INFO_BEFORE_PLTE))
-      png_error(png_ptr,
-         "png_write_info was never called before png_write_row.");
+      /* Make sure we wrote the header info */
+      if (!(png_ptr->mode & PNG_WROTE_INFO_BEFORE_PLTE))
+         png_error(png_ptr,
+            "png_write_info was never called before png_write_row.");
 
-   /* check for transforms that have been set but were defined out */
+      /* Check for transforms that have been set but were defined out */
 #if !defined(PNG_WRITE_INVERT_SUPPORTED) && defined(PNG_READ_INVERT_SUPPORTED)
-   if (png_ptr->transformations & PNG_INVERT_MONO)
-      png_warning(png_ptr, "PNG_WRITE_INVERT_SUPPORTED is not defined.");
+      if (png_ptr->transformations & PNG_INVERT_MONO)
+         png_warning(png_ptr, "PNG_WRITE_INVERT_SUPPORTED is not defined.");
 #endif
 #if !defined(PNG_WRITE_FILLER_SUPPORTED) && defined(PNG_READ_FILLER_SUPPORTED)
-   if (png_ptr->transformations & PNG_FILLER)
-      png_warning(png_ptr, "PNG_WRITE_FILLER_SUPPORTED is not defined.");
+      if (png_ptr->transformations & PNG_FILLER)
+         png_warning(png_ptr, "PNG_WRITE_FILLER_SUPPORTED is not defined.");
 #endif
 #if !defined(PNG_WRITE_PACKSWAP_SUPPORTED) && defined(PNG_READ_PACKSWAP_SUPPORTED)
-   if (png_ptr->transformations & PNG_PACKSWAP)
-      png_warning(png_ptr, "PNG_WRITE_PACKSWAP_SUPPORTED is not defined.");
+      if (png_ptr->transformations & PNG_PACKSWAP)
+         png_warning(png_ptr, "PNG_WRITE_PACKSWAP_SUPPORTED is not defined.");
 #endif
 #if !defined(PNG_WRITE_PACK_SUPPORTED) && defined(PNG_READ_PACK_SUPPORTED)
-   if (png_ptr->transformations & PNG_PACK)
-      png_warning(png_ptr, "PNG_WRITE_PACK_SUPPORTED is not defined.");
+      if (png_ptr->transformations & PNG_PACK)
+         png_warning(png_ptr, "PNG_WRITE_PACK_SUPPORTED is not defined.");
 #endif
 #if !defined(PNG_WRITE_SHIFT_SUPPORTED) && defined(PNG_READ_SHIFT_SUPPORTED)
-   if (png_ptr->transformations & PNG_SHIFT)
-      png_warning(png_ptr, "PNG_WRITE_SHIFT_SUPPORTED is not defined.");
+      if (png_ptr->transformations & PNG_SHIFT)
+         png_warning(png_ptr, "PNG_WRITE_SHIFT_SUPPORTED is not defined.");
 #endif
 #if !defined(PNG_WRITE_BGR_SUPPORTED) && defined(PNG_READ_BGR_SUPPORTED)
-   if (png_ptr->transformations & PNG_BGR)
-      png_warning(png_ptr, "PNG_WRITE_BGR_SUPPORTED is not defined.");
+      if (png_ptr->transformations & PNG_BGR)
+         png_warning(png_ptr, "PNG_WRITE_BGR_SUPPORTED is not defined.");
 #endif
 #if !defined(PNG_WRITE_SWAP_SUPPORTED) && defined(PNG_READ_SWAP_SUPPORTED)
-   if (png_ptr->transformations & PNG_SWAP_BYTES)
-      png_warning(png_ptr, "PNG_WRITE_SWAP_SUPPORTED is not defined.");
+      if (png_ptr->transformations & PNG_SWAP_BYTES)
+         png_warning(png_ptr, "PNG_WRITE_SWAP_SUPPORTED is not defined.");
 #endif
 
       png_write_start_row(png_ptr);
    }
 
 #if defined(PNG_WRITE_INTERLACING_SUPPORTED)
-   /* if interlaced and not interested in row, return */
+   /* If interlaced and not interested in row, return */
    if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE))
    {
       switch (png_ptr->pass)
@@ -851,7 +880,7 @@ png_write_row(png_structp png_ptr, png_bytep row)
    }
 #endif
 
-   /* set up row info for transformations */
+   /* Set up row info for transformations */
    png_ptr->row_info.color_type = png_ptr->color_type;
    png_ptr->row_info.width = png_ptr->usr_width;
    png_ptr->row_info.channels = png_ptr->usr_channels;
@@ -862,25 +891,25 @@ png_write_row(png_structp png_ptr, png_bytep row)
    png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth,
       png_ptr->row_info.width);
 
-   png_debug1(3, "row_info->color_type = %d\n", png_ptr->row_info.color_type);
-   png_debug1(3, "row_info->width = %lu\n", png_ptr->row_info.width);
-   png_debug1(3, "row_info->channels = %d\n", png_ptr->row_info.channels);
-   png_debug1(3, "row_info->bit_depth = %d\n", png_ptr->row_info.bit_depth);
-   png_debug1(3, "row_info->pixel_depth = %d\n", png_ptr->row_info.pixel_depth);
-   png_debug1(3, "row_info->rowbytes = %lu\n", png_ptr->row_info.rowbytes);
+   png_debug1(3, "row_info->color_type = %d", png_ptr->row_info.color_type);
+   png_debug1(3, "row_info->width = %lu", png_ptr->row_info.width);
+   png_debug1(3, "row_info->channels = %d", png_ptr->row_info.channels);
+   png_debug1(3, "row_info->bit_depth = %d", png_ptr->row_info.bit_depth);
+   png_debug1(3, "row_info->pixel_depth = %d", png_ptr->row_info.pixel_depth);
+   png_debug1(3, "row_info->rowbytes = %lu", png_ptr->row_info.rowbytes);
 
    /* Copy user's row into buffer, leaving room for filter byte. */
    png_memcpy_check(png_ptr, png_ptr->row_buf + 1, row,
       png_ptr->row_info.rowbytes);
 
 #if defined(PNG_WRITE_INTERLACING_SUPPORTED)
-   /* handle interlacing */
+   /* Handle interlacing */
    if (png_ptr->interlaced && png_ptr->pass < 6 &&
       (png_ptr->transformations & PNG_INTERLACE))
    {
       png_do_write_interlace(&(png_ptr->row_info),
          png_ptr->row_buf + 1, png_ptr->pass);
-      /* this should always get caught above, but still ... */
+      /* This should always get caught above, but still ... */
       if (!(png_ptr->row_info.width))
       {
          png_write_finish_row(png_ptr);
@@ -889,7 +918,7 @@ png_write_row(png_structp png_ptr, png_bytep row)
    }
 #endif
 
-   /* handle other transformations */
+   /* Handle other transformations */
    if (png_ptr->transformations)
       png_do_write_transformations(png_ptr);
 
@@ -903,7 +932,7 @@ png_write_row(png_structp png_ptr, png_bytep row)
     * 4. The filter_method is 64 and
     * 5. The color_type is RGB or RGBA
     */
-   if((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) &&
+   if ((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) &&
       (png_ptr->filter_type == PNG_INTRAPIXEL_DIFFERENCING))
    {
       /* Intrapixel differencing */
@@ -923,34 +952,34 @@ png_write_row(png_structp png_ptr, png_bytep row)
 void PNGAPI
 png_set_flush(png_structp png_ptr, int nrows)
 {
-   png_debug(1, "in png_set_flush\n");
+   png_debug(1, "in png_set_flush");
    if (png_ptr == NULL)
       return;
    png_ptr->flush_dist = (nrows < 0 ? 0 : nrows);
 }
 
-/* flush the current output buffers now */
+/* Flush the current output buffers now */
 void PNGAPI
 png_write_flush(png_structp png_ptr)
 {
    int wrote_IDAT;
 
-   png_debug(1, "in png_write_flush\n");
+   png_debug(1, "in png_write_flush");
    if (png_ptr == NULL)
       return;
    /* We have already written out all of the data */
    if (png_ptr->row_number >= png_ptr->num_rows)
-     return;
+      return;
 
    do
    {
       int ret;
 
-      /* compress the data */
+      /* Compress the data */
       ret = deflate(&png_ptr->zstream, Z_SYNC_FLUSH);
       wrote_IDAT = 0;
 
-      /* check for compression errors */
+      /* Check for compression errors */
       if (ret != Z_OK)
       {
          if (png_ptr->zstream.msg != NULL)
@@ -961,7 +990,7 @@ png_write_flush(png_structp png_ptr)
 
       if (!(png_ptr->zstream.avail_out))
       {
-         /* write the IDAT and reset the zlib output buffer */
+         /* Write the IDAT and reset the zlib output buffer */
          png_write_IDAT(png_ptr, png_ptr->zbuf,
                         png_ptr->zbuf_size);
          png_ptr->zstream.next_out = png_ptr->zbuf;
@@ -973,7 +1002,7 @@ png_write_flush(png_structp png_ptr)
    /* If there is any data left to be output, write it into a new IDAT */
    if (png_ptr->zbuf_size != png_ptr->zstream.avail_out)
    {
-      /* write the IDAT and reset the zlib output buffer */
+      /* Write the IDAT and reset the zlib output buffer */
       png_write_IDAT(png_ptr, png_ptr->zbuf,
                      png_ptr->zbuf_size - png_ptr->zstream.avail_out);
       png_ptr->zstream.next_out = png_ptr->zbuf;
@@ -984,7 +1013,7 @@ png_write_flush(png_structp png_ptr)
 }
 #endif /* PNG_WRITE_FLUSH_SUPPORTED */
 
-/* free all memory used by the write */
+/* Free all memory used by the write */
 void PNGAPI
 png_destroy_write_struct(png_structpp png_ptr_ptr, png_infopp info_ptr_ptr)
 {
@@ -995,7 +1024,7 @@ png_destroy_write_struct(png_structpp png_ptr_ptr, png_infopp info_ptr_ptr)
    png_voidp mem_ptr = NULL;
 #endif
 
-   png_debug(1, "in png_destroy_write_struct\n");
+   png_debug(1, "in png_destroy_write_struct");
    if (png_ptr_ptr != NULL)
    {
       png_ptr = *png_ptr_ptr;
@@ -1027,7 +1056,7 @@ png_destroy_write_struct(png_structpp png_ptr_ptr, png_infopp info_ptr_ptr)
         {
            png_free(png_ptr, png_ptr->chunk_list);
            png_ptr->chunk_list=NULL;
-           png_ptr->num_chunk_list=0;
+           png_ptr->num_chunk_list = 0;
         }
 #endif
       }
@@ -1060,7 +1089,7 @@ void /* PRIVATE */
 png_write_destroy(png_structp png_ptr)
 {
 #ifdef PNG_SETJMP_SUPPORTED
-   jmp_buf tmp_jmp; /* save jump buffer */
+   jmp_buf tmp_jmp; /* Save jump buffer */
 #endif
    png_error_ptr error_fn;
    png_error_ptr warning_fn;
@@ -1069,14 +1098,14 @@ png_write_destroy(png_structp png_ptr)
    png_free_ptr free_fn;
 #endif
 
-   png_debug(1, "in png_write_destroy\n");
-   /* free any memory zlib uses */
+   png_debug(1, "in png_write_destroy");
+   /* Free any memory zlib uses */
    deflateEnd(&png_ptr->zstream);
 
-   /* free our memory.  png_free checks NULL for us. */
+   /* Free our memory.  png_free checks NULL for us. */
    png_free(png_ptr, png_ptr->zbuf);
    png_free(png_ptr, png_ptr->row_buf);
-#ifndef PNG_NO_WRITE_FILTERING
+#ifndef PNG_NO_WRITE_FILTER
    png_free(png_ptr, png_ptr->prev_row);
    png_free(png_ptr, png_ptr->sub_row);
    png_free(png_ptr, png_ptr->up_row);
@@ -1097,8 +1126,8 @@ png_write_destroy(png_structp png_ptr)
 #endif
 
 #ifdef PNG_SETJMP_SUPPORTED
-   /* reset structure */
-   png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf));
+   /* Reset structure */
+   png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof(jmp_buf));
 #endif
 
    error_fn = png_ptr->error_fn;
@@ -1108,7 +1137,7 @@ png_write_destroy(png_structp png_ptr)
    free_fn = png_ptr->free_fn;
 #endif
 
-   png_memset(png_ptr, 0, png_sizeof (png_struct));
+   png_memset(png_ptr, 0, png_sizeof(png_struct));
 
    png_ptr->error_fn = error_fn;
    png_ptr->warning_fn = warning_fn;
@@ -1118,7 +1147,7 @@ png_write_destroy(png_structp png_ptr)
 #endif
 
 #ifdef PNG_SETJMP_SUPPORTED
-   png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf));
+   png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof(jmp_buf));
 #endif
 }
 
@@ -1126,11 +1155,11 @@ png_write_destroy(png_structp png_ptr)
 void PNGAPI
 png_set_filter(png_structp png_ptr, int method, int filters)
 {
-   png_debug(1, "in png_set_filter\n");
+   png_debug(1, "in png_set_filter");
    if (png_ptr == NULL)
       return;
 #if defined(PNG_MNG_FEATURES_SUPPORTED)
-   if((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) &&
+   if ((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) &&
       (method == PNG_INTRAPIXEL_DIFFERENCING))
          method = PNG_FILTER_TYPE_BASE;
 #endif
@@ -1249,7 +1278,7 @@ png_set_filter_heuristics(png_structp png_ptr, int heuristic_method,
 {
    int i;
 
-   png_debug(1, "in png_set_filter_heuristics\n");
+   png_debug(1, "in png_set_filter_heuristics");
    if (png_ptr == NULL)
       return;
    if (heuristic_method >= PNG_FILTER_HEURISTIC_LAST)
@@ -1363,7 +1392,7 @@ png_set_filter_heuristics(png_structp png_ptr, int heuristic_method,
 void PNGAPI
 png_set_compression_level(png_structp png_ptr, int level)
 {
-   png_debug(1, "in png_set_compression_level\n");
+   png_debug(1, "in png_set_compression_level");
    if (png_ptr == NULL)
       return;
    png_ptr->flags |= PNG_FLAG_ZLIB_CUSTOM_LEVEL;
@@ -1373,7 +1402,7 @@ png_set_compression_level(png_structp png_ptr, int level)
 void PNGAPI
 png_set_compression_mem_level(png_structp png_ptr, int mem_level)
 {
-   png_debug(1, "in png_set_compression_mem_level\n");
+   png_debug(1, "in png_set_compression_mem_level");
    if (png_ptr == NULL)
       return;
    png_ptr->flags |= PNG_FLAG_ZLIB_CUSTOM_MEM_LEVEL;
@@ -1383,7 +1412,7 @@ png_set_compression_mem_level(png_structp png_ptr, int mem_level)
 void PNGAPI
 png_set_compression_strategy(png_structp png_ptr, int strategy)
 {
-   png_debug(1, "in png_set_compression_strategy\n");
+   png_debug(1, "in png_set_compression_strategy");
    if (png_ptr == NULL)
       return;
    png_ptr->flags |= PNG_FLAG_ZLIB_CUSTOM_STRATEGY;
@@ -1400,7 +1429,7 @@ png_set_compression_window_bits(png_structp png_ptr, int window_bits)
    else if (window_bits < 8)
       png_warning(png_ptr, "Only compression windows >= 256 supported by PNG");
 #ifndef WBITS_8_OK
-   /* avoid libpng bug with 256-byte windows */
+   /* Avoid libpng bug with 256-byte windows */
    if (window_bits == 8)
      {
        png_warning(png_ptr, "Compression window is being reset to 512");
@@ -1414,7 +1443,7 @@ png_set_compression_window_bits(png_structp png_ptr, int window_bits)
 void PNGAPI
 png_set_compression_method(png_structp png_ptr, int method)
 {
-   png_debug(1, "in png_set_compression_method\n");
+   png_debug(1, "in png_set_compression_method");
    if (png_ptr == NULL)
       return;
    if (method != 8)
@@ -1436,7 +1465,7 @@ void PNGAPI
 png_set_write_user_transform_fn(png_structp png_ptr, png_user_transform_ptr
    write_user_transform_fn)
 {
-   png_debug(1, "in png_set_write_user_transform_fn\n");
+   png_debug(1, "in png_set_write_user_transform_fn");
    if (png_ptr == NULL)
       return;
    png_ptr->transformations |= PNG_USER_TRANSFORM;
@@ -1453,9 +1482,9 @@ png_write_png(png_structp png_ptr, png_infop info_ptr,
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 #if defined(PNG_WRITE_INVERT_ALPHA_SUPPORTED)
-   /* invert the alpha channel from opacity to transparency */
+   /* Invert the alpha channel from opacity to transparency */
    if (transforms & PNG_TRANSFORM_INVERT_ALPHA)
-       png_set_invert_alpha(png_ptr);
+      png_set_invert_alpha(png_ptr);
 #endif
 
    /* Write the file header information. */
@@ -1464,9 +1493,9 @@ png_write_png(png_structp png_ptr, png_infop info_ptr,
    /* ------ these transformations don't touch the info structure ------- */
 
 #if defined(PNG_WRITE_INVERT_SUPPORTED)
-   /* invert monochrome pixels */
+   /* Invert monochrome pixels */
    if (transforms & PNG_TRANSFORM_INVERT_MONO)
-       png_set_invert_mono(png_ptr);
+      png_set_invert_mono(png_ptr);
 #endif
 
 #if defined(PNG_WRITE_SHIFT_SUPPORTED)
@@ -1475,57 +1504,57 @@ png_write_png(png_structp png_ptr, png_infop info_ptr,
     */
    if ((transforms & PNG_TRANSFORM_SHIFT)
                && (info_ptr->valid & PNG_INFO_sBIT))
-       png_set_shift(png_ptr, &info_ptr->sig_bit);
+      png_set_shift(png_ptr, &info_ptr->sig_bit);
 #endif
 
 #if defined(PNG_WRITE_PACK_SUPPORTED)
-   /* pack pixels into bytes */
+   /* Pack pixels into bytes */
    if (transforms & PNG_TRANSFORM_PACKING)
        png_set_packing(png_ptr);
 #endif
 
 #if defined(PNG_WRITE_SWAP_ALPHA_SUPPORTED)
-   /* swap location of alpha bytes from ARGB to RGBA */
+   /* Swap location of alpha bytes from ARGB to RGBA */
    if (transforms & PNG_TRANSFORM_SWAP_ALPHA)
-       png_set_swap_alpha(png_ptr);
+      png_set_swap_alpha(png_ptr);
 #endif
 
 #if defined(PNG_WRITE_FILLER_SUPPORTED)
-   /* Get rid of filler (OR ALPHA) bytes, pack XRGB/RGBX/ARGB/RGBA into
-    * RGB (4 channels -> 3 channels). The second parameter is not used.
-    */
-   if (transforms & PNG_TRANSFORM_STRIP_FILLER)
-       png_set_filler(png_ptr, 0, PNG_FILLER_BEFORE);
+   /* Pack XRGB/RGBX/ARGB/RGBA into * RGB (4 channels -> 3 channels) */
+   if (transforms & PNG_TRANSFORM_STRIP_FILLER_AFTER)
+      png_set_filler(png_ptr, 0, PNG_FILLER_AFTER);
+   else if (transforms & PNG_TRANSFORM_STRIP_FILLER_BEFORE)
+      png_set_filler(png_ptr, 0, PNG_FILLER_BEFORE);
 #endif
 
 #if defined(PNG_WRITE_BGR_SUPPORTED)
-   /* flip BGR pixels to RGB */
+   /* Flip BGR pixels to RGB */
    if (transforms & PNG_TRANSFORM_BGR)
-       png_set_bgr(png_ptr);
+      png_set_bgr(png_ptr);
 #endif
 
 #if defined(PNG_WRITE_SWAP_SUPPORTED)
-   /* swap bytes of 16-bit files to most significant byte first */
+   /* Swap bytes of 16-bit files to most significant byte first */
    if (transforms & PNG_TRANSFORM_SWAP_ENDIAN)
-       png_set_swap(png_ptr);
+      png_set_swap(png_ptr);
 #endif
 
 #if defined(PNG_WRITE_PACKSWAP_SUPPORTED)
-   /* swap bits of 1, 2, 4 bit packed pixel formats */
+   /* Swap bits of 1, 2, 4 bit packed pixel formats */
    if (transforms & PNG_TRANSFORM_PACKSWAP)
-       png_set_packswap(png_ptr);
+      png_set_packswap(png_ptr);
 #endif
 
    /* ----------------------- end of transformations ------------------- */
 
-   /* write the bits */
+   /* Write the bits */
    if (info_ptr->valid & PNG_INFO_IDAT)
        png_write_image(png_ptr, info_ptr->row_pointers);
 
    /* It is REQUIRED to call this to finish writing the rest of the file */
    png_write_end(png_ptr, info_ptr);
 
-   transforms = transforms; /* quiet compiler warnings */
+   transforms = transforms; /* Quiet compiler warnings */
    params = params;
 }
 #endif
diff --git a/src/3rdparty/libpng/pngwtran.c b/src/3rdparty/libpng/pngwtran.c
index 0372fe656c..88a7d3cbf3 100644
--- a/src/3rdparty/libpng/pngwtran.c
+++ b/src/3rdparty/libpng/pngwtran.c
@@ -1,11 +1,14 @@
 
 /* pngwtran.c - transforms the data in a row for PNG writers
  *
- * Last changed in libpng 1.2.9 April 14, 2006
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2006 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.37 [June 4, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
+ *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
  */
 
 #define PNG_INTERNAL
@@ -18,15 +21,15 @@
 void /* PRIVATE */
 png_do_write_transformations(png_structp png_ptr)
 {
-   png_debug(1, "in png_do_write_transformations\n");
+   png_debug(1, "in png_do_write_transformations");
 
    if (png_ptr == NULL)
       return;
 
 #if defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED)
    if (png_ptr->transformations & PNG_USER_TRANSFORM)
-      if(png_ptr->write_user_transform_fn != NULL)
-        (*(png_ptr->write_user_transform_fn)) /* user write transform function */
+      if (png_ptr->write_user_transform_fn != NULL)
+        (*(png_ptr->write_user_transform_fn)) /* User write transform function */
           (png_ptr,                    /* png_ptr */
            &(png_ptr->row_info),       /* row_info:     */
              /*  png_uint_32 width;          width of row */
@@ -86,7 +89,7 @@ png_do_write_transformations(png_structp png_ptr)
 void /* PRIVATE */
 png_do_pack(png_row_infop row_info, png_bytep row, png_uint_32 bit_depth)
 {
-   png_debug(1, "in png_do_pack\n");
+   png_debug(1, "in png_do_pack");
    if (row_info->bit_depth == 8 &&
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
        row != NULL && row_info != NULL &&
@@ -212,7 +215,7 @@ png_do_pack(png_row_infop row_info, png_bytep row, png_uint_32 bit_depth)
 void /* PRIVATE */
 png_do_shift(png_row_infop row_info, png_bytep row, png_color_8p bit_depth)
 {
-   png_debug(1, "in png_do_shift\n");
+   png_debug(1, "in png_do_shift");
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
    if (row != NULL && row_info != NULL &&
 #else
@@ -248,7 +251,7 @@ png_do_shift(png_row_infop row_info, png_bytep row, png_color_8p bit_depth)
          channels++;
       }
 
-      /* with low row depths, could only be grayscale, so one channel */
+      /* With low row depths, could only be grayscale, so one channel */
       if (row_info->bit_depth < 8)
       {
          png_bytep bp = row;
@@ -336,7 +339,7 @@ png_do_shift(png_row_infop row_info, png_bytep row, png_color_8p bit_depth)
 void /* PRIVATE */
 png_do_write_swap_alpha(png_row_infop row_info, png_bytep row)
 {
-   png_debug(1, "in png_do_write_swap_alpha\n");
+   png_debug(1, "in png_do_write_swap_alpha");
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
    if (row != NULL && row_info != NULL)
 #endif
@@ -424,7 +427,7 @@ png_do_write_swap_alpha(png_row_infop row_info, png_bytep row)
 void /* PRIVATE */
 png_do_write_invert_alpha(png_row_infop row_info, png_bytep row)
 {
-   png_debug(1, "in png_do_write_invert_alpha\n");
+   png_debug(1, "in png_do_write_invert_alpha");
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
    if (row != NULL && row_info != NULL)
 #endif
@@ -439,7 +442,7 @@ png_do_write_invert_alpha(png_row_infop row_info, png_bytep row)
             png_uint_32 row_width = row_info->width;
             for (i = 0, sp = dp = row; i < row_width; i++)
             {
-               /* does nothing
+               /* Does nothing
                *(dp++) = *(sp++);
                *(dp++) = *(sp++);
                *(dp++) = *(sp++);
@@ -457,7 +460,7 @@ png_do_write_invert_alpha(png_row_infop row_info, png_bytep row)
 
             for (i = 0, sp = dp = row; i < row_width; i++)
             {
-               /* does nothing
+               /* Does nothing
                *(dp++) = *(sp++);
                *(dp++) = *(sp++);
                *(dp++) = *(sp++);
@@ -495,7 +498,7 @@ png_do_write_invert_alpha(png_row_infop row_info, png_bytep row)
 
             for (i = 0, sp = dp = row; i < row_width; i++)
             {
-               /* does nothing
+               /* Does nothing
                *(dp++) = *(sp++);
                *(dp++) = *(sp++);
                */
@@ -510,11 +513,11 @@ png_do_write_invert_alpha(png_row_infop row_info, png_bytep row)
 #endif
 
 #if defined(PNG_MNG_FEATURES_SUPPORTED)
-/* undoes intrapixel differencing  */
+/* Undoes intrapixel differencing  */
 void /* PRIVATE */
 png_do_write_intrapixel(png_row_infop row_info, png_bytep row)
 {
-   png_debug(1, "in png_do_write_intrapixel\n");
+   png_debug(1, "in png_do_write_intrapixel");
    if (
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
        row != NULL && row_info != NULL &&
@@ -558,8 +561,8 @@ png_do_write_intrapixel(png_row_infop row_info, png_bytep row)
             png_uint_32 s0   = (*(rp  ) << 8) | *(rp+1);
             png_uint_32 s1   = (*(rp+2) << 8) | *(rp+3);
             png_uint_32 s2   = (*(rp+4) << 8) | *(rp+5);
-            png_uint_32 red  = (png_uint_32)((s0-s1) & 0xffffL);
-            png_uint_32 blue = (png_uint_32)((s2-s1) & 0xffffL);
+            png_uint_32 red  = (png_uint_32)((s0 - s1) & 0xffffL);
+            png_uint_32 blue = (png_uint_32)((s2 - s1) & 0xffffL);
             *(rp  ) = (png_byte)((red >> 8) & 0xff);
             *(rp+1) = (png_byte)(red & 0xff);
             *(rp+4) = (png_byte)((blue >> 8) & 0xff);
diff --git a/src/3rdparty/libpng/pngwutil.c b/src/3rdparty/libpng/pngwutil.c
index 0774080b4d..f52495c072 100644
--- a/src/3rdparty/libpng/pngwutil.c
+++ b/src/3rdparty/libpng/pngwutil.c
@@ -1,11 +1,14 @@
 
 /* pngwutil.c - utilities to write a PNG file
  *
- * Last changed in libpng 1.2.27 [April 29, 2008]
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.40 [September 10, 2009]
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
+ *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
  */
 
 #define PNG_INTERNAL
@@ -49,6 +52,24 @@ png_save_uint_16(png_bytep buf, unsigned int i)
    buf[1] = (png_byte)(i & 0xff);
 }
 
+/* Simple function to write the signature.  If we have already written
+ * the magic bytes of the signature, or more likely, the PNG stream is
+ * being embedded into another stream and doesn't need its own signature,
+ * we should call png_set_sig_bytes() to tell libpng how many of the
+ * bytes have already been written.
+ */
+void /* PRIVATE */
+png_write_sig(png_structp png_ptr)
+{
+   png_byte png_signature[8] = {137, 80, 78, 71, 13, 10, 26, 10};
+
+   /* Write the rest of the 8 byte signature */
+   png_write_data(png_ptr, &png_signature[png_ptr->sig_bytes],
+      (png_size_t)(8 - png_ptr->sig_bytes));
+   if (png_ptr->sig_bytes < 3)
+      png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
+}
+
 /* Write a PNG chunk all at once.  The type is an array of ASCII characters
  * representing the chunk name.  The array must be at least 4 bytes in
  * length, and does not need to be null terminated.  To be safe, pass the
@@ -62,9 +83,10 @@ void PNGAPI
 png_write_chunk(png_structp png_ptr, png_bytep chunk_name,
    png_bytep data, png_size_t length)
 {
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
    png_write_chunk_start(png_ptr, chunk_name, (png_uint_32)length);
-   png_write_chunk_data(png_ptr, data, length);
+   png_write_chunk_data(png_ptr, data, (png_size_t)length);
    png_write_chunk_end(png_ptr);
 }
 
@@ -76,17 +98,21 @@ void PNGAPI
 png_write_chunk_start(png_structp png_ptr, png_bytep chunk_name,
    png_uint_32 length)
 {
-   png_byte buf[4];
-   png_debug2(0, "Writing %s chunk (%lu bytes)\n", chunk_name, length);
-   if(png_ptr == NULL) return;
+   png_byte buf[8];
 
-   /* write the length */
-   png_save_uint_32(buf, length);
-   png_write_data(png_ptr, buf, (png_size_t)4);
+   png_debug2(0, "Writing %s chunk, length = %lu", chunk_name,
+      (unsigned long)length);
 
-   /* write the chunk name */
-   png_write_data(png_ptr, chunk_name, (png_size_t)4);
-   /* reset the crc and run it over the chunk name */
+   if (png_ptr == NULL)
+      return;
+
+   /* Write the length and the chunk name */
+   png_save_uint_32(buf, length);
+   png_memcpy(buf + 4, chunk_name, 4);
+   png_write_data(png_ptr, buf, (png_size_t)8);
+   /* Put the chunk name into png_ptr->chunk_name */
+   png_memcpy(png_ptr->chunk_name, chunk_name, 4);
+   /* Reset the crc and run it over the chunk name */
    png_reset_crc(png_ptr);
    png_calculate_crc(png_ptr, chunk_name, (png_size_t)4);
 }
@@ -99,12 +125,16 @@ png_write_chunk_start(png_structp png_ptr, png_bytep chunk_name,
 void PNGAPI
 png_write_chunk_data(png_structp png_ptr, png_bytep data, png_size_t length)
 {
-   /* write the data, and run the CRC over it */
-   if(png_ptr == NULL) return;
+   /* Write the data, and run the CRC over it */
+   if (png_ptr == NULL)
+      return;
    if (data != NULL && length > 0)
    {
-      png_calculate_crc(png_ptr, data, length);
       png_write_data(png_ptr, data, length);
+      /* Update the CRC after writing the data,
+       * in case that the user I/O routine alters it.
+       */
+      png_calculate_crc(png_ptr, data, length);
    }
 }
 
@@ -114,34 +144,16 @@ png_write_chunk_end(png_structp png_ptr)
 {
    png_byte buf[4];
 
-   if(png_ptr == NULL) return;
+   if (png_ptr == NULL) return;
 
-   /* write the crc */
+   /* Write the crc in a single operation */
    png_save_uint_32(buf, png_ptr->crc);
 
    png_write_data(png_ptr, buf, (png_size_t)4);
 }
 
-/* Simple function to write the signature.  If we have already written
- * the magic bytes of the signature, or more likely, the PNG stream is
- * being embedded into another stream and doesn't need its own signature,
- * we should call png_set_sig_bytes() to tell libpng how many of the
- * bytes have already been written.
- */
-void /* PRIVATE */
-png_write_sig(png_structp png_ptr)
-{
-   png_byte png_signature[8] = {137, 80, 78, 71, 13, 10, 26, 10};
-   /* write the rest of the 8 byte signature */
-   png_write_data(png_ptr, &png_signature[png_ptr->sig_bytes],
-      (png_size_t)8 - png_ptr->sig_bytes);
-   if(png_ptr->sig_bytes < 3)
-      png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
-}
-
 #if defined(PNG_WRITE_TEXT_SUPPORTED) || defined(PNG_WRITE_iCCP_SUPPORTED)
-/*
- * This pair of functions encapsulates the operation of (a) compressing a
+/* This pair of functions encapsulates the operation of (a) compressing a
  * text string, and (b) issuing it later as a series of chunk data writes.
  * The compression_state structure is shared context for these functions
  * set up by the caller in order to make the whole mess thread-safe.
@@ -149,14 +161,14 @@ png_write_sig(png_structp png_ptr)
 
 typedef struct
 {
-    char *input;   /* the uncompressed input data */
-    int input_len;   /* its length */
-    int num_output_ptr; /* number of output pointers used */
-    int max_output_ptr; /* size of output_ptr */
-    png_charpp output_ptr; /* array of pointers to output */
+   char *input;   /* The uncompressed input data */
+   int input_len;   /* Its length */
+   int num_output_ptr; /* Number of output pointers used */
+   int max_output_ptr; /* Size of output_ptr */
+   png_charpp output_ptr; /* Array of pointers to output */
 } compression_state;
 
-/* compress given text into storage in the png_ptr structure */
+/* Compress given text into storage in the png_ptr structure */
 static int /* PRIVATE */
 png_text_compress(png_structp png_ptr,
         png_charp text, png_size_t text_len, int compression,
@@ -170,7 +182,7 @@ png_text_compress(png_structp png_ptr,
    comp->input = NULL;
    comp->input_len = 0;
 
-   /* we may just want to pass the text right through */
+   /* We may just want to pass the text right through */
    if (compression == PNG_TEXT_COMPRESSION_NONE)
    {
        comp->input = text;
@@ -204,29 +216,29 @@ png_text_compress(png_structp png_ptr,
     * wouldn't cause a failure, just a slowdown due to swapping).
     */
 
-   /* set up the compression buffers */
+   /* Set up the compression buffers */
    png_ptr->zstream.avail_in = (uInt)text_len;
    png_ptr->zstream.next_in = (Bytef *)text;
    png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
    png_ptr->zstream.next_out = (Bytef *)png_ptr->zbuf;
 
-   /* this is the same compression loop as in png_write_row() */
+   /* This is the same compression loop as in png_write_row() */
    do
    {
-      /* compress the data */
+      /* Compress the data */
       ret = deflate(&png_ptr->zstream, Z_NO_FLUSH);
       if (ret != Z_OK)
       {
-         /* error */
+         /* Error */
          if (png_ptr->zstream.msg != NULL)
             png_error(png_ptr, png_ptr->zstream.msg);
          else
             png_error(png_ptr, "zlib error");
       }
-      /* check to see if we need more room */
+      /* Check to see if we need more room */
       if (!(png_ptr->zstream.avail_out))
       {
-         /* make sure the output array has room */
+         /* Make sure the output array has room */
          if (comp->num_output_ptr >= comp->max_output_ptr)
          {
             int old_max;
@@ -239,20 +251,21 @@ png_text_compress(png_structp png_ptr,
 
                old_ptr = comp->output_ptr;
                comp->output_ptr = (png_charpp)png_malloc(png_ptr,
-                  (png_uint_32)(comp->max_output_ptr *
-                  png_sizeof (png_charpp)));
+                  (png_uint_32)
+                  (comp->max_output_ptr * png_sizeof(png_charpp)));
                png_memcpy(comp->output_ptr, old_ptr, old_max
-                  * png_sizeof (png_charp));
+                  * png_sizeof(png_charp));
                png_free(png_ptr, old_ptr);
             }
             else
                comp->output_ptr = (png_charpp)png_malloc(png_ptr,
-                  (png_uint_32)(comp->max_output_ptr *
-                  png_sizeof (png_charp)));
+                  (png_uint_32)
+                  (comp->max_output_ptr * png_sizeof(png_charp)));
          }
 
-         /* save the data */
-         comp->output_ptr[comp->num_output_ptr] = (png_charp)png_malloc(png_ptr,
+         /* Save the data */
+         comp->output_ptr[comp->num_output_ptr] =
+            (png_charp)png_malloc(png_ptr,
             (png_uint_32)png_ptr->zbuf_size);
          png_memcpy(comp->output_ptr[comp->num_output_ptr], png_ptr->zbuf,
             png_ptr->zbuf_size);
@@ -262,21 +275,21 @@ png_text_compress(png_structp png_ptr,
          png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
          png_ptr->zstream.next_out = png_ptr->zbuf;
       }
-   /* continue until we don't have any more to compress */
+   /* Continue until we don't have any more to compress */
    } while (png_ptr->zstream.avail_in);
 
-   /* finish the compression */
+   /* Finish the compression */
    do
    {
-      /* tell zlib we are finished */
+      /* Tell zlib we are finished */
       ret = deflate(&png_ptr->zstream, Z_FINISH);
 
       if (ret == Z_OK)
       {
-         /* check to see if we need more room */
+         /* Check to see if we need more room */
          if (!(png_ptr->zstream.avail_out))
          {
-            /* check to make sure our output array has room */
+            /* Check to make sure our output array has room */
             if (comp->num_output_ptr >= comp->max_output_ptr)
             {
                int old_max;
@@ -291,20 +304,21 @@ png_text_compress(png_structp png_ptr,
                   /* This could be optimized to realloc() */
                   comp->output_ptr = (png_charpp)png_malloc(png_ptr,
                      (png_uint_32)(comp->max_output_ptr *
-                     png_sizeof (png_charpp)));
+                     png_sizeof(png_charp)));
                   png_memcpy(comp->output_ptr, old_ptr,
-                     old_max * png_sizeof (png_charp));
+                     old_max * png_sizeof(png_charp));
                   png_free(png_ptr, old_ptr);
                }
                else
                   comp->output_ptr = (png_charpp)png_malloc(png_ptr,
                      (png_uint_32)(comp->max_output_ptr *
-                     png_sizeof (png_charp)));
+                     png_sizeof(png_charp)));
             }
 
-            /* save off the data */
+            /* Save the data */
             comp->output_ptr[comp->num_output_ptr] =
-               (png_charp)png_malloc(png_ptr, (png_uint_32)png_ptr->zbuf_size);
+               (png_charp)png_malloc(png_ptr,
+               (png_uint_32)png_ptr->zbuf_size);
             png_memcpy(comp->output_ptr[comp->num_output_ptr], png_ptr->zbuf,
                png_ptr->zbuf_size);
             comp->num_output_ptr++;
@@ -316,7 +330,7 @@ png_text_compress(png_structp png_ptr,
       }
       else if (ret != Z_STREAM_END)
       {
-         /* we got an error */
+         /* We got an error */
          if (png_ptr->zstream.msg != NULL)
             png_error(png_ptr, png_ptr->zstream.msg);
          else
@@ -324,7 +338,7 @@ png_text_compress(png_structp png_ptr,
       }
    } while (ret != Z_STREAM_END);
 
-   /* text length is number of buffers plus last buffer */
+   /* Text length is number of buffers plus last buffer */
    text_len = png_ptr->zbuf_size * comp->num_output_ptr;
    if (png_ptr->zstream.avail_out < png_ptr->zbuf_size)
       text_len += png_ptr->zbuf_size - (png_size_t)png_ptr->zstream.avail_out;
@@ -332,37 +346,37 @@ png_text_compress(png_structp png_ptr,
    return((int)text_len);
 }
 
-/* ship the compressed text out via chunk writes */
+/* Ship the compressed text out via chunk writes */
 static void /* PRIVATE */
 png_write_compressed_data_out(png_structp png_ptr, compression_state *comp)
 {
    int i;
 
-   /* handle the no-compression case */
+   /* Handle the no-compression case */
    if (comp->input)
    {
-       png_write_chunk_data(png_ptr, (png_bytep)comp->input,
+      png_write_chunk_data(png_ptr, (png_bytep)comp->input,
                             (png_size_t)comp->input_len);
-       return;
+      return;
    }
 
-   /* write saved output buffers, if any */
+   /* Write saved output buffers, if any */
    for (i = 0; i < comp->num_output_ptr; i++)
    {
-      png_write_chunk_data(png_ptr,(png_bytep)comp->output_ptr[i],
-         png_ptr->zbuf_size);
+      png_write_chunk_data(png_ptr, (png_bytep)comp->output_ptr[i],
+         (png_size_t)png_ptr->zbuf_size);
       png_free(png_ptr, comp->output_ptr[i]);
-      comp->output_ptr[i]=NULL;
+       comp->output_ptr[i]=NULL;
    }
    if (comp->max_output_ptr != 0)
       png_free(png_ptr, comp->output_ptr);
-      comp->output_ptr=NULL;
-   /* write anything left in zbuf */
+       comp->output_ptr=NULL;
+   /* Write anything left in zbuf */
    if (png_ptr->zstream.avail_out < (png_uint_32)png_ptr->zbuf_size)
       png_write_chunk_data(png_ptr, png_ptr->zbuf,
-         png_ptr->zbuf_size - png_ptr->zstream.avail_out);
+         (png_size_t)(png_ptr->zbuf_size - png_ptr->zstream.avail_out));
 
-   /* reset zlib for another zTXt/iTXt or image data */
+   /* Reset zlib for another zTXt/iTXt or image data */
    deflateReset(&png_ptr->zstream);
    png_ptr->zstream.data_type = Z_BINARY;
 }
@@ -382,9 +396,10 @@ png_write_IHDR(png_structp png_ptr, png_uint_32 width, png_uint_32 height,
 #endif
    int ret;
 
-   png_byte buf[13]; /* buffer to store the IHDR info */
+   png_byte buf[13]; /* Buffer to store the IHDR info */
+
+   png_debug(1, "in png_write_IHDR");
 
-   png_debug(1, "in png_write_IHDR\n");
    /* Check that we have valid input data from the application info */
    switch (color_type)
    {
@@ -396,7 +411,7 @@ png_write_IHDR(png_structp png_ptr, png_uint_32 width, png_uint_32 height,
             case 4:
             case 8:
             case 16: png_ptr->channels = 1; break;
-            default: png_error(png_ptr,"Invalid bit depth for grayscale image");
+            default: png_error(png_ptr, "Invalid bit depth for grayscale image");
          }
          break;
       case PNG_COLOR_TYPE_RGB:
@@ -468,7 +483,7 @@ png_write_IHDR(png_structp png_ptr, png_uint_32 width, png_uint_32 height,
    interlace_type=PNG_INTERLACE_NONE;
 #endif
 
-   /* save off the relevent information */
+   /* Save the relevent information */
    png_ptr->bit_depth = (png_byte)bit_depth;
    png_ptr->color_type = (png_byte)color_type;
    png_ptr->interlaced = (png_byte)interlace_type;
@@ -481,12 +496,12 @@ png_write_IHDR(png_structp png_ptr, png_uint_32 width, png_uint_32 height,
 
    png_ptr->pixel_depth = (png_byte)(bit_depth * png_ptr->channels);
    png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, width);
-   /* set the usr info, so any transformations can modify it */
+   /* Set the usr info, so any transformations can modify it */
    png_ptr->usr_width = png_ptr->width;
    png_ptr->usr_bit_depth = png_ptr->bit_depth;
    png_ptr->usr_channels = png_ptr->channels;
 
-   /* pack the header information into the buffer */
+   /* Pack the header information into the buffer */
    png_save_uint_32(buf, width);
    png_save_uint_32(buf + 4, height);
    buf[8] = (png_byte)bit_depth;
@@ -495,10 +510,10 @@ png_write_IHDR(png_structp png_ptr, png_uint_32 width, png_uint_32 height,
    buf[11] = (png_byte)filter_type;
    buf[12] = (png_byte)interlace_type;
 
-   /* write the chunk */
-   png_write_chunk(png_ptr, png_IHDR, buf, (png_size_t)13);
+   /* Write the chunk */
+   png_write_chunk(png_ptr, (png_bytep)png_IHDR, buf, (png_size_t)13);
 
-   /* initialize zlib with PNG info */
+   /* Initialize zlib with PNG info */
    png_ptr->zstream.zalloc = png_zalloc;
    png_ptr->zstream.zfree = png_zfree;
    png_ptr->zstream.opaque = (voidpf)png_ptr;
@@ -541,13 +556,13 @@ png_write_IHDR(png_structp png_ptr, png_uint_32 width, png_uint_32 height,
    png_ptr->zstream.next_out = png_ptr->zbuf;
    png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
    /* libpng is not interested in zstream.data_type */
-   /* set it to a predefined value, to avoid its evaluation inside zlib */
+   /* Set it to a predefined value, to avoid its evaluation inside zlib */
    png_ptr->zstream.data_type = Z_BINARY;
 
    png_ptr->mode = PNG_HAVE_IHDR;
 }
 
-/* write the palette.  We are careful not to trust png_color to be in the
+/* Write the palette.  We are careful not to trust png_color to be in the
  * correct order for PNG, so people can redefine it to any convenient
  * structure.
  */
@@ -561,7 +576,8 @@ png_write_PLTE(png_structp png_ptr, png_colorp palette, png_uint_32 num_pal)
    png_colorp pal_ptr;
    png_byte buf[3];
 
-   png_debug(1, "in png_write_PLTE\n");
+   png_debug(1, "in png_write_PLTE");
+
    if ((
 #if defined(PNG_MNG_FEATURES_SUPPORTED)
         !(png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) &&
@@ -587,9 +603,10 @@ png_write_PLTE(png_structp png_ptr, png_colorp palette, png_uint_32 num_pal)
    }
 
    png_ptr->num_palette = (png_uint_16)num_pal;
-   png_debug1(3, "num_palette = %d\n", png_ptr->num_palette);
+   png_debug1(3, "num_palette = %d", png_ptr->num_palette);
 
-   png_write_chunk_start(png_ptr, png_PLTE, num_pal * 3);
+   png_write_chunk_start(png_ptr, (png_bytep)png_PLTE,
+     (png_uint_32)(num_pal * 3));
 #ifndef PNG_NO_POINTER_INDEXING
    for (i = 0, pal_ptr = palette; i < num_pal; i++, pal_ptr++)
    {
@@ -613,14 +630,15 @@ png_write_PLTE(png_structp png_ptr, png_colorp palette, png_uint_32 num_pal)
    png_ptr->mode |= PNG_HAVE_PLTE;
 }
 
-/* write an IDAT chunk */
+/* Write an IDAT chunk */
 void /* PRIVATE */
 png_write_IDAT(png_structp png_ptr, png_bytep data, png_size_t length)
 {
 #ifdef PNG_USE_LOCAL_ARRAYS
    PNG_IDAT;
 #endif
-   png_debug(1, "in png_write_IDAT\n");
+
+   png_debug(1, "in png_write_IDAT");
 
    /* Optimize the CMF field in the zlib stream. */
    /* This hack of the zlib stream is compliant to the stream specification. */
@@ -630,9 +648,11 @@ png_write_IDAT(png_structp png_ptr, png_bytep data, png_size_t length)
       unsigned int z_cmf = data[0];  /* zlib compression method and flags */
       if ((z_cmf & 0x0f) == 8 && (z_cmf & 0xf0) <= 0x70)
       {
-         /* Avoid memory underflows and multiplication overflows. */
-         /* The conditions below are practically always satisfied;
-            however, they still must be checked. */
+         /* Avoid memory underflows and multiplication overflows.
+          *
+          * The conditions below are practically always satisfied;
+          * however, they still must be checked.
+          */
          if (length >= 2 &&
              png_ptr->height < 16384 && png_ptr->width < 16384)
          {
@@ -661,25 +681,27 @@ png_write_IDAT(png_structp png_ptr, png_bytep data, png_size_t length)
             "Invalid zlib compression method or flags in IDAT");
    }
 
-   png_write_chunk(png_ptr, png_IDAT, data, length);
+   png_write_chunk(png_ptr, (png_bytep)png_IDAT, data, length);
    png_ptr->mode |= PNG_HAVE_IDAT;
 }
 
-/* write an IEND chunk */
+/* Write an IEND chunk */
 void /* PRIVATE */
 png_write_IEND(png_structp png_ptr)
 {
 #ifdef PNG_USE_LOCAL_ARRAYS
    PNG_IEND;
 #endif
-   png_debug(1, "in png_write_IEND\n");
-   png_write_chunk(png_ptr, png_IEND, png_bytep_NULL,
+
+   png_debug(1, "in png_write_IEND");
+
+   png_write_chunk(png_ptr, (png_bytep)png_IEND, png_bytep_NULL,
      (png_size_t)0);
    png_ptr->mode |= PNG_HAVE_IEND;
 }
 
 #if defined(PNG_WRITE_gAMA_SUPPORTED)
-/* write a gAMA chunk */
+/* Write a gAMA chunk */
 #ifdef PNG_FLOATING_POINT_SUPPORTED
 void /* PRIVATE */
 png_write_gAMA(png_structp png_ptr, double file_gamma)
@@ -690,11 +712,12 @@ png_write_gAMA(png_structp png_ptr, double file_gamma)
    png_uint_32 igamma;
    png_byte buf[4];
 
-   png_debug(1, "in png_write_gAMA\n");
+   png_debug(1, "in png_write_gAMA");
+
    /* file_gamma is saved in 1/100,000ths */
    igamma = (png_uint_32)(file_gamma * 100000.0 + 0.5);
    png_save_uint_32(buf, igamma);
-   png_write_chunk(png_ptr, png_gAMA, buf, (png_size_t)4);
+   png_write_chunk(png_ptr, (png_bytep)png_gAMA, buf, (png_size_t)4);
 }
 #endif
 #ifdef PNG_FIXED_POINT_SUPPORTED
@@ -706,16 +729,17 @@ png_write_gAMA_fixed(png_structp png_ptr, png_fixed_point file_gamma)
 #endif
    png_byte buf[4];
 
-   png_debug(1, "in png_write_gAMA\n");
+   png_debug(1, "in png_write_gAMA");
+
    /* file_gamma is saved in 1/100,000ths */
    png_save_uint_32(buf, (png_uint_32)file_gamma);
-   png_write_chunk(png_ptr, png_gAMA, buf, (png_size_t)4);
+   png_write_chunk(png_ptr, (png_bytep)png_gAMA, buf, (png_size_t)4);
 }
 #endif
 #endif
 
 #if defined(PNG_WRITE_sRGB_SUPPORTED)
-/* write a sRGB chunk */
+/* Write a sRGB chunk */
 void /* PRIVATE */
 png_write_sRGB(png_structp png_ptr, int srgb_intent)
 {
@@ -724,17 +748,18 @@ png_write_sRGB(png_structp png_ptr, int srgb_intent)
 #endif
    png_byte buf[1];
 
-   png_debug(1, "in png_write_sRGB\n");
-   if(srgb_intent >= PNG_sRGB_INTENT_LAST)
+   png_debug(1, "in png_write_sRGB");
+
+   if (srgb_intent >= PNG_sRGB_INTENT_LAST)
          png_warning(png_ptr,
             "Invalid sRGB rendering intent specified");
    buf[0]=(png_byte)srgb_intent;
-   png_write_chunk(png_ptr, png_sRGB, buf, (png_size_t)1);
+   png_write_chunk(png_ptr, (png_bytep)png_sRGB, buf, (png_size_t)1);
 }
 #endif
 
 #if defined(PNG_WRITE_iCCP_SUPPORTED)
-/* write an iCCP chunk */
+/* Write an iCCP chunk */
 void /* PRIVATE */
 png_write_iCCP(png_structp png_ptr, png_charp name, int compression_type,
    png_charp profile, int profile_len)
@@ -747,7 +772,7 @@ png_write_iCCP(png_structp png_ptr, png_charp name, int compression_type,
    compression_state comp;
    int embedded_profile_len = 0;
 
-   png_debug(1, "in png_write_iCCP\n");
+   png_debug(1, "in png_write_iCCP");
 
    comp.num_output_ptr = 0;
    comp.max_output_ptr = 0;
@@ -755,12 +780,9 @@ png_write_iCCP(png_structp png_ptr, png_charp name, int compression_type,
    comp.input = NULL;
    comp.input_len = 0;
 
-   if (name == NULL || (name_len = png_check_keyword(png_ptr, name,
+   if ((name_len = png_check_keyword(png_ptr, name,
       &new_name)) == 0)
-   {
-      png_warning(png_ptr, "Empty keyword in iCCP chunk");
       return;
-   }
 
    if (compression_type != PNG_COMPRESSION_TYPE_BASE)
       png_warning(png_ptr, "Unknown compression type in iCCP chunk");
@@ -770,34 +792,44 @@ png_write_iCCP(png_structp png_ptr, png_charp name, int compression_type,
 
    if (profile_len > 3)
       embedded_profile_len =
-          ((*( (png_bytep)profile  ))<<24) |
-          ((*( (png_bytep)profile+1))<<16) |
-          ((*( (png_bytep)profile+2))<< 8) |
-          ((*( (png_bytep)profile+3))    );
+          ((*( (png_bytep)profile    ))<<24) |
+          ((*( (png_bytep)profile + 1))<<16) |
+          ((*( (png_bytep)profile + 2))<< 8) |
+          ((*( (png_bytep)profile + 3))    );
+
+   if (embedded_profile_len < 0)
+   {
+      png_warning(png_ptr,
+        "Embedded profile length in iCCP chunk is negative");
+      png_free(png_ptr, new_name);
+      return;
+   }
 
    if (profile_len < embedded_profile_len)
-     {
-        png_warning(png_ptr,
-          "Embedded profile length too large in iCCP chunk");
-        return;
-     }
+   {
+      png_warning(png_ptr,
+        "Embedded profile length too large in iCCP chunk");
+      png_free(png_ptr, new_name);
+      return;
+   }
 
    if (profile_len > embedded_profile_len)
-     {
-        png_warning(png_ptr,
-          "Truncating profile to actual length in iCCP chunk");
-        profile_len = embedded_profile_len;
-     }
+   {
+      png_warning(png_ptr,
+        "Truncating profile to actual length in iCCP chunk");
+      profile_len = embedded_profile_len;
+   }
 
    if (profile_len)
-       profile_len = png_text_compress(png_ptr, profile, (png_size_t)profile_len,
-          PNG_COMPRESSION_TYPE_BASE, &comp);
+      profile_len = png_text_compress(png_ptr, profile,
+        (png_size_t)profile_len, PNG_COMPRESSION_TYPE_BASE, &comp);
 
-   /* make sure we include the NULL after the name and the compression type */
-   png_write_chunk_start(png_ptr, png_iCCP,
-          (png_uint_32)name_len+profile_len+2);
-   new_name[name_len+1]=0x00;
-   png_write_chunk_data(png_ptr, (png_bytep)new_name, name_len + 2);
+   /* Make sure we include the NULL after the name and the compression type */
+   png_write_chunk_start(png_ptr, (png_bytep)png_iCCP,
+          (png_uint_32)(name_len + profile_len + 2));
+   new_name[name_len + 1] = 0x00;
+   png_write_chunk_data(png_ptr, (png_bytep)new_name,
+     (png_size_t)(name_len + 2));
 
    if (profile_len)
       png_write_compressed_data_out(png_ptr, &comp);
@@ -808,7 +840,7 @@ png_write_iCCP(png_structp png_ptr, png_charp name, int compression_type,
 #endif
 
 #if defined(PNG_WRITE_sPLT_SUPPORTED)
-/* write a sPLT chunk */
+/* Write a sPLT chunk */
 void /* PRIVATE */
 png_write_sPLT(png_structp png_ptr, png_sPLT_tp spalette)
 {
@@ -825,63 +857,61 @@ png_write_sPLT(png_structp png_ptr, png_sPLT_tp spalette)
    int i;
 #endif
 
-   png_debug(1, "in png_write_sPLT\n");
-   if (spalette->name == NULL || (name_len = png_check_keyword(png_ptr,
-      spalette->name, &new_name))==0)
-   {
-      png_warning(png_ptr, "Empty keyword in sPLT chunk");
+   png_debug(1, "in png_write_sPLT");
+
+   if ((name_len = png_check_keyword(png_ptr,spalette->name, &new_name))==0)
       return;
-   }
 
-   /* make sure we include the NULL after the name */
-   png_write_chunk_start(png_ptr, png_sPLT,
-          (png_uint_32)(name_len + 2 + palette_size));
-   png_write_chunk_data(png_ptr, (png_bytep)new_name, name_len + 1);
-   png_write_chunk_data(png_ptr, (png_bytep)&spalette->depth, 1);
+   /* Make sure we include the NULL after the name */
+   png_write_chunk_start(png_ptr, (png_bytep)png_sPLT,
+     (png_uint_32)(name_len + 2 + palette_size));
+   png_write_chunk_data(png_ptr, (png_bytep)new_name,
+     (png_size_t)(name_len + 1));
+   png_write_chunk_data(png_ptr, (png_bytep)&spalette->depth, (png_size_t)1);
 
-   /* loop through each palette entry, writing appropriately */
+   /* Loop through each palette entry, writing appropriately */
 #ifndef PNG_NO_POINTER_INDEXING
-   for (ep = spalette->entries; ep<spalette->entries+spalette->nentries; ep++)
-   {
-       if (spalette->depth == 8)
-       {
-           entrybuf[0] = (png_byte)ep->red;
-           entrybuf[1] = (png_byte)ep->green;
-           entrybuf[2] = (png_byte)ep->blue;
-           entrybuf[3] = (png_byte)ep->alpha;
-           png_save_uint_16(entrybuf + 4, ep->frequency);
-       }
-       else
-       {
-           png_save_uint_16(entrybuf + 0, ep->red);
-           png_save_uint_16(entrybuf + 2, ep->green);
-           png_save_uint_16(entrybuf + 4, ep->blue);
-           png_save_uint_16(entrybuf + 6, ep->alpha);
-           png_save_uint_16(entrybuf + 8, ep->frequency);
-       }
-       png_write_chunk_data(png_ptr, entrybuf, (png_size_t)entry_size);
+   for (ep = spalette->entries; ep<spalette->entries + spalette->nentries; ep++)
+   {
+      if (spalette->depth == 8)
+      {
+          entrybuf[0] = (png_byte)ep->red;
+          entrybuf[1] = (png_byte)ep->green;
+          entrybuf[2] = (png_byte)ep->blue;
+          entrybuf[3] = (png_byte)ep->alpha;
+          png_save_uint_16(entrybuf + 4, ep->frequency);
+      }
+      else
+      {
+          png_save_uint_16(entrybuf + 0, ep->red);
+          png_save_uint_16(entrybuf + 2, ep->green);
+          png_save_uint_16(entrybuf + 4, ep->blue);
+          png_save_uint_16(entrybuf + 6, ep->alpha);
+          png_save_uint_16(entrybuf + 8, ep->frequency);
+      }
+      png_write_chunk_data(png_ptr, entrybuf, (png_size_t)entry_size);
    }
 #else
    ep=spalette->entries;
    for (i=0; i>spalette->nentries; i++)
    {
-       if (spalette->depth == 8)
-       {
-           entrybuf[0] = (png_byte)ep[i].red;
-           entrybuf[1] = (png_byte)ep[i].green;
-           entrybuf[2] = (png_byte)ep[i].blue;
-           entrybuf[3] = (png_byte)ep[i].alpha;
-           png_save_uint_16(entrybuf + 4, ep[i].frequency);
-       }
-       else
-       {
-           png_save_uint_16(entrybuf + 0, ep[i].red);
-           png_save_uint_16(entrybuf + 2, ep[i].green);
-           png_save_uint_16(entrybuf + 4, ep[i].blue);
-           png_save_uint_16(entrybuf + 6, ep[i].alpha);
-           png_save_uint_16(entrybuf + 8, ep[i].frequency);
-       }
-       png_write_chunk_data(png_ptr, entrybuf, entry_size);
+      if (spalette->depth == 8)
+      {
+          entrybuf[0] = (png_byte)ep[i].red;
+          entrybuf[1] = (png_byte)ep[i].green;
+          entrybuf[2] = (png_byte)ep[i].blue;
+          entrybuf[3] = (png_byte)ep[i].alpha;
+          png_save_uint_16(entrybuf + 4, ep[i].frequency);
+      }
+      else
+      {
+          png_save_uint_16(entrybuf + 0, ep[i].red);
+          png_save_uint_16(entrybuf + 2, ep[i].green);
+          png_save_uint_16(entrybuf + 4, ep[i].blue);
+          png_save_uint_16(entrybuf + 6, ep[i].alpha);
+          png_save_uint_16(entrybuf + 8, ep[i].frequency);
+      }
+      png_write_chunk_data(png_ptr, entrybuf, (png_size_t)entry_size);
    }
 #endif
 
@@ -891,7 +921,7 @@ png_write_sPLT(png_structp png_ptr, png_sPLT_tp spalette)
 #endif
 
 #if defined(PNG_WRITE_sBIT_SUPPORTED)
-/* write the sBIT chunk */
+/* Write the sBIT chunk */
 void /* PRIVATE */
 png_write_sBIT(png_structp png_ptr, png_color_8p sbit, int color_type)
 {
@@ -901,8 +931,9 @@ png_write_sBIT(png_structp png_ptr, png_color_8p sbit, int color_type)
    png_byte buf[4];
    png_size_t size;
 
-   png_debug(1, "in png_write_sBIT\n");
-   /* make sure we don't depend upon the order of PNG_COLOR_8 */
+   png_debug(1, "in png_write_sBIT");
+
+   /* Make sure we don't depend upon the order of PNG_COLOR_8 */
    if (color_type & PNG_COLOR_MASK_COLOR)
    {
       png_byte maxbits;
@@ -942,12 +973,12 @@ png_write_sBIT(png_structp png_ptr, png_color_8p sbit, int color_type)
       buf[size++] = sbit->alpha;
    }
 
-   png_write_chunk(png_ptr, png_sBIT, buf, size);
+   png_write_chunk(png_ptr, (png_bytep)png_sBIT, buf, size);
 }
 #endif
 
 #if defined(PNG_WRITE_cHRM_SUPPORTED)
-/* write the cHRM chunk */
+/* Write the cHRM chunk */
 #ifdef PNG_FLOATING_POINT_SUPPORTED
 void /* PRIVATE */
 png_write_cHRM(png_structp png_ptr, double white_x, double white_y,
@@ -958,55 +989,42 @@ png_write_cHRM(png_structp png_ptr, double white_x, double white_y,
    PNG_cHRM;
 #endif
    png_byte buf[32];
-   png_uint_32 itemp;
 
-   png_debug(1, "in png_write_cHRM\n");
-   /* each value is saved in 1/100,000ths */
-   if (white_x < 0 || white_x > 0.8 || white_y < 0 || white_y > 0.8 ||
-       white_x + white_y > 1.0)
-   {
-      png_warning(png_ptr, "Invalid cHRM white point specified");
-#if !defined(PNG_NO_CONSOLE_IO)
-      fprintf(stderr,"white_x=%f, white_y=%f\n",white_x, white_y);
-#endif
-      return;
-   }
-   itemp = (png_uint_32)(white_x * 100000.0 + 0.5);
-   png_save_uint_32(buf, itemp);
-   itemp = (png_uint_32)(white_y * 100000.0 + 0.5);
-   png_save_uint_32(buf + 4, itemp);
+   png_fixed_point int_white_x, int_white_y, int_red_x, int_red_y,
+      int_green_x, int_green_y, int_blue_x, int_blue_y;
 
-   if (red_x < 0 ||  red_y < 0 || red_x + red_y > 1.0)
-   {
-      png_warning(png_ptr, "Invalid cHRM red point specified");
-      return;
-   }
-   itemp = (png_uint_32)(red_x * 100000.0 + 0.5);
-   png_save_uint_32(buf + 8, itemp);
-   itemp = (png_uint_32)(red_y * 100000.0 + 0.5);
-   png_save_uint_32(buf + 12, itemp);
+   png_debug(1, "in png_write_cHRM");
 
-   if (green_x < 0 || green_y < 0 || green_x + green_y > 1.0)
-   {
-      png_warning(png_ptr, "Invalid cHRM green point specified");
-      return;
-   }
-   itemp = (png_uint_32)(green_x * 100000.0 + 0.5);
-   png_save_uint_32(buf + 16, itemp);
-   itemp = (png_uint_32)(green_y * 100000.0 + 0.5);
-   png_save_uint_32(buf + 20, itemp);
+   int_white_x = (png_uint_32)(white_x * 100000.0 + 0.5);
+   int_white_y = (png_uint_32)(white_y * 100000.0 + 0.5);
+   int_red_x   = (png_uint_32)(red_x   * 100000.0 + 0.5);
+   int_red_y   = (png_uint_32)(red_y   * 100000.0 + 0.5);
+   int_green_x = (png_uint_32)(green_x * 100000.0 + 0.5);
+   int_green_y = (png_uint_32)(green_y * 100000.0 + 0.5);
+   int_blue_x  = (png_uint_32)(blue_x  * 100000.0 + 0.5);
+   int_blue_y  = (png_uint_32)(blue_y  * 100000.0 + 0.5);
 
-   if (blue_x < 0 || blue_y < 0 || blue_x + blue_y > 1.0)
+#if !defined(PNG_NO_CHECK_cHRM)
+   if (png_check_cHRM_fixed(png_ptr, int_white_x, int_white_y,
+      int_red_x, int_red_y, int_green_x, int_green_y, int_blue_x, int_blue_y))
+#endif
    {
-      png_warning(png_ptr, "Invalid cHRM blue point specified");
-      return;
-   }
-   itemp = (png_uint_32)(blue_x * 100000.0 + 0.5);
-   png_save_uint_32(buf + 24, itemp);
-   itemp = (png_uint_32)(blue_y * 100000.0 + 0.5);
-   png_save_uint_32(buf + 28, itemp);
+      /* Each value is saved in 1/100,000ths */
+
+      png_save_uint_32(buf, int_white_x);
+      png_save_uint_32(buf + 4, int_white_y);
+
+      png_save_uint_32(buf + 8, int_red_x);
+      png_save_uint_32(buf + 12, int_red_y);
 
-   png_write_chunk(png_ptr, png_cHRM, buf, (png_size_t)32);
+      png_save_uint_32(buf + 16, int_green_x);
+      png_save_uint_32(buf + 20, int_green_y);
+
+      png_save_uint_32(buf + 24, int_blue_x);
+      png_save_uint_32(buf + 28, int_blue_y);
+
+      png_write_chunk(png_ptr, (png_bytep)png_cHRM, buf, (png_size_t)32);
+   }
 }
 #endif
 #ifdef PNG_FIXED_POINT_SUPPORTED
@@ -1021,50 +1039,34 @@ png_write_cHRM_fixed(png_structp png_ptr, png_fixed_point white_x,
 #endif
    png_byte buf[32];
 
-   png_debug(1, "in png_write_cHRM\n");
-   /* each value is saved in 1/100,000ths */
-   if (white_x > 80000L || white_y > 80000L || white_x + white_y > 100000L)
-   {
-      png_warning(png_ptr, "Invalid fixed cHRM white point specified");
-#if !defined(PNG_NO_CONSOLE_IO)
-      fprintf(stderr,"white_x=%ld, white_y=%ld\n",white_x, white_y);
-#endif
-      return;
-   }
-   png_save_uint_32(buf, (png_uint_32)white_x);
-   png_save_uint_32(buf + 4, (png_uint_32)white_y);
+   png_debug(1, "in png_write_cHRM");
 
-   if (red_x + red_y > 100000L)
+   /* Each value is saved in 1/100,000ths */
+#if !defined(PNG_NO_CHECK_cHRM)
+   if (png_check_cHRM_fixed(png_ptr, white_x, white_y, red_x, red_y,
+      green_x, green_y, blue_x, blue_y))
+#endif
    {
-      png_warning(png_ptr, "Invalid cHRM fixed red point specified");
-      return;
-   }
-   png_save_uint_32(buf + 8, (png_uint_32)red_x);
-   png_save_uint_32(buf + 12, (png_uint_32)red_y);
+      png_save_uint_32(buf, (png_uint_32)white_x);
+      png_save_uint_32(buf + 4, (png_uint_32)white_y);
 
-   if (green_x + green_y > 100000L)
-   {
-      png_warning(png_ptr, "Invalid fixed cHRM green point specified");
-      return;
-   }
-   png_save_uint_32(buf + 16, (png_uint_32)green_x);
-   png_save_uint_32(buf + 20, (png_uint_32)green_y);
+      png_save_uint_32(buf + 8, (png_uint_32)red_x);
+      png_save_uint_32(buf + 12, (png_uint_32)red_y);
 
-   if (blue_x + blue_y > 100000L)
-   {
-      png_warning(png_ptr, "Invalid fixed cHRM blue point specified");
-      return;
-   }
-   png_save_uint_32(buf + 24, (png_uint_32)blue_x);
-   png_save_uint_32(buf + 28, (png_uint_32)blue_y);
+      png_save_uint_32(buf + 16, (png_uint_32)green_x);
+      png_save_uint_32(buf + 20, (png_uint_32)green_y);
+
+      png_save_uint_32(buf + 24, (png_uint_32)blue_x);
+      png_save_uint_32(buf + 28, (png_uint_32)blue_y);
 
-   png_write_chunk(png_ptr, png_cHRM, buf, (png_size_t)32);
+      png_write_chunk(png_ptr, (png_bytep)png_cHRM, buf, (png_size_t)32);
+   }
 }
 #endif
 #endif
 
 #if defined(PNG_WRITE_tRNS_SUPPORTED)
-/* write the tRNS chunk */
+/* Write the tRNS chunk */
 void /* PRIVATE */
 png_write_tRNS(png_structp png_ptr, png_bytep trans, png_color_16p tran,
    int num_trans, int color_type)
@@ -1074,42 +1076,44 @@ png_write_tRNS(png_structp png_ptr, png_bytep trans, png_color_16p tran,
 #endif
    png_byte buf[6];
 
-   png_debug(1, "in png_write_tRNS\n");
+   png_debug(1, "in png_write_tRNS");
+
    if (color_type == PNG_COLOR_TYPE_PALETTE)
    {
       if (num_trans <= 0 || num_trans > (int)png_ptr->num_palette)
       {
-         png_warning(png_ptr,"Invalid number of transparent colors specified");
+         png_warning(png_ptr, "Invalid number of transparent colors specified");
          return;
       }
-      /* write the chunk out as it is */
-      png_write_chunk(png_ptr, png_tRNS, trans, (png_size_t)num_trans);
+      /* Write the chunk out as it is */
+      png_write_chunk(png_ptr, (png_bytep)png_tRNS, trans,
+        (png_size_t)num_trans);
    }
    else if (color_type == PNG_COLOR_TYPE_GRAY)
    {
-      /* one 16 bit value */
-      if(tran->gray >= (1 << png_ptr->bit_depth))
+      /* One 16 bit value */
+      if (tran->gray >= (1 << png_ptr->bit_depth))
       {
          png_warning(png_ptr,
            "Ignoring attempt to write tRNS chunk out-of-range for bit_depth");
          return;
       }
       png_save_uint_16(buf, tran->gray);
-      png_write_chunk(png_ptr, png_tRNS, buf, (png_size_t)2);
+      png_write_chunk(png_ptr, (png_bytep)png_tRNS, buf, (png_size_t)2);
    }
    else if (color_type == PNG_COLOR_TYPE_RGB)
    {
-      /* three 16 bit values */
+      /* Three 16 bit values */
       png_save_uint_16(buf, tran->red);
       png_save_uint_16(buf + 2, tran->green);
       png_save_uint_16(buf + 4, tran->blue);
-      if(png_ptr->bit_depth == 8 && (buf[0] | buf[2] | buf[4]))
-         {
-            png_warning(png_ptr,
-              "Ignoring attempt to write 16-bit tRNS chunk when bit_depth is 8");
-            return;
-         }
-      png_write_chunk(png_ptr, png_tRNS, buf, (png_size_t)6);
+      if (png_ptr->bit_depth == 8 && (buf[0] | buf[2] | buf[4]))
+      {
+         png_warning(png_ptr,
+           "Ignoring attempt to write 16-bit tRNS chunk when bit_depth is 8");
+         return;
+      }
+      png_write_chunk(png_ptr, (png_bytep)png_tRNS, buf, (png_size_t)6);
    }
    else
    {
@@ -1119,7 +1123,7 @@ png_write_tRNS(png_structp png_ptr, png_bytep trans, png_color_16p tran,
 #endif
 
 #if defined(PNG_WRITE_bKGD_SUPPORTED)
-/* write the background chunk */
+/* Write the background chunk */
 void /* PRIVATE */
 png_write_bKGD(png_structp png_ptr, png_color_16p back, int color_type)
 {
@@ -1128,7 +1132,8 @@ png_write_bKGD(png_structp png_ptr, png_color_16p back, int color_type)
 #endif
    png_byte buf[6];
 
-   png_debug(1, "in png_write_bKGD\n");
+   png_debug(1, "in png_write_bKGD");
+
    if (color_type == PNG_COLOR_TYPE_PALETTE)
    {
       if (
@@ -1136,43 +1141,43 @@ png_write_bKGD(png_structp png_ptr, png_color_16p back, int color_type)
           (png_ptr->num_palette ||
           (!(png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE))) &&
 #endif
-         back->index > png_ptr->num_palette)
+         back->index >= png_ptr->num_palette)
       {
          png_warning(png_ptr, "Invalid background palette index");
          return;
       }
       buf[0] = back->index;
-      png_write_chunk(png_ptr, png_bKGD, buf, (png_size_t)1);
+      png_write_chunk(png_ptr, (png_bytep)png_bKGD, buf, (png_size_t)1);
    }
    else if (color_type & PNG_COLOR_MASK_COLOR)
    {
       png_save_uint_16(buf, back->red);
       png_save_uint_16(buf + 2, back->green);
       png_save_uint_16(buf + 4, back->blue);
-      if(png_ptr->bit_depth == 8 && (buf[0] | buf[2] | buf[4]))
-         {
-            png_warning(png_ptr,
-              "Ignoring attempt to write 16-bit bKGD chunk when bit_depth is 8");
-            return;
-         }
-      png_write_chunk(png_ptr, png_bKGD, buf, (png_size_t)6);
+      if (png_ptr->bit_depth == 8 && (buf[0] | buf[2] | buf[4]))
+      {
+         png_warning(png_ptr,
+           "Ignoring attempt to write 16-bit bKGD chunk when bit_depth is 8");
+         return;
+      }
+      png_write_chunk(png_ptr, (png_bytep)png_bKGD, buf, (png_size_t)6);
    }
    else
    {
-      if(back->gray >= (1 << png_ptr->bit_depth))
+      if (back->gray >= (1 << png_ptr->bit_depth))
       {
          png_warning(png_ptr,
            "Ignoring attempt to write bKGD chunk out-of-range for bit_depth");
          return;
       }
       png_save_uint_16(buf, back->gray);
-      png_write_chunk(png_ptr, png_bKGD, buf, (png_size_t)2);
+      png_write_chunk(png_ptr, (png_bytep)png_bKGD, buf, (png_size_t)2);
    }
 }
 #endif
 
 #if defined(PNG_WRITE_hIST_SUPPORTED)
-/* write the histogram */
+/* Write the histogram */
 void /* PRIVATE */
 png_write_hIST(png_structp png_ptr, png_uint_16p hist, int num_hist)
 {
@@ -1182,16 +1187,18 @@ png_write_hIST(png_structp png_ptr, png_uint_16p hist, int num_hist)
    int i;
    png_byte buf[3];
 
-   png_debug(1, "in png_write_hIST\n");
+   png_debug(1, "in png_write_hIST");
+
    if (num_hist > (int)png_ptr->num_palette)
    {
-      png_debug2(3, "num_hist = %d, num_palette = %d\n", num_hist,
+      png_debug2(3, "num_hist = %d, num_palette = %d", num_hist,
          png_ptr->num_palette);
       png_warning(png_ptr, "Invalid number of histogram entries specified");
       return;
    }
 
-   png_write_chunk_start(png_ptr, png_hIST, (png_uint_32)(num_hist * 2));
+   png_write_chunk_start(png_ptr, (png_bytep)png_hIST,
+     (png_uint_32)(num_hist * 2));
    for (i = 0; i < num_hist; i++)
    {
       png_save_uint_16(buf, hist[i]);
@@ -1221,7 +1228,8 @@ png_check_keyword(png_structp png_ptr, png_charp key, png_charpp new_key)
    int kflag;
    int kwarn=0;
 
-   png_debug(1, "in png_check_keyword\n");
+   png_debug(1, "in png_check_keyword");
+
    *new_key = NULL;
 
    if (key == NULL || (key_len = png_strlen(key)) == 0)
@@ -1230,7 +1238,7 @@ png_check_keyword(png_structp png_ptr, png_charp key, png_charpp new_key)
       return ((png_size_t)0);
    }
 
-   png_debug1(2, "Keyword to be checked is '%s'\n", key);
+   png_debug1(2, "Keyword to be checked is '%s'", key);
 
    *new_key = (png_charp)png_malloc_warn(png_ptr, (png_uint_32)(key_len + 2));
    if (*new_key == NULL)
@@ -1271,8 +1279,8 @@ png_check_keyword(png_structp png_ptr, png_charp key, png_charpp new_key)
 
       while (*kp == ' ')
       {
-        *(kp--) = '\0';
-        key_len--;
+         *(kp--) = '\0';
+         key_len--;
       }
    }
 
@@ -1284,12 +1292,12 @@ png_check_keyword(png_structp png_ptr, png_charp key, png_charpp new_key)
 
       while (*kp == ' ')
       {
-        kp++;
-        key_len--;
+         kp++;
+         key_len--;
       }
    }
 
-   png_debug1(2, "Checking for multiple internal spaces in '%s'\n", kp);
+   png_debug1(2, "Checking for multiple internal spaces in '%s'", kp);
 
    /* Remove multiple internal spaces. */
    for (kflag = 0, dp = *new_key; *kp != '\0'; kp++)
@@ -1311,20 +1319,20 @@ png_check_keyword(png_structp png_ptr, png_charp key, png_charpp new_key)
       }
    }
    *dp = '\0';
-   if(kwarn)
+   if (kwarn)
       png_warning(png_ptr, "extra interior spaces removed from keyword");
 
    if (key_len == 0)
    {
       png_free(png_ptr, *new_key);
-      *new_key=NULL;
+       *new_key=NULL;
       png_warning(png_ptr, "Zero length keyword");
    }
 
    if (key_len > 79)
    {
       png_warning(png_ptr, "keyword length must be 1 - 79 characters");
-      new_key[79] = '\0';
+      (*new_key)[79] = '\0';
       key_len = 79;
    }
 
@@ -1333,7 +1341,7 @@ png_check_keyword(png_structp png_ptr, png_charp key, png_charpp new_key)
 #endif
 
 #if defined(PNG_WRITE_tEXt_SUPPORTED)
-/* write a tEXt chunk */
+/* Write a tEXt chunk */
 void /* PRIVATE */
 png_write_tEXt(png_structp png_ptr, png_charp key, png_charp text,
    png_size_t text_len)
@@ -1344,29 +1352,29 @@ png_write_tEXt(png_structp png_ptr, png_charp key, png_charp text,
    png_size_t key_len;
    png_charp new_key;
 
-   png_debug(1, "in png_write_tEXt\n");
-   if (key == NULL || (key_len = png_check_keyword(png_ptr, key, &new_key))==0)
-   {
-      png_warning(png_ptr, "Empty keyword in tEXt chunk");
+   png_debug(1, "in png_write_tEXt");
+
+   if ((key_len = png_check_keyword(png_ptr, key, &new_key))==0)
       return;
-   }
 
    if (text == NULL || *text == '\0')
       text_len = 0;
    else
       text_len = png_strlen(text);
 
-   /* make sure we include the 0 after the key */
-   png_write_chunk_start(png_ptr, png_tEXt, (png_uint_32)key_len+text_len+1);
+   /* Make sure we include the 0 after the key */
+   png_write_chunk_start(png_ptr, (png_bytep)png_tEXt,
+      (png_uint_32)(key_len + text_len + 1));
    /*
     * We leave it to the application to meet PNG-1.0 requirements on the
     * contents of the text.  PNG-1.0 through PNG-1.2 discourage the use of
     * any non-Latin-1 characters except for NEWLINE.  ISO PNG will forbid them.
     * The NUL character is forbidden by PNG-1.0 through PNG-1.2 and ISO PNG.
     */
-   png_write_chunk_data(png_ptr, (png_bytep)new_key, key_len + 1);
+   png_write_chunk_data(png_ptr, (png_bytep)new_key,
+     (png_size_t)(key_len + 1));
    if (text_len)
-      png_write_chunk_data(png_ptr, (png_bytep)text, text_len);
+      png_write_chunk_data(png_ptr, (png_bytep)text, (png_size_t)text_len);
 
    png_write_chunk_end(png_ptr);
    png_free(png_ptr, new_key);
@@ -1374,7 +1382,7 @@ png_write_tEXt(png_structp png_ptr, png_charp key, png_charp text,
 #endif
 
 #if defined(PNG_WRITE_zTXt_SUPPORTED)
-/* write a compressed text chunk */
+/* Write a compressed text chunk */
 void /* PRIVATE */
 png_write_zTXt(png_structp png_ptr, png_charp key, png_charp text,
    png_size_t text_len, int compression)
@@ -1387,7 +1395,7 @@ png_write_zTXt(png_structp png_ptr, png_charp key, png_charp text,
    png_charp new_key;
    compression_state comp;
 
-   png_debug(1, "in png_write_zTXt\n");
+   png_debug(1, "in png_write_zTXt");
 
    comp.num_output_ptr = 0;
    comp.max_output_ptr = 0;
@@ -1395,9 +1403,9 @@ png_write_zTXt(png_structp png_ptr, png_charp key, png_charp text,
    comp.input = NULL;
    comp.input_len = 0;
 
-   if (key == NULL || (key_len = png_check_keyword(png_ptr, key, &new_key))==0)
+   if ((key_len = png_check_keyword(png_ptr, key, &new_key))==0)
    {
-      png_warning(png_ptr, "Empty keyword in zTXt chunk");
+      png_free(png_ptr, new_key);
       return;
    }
 
@@ -1410,30 +1418,31 @@ png_write_zTXt(png_structp png_ptr, png_charp key, png_charp text,
 
    text_len = png_strlen(text);
 
-   /* compute the compressed data; do it now for the length */
+   /* Compute the compressed data; do it now for the length */
    text_len = png_text_compress(png_ptr, text, text_len, compression,
        &comp);
 
-   /* write start of chunk */
-   png_write_chunk_start(png_ptr, png_zTXt, (png_uint_32)
-      (key_len+text_len+2));
-   /* write key */
-   png_write_chunk_data(png_ptr, (png_bytep)new_key, key_len + 1);
+   /* Write start of chunk */
+   png_write_chunk_start(png_ptr, (png_bytep)png_zTXt,
+     (png_uint_32)(key_len+text_len + 2));
+   /* Write key */
+   png_write_chunk_data(png_ptr, (png_bytep)new_key,
+     (png_size_t)(key_len + 1));
    png_free(png_ptr, new_key);
 
    buf[0] = (png_byte)compression;
-   /* write compression */
+   /* Write compression */
    png_write_chunk_data(png_ptr, (png_bytep)buf, (png_size_t)1);
-   /* write the compressed data */
+   /* Write the compressed data */
    png_write_compressed_data_out(png_ptr, &comp);
 
-   /* close the chunk */
+   /* Close the chunk */
    png_write_chunk_end(png_ptr);
 }
 #endif
 
 #if defined(PNG_WRITE_iTXt_SUPPORTED)
-/* write an iTXt chunk */
+/* Write an iTXt chunk */
 void /* PRIVATE */
 png_write_iTXt(png_structp png_ptr, int compression, png_charp key,
     png_charp lang, png_charp lang_key, png_charp text)
@@ -1442,23 +1451,22 @@ png_write_iTXt(png_structp png_ptr, int compression, png_charp key,
    PNG_iTXt;
 #endif
    png_size_t lang_len, key_len, lang_key_len, text_len;
-   png_charp new_lang, new_key;
+   png_charp new_lang;
+   png_charp new_key = NULL;
    png_byte cbuf[2];
    compression_state comp;
 
-   png_debug(1, "in png_write_iTXt\n");
+   png_debug(1, "in png_write_iTXt");
 
    comp.num_output_ptr = 0;
    comp.max_output_ptr = 0;
    comp.output_ptr = NULL;
    comp.input = NULL;
 
-   if (key == NULL || (key_len = png_check_keyword(png_ptr, key, &new_key))==0)
-   {
-      png_warning(png_ptr, "Empty keyword in iTXt chunk");
+   if ((key_len = png_check_keyword(png_ptr, key, &new_key))==0)
       return;
-   }
-   if (lang == NULL || (lang_len = png_check_keyword(png_ptr, lang, &new_lang))==0)
+
+   if ((lang_len = png_check_keyword(png_ptr, lang, &new_lang))==0)
    {
       png_warning(png_ptr, "Empty language field in iTXt chunk");
       new_lang = NULL;
@@ -1466,24 +1474,24 @@ png_write_iTXt(png_structp png_ptr, int compression, png_charp key,
    }
 
    if (lang_key == NULL)
-     lang_key_len = 0;
+      lang_key_len = 0;
    else
-     lang_key_len = png_strlen(lang_key);
+      lang_key_len = png_strlen(lang_key);
 
    if (text == NULL)
       text_len = 0;
    else
-     text_len = png_strlen(text);
+      text_len = png_strlen(text);
 
-   /* compute the compressed data; do it now for the length */
+   /* Compute the compressed data; do it now for the length */
    text_len = png_text_compress(png_ptr, text, text_len, compression-2,
       &comp);
 
 
-   /* make sure we include the compression flag, the compression byte,
+   /* Make sure we include the compression flag, the compression byte,
     * and the NULs after the key, lang, and lang_key parts */
 
-   png_write_chunk_start(png_ptr, png_iTXt,
+   png_write_chunk_start(png_ptr, (png_bytep)png_iTXt,
           (png_uint_32)(
         5 /* comp byte, comp flag, terminators for key, lang and lang_key */
         + key_len
@@ -1491,27 +1499,29 @@ png_write_iTXt(png_structp png_ptr, int compression, png_charp key,
         + lang_key_len
         + text_len));
 
-   /*
-    * We leave it to the application to meet PNG-1.0 requirements on the
+   /* We leave it to the application to meet PNG-1.0 requirements on the
     * contents of the text.  PNG-1.0 through PNG-1.2 discourage the use of
     * any non-Latin-1 characters except for NEWLINE.  ISO PNG will forbid them.
     * The NUL character is forbidden by PNG-1.0 through PNG-1.2 and ISO PNG.
     */
-   png_write_chunk_data(png_ptr, (png_bytep)new_key, key_len + 1);
+   png_write_chunk_data(png_ptr, (png_bytep)new_key,
+     (png_size_t)(key_len + 1));
 
-   /* set the compression flag */
+   /* Set the compression flag */
    if (compression == PNG_ITXT_COMPRESSION_NONE || \
        compression == PNG_TEXT_COMPRESSION_NONE)
        cbuf[0] = 0;
    else /* compression == PNG_ITXT_COMPRESSION_zTXt */
        cbuf[0] = 1;
-   /* set the compression method */
+   /* Set the compression method */
    cbuf[1] = 0;
-   png_write_chunk_data(png_ptr, cbuf, 2);
+   png_write_chunk_data(png_ptr, cbuf, (png_size_t)2);
 
    cbuf[0] = 0;
-   png_write_chunk_data(png_ptr, (new_lang ? (png_bytep)new_lang : cbuf), lang_len + 1);
-   png_write_chunk_data(png_ptr, (lang_key ? (png_bytep)lang_key : cbuf), lang_key_len + 1);
+   png_write_chunk_data(png_ptr, (new_lang ? (png_bytep)new_lang : cbuf),
+     (png_size_t)(lang_len + 1));
+   png_write_chunk_data(png_ptr, (lang_key ? (png_bytep)lang_key : cbuf),
+     (png_size_t)(lang_key_len + 1));
    png_write_compressed_data_out(png_ptr, &comp);
 
    png_write_chunk_end(png_ptr);
@@ -1521,7 +1531,7 @@ png_write_iTXt(png_structp png_ptr, int compression, png_charp key,
 #endif
 
 #if defined(PNG_WRITE_oFFs_SUPPORTED)
-/* write the oFFs chunk */
+/* Write the oFFs chunk */
 void /* PRIVATE */
 png_write_oFFs(png_structp png_ptr, png_int_32 x_offset, png_int_32 y_offset,
    int unit_type)
@@ -1531,7 +1541,8 @@ png_write_oFFs(png_structp png_ptr, png_int_32 x_offset, png_int_32 y_offset,
 #endif
    png_byte buf[9];
 
-   png_debug(1, "in png_write_oFFs\n");
+   png_debug(1, "in png_write_oFFs");
+
    if (unit_type >= PNG_OFFSET_LAST)
       png_warning(png_ptr, "Unrecognized unit type for oFFs chunk");
 
@@ -1539,11 +1550,11 @@ png_write_oFFs(png_structp png_ptr, png_int_32 x_offset, png_int_32 y_offset,
    png_save_int_32(buf + 4, y_offset);
    buf[8] = (png_byte)unit_type;
 
-   png_write_chunk(png_ptr, png_oFFs, buf, (png_size_t)9);
+   png_write_chunk(png_ptr, (png_bytep)png_oFFs, buf, (png_size_t)9);
 }
 #endif
 #if defined(PNG_WRITE_pCAL_SUPPORTED)
-/* write the pCAL chunk (described in the PNG extensions document) */
+/* Write the pCAL chunk (described in the PNG extensions document) */
 void /* PRIVATE */
 png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0,
    png_int_32 X1, int type, int nparams, png_charp units, png_charpp params)
@@ -1557,31 +1568,34 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0,
    png_charp new_purpose;
    int i;
 
-   png_debug1(1, "in png_write_pCAL (%d parameters)\n", nparams);
+   png_debug1(1, "in png_write_pCAL (%d parameters)", nparams);
+
    if (type >= PNG_EQUATION_LAST)
       png_warning(png_ptr, "Unrecognized equation type for pCAL chunk");
 
    purpose_len = png_check_keyword(png_ptr, purpose, &new_purpose) + 1;
-   png_debug1(3, "pCAL purpose length = %d\n", (int)purpose_len);
+   png_debug1(3, "pCAL purpose length = %d", (int)purpose_len);
    units_len = png_strlen(units) + (nparams == 0 ? 0 : 1);
-   png_debug1(3, "pCAL units length = %d\n", (int)units_len);
+   png_debug1(3, "pCAL units length = %d", (int)units_len);
    total_len = purpose_len + units_len + 10;
 
-   params_len = (png_uint_32p)png_malloc(png_ptr, (png_uint_32)(nparams
-      *png_sizeof(png_uint_32)));
+   params_len = (png_uint_32p)png_malloc(png_ptr,
+      (png_uint_32)(nparams * png_sizeof(png_uint_32)));
 
    /* Find the length of each parameter, making sure we don't count the
       null terminator for the last parameter. */
    for (i = 0; i < nparams; i++)
    {
       params_len[i] = png_strlen(params[i]) + (i == nparams - 1 ? 0 : 1);
-      png_debug2(3, "pCAL parameter %d length = %lu\n", i, params_len[i]);
+      png_debug2(3, "pCAL parameter %d length = %lu", i,
+        (unsigned long) params_len[i]);
       total_len += (png_size_t)params_len[i];
    }
 
-   png_debug1(3, "pCAL total length = %d\n", (int)total_len);
-   png_write_chunk_start(png_ptr, png_pCAL, (png_uint_32)total_len);
-   png_write_chunk_data(png_ptr, (png_bytep)new_purpose, purpose_len);
+   png_debug1(3, "pCAL total length = %d", (int)total_len);
+   png_write_chunk_start(png_ptr, (png_bytep)png_pCAL, (png_uint_32)total_len);
+   png_write_chunk_data(png_ptr, (png_bytep)new_purpose,
+     (png_size_t)purpose_len);
    png_save_int_32(buf, X0);
    png_save_int_32(buf + 4, X1);
    buf[8] = (png_byte)type;
@@ -1603,7 +1617,7 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0,
 #endif
 
 #if defined(PNG_WRITE_sCAL_SUPPORTED)
-/* write the sCAL chunk */
+/* Write the sCAL chunk */
 #if defined(PNG_FLOATING_POINT_SUPPORTED) && !defined(PNG_NO_STDIO)
 void /* PRIVATE */
 png_write_sCAL(png_structp png_ptr, int unit, double width, double height)
@@ -1614,7 +1628,7 @@ png_write_sCAL(png_structp png_ptr, int unit, double width, double height)
    char buf[64];
    png_size_t total_len;
 
-   png_debug(1, "in png_write_sCAL\n");
+   png_debug(1, "in png_write_sCAL");
 
    buf[0] = (char)unit;
 #if defined(_WIN32_WCE)
@@ -1639,8 +1653,8 @@ png_write_sCAL(png_structp png_ptr, int unit, double width, double height)
    total_len += png_strlen(buf + total_len);
 #endif
 
-   png_debug1(3, "sCAL total length = %u\n", (unsigned int)total_len);
-   png_write_chunk(png_ptr, png_sCAL, (png_bytep)buf, total_len);
+   png_debug1(3, "sCAL total length = %u", (unsigned int)total_len);
+   png_write_chunk(png_ptr, (png_bytep)png_sCAL, (png_bytep)buf, total_len);
 }
 #else
 #ifdef PNG_FIXED_POINT_SUPPORTED
@@ -1654,7 +1668,7 @@ png_write_sCAL_s(png_structp png_ptr, int unit, png_charp width,
    png_byte buf[64];
    png_size_t wlen, hlen, total_len;
 
-   png_debug(1, "in png_write_sCAL_s\n");
+   png_debug(1, "in png_write_sCAL_s");
 
    wlen = png_strlen(width);
    hlen = png_strlen(height);
@@ -1666,18 +1680,18 @@ png_write_sCAL_s(png_structp png_ptr, int unit, png_charp width,
    }
 
    buf[0] = (png_byte)unit;
-   png_memcpy(buf + 1, width, wlen + 1);      /* append the '\0' here */
-   png_memcpy(buf + wlen + 2, height, hlen);  /* do NOT append the '\0' here */
+   png_memcpy(buf + 1, width, wlen + 1);      /* Append the '\0' here */
+   png_memcpy(buf + wlen + 2, height, hlen);  /* Do NOT append the '\0' here */
 
-   png_debug1(3, "sCAL total length = %u\n", (unsigned int)total_len);
-   png_write_chunk(png_ptr, png_sCAL, buf, total_len);
+   png_debug1(3, "sCAL total length = %u", (unsigned int)total_len);
+   png_write_chunk(png_ptr, (png_bytep)png_sCAL, buf, total_len);
 }
 #endif
 #endif
 #endif
 
 #if defined(PNG_WRITE_pHYs_SUPPORTED)
-/* write the pHYs chunk */
+/* Write the pHYs chunk */
 void /* PRIVATE */
 png_write_pHYs(png_structp png_ptr, png_uint_32 x_pixels_per_unit,
    png_uint_32 y_pixels_per_unit,
@@ -1688,7 +1702,8 @@ png_write_pHYs(png_structp png_ptr, png_uint_32 x_pixels_per_unit,
 #endif
    png_byte buf[9];
 
-   png_debug(1, "in png_write_pHYs\n");
+   png_debug(1, "in png_write_pHYs");
+
    if (unit_type >= PNG_RESOLUTION_LAST)
       png_warning(png_ptr, "Unrecognized unit type for pHYs chunk");
 
@@ -1696,7 +1711,7 @@ png_write_pHYs(png_structp png_ptr, png_uint_32 x_pixels_per_unit,
    png_save_uint_32(buf + 4, y_pixels_per_unit);
    buf[8] = (png_byte)unit_type;
 
-   png_write_chunk(png_ptr, png_pHYs, buf, (png_size_t)9);
+   png_write_chunk(png_ptr, (png_bytep)png_pHYs, buf, (png_size_t)9);
 }
 #endif
 
@@ -1712,7 +1727,8 @@ png_write_tIME(png_structp png_ptr, png_timep mod_time)
 #endif
    png_byte buf[7];
 
-   png_debug(1, "in png_write_tIME\n");
+   png_debug(1, "in png_write_tIME");
+
    if (mod_time->month  > 12 || mod_time->month  < 1 ||
        mod_time->day    > 31 || mod_time->day    < 1 ||
        mod_time->hour   > 23 || mod_time->second > 60)
@@ -1728,83 +1744,86 @@ png_write_tIME(png_structp png_ptr, png_timep mod_time)
    buf[5] = mod_time->minute;
    buf[6] = mod_time->second;
 
-   png_write_chunk(png_ptr, png_tIME, buf, (png_size_t)7);
+   png_write_chunk(png_ptr, (png_bytep)png_tIME, buf, (png_size_t)7);
 }
 #endif
 
-/* initializes the row writing capability of libpng */
+/* Initializes the row writing capability of libpng */
 void /* PRIVATE */
 png_write_start_row(png_structp png_ptr)
 {
 #ifdef PNG_WRITE_INTERLACING_SUPPORTED
 #ifdef PNG_USE_LOCAL_ARRAYS
-   /* arrays to facilitate easy interlacing - use pass (0 - 6) as index */
+   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
 
-   /* start of interlace block */
+   /* Start of interlace block */
    int png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
 
-   /* offset to next interlace block */
+   /* Offset to next interlace block */
    int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
 
-   /* start of interlace block in the y direction */
+   /* Start of interlace block in the y direction */
    int png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
 
-   /* offset to next interlace block in the y direction */
+   /* Offset to next interlace block in the y direction */
    int png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
 #endif
 #endif
 
    png_size_t buf_size;
 
-   png_debug(1, "in png_write_start_row\n");
+   png_debug(1, "in png_write_start_row");
+
    buf_size = (png_size_t)(PNG_ROWBYTES(
-      png_ptr->usr_channels*png_ptr->usr_bit_depth,png_ptr->width)+1);
+      png_ptr->usr_channels*png_ptr->usr_bit_depth, png_ptr->width) + 1);
 
-   /* set up row buffer */
-   png_ptr->row_buf = (png_bytep)png_malloc(png_ptr, (png_uint_32)buf_size);
+   /* Set up row buffer */
+   png_ptr->row_buf = (png_bytep)png_malloc(png_ptr,
+     (png_uint_32)buf_size);
    png_ptr->row_buf[0] = PNG_FILTER_VALUE_NONE;
 
-#ifndef PNG_NO_WRITE_FILTERING
-   /* set up filtering buffer, if using this filter */
+#ifndef PNG_NO_WRITE_FILTER
+   /* Set up filtering buffer, if using this filter */
    if (png_ptr->do_filter & PNG_FILTER_SUB)
    {
       png_ptr->sub_row = (png_bytep)png_malloc(png_ptr,
-         (png_ptr->rowbytes + 1));
+         (png_uint_32)(png_ptr->rowbytes + 1));
       png_ptr->sub_row[0] = PNG_FILTER_VALUE_SUB;
    }
 
    /* We only need to keep the previous row if we are using one of these. */
    if (png_ptr->do_filter & (PNG_FILTER_AVG | PNG_FILTER_UP | PNG_FILTER_PAETH))
    {
-     /* set up previous row buffer */
-      png_ptr->prev_row = (png_bytep)png_malloc(png_ptr, (png_uint_32)buf_size);
-      png_memset(png_ptr->prev_row, 0, buf_size);
+     /* Set up previous row buffer */
+     png_ptr->prev_row = (png_bytep)png_malloc(png_ptr,
+        (png_uint_32)buf_size);
+     png_memset(png_ptr->prev_row, 0, buf_size);
 
       if (png_ptr->do_filter & PNG_FILTER_UP)
       {
          png_ptr->up_row = (png_bytep)png_malloc(png_ptr,
-            (png_ptr->rowbytes + 1));
+           (png_uint_32)(png_ptr->rowbytes + 1));
          png_ptr->up_row[0] = PNG_FILTER_VALUE_UP;
       }
 
       if (png_ptr->do_filter & PNG_FILTER_AVG)
       {
          png_ptr->avg_row = (png_bytep)png_malloc(png_ptr,
-            (png_ptr->rowbytes + 1));
+           (png_uint_32)(png_ptr->rowbytes + 1));
          png_ptr->avg_row[0] = PNG_FILTER_VALUE_AVG;
       }
 
       if (png_ptr->do_filter & PNG_FILTER_PAETH)
       {
          png_ptr->paeth_row = (png_bytep)png_malloc(png_ptr,
-            (png_ptr->rowbytes + 1));
+           (png_uint_32)(png_ptr->rowbytes + 1));
          png_ptr->paeth_row[0] = PNG_FILTER_VALUE_PAETH;
       }
-#endif /* PNG_NO_WRITE_FILTERING */
    }
+#endif /* PNG_NO_WRITE_FILTER */
 
 #ifdef PNG_WRITE_INTERLACING_SUPPORTED
-   /* if interlaced, we need to set up width and height of pass */
+   /* If interlaced, we need to set up width and height of pass */
    if (png_ptr->interlaced)
    {
       if (!(png_ptr->transformations & PNG_INTERLACE))
@@ -1836,34 +1855,35 @@ png_write_finish_row(png_structp png_ptr)
 {
 #ifdef PNG_WRITE_INTERLACING_SUPPORTED
 #ifdef PNG_USE_LOCAL_ARRAYS
-   /* arrays to facilitate easy interlacing - use pass (0 - 6) as index */
+   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
 
-   /* start of interlace block */
+   /* Start of interlace block */
    int png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
 
-   /* offset to next interlace block */
+   /* Offset to next interlace block */
    int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
 
-   /* start of interlace block in the y direction */
+   /* Start of interlace block in the y direction */
    int png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
 
-   /* offset to next interlace block in the y direction */
+   /* Offset to next interlace block in the y direction */
    int png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
 #endif
 #endif
 
    int ret;
 
-   png_debug(1, "in png_write_finish_row\n");
-   /* next row */
+   png_debug(1, "in png_write_finish_row");
+
+   /* Next row */
    png_ptr->row_number++;
 
-   /* see if we are done */
+   /* See if we are done */
    if (png_ptr->row_number < png_ptr->num_rows)
       return;
 
 #ifdef PNG_WRITE_INTERLACING_SUPPORTED
-   /* if interlaced, go to next pass */
+   /* If interlaced, go to next pass */
    if (png_ptr->interlaced)
    {
       png_ptr->row_number = 0;
@@ -1873,7 +1893,7 @@ png_write_finish_row(png_structp png_ptr)
       }
       else
       {
-         /* loop until we find a non-zero width or height pass */
+         /* Loop until we find a non-zero width or height pass */
          do
          {
             png_ptr->pass++;
@@ -1893,28 +1913,28 @@ png_write_finish_row(png_structp png_ptr)
 
       }
 
-      /* reset the row above the image for the next pass */
+      /* Reset the row above the image for the next pass */
       if (png_ptr->pass < 7)
       {
          if (png_ptr->prev_row != NULL)
             png_memset(png_ptr->prev_row, 0,
                (png_size_t)(PNG_ROWBYTES(png_ptr->usr_channels*
-               png_ptr->usr_bit_depth,png_ptr->width))+1);
+               png_ptr->usr_bit_depth, png_ptr->width)) + 1);
          return;
       }
    }
 #endif
 
-   /* if we get here, we've just written the last row, so we need
+   /* If we get here, we've just written the last row, so we need
       to flush the compressor */
    do
    {
-      /* tell the compressor we are done */
+      /* Tell the compressor we are done */
       ret = deflate(&png_ptr->zstream, Z_FINISH);
-      /* check for an error */
+      /* Check for an error */
       if (ret == Z_OK)
       {
-         /* check to see if we need more room */
+         /* Check to see if we need more room */
          if (!(png_ptr->zstream.avail_out))
          {
             png_write_IDAT(png_ptr, png_ptr->zbuf, png_ptr->zbuf_size);
@@ -1931,7 +1951,7 @@ png_write_finish_row(png_structp png_ptr)
       }
    } while (ret != Z_STREAM_END);
 
-   /* write any extra space */
+   /* Write any extra space */
    if (png_ptr->zstream.avail_out < png_ptr->zbuf_size)
    {
       png_write_IDAT(png_ptr, png_ptr->zbuf, png_ptr->zbuf_size -
@@ -1954,24 +1974,25 @@ void /* PRIVATE */
 png_do_write_interlace(png_row_infop row_info, png_bytep row, int pass)
 {
 #ifdef PNG_USE_LOCAL_ARRAYS
-   /* arrays to facilitate easy interlacing - use pass (0 - 6) as index */
+   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
 
-   /* start of interlace block */
+   /* Start of interlace block */
    int png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
 
-   /* offset to next interlace block */
+   /* Offset to next interlace block */
    int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
 #endif
 
-   png_debug(1, "in png_do_write_interlace\n");
-   /* we don't have to do anything on the last pass (6) */
+   png_debug(1, "in png_do_write_interlace");
+
+   /* We don't have to do anything on the last pass (6) */
 #if defined(PNG_USELESS_TESTS_SUPPORTED)
    if (row != NULL && row_info != NULL && pass < 6)
 #else
    if (pass < 6)
 #endif
    {
-      /* each pixel depth is handled separately */
+      /* Each pixel depth is handled separately */
       switch (row_info->pixel_depth)
       {
          case 1:
@@ -2082,27 +2103,27 @@ png_do_write_interlace(png_row_infop row_info, png_bytep row, int pass)
             png_uint_32 row_width = row_info->width;
             png_size_t pixel_bytes;
 
-            /* start at the beginning */
+            /* Start at the beginning */
             dp = row;
-            /* find out how many bytes each pixel takes up */
+            /* Find out how many bytes each pixel takes up */
             pixel_bytes = (row_info->pixel_depth >> 3);
-            /* loop through the row, only looking at the pixels that
+            /* Loop through the row, only looking at the pixels that
                matter */
             for (i = png_pass_start[pass]; i < row_width;
                i += png_pass_inc[pass])
             {
-               /* find out where the original pixel is */
+               /* Find out where the original pixel is */
                sp = row + (png_size_t)i * pixel_bytes;
-               /* move the pixel */
+               /* Move the pixel */
                if (dp != sp)
                   png_memcpy(dp, sp, pixel_bytes);
-               /* next pixel */
+               /* Next pixel */
                dp += pixel_bytes;
             }
             break;
          }
       }
-      /* set new row width */
+      /* Set new row width */
       row_info->width = (row_info->width +
          png_pass_inc[pass] - 1 -
          png_pass_start[pass]) /
@@ -2130,12 +2151,13 @@ png_write_find_filter(png_structp png_ptr, png_row_infop row_info)
    png_uint_32 mins, bpp;
    png_byte filter_to_do = png_ptr->do_filter;
    png_uint_32 row_bytes = row_info->rowbytes;
-#if defined(PNG_WRITE_WEIGHTED_FILTER_SUPPORTED)
+#ifdef PNG_WRITE_WEIGHTED_FILTER_SUPPORTED
    int num_p_filters = (int)png_ptr->num_prev_filters;
-#endif
+#endif 
 
-   png_debug(1, "in png_write_find_filter\n");
-   /* find out how many bytes offset each pixel is */
+   png_debug(1, "in png_write_find_filter");
+
+   /* Find out how many bytes offset each pixel is */
    bpp = (row_info->pixel_depth + 7) >> 3;
 
    prev_row = png_ptr->prev_row;
@@ -2222,9 +2244,9 @@ png_write_find_filter(png_structp png_ptr, png_row_infop row_info)
       mins = sum;
    }
 
-   /* sub filter */
+   /* Sub filter */
    if (filter_to_do == PNG_FILTER_SUB)
-   /* it's the only filter so no testing is needed */
+   /* It's the only filter so no testing is needed */
    {
       png_bytep rp, lp, dp;
       png_uint_32 i;
@@ -2339,7 +2361,7 @@ png_write_find_filter(png_structp png_ptr, png_row_infop row_info)
       }
    }
 
-   /* up filter */
+   /* Up filter */
    if (filter_to_do == PNG_FILTER_UP)
    {
       png_bytep rp, dp, pp;
@@ -2442,7 +2464,7 @@ png_write_find_filter(png_structp png_ptr, png_row_infop row_info)
       }
    }
 
-   /* avg filter */
+   /* Avg filter */
    if (filter_to_do == PNG_FILTER_AVG)
    {
       png_bytep rp, dp, pp, lp;
@@ -2743,20 +2765,21 @@ png_write_find_filter(png_structp png_ptr, png_row_infop row_info)
 void /* PRIVATE */
 png_write_filtered_row(png_structp png_ptr, png_bytep filtered_row)
 {
-   png_debug(1, "in png_write_filtered_row\n");
-   png_debug1(2, "filter = %d\n", filtered_row[0]);
-   /* set up the zlib input buffer */
+   png_debug(1, "in png_write_filtered_row");
+
+   png_debug1(2, "filter = %d", filtered_row[0]);
+   /* Set up the zlib input buffer */
 
    png_ptr->zstream.next_in = filtered_row;
    png_ptr->zstream.avail_in = (uInt)png_ptr->row_info.rowbytes + 1;
-   /* repeat until we have compressed all the data */
+   /* Repeat until we have compressed all the data */
    do
    {
-      int ret; /* return of zlib */
+      int ret; /* Return of zlib */
 
-      /* compress the data */
+      /* Compress the data */
       ret = deflate(&png_ptr->zstream, Z_NO_FLUSH);
-      /* check for compression errors */
+      /* Check for compression errors */
       if (ret != Z_OK)
       {
          if (png_ptr->zstream.msg != NULL)
@@ -2765,18 +2788,18 @@ png_write_filtered_row(png_structp png_ptr, png_bytep filtered_row)
             png_error(png_ptr, "zlib error");
       }
 
-      /* see if it is time to write another IDAT */
+      /* See if it is time to write another IDAT */
       if (!(png_ptr->zstream.avail_out))
       {
-         /* write the IDAT and reset the zlib output buffer */
+         /* Write the IDAT and reset the zlib output buffer */
          png_write_IDAT(png_ptr, png_ptr->zbuf, png_ptr->zbuf_size);
          png_ptr->zstream.next_out = png_ptr->zbuf;
          png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
       }
-   /* repeat until all data has been compressed */
+   /* Repeat until all data has been compressed */
    } while (png_ptr->zstream.avail_in);
 
-   /* swap the current and previous rows */
+   /* Swap the current and previous rows */
    if (png_ptr->prev_row != NULL)
    {
       png_bytep tptr;
@@ -2786,7 +2809,7 @@ png_write_filtered_row(png_structp png_ptr, png_bytep filtered_row)
       png_ptr->row_buf = tptr;
    }
 
-   /* finish row - updates counters and flushes zlib if last row */
+   /* Finish row - updates counters and flushes zlib if last row */
    png_write_finish_row(png_ptr);
 
 #if defined(PNG_WRITE_FLUSH_SUPPORTED)
diff --git a/src/3rdparty/libpng/scripts/CMakeLists.txt b/src/3rdparty/libpng/scripts/CMakeLists.txt
index fceea622d8..c040c03c28 100644
--- a/src/3rdparty/libpng/scripts/CMakeLists.txt
+++ b/src/3rdparty/libpng/scripts/CMakeLists.txt
@@ -1,17 +1,24 @@
-                                             
-project(PNG)
+project(PNG C)
+cmake_minimum_required(VERSION 2.4.3)
 
 # Copyright (C) 2007 Glenn Randers-Pehrson
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 set(PNGLIB_MAJOR 1)
 set(PNGLIB_MINOR 2)
-set(PNGLIB_RELEASE 29)
+set(PNGLIB_RELEASE 40)
 set(PNGLIB_NAME libpng${PNGLIB_MAJOR}${PNGLIB_MINOR})
 set(PNGLIB_VERSION ${PNGLIB_MAJOR}.${PNGLIB_MINOR}.${PNGLIB_RELEASE})
 
+set(CMAKE_ALLOW_LOOSE_LOOP_CONSTRUCTS true)
+
 # needed packages
 find_package(ZLIB REQUIRED)
+include_directories(${ZLIB_INCLUDE_DIR})
+
 if(NOT WIN32)
  find_library(M_LIBRARY
      NAMES m
@@ -20,24 +27,33 @@ if(NOT WIN32)
  if(NOT M_LIBRARY)
    message(STATUS
      "math library 'libm' not found - floating point support disabled")
- endif(NOT M_LIBRARY)
-else(NOT WIN32)
+ endif()
+else()
  # not needed on windows
  set(M_LIBRARY "")
-endif(NOT WIN32)
-
+endif()
 
 # COMMAND LINE OPTIONS
-option(PNG_SHARED "Build shared lib" YES)
-option(PNG_STATIC "Build static lib" YES)
+if(DEFINED PNG_SHARED)
+  option(PNG_SHARED "Build shared lib" ${PNG_SHARED})
+else()
+  option(PNG_SHARED "Build shared lib" ON)
+endif()
+if(DEFINED PNG_STATIC)
+  option(PNG_STATIC "Build static lib" ${PNG_STATIC})
+else()
+  option(PNG_STATIC "Build static lib" ON)
+endif()
+
 if(MINGW)
   option(PNG_TESTS  "Build pngtest" NO)
 else(MINGW)
   option(PNG_TESTS  "Build pngtest" YES)
 endif(MINGW)
+
 option(PNG_NO_CONSOLE_IO "FIXME" YES)
 option(PNG_NO_STDIO      "FIXME" YES)
-option(PNG_DEBUG         "Build with debug output" YES)
+option(PNG_DEBUG         "Build with debug output" NO)
 option(PNGARG            "FIXME" YES)
 #TODO:
 # PNG_CONSOLE_IO_SUPPORTED
@@ -54,20 +70,16 @@ if(NOT WIN32)
       set(png_asm_tmp "OFF")
    endif("uname_output" MATCHES "^.*i[1-9]86.*$")
  endif(uname_executable)
-else(NOT WIN32)
+else()
  # this env var is normally only set on win64
  SET(TEXT "ProgramFiles(x86)")
  if("$ENV{${TEXT}}" STREQUAL "")
   set(png_asm_tmp "ON")
  endif("$ENV{${TEXT}}" STREQUAL "")
-endif(NOT WIN32)
+endif()
 
 # SET LIBNAME
-# msvc does not append 'lib' - do it here to have consistent name
-if(MSVC)
- set(PNG_LIB_NAME lib)
-endif(MSVC)
-set(PNG_LIB_NAME ${PNG_LIB_NAME}png${PNGLIB_MAJOR}${PNGLIB_MINOR})
+set(PNG_LIB_NAME png${PNGLIB_MAJOR}${PNGLIB_MINOR})
 
 # to distinguish between debug and release lib
 set(CMAKE_DEBUG_POSTFIX "d")
@@ -101,54 +113,67 @@ if(MSVC)
   add_definitions(-DPNG_NO_MODULEDEF -D_CRT_SECURE_NO_DEPRECATE)
 endif(MSVC)
 
-add_definitions(-DZLIB_DLL)
+if(PNG_SHARED OR  NOT MSVC)
+	#if building msvc static this has NOT do be defined
+	add_definitions(-DZLIB_DLL)
+endif()
 
 add_definitions(-DLIBPNG_NO_MMX)
 add_definitions(-DPNG_NO_MMX_CODE)
 
 if(PNG_CONSOLE_IO_SUPPORTED)
  add_definitions(-DPNG_CONSOLE_IO_SUPPORTED)
-endif(PNG_CONSOLE_IO_SUPPORTED)
+endif()
 
 if(PNG_NO_CONSOLE_IO)
  add_definitions(-DPNG_NO_CONSOLE_IO)
-endif(PNG_NO_CONSOLE_IO)
+endif()
 
 if(PNG_NO_STDIO)
  add_definitions(-DPNG_NO_STDIO)
-endif(PNG_NO_STDIO)
+endif()
 
 if(PNG_DEBUG)
  add_definitions(-DPNG_DEBUG)
-endif(PNG_DEBUG)
+endif()
 
 if(NOT M_LIBRARY AND NOT WIN32)
  add_definitions(-DPNG_NO_FLOATING_POINT_SUPPORTED)
-endif(NOT M_LIBRARY AND NOT WIN32)
+endif()
 
 # NOW BUILD OUR TARGET
 include_directories(${PNG_SOURCE_DIR} ${ZLIB_INCLUDE_DIR})
 
 if(PNG_SHARED)
  add_library(${PNG_LIB_NAME} SHARED ${libpng_sources})
+ if(MSVC)
+   # msvc does not append 'lib' - do it here to have consistent name
+   set_target_properties(${PNG_LIB_NAME} PROPERTIES PREFIX "lib")
+ endif()
  target_link_libraries(${PNG_LIB_NAME} ${ZLIB_LIBRARY} ${M_LIBRARY})
-endif(PNG_SHARED)
+endif()
+
 if(PNG_STATIC)
 # does not work without changing name
  set(PNG_LIB_NAME_STATIC ${PNG_LIB_NAME}_static)
  add_library(${PNG_LIB_NAME_STATIC} STATIC ${libpng_sources})
-endif(PNG_STATIC)
+ if(MSVC)
+   # msvc does not append 'lib' - do it here to have consistent name
+   set_target_properties(${PNG_LIB_NAME_STATIC} PROPERTIES PREFIX "lib")
+ endif()
+endif()
+
 
 if(PNG_SHARED AND WIN32)
  set_target_properties(${PNG_LIB_NAME} PROPERTIES DEFINE_SYMBOL PNG_BUILD_DLL)
-endif(PNG_SHARED AND WIN32)
+endif()
 
-if(PNG_TESTS)
+if(PNG_TESTS AND PNG_SHARED)
 # does not work with msvc due to png_lib_ver issue
  add_executable(pngtest ${pngtest_sources})
  target_link_libraries(pngtest ${PNG_LIB_NAME})
 #  add_test(pngtest ${PNG_SOURCE_DIR}/pngtest.png)
-endif(PNG_TESTS)
+endif()
 
 
 # CREATE PKGCONFIG FILES
@@ -168,31 +193,49 @@ configure_file(${PNG_SOURCE_DIR}/scripts/libpng-config.in
   ${PNG_BINARY_DIR}/${PNGLIB_NAME}-config)
 
 # SET UP LINKS
-set_target_properties(${PNG_LIB_NAME} PROPERTIES
-#    VERSION 0.${PNGLIB_RELEASE}.1.2.29
+if(PNG_SHARED)
+  set_target_properties(${PNG_LIB_NAME} PROPERTIES
+#    VERSION 0.${PNGLIB_RELEASE}.1.2.40
      VERSION 0.${PNGLIB_RELEASE}.0
      SOVERSION 0
      CLEAN_DIRECT_OUTPUT 1)
-if(NOT WIN32)
-  # that's uncool on win32 - it overwrites our static import lib...
-  set_target_properties(${PNG_LIB_NAME_STATIC} PROPERTIES
-     OUTPUT_NAME ${PNG_LIB_NAME}
-     CLEAN_DIRECT_OUTPUT 1)
-endif(NOT WIN32)
-# INSTALL
-install_targets(/lib ${PNG_LIB_NAME})
+endif()
 if(PNG_STATIC)
-  install_targets(/lib ${PNG_LIB_NAME_STATIC})
-endif(PNG_STATIC)
+  if(NOT WIN32)
+    # that's uncool on win32 - it overwrites our static import lib...
+    set_target_properties(${PNG_LIB_NAME_STATIC} PROPERTIES
+       OUTPUT_NAME ${PNG_LIB_NAME}
+       CLEAN_DIRECT_OUTPUT 1)
+  endif()
+endif()
 
+# INSTALL
+if(NOT SKIP_INSTALL_LIBRARIES AND NOT SKIP_INSTALL_ALL )
+    if(PNG_SHARED)
+        install(TARGETS ${PNG_LIB_NAME}
+            RUNTIME DESTINATION bin
+            LIBRARY DESTINATION lib
+            ARCHIVE DESTINATION lib)
+    endif()
+    if(PNG_STATIC)
+        install(TARGETS ${PNG_LIB_NAME_STATIC}
+            LIBRARY DESTINATION lib
+            ARCHIVE DESTINATION lib)
+    endif()
+endif()
+
+if(NOT SKIP_INSTALL_HEADERS AND NOT SKIP_INSTALL_ALL )
 install(FILES png.h pngconf.h         DESTINATION include)
 install(FILES png.h pngconf.h         DESTINATION include/${PNGLIB_NAME})
-install(FILES libpng.3 libpngpf.3             DESTINATION man/man3)
-install(FILES png.5                           DESTINATION man/man5)
-install(FILES ${PNG_BINARY_DIR}/libpng.pc     DESTINATION lib/pkgconfig)
-install(FILES ${PNG_BINARY_DIR}/libpng-config      DESTINATION bin)
-install(FILES ${PNG_BINARY_DIR}/${PNGLIB_NAME}.pc  DESTINATION lib/pkgconfig)
-install(FILES ${PNG_BINARY_DIR}/${PNGLIB_NAME}-config DESTINATION bin)
+endif()
+if(NOT SKIP_INSTALL_FILES AND NOT SKIP_INSTALL_ALL )
+    install(FILES libpng.3 libpngpf.3             DESTINATION man/man3)
+    install(FILES png.5                           DESTINATION man/man5)
+    install(FILES ${PNG_BINARY_DIR}/libpng.pc     DESTINATION lib/pkgconfig)
+    install(FILES ${PNG_BINARY_DIR}/libpng-config      DESTINATION bin)
+    install(FILES ${PNG_BINARY_DIR}/${PNGLIB_NAME}.pc  DESTINATION lib/pkgconfig)
+    install(FILES ${PNG_BINARY_DIR}/${PNGLIB_NAME}-config DESTINATION bin)
+endif()
 
 # what's with libpng.txt and all the extra files?
 
diff --git a/src/3rdparty/libpng/scripts/descrip.mms b/src/3rdparty/libpng/scripts/descrip.mms
index 3584b0d782..f3a8d7bab7 100644
--- a/src/3rdparty/libpng/scripts/descrip.mms
+++ b/src/3rdparty/libpng/scripts/descrip.mms
@@ -1,6 +1,6 @@
 
 cc_defs = /inc=$(ZLIBSRC)
-c_deb = 
+c_deb =
 
 .ifdef __DECC__
 pref = /prefix=all
@@ -29,7 +29,7 @@ test : pngtest.exe
    run pngtest
 
 clean :
-	delete *.obj;*,*.exe;*
+	delete *.obj;*,*.exe;
 
 
 # Other dependencies.
@@ -44,9 +44,9 @@ pngerror.obj : png.h, pngconf.h
 pngmem.obj : png.h, pngconf.h
 pngrio.obj : png.h, pngconf.h
 pngwio.obj : png.h, pngconf.h
-pngtest.obj : png.h, pngconf.h
 pngtrans.obj : png.h, pngconf.h
 pngwrite.obj : png.h, pngconf.h
 pngwtran.obj : png.h, pngconf.h
 pngwutil.obj : png.h, pngconf.h
 
+pngtest.obj : png.h, pngconf.h
diff --git a/src/3rdparty/libpng/scripts/libpng-config-head.in b/src/3rdparty/libpng/scripts/libpng-config-head.in
index 15699383d7..38fcc086d1 100755
--- a/src/3rdparty/libpng/scripts/libpng-config-head.in
+++ b/src/3rdparty/libpng/scripts/libpng-config-head.in
@@ -4,11 +4,14 @@
 # provides configuration info for libpng.
 
 # Copyright (C) 2002 Glenn Randers-Pehrson
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Modeled after libxml-config.
 
-version=1.2.29
+version=1.2.40
 prefix=""
 libdir=""
 libs=""
diff --git a/src/3rdparty/libpng/scripts/libpng-config.in b/src/3rdparty/libpng/scripts/libpng-config.in
index f227ee5794..7ae7d50f20 100755
--- a/src/3rdparty/libpng/scripts/libpng-config.in
+++ b/src/3rdparty/libpng/scripts/libpng-config.in
@@ -4,7 +4,10 @@
 # provides configuration info for libpng.
 
 # Copyright (C) 2002, 2004, 2006, 2007 Glenn Randers-Pehrson
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Modeled after libxml-config.
 
@@ -14,7 +17,7 @@ exec_prefix="@exec_prefix@"
 libdir="@libdir@"
 includedir="@includedir@/libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@"
 libs="-lpng@PNGLIB_MAJOR@@PNGLIB_MINOR@"
-all_libs="-lpng@PNGLIB_MAJOR@@PNGLIB_MINOR@ -lz -lm"
+all_libs="-lpng@PNGLIB_MAJOR@@PNGLIB_MINOR@ @LIBS@"
 I_opts="-I${includedir}"
 L_opts="-L${libdir}"
 R_opts=""
diff --git a/src/3rdparty/libpng/scripts/libpng.icc b/src/3rdparty/libpng/scripts/libpng.icc
index f9c51af3a4..6635963501 100644
--- a/src/3rdparty/libpng/scripts/libpng.icc
+++ b/src/3rdparty/libpng/scripts/libpng.icc
@@ -1,13 +1,16 @@
 // Project file for libpng (static)
 // IBM VisualAge/C++ version 4.0 or later
 // Copyright (C) 2000 Cosmin Truta
-// For conditions of distribution and use, see copyright notice in png.h
+//
+// This code is released under the libpng license.
+// For conditions of distribution and use, see the disclaimer
+// and license in png.h
+//
 // Notes:
 //   All modules are compiled in C mode
 //   Tested with IBM VAC++ 4.0 under Win32
 //   Expected to work with IBM VAC++ 4.0 or later under OS/2 and Win32
 //   Can be easily adapted for IBM VAC++ 4.0 or later under AIX
-// For conditions of distribution and use, see copyright notice in png.h
 
 option incl(searchpath, "../zlib"), opt(level, "2"),
  link(libsearchpath, "../zlib")
diff --git a/src/3rdparty/libpng/scripts/libpng.pc-configure.in b/src/3rdparty/libpng/scripts/libpng.pc-configure.in
index e7c5e23f4b..cadb555021 100644
--- a/src/3rdparty/libpng/scripts/libpng.pc-configure.in
+++ b/src/3rdparty/libpng/scripts/libpng.pc-configure.in
@@ -1,10 +1,11 @@
 prefix=@prefix@
 exec_prefix=@exec_prefix@
 libdir=@libdir@
-includedir=@includedir@/libpng12
+includedir=@includedir@/libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@
 
 Name: libpng
 Description: Loads and saves PNG files
-Version: 1.2.29
-Libs: -L${libdir} -lpng12
+Version: @PNGLIB_VERSION@
+Libs: -L${libdir} -lpng@PNGLIB_MAJOR@@PNGLIB_MINOR@
+Libs.private: @LIBS@
 Cflags: -I${includedir} @LIBPNG_NO_MMX@
diff --git a/src/3rdparty/libpng/scripts/libpng.pc.in b/src/3rdparty/libpng/scripts/libpng.pc.in
index bcf61620bc..f4ab0d2891 100644
--- a/src/3rdparty/libpng/scripts/libpng.pc.in
+++ b/src/3rdparty/libpng/scripts/libpng.pc.in
@@ -5,6 +5,6 @@ includedir=@includedir@/libpng12
 
 Name: libpng
 Description: Loads and saves PNG files
-Version: 1.2.29
+Version: 1.2.40
 Libs: -L${libdir} -lpng12
 Cflags: -I${includedir}
diff --git a/src/3rdparty/libpng/scripts/makefile.32sunu b/src/3rdparty/libpng/scripts/makefile.32sunu
index 7b419f22b2..2ce4a3a905 100644
--- a/src/3rdparty/libpng/scripts/makefile.32sunu
+++ b/src/3rdparty/libpng/scripts/makefile.32sunu
@@ -3,12 +3,15 @@
 # Copyright (C) 2002, 2006 Glenn Randers-Pehrson
 # Copyright (C) 1998 Greg Roelofs
 # Copyright (C) 1996, 1997 Andreas Dilger
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Library name:
 LIBNAME=libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
diff --git a/src/3rdparty/libpng/scripts/makefile.64sunu b/src/3rdparty/libpng/scripts/makefile.64sunu
index a7762cc787..134e7924fc 100644
--- a/src/3rdparty/libpng/scripts/makefile.64sunu
+++ b/src/3rdparty/libpng/scripts/makefile.64sunu
@@ -3,12 +3,15 @@
 # Copyright (C) 2002, 2006 Glenn Randers-Pehrson
 # Copyright (C) 1998 Greg Roelofs
 # Copyright (C) 1996, 1997 Andreas Dilger
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Library name:
 LIBNAME=libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
diff --git a/src/3rdparty/libpng/scripts/makefile.acorn b/src/3rdparty/libpng/scripts/makefile.acorn
index 470cf89b16..a0e577b245 100644
--- a/src/3rdparty/libpng/scripts/makefile.acorn
+++ b/src/3rdparty/libpng/scripts/makefile.acorn
@@ -6,11 +6,10 @@ CCflags = -c -depend !Depend -IC:,Zlib: -g -throwback  -DRISCOS  -fnah
 C++flags = -c -depend !Depend -IC: -throwback
 Linkflags = -aif -c++ -o $@
 ObjAsmflags = -throwback -NoCache -depend !Depend
-CMHGflags = 
+CMHGflags =
 LibFileflags = -c -l -o $@
 Squeezeflags = -o $@
 
-
 # Final targets:
 @.libpng-lib:   @.o.png @.o.pngerror @.o.pngrio @.o.pngwio @.o.pngmem \
 	@.o.pngpread @.o.pngset @.o.pngget @.o.pngread @.o.pngrtran \
diff --git a/src/3rdparty/libpng/scripts/makefile.aix b/src/3rdparty/libpng/scripts/makefile.aix
index 99e38680d4..2cb6e67787 100644
--- a/src/3rdparty/libpng/scripts/makefile.aix
+++ b/src/3rdparty/libpng/scripts/makefile.aix
@@ -1,9 +1,12 @@
 # makefile for libpng using gcc (generic, static library)
-# Copyright (C) 2002, 2006 Glenn Randers-Pehrson
+# Copyright (C) 2002, 2006-2009 Glenn Randers-Pehrson
 # Copyright (C) 2000 Cosmin Truta
 # Copyright (C) 2000 Marc O. Gloor (AIX support added, from makefile.gcc)
 # Copyright (C) 1995 Guy Eric Schalnat, Group 42, Inc.
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Location of the zlib library and include files
 ZLIBINC = ../zlib
@@ -20,7 +23,7 @@ LN_SF = ln -f -s
 
 LIBNAME=libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 prefix=/usr/local
@@ -44,7 +47,7 @@ CDEBUG = -g -DPNG_DEBUG=5
 LDDEBUG =
 CRELEASE = -O2
 LDRELEASE = -s
-WARNMORE=-Wall
+WARNMORE=-W -Wall
 CFLAGS = -I$(ZLIBINC) $(WARNMORE) $(CRELEASE)
 LDFLAGS = -L. -L$(ZLIBLIB) -lpng12 -lz -lm $(LDRELEASE)
 
@@ -54,7 +57,7 @@ A=.a
 E=
 
 # Variables
-OBJS = png$(O) pngerror$(O) pngget$(O) pngmem$(O) pngpread$(O) \
+OBJS =  png$(O) pngerror$(O) pngget$(O) pngmem$(O) pngpread$(O) \
 	pngread$(O) pngrio$(O) pngrtran$(O) pngrutil$(O) pngset$(O) \
 	pngtrans$(O) pngwio$(O) pngwrite$(O) pngwtran$(O) pngwutil$(O)
 
@@ -94,20 +97,20 @@ install: $(LIBNAME)$(A)
 clean:
 	$(RM_F) *.o $(LIBNAME)$(A) pngtest pngout.png
 
-png$(O): png.h pngconf.h
+png$(O):      png.h pngconf.h
 pngerror$(O): png.h pngconf.h
-pngget$(O): png.h pngconf.h
-pngmem$(O): png.h pngconf.h
+pngget$(O):   png.h pngconf.h
+pngmem$(O):   png.h pngconf.h
 pngpread$(O): png.h pngconf.h
-pngread$(O): png.h pngconf.h
-pngrio$(O): png.h pngconf.h
+pngread$(O):  png.h pngconf.h
+pngrio$(O):   png.h pngconf.h
 pngrtran$(O): png.h pngconf.h
 pngrutil$(O): png.h pngconf.h
-pngset$(O): png.h pngconf.h
-pngtest$(O): png.h pngconf.h
+pngset$(O):   png.h pngconf.h
 pngtrans$(O): png.h pngconf.h
-pngwio$(O): png.h pngconf.h
+pngwio$(O):   png.h pngconf.h
 pngwrite$(O): png.h pngconf.h
 pngwtran$(O): png.h pngconf.h
 pngwutil$(O): png.h pngconf.h
 
+pngtest$(O):  png.h pngconf.h
diff --git a/src/3rdparty/libpng/scripts/makefile.amiga b/src/3rdparty/libpng/scripts/makefile.amiga
index 79cb42499f..50977c7b03 100644
--- a/src/3rdparty/libpng/scripts/makefile.amiga
+++ b/src/3rdparty/libpng/scripts/makefile.amiga
@@ -1,7 +1,10 @@
 # Commodore Amiga Makefile
 # makefile for libpng and SAS C V6.5x compiler
 # Copyright (C) 1995-2000 Wolf Faust
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 #
 # Note: Use #define PNG_READ_BIG_ENDIAN_SUPPORTED in pngconf.h
 #
diff --git a/src/3rdparty/libpng/scripts/makefile.atari b/src/3rdparty/libpng/scripts/makefile.atari
index 9566d5d608..944337d99b 100644
--- a/src/3rdparty/libpng/scripts/makefile.atari
+++ b/src/3rdparty/libpng/scripts/makefile.atari
@@ -1,8 +1,12 @@
 # makefile for libpng
 # Copyright (C) 2002 Glenn Randers-Pehrson
 # Copyright (C) 1995 Guy Eric Schalnat, Group 42, Inc.
-# For conditions of distribution and use, see copyright notice in png.h
-# modified for LC56/ATARI assumes libz.lib is in same dir and uses default
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
+
+# Modified for LC56/ATARI assumes libz.lib is in same dir and uses default
 # rules for library management
 #
 CFLAGS=-I..\zlib -O
diff --git a/src/3rdparty/libpng/scripts/makefile.bc32 b/src/3rdparty/libpng/scripts/makefile.bc32
index 04407dd17f..4b96231b54 100644
--- a/src/3rdparty/libpng/scripts/makefile.bc32
+++ b/src/3rdparty/libpng/scripts/makefile.bc32
@@ -11,7 +11,6 @@
 ## Where zlib.h, zconf.h and zlib.lib are
 ZLIB_DIR=..\zlib
 
-
 ## Compiler, linker and lib stuff
 CC=bcc32
 LD=bcc32
@@ -49,7 +48,6 @@ CFLAGS=-I$(ZLIB_DIR) -O2 -d -k- -w $(TARGET_CPU) $(CDEBUG)
 # -M  generate map file
 LDFLAGS=-L$(ZLIB_DIR) -M $(LDEBUG)
 
-
 ## Variables
 OBJS = \
 	png.obj \
@@ -87,7 +85,6 @@ LIBOBJS = \
 
 LIBNAME=libpng.lib
 
-
 ## Implicit rules
 # Braces let make "batch" calls to the compiler,
 # 2 calls instead of 12; space is important.
@@ -100,7 +97,6 @@ LIBNAME=libpng.lib
 .obj.exe:
 	$(LD) $(LDFLAGS) $*.obj $(LIBNAME) zlib.lib $(NOEHLIB)
 
-
 ## Major targets
 all: libpng pngtest
 
@@ -111,25 +107,24 @@ pngtest: pngtest.exe
 test: pngtest.exe
 	pngtest
 
-
 ## Minor Targets
 
-png.obj: png.c
-pngerror.obj: pngerror.c
-pngget.obj: pngget.c
-pngmem.obj: pngmem.c
-pngpread.obj: pngpread.c
-pngread.obj: pngread.c
-pngrio.obj: pngrio.c
-pngrtran.obj: pngrtran.c
-pngrutil.obj: pngrutil.c
-pngset.obj: pngset.c
-pngtrans.obj: pngtrans.c
-pngwio.obj: pngwio.c
-pngwrite.obj: pngwrite.c
-pngwtran.obj: pngwtran.c
-pngwutil.obj: pngwutil.c
-
+png.obj: png.c png.h pngconf.h
+pngerror.obj: pngerror.c png.h pngconf.h
+pngget.obj: pngget.c png.h pngconf.h
+pngmem.obj: pngmem.c png.h pngconf.h
+pngpread.obj: pngpread.c png.h pngconf.h
+pngread.obj: pngread.c png.h pngconf.h
+pngrio.obj: pngrio.c png.h pngconf.h
+pngrtran.obj: pngrtran.c png.h pngconf.h
+pngrutil.obj: pngrutil.c png.h pngconf.h
+pngset.obj: pngset.c png.h pngconf.h
+pngtrans.obj: pngtrans.c png.h pngconf.h
+pngwio.obj: pngwio.c png.h pngconf.h
+pngwrite.obj: pngwrite.c png.h pngconf.h
+pngwtran.obj: pngwtran.c png.h pngconf.h
+pngwutil.obj: pngwutil.c png.h pngconf.h
+pngtest.obj: pngtest.c png.h pngconf.h
 
 $(LIBNAME): $(OBJS)
 	-del $(LIBNAME)
@@ -137,7 +132,6 @@ $(LIBNAME): $(OBJS)
 $(LIBOBJS), libpng
 |
 
-
 # Cleanup
 clean:
 	-del *.obj
@@ -148,5 +142,4 @@ clean:
 	-del *.tds
 	-del pngout.png
 
-
 # End of makefile for libpng
diff --git a/src/3rdparty/libpng/scripts/makefile.beos b/src/3rdparty/libpng/scripts/makefile.beos
index 341a57c459..5dbf14c430 100644
--- a/src/3rdparty/libpng/scripts/makefile.beos
+++ b/src/3rdparty/libpng/scripts/makefile.beos
@@ -1,14 +1,17 @@
 # makefile for libpng on BeOS x86 ELF with gcc
 # modified from makefile.linux by Sander Stoks
-# Copyright (C) 2002, 2006 Glenn Randers-Pehrson
+# Copyright (C) 2002, 2006, 2008 Glenn Randers-Pehrson
 # Copyright (C) 1999 Greg Roelofs
 # Copyright (C) 1996, 1997 Andreas Dilger
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Library name:
 LIBNAME=libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
@@ -41,7 +44,7 @@ WARNMORE=-Wwrite-strings -Wpointer-arith -Wshadow \
 
 # On BeOS, -O1 is actually better than -O3.  This is a known bug but it's
 # still here in R4.5
-CFLAGS=-I$(ZLIBINC) -Wall -O1 -funroll-loops \
+CFLAGS=-I$(ZLIBINC) -W -Wall -O1 -funroll-loops \
 	$(ALIGN) # $(WARNMORE) -g -DPNG_DEBUG=5
 # LDFLAGS=-L. -Wl,-rpath,. -L$(ZLIBLIB) -Wl,-rpath,$(ZLIBLIB) -lpng -lz
 LDFLAGS=-L. -Wl,-soname=$(LIBSOMAJ) -L$(ZLIBLIB) -lz
@@ -223,4 +226,5 @@ pngwrite.o pngwrite.pic.o: png.h pngconf.h
 pngwtran.o pngwtran.pic.o: png.h pngconf.h
 pngwutil.o pngwutil.pic.o: png.h pngconf.h
 pngpread.o pngpread.pic.o: png.h pngconf.h
+
 pngtest.o: png.h pngconf.h
diff --git a/src/3rdparty/libpng/scripts/makefile.bor b/src/3rdparty/libpng/scripts/makefile.bor
index a5651aa3f8..0a8ef001d4 100644
--- a/src/3rdparty/libpng/scripts/makefile.bor
+++ b/src/3rdparty/libpng/scripts/makefile.bor
@@ -12,7 +12,6 @@
 ## Where zlib.h, zconf.h and zlib_MODEL.lib are
 ZLIB_DIR=..\zlib
 
-
 ## Compiler, linker and lib stuff
 CC=bcc
 LD=bcc
@@ -57,8 +56,8 @@ CFLAGS=-O2 -Z -X- -w -I$(ZLIB_DIR) -$(TARGET_CPU) $(MODEL_ARG) $(CDEBUG)
 # -M  generate map file
 LDFLAGS=-M -L$(ZLIB_DIR) $(MODEL_ARG) $(LDEBUG)
 
-
 ## Variables
+
 OBJS = \
 	png.obj \
 	pngerror.obj \
@@ -95,8 +94,8 @@ LIBOBJS = \
 
 LIBNAME=libpng$(MODEL).lib
 
-
 ## Implicit rules
+
 # Braces let make "batch" calls to the compiler,
 # 2 calls instead of 12; space is important.
 .c.obj:
@@ -105,8 +104,8 @@ LIBNAME=libpng$(MODEL).lib
 .c.exe:
 	$(CC) $(CFLAGS) $(LDFLAGS) $*.c $(LIBNAME) zlib_$(MODEL).lib $(NOEHLIB)
 
-
 ## Major targets
+
 all: libpng pngtest
 
 libpng: $(LIBNAME)
@@ -116,25 +115,23 @@ pngtest: pngtest$(MODEL).exe
 test: pngtest$(MODEL).exe
 	pngtest$(MODEL)
 
-
 ## Minor Targets
 
-png.obj: png.c
-pngerror.obj: pngerror.c
-pngget.obj: pngget.c
-pngmem.obj: pngmem.c
-pngpread.obj: pngpread.c
-pngread.obj: pngread.c
-pngrio.obj: pngrio.c
-pngrtran.obj: pngrtran.c
-pngrutil.obj: pngrutil.c
-pngset.obj: pngset.c
-pngtrans.obj: pngtrans.c
-pngwio.obj: pngwio.c
-pngwrite.obj: pngwrite.c
-pngwtran.obj: pngwtran.c
-pngwutil.obj: pngwutil.c
-
+png.obj: png.c png.h pngconf.h
+pngerror.obj: pngerror.c png.h pngconf.h
+pngget.obj: pngget.c png.h pngconf.h
+pngmem.obj: pngmem.c png.h pngconf.h
+pngpread.obj: pngpread.c png.h pngconf.h
+pngread.obj: pngread.c png.h pngconf.h
+pngrio.obj: pngrio.c png.h pngconf.h
+pngrtran.obj: pngrtran.c png.h pngconf.h
+pngrutil.obj: pngrutil.c png.h pngconf.h
+pngset.obj: pngset.c png.h pngconf.h
+pngtrans.obj: pngtrans.c png.h pngconf.h
+pngwio.obj: pngwio.c png.h pngconf.h
+pngwrite.obj: pngwrite.c png.h pngconf.h
+pngwtran.obj: pngwtran.c png.h pngconf.h
+pngwutil.obj: pngwutil.c png.h pngconf.h
 
 $(LIBNAME): $(OBJS)
 	-del $(LIBNAME)
@@ -142,14 +139,12 @@ $(LIBNAME): $(OBJS)
 $(LIBOBJS), libpng$(MODEL)
 |
 
-
 pngtest$(MODEL).obj: pngtest.c
 	$(CC) $(CFLAGS) -opngtest$(MODEL) -c pngtest.c
 
 pngtest$(MODEL).exe: pngtest$(MODEL).obj
 	$(LD) $(LDFLAGS) pngtest$(MODEL).obj $(LIBNAME) zlib_$(MODEL).lib $(NOEHLIB)
 
-
 # Clean up anything else you want
 clean:
 	-del *.obj
@@ -158,5 +153,4 @@ clean:
 	-del *.lst
 	-del *.map
 
-
 # End of makefile for libpng
diff --git a/src/3rdparty/libpng/scripts/makefile.cygwin b/src/3rdparty/libpng/scripts/makefile.cygwin
index bbf3e5fdc2..2a19090c7e 100644
--- a/src/3rdparty/libpng/scripts/makefile.cygwin
+++ b/src/3rdparty/libpng/scripts/makefile.cygwin
@@ -3,11 +3,14 @@
 #   of the library, and builds two copies of pngtest: one
 #   statically linked and one dynamically linked.
 #
-# Copyright (C) 2002, 2006, 2007 Soren Anderson, Charles Wilson,
+# Copyright (C) 2002, 2006-2008 Soren Anderson, Charles Wilson,
 #    and Glenn Randers-Pehrson, based on makefile for linux-elf w/mmx by:
 # Copyright (C) 1998-2000 Greg Roelofs
 # Copyright (C) 1996, 1997 Andreas Dilger
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # This makefile intends to support building outside the src directory
 # if desired. When invoking it, specify an argument to SRCDIR on the
@@ -60,21 +63,21 @@ WARNMORE=-Wwrite-strings -Wpointer-arith -Wshadow \
 
 ### if you don't need thread safety, but want the asm accel
 #CFLAGS= $(strip $(MINGW_CCFLAGS) -DPNG_THREAD_UNSAFE_OK \
-#	$(addprefix -I,$(ZLIBINC)) -Wall -O $(ALIGN) -funroll-loops \
+#	$(addprefix -I,$(ZLIBINC)) -W -Wall -O $(ALIGN) -funroll-loops \
 #	-fomit-frame-pointer)  # $(WARNMORE) -g -DPNG_DEBUG=5
 ### if you need thread safety and want (minimal) asm accel
 #CFLAGS= $(strip $(MINGW_CCFLAGS) $(addprefix -I,$(ZLIBINC)) \
-#	-Wall -O $(ALIGN) -funroll-loops \
+#	-W -Wall -O $(ALIGN) -funroll-loops \
 #	-fomit-frame-pointer)  # $(WARNMORE) -g -DPNG_DEBUG=5
 ### Normal (non-asm) compilation
 CFLAGS= $(strip $(MINGW_CCFLAGS) $(addprefix -I,$(ZLIBINC)) \
-        -Wall -O3 $(ALIGN) -funroll-loops -DPNG_NO_MMX_CODE \
+        -W -Wall -O3 $(ALIGN) -funroll-loops -DPNG_NO_MMX_CODE \
 	-fomit-frame-pointer) # $(WARNMORE) -g -DPNG_DEBUG=5
 
 LIBNAME = libpng12
 PNGMAJ = 0
 CYGDLL = 12
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 SHAREDLIB=cygpng$(CYGDLL).dll
@@ -176,7 +179,7 @@ pngtest-stat$(EXE): pngtest.o $(STATLIB)
 pngtest.pic.o: pngtest.c
 	$(CC) $(CFLAGS) -c $< -o $@
 
-pngtest.o: pngtest.c
+pngtest.o: pngtest.c png.h pngconf.h
 	$(CC) $(CFLAGS) -c $< -o $@
 
 test: test-static test-shared
diff --git a/src/3rdparty/libpng/scripts/makefile.darwin b/src/3rdparty/libpng/scripts/makefile.darwin
index 76be8a6d55..c07880fb92 100644
--- a/src/3rdparty/libpng/scripts/makefile.darwin
+++ b/src/3rdparty/libpng/scripts/makefile.darwin
@@ -1,10 +1,13 @@
 # makefile for libpng on Darwin / Mac OS X
-# Copyright (C) 2002, 2004, 2006 Glenn Randers-Pehrson
+# Copyright (C) 2002, 2004, 2006, 2008 Glenn Randers-Pehrson
 # Copyright (C) 2001 Christoph Pfisterer
 # derived from makefile.linux:
 #  Copyright (C) 1998, 1999 Greg Roelofs
 #  Copyright (C) 1996, 1997 Andreas Dilger
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # where "make install" puts libpng.a, libpng12.dylib, png.h and pngconf.h
 prefix=/usr/local
@@ -18,8 +21,8 @@ ZLIBINC=../zlib
 
 # Library name:
 LIBNAME = libpng12
-PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMAJ = 12
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
@@ -38,8 +41,8 @@ LN_SF=ln -sf
 RANLIB=ranlib
 RM_F=/bin/rm -f
 
-# CFLAGS=-I$(ZLIBINC) -Wall -O3 -funroll-loops -DPNG_NO_MMX_CODE
-CFLAGS=-I$(ZLIBINC) -Wall -O -funroll-loops
+# CFLAGS=-I$(ZLIBINC) -W -Wall -O3 -funroll-loops -DPNG_NO_MMX_CODE
+CFLAGS=-I$(ZLIBINC) -W -Wall -O -funroll-loops
 LDFLAGS=-L. -L$(ZLIBLIB) -lpng12 -lz
 
 INCPATH=$(prefix)/include
@@ -104,7 +107,7 @@ $(LIBSOMAJ): $(LIBSOVER)
 $(LIBSOVER): $(OBJSDLL)
 	$(CC) -dynamiclib \
 	 -install_name $(LIBPATH)/$(LIBSOMAJ) \
-	 -current_version $(PNGVER) -compatibility_version $(PNGVER) \
+	 -current_version 0 -compatibility_version 0 \
 	 -o $(LIBSOVER) \
 	 $(OBJSDLL) -L$(ZLIBLIB) -lz
 
diff --git a/src/3rdparty/libpng/scripts/makefile.dec b/src/3rdparty/libpng/scripts/makefile.dec
index de35c56bff..b8f99dba98 100644
--- a/src/3rdparty/libpng/scripts/makefile.dec
+++ b/src/3rdparty/libpng/scripts/makefile.dec
@@ -1,11 +1,14 @@
 # makefile for libpng on DEC Alpha Unix
 # Copyright (C) 2000-2002, 2006 Glenn Randers-Pehrson
 # Copyright (C) 1995 Guy Eric Schalnat, Group 42, Inc.
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Library name:
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 LIBNAME = libpng12
 
@@ -205,10 +208,10 @@ pngget.o: png.h pngconf.h
 pngread.o: png.h pngconf.h
 pngrtran.o: png.h pngconf.h
 pngrutil.o: png.h pngconf.h
-pngtest.o: png.h pngconf.h
 pngtrans.o: png.h pngconf.h
 pngwrite.o: png.h pngconf.h
 pngwtran.o: png.h pngconf.h
 pngwutil.o: png.h pngconf.h
 pngpread.o: png.h pngconf.h
 
+pngtest.o: png.h pngconf.h
diff --git a/src/3rdparty/libpng/scripts/makefile.dj2 b/src/3rdparty/libpng/scripts/makefile.dj2
index 09045c2755..28821a4ac7 100644
--- a/src/3rdparty/libpng/scripts/makefile.dj2
+++ b/src/3rdparty/libpng/scripts/makefile.dj2
@@ -1,7 +1,10 @@
 # DJGPP (DOS gcc) makefile for libpng
-# Copyright (C) 2002 Glenn Randers-Pehrson
+# Copyright (C) 2002, 2006, 2009 Glenn Randers-Pehrson
 # Copyright (C) 1995 Guy Eric Schalnat, Group 42, Inc.
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # where make install will put libpng.a and png.h
 #prefix=/usr/local
@@ -47,9 +50,9 @@ pngread.o: png.h pngconf.h
 pngpread.o: png.h pngconf.h
 pngrtran.o: png.h pngconf.h
 pngrutil.o: png.h pngconf.h
-pngtest.o: png.h pngconf.h
 pngtrans.o: png.h pngconf.h
 pngwrite.o: png.h pngconf.h
 pngwtran.o: png.h pngconf.h
 pngwutil.o: png.h pngconf.h
 
+pngtest.o: png.h pngconf.h
diff --git a/src/3rdparty/libpng/scripts/makefile.elf b/src/3rdparty/libpng/scripts/makefile.elf
index 1c1a8e9466..126a9a14bd 100644
--- a/src/3rdparty/libpng/scripts/makefile.elf
+++ b/src/3rdparty/libpng/scripts/makefile.elf
@@ -1,7 +1,11 @@
 # makefile for libpng.a and libpng12.so on Linux ELF with gcc
-# Copyright (C) 1998, 1999, 2002, 2006 Greg Roelofs and Glenn Randers-Pehrson
+# Copyright (C) 1998, 1999, 2002, 2006, 2008 Greg Roelofs
+# and Glenn Randers-Pehrson
 # Copyright (C) 1996, 1997 Andreas Dilger
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Modified for Debian by Junichi Uekawa and Josselin Mouette
 # Major modifications are:
@@ -12,7 +16,7 @@
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
@@ -53,7 +57,7 @@ WARNMORE=-Wwrite-strings -Wpointer-arith -Wshadow \
 
 # for pgcc version 2.95.1, -O3 is buggy; don't use it.
 
-CFLAGS=-Wall -D_REENTRANT -O2 \
+CFLAGS=-W -Wall -D_REENTRANT -O2 \
 	$(ALIGN) # $(WARNMORE) -g -DPNG_DEBUG=5
 
 LDFLAGS=-L. -lpng12
diff --git a/src/3rdparty/libpng/scripts/makefile.freebsd b/src/3rdparty/libpng/scripts/makefile.freebsd
index 59f36444f9..d9df1ee321 100644
--- a/src/3rdparty/libpng/scripts/makefile.freebsd
+++ b/src/3rdparty/libpng/scripts/makefile.freebsd
@@ -1,6 +1,9 @@
 # makefile for libpng under FreeBSD
-# Copyright (C) 2002, 2007 Glenn Randers-Pehrson and Andrey A. Chernov
-# For conditions of distribution and use, see copyright notice in png.h
+# Copyright (C) 2002, 2007, 2009 Glenn Randers-Pehrson and Andrey A. Chernov
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 PREFIX?=        /usr/local
 SHLIB_VER?=     5
diff --git a/src/3rdparty/libpng/scripts/makefile.gcc b/src/3rdparty/libpng/scripts/makefile.gcc
index e899b108e3..d1fb8674a8 100644
--- a/src/3rdparty/libpng/scripts/makefile.gcc
+++ b/src/3rdparty/libpng/scripts/makefile.gcc
@@ -1,7 +1,11 @@
 # makefile for libpng using gcc (generic, static library)
+# Copyright (C) 2008 Glenn Randers-Pehrson
 # Copyright (C) 2000 Cosmin Truta
 # Copyright (C) 1995 Guy Eric Schalnat, Group 42, Inc.
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Location of the zlib library and include files
 ZLIBINC = ../zlib
@@ -18,8 +22,8 @@ CDEBUG = -g -DPNG_DEBUG=5
 LDDEBUG =
 CRELEASE = -O2
 LDRELEASE = -s
-#CFLAGS = -Wall $(CDEBUG)
-CFLAGS = -Wall $(CRELEASE)
+#CFLAGS = -W -Wall $(CDEBUG)
+CFLAGS = -W -Wall $(CRELEASE)
 #LDFLAGS = $(LDDEBUG)
 LDFLAGS = $(LDRELEASE)
 LIBS = -lz -lm
@@ -30,9 +34,9 @@ A=.a
 EXE=
 
 # Variables
-OBJS = png$(O) pngerror$(O) pngget$(O) pngmem$(O) pngpread$(O) \
-       pngread$(O) pngrio$(O) pngrtran$(O) pngrutil$(O) pngset$(O) \
-       pngtrans$(O) pngwio$(O) pngwrite$(O) pngwtran$(O) pngwutil$(O)
+OBJS =  png$(O) pngerror$(O) pngget$(O) pngmem$(O) pngpread$(O) \
+	pngread$(O) pngrio$(O) pngrtran$(O) pngrutil$(O) pngset$(O) \
+	pngtrans$(O) pngwio$(O) pngwrite$(O) pngwtran$(O) pngwutil$(O)
 
 # Targets
 all: static
@@ -60,20 +64,20 @@ pngtest$(EXE): pngtest$(O) libpng$(A)
 clean:
 	$(RM_F) *$(O) libpng$(A) pngtest$(EXE) pngout.png
 
-png$(O): png.h pngconf.h
+png$(O):      png.h pngconf.h
 pngerror$(O): png.h pngconf.h
-pngget$(O): png.h pngconf.h
-pngmem$(O): png.h pngconf.h
+pngget$(O):   png.h pngconf.h
+pngmem$(O):   png.h pngconf.h
 pngpread$(O): png.h pngconf.h
-pngread$(O): png.h pngconf.h
-pngrio$(O): png.h pngconf.h
+pngread$(O):  png.h pngconf.h
+pngrio$(O):   png.h pngconf.h
 pngrtran$(O): png.h pngconf.h
 pngrutil$(O): png.h pngconf.h
-pngset$(O): png.h pngconf.h
-pngtest$(O): png.h pngconf.h
+pngset$(O):   png.h pngconf.h
 pngtrans$(O): png.h pngconf.h
-pngwio$(O): png.h pngconf.h
+pngwio$(O):   png.h pngconf.h
 pngwrite$(O): png.h pngconf.h
 pngwtran$(O): png.h pngconf.h
 pngwutil$(O): png.h pngconf.h
 
+pngtest$(O):  png.h pngconf.h
diff --git a/src/3rdparty/libpng/scripts/makefile.gcmmx b/src/3rdparty/libpng/scripts/makefile.gcmmx
index f25d09f343..b569e878d4 100644
--- a/src/3rdparty/libpng/scripts/makefile.gcmmx
+++ b/src/3rdparty/libpng/scripts/makefile.gcmmx
@@ -1,9 +1,12 @@
 # makefile for libpng.a and libpng12.so on Linux ELF with gcc using MMX
 # assembler code
-# Copyright 2002, 2006 Greg Roelofs and Glenn Randers-Pehrson
+# Copyright 2002, 2006, 2008 Greg Roelofs and Glenn Randers-Pehrson
 # Copyright 1998-2001 Greg Roelofs
 # Copyright 1996-1997 Andreas Dilger
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # CAUTION: Do not use this makefile with gcc versions 2.7.2.2 and earlier.
 
@@ -14,7 +17,7 @@
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
@@ -58,17 +61,17 @@ WARNMORE=-Wwrite-strings -Wpointer-arith -Wshadow \
 
 # Remove -DPNG_THREAD_UNSAFE_OK if you need thread safety
 ### for generic gcc:
-CFLAGS=-DPNG_THREAD_UNSAFE_OK -I$(ZLIBINC) -Wall -O \
+CFLAGS=-DPNG_THREAD_UNSAFE_OK -I$(ZLIBINC) -W -Wall -O \
 	$(ALIGN) -funroll-loops \
 	-fomit-frame-pointer  # $(WARNMORE) -g -DPNG_DEBUG=5
 ### for gcc 2.95.2 on 686:
-#CFLAGS=-DPNG_THREAD_UNSAFE_OK -I$(ZLIBINC) -Wall -O \
+#CFLAGS=-DPNG_THREAD_UNSAFE_OK -I$(ZLIBINC) -W -Wall -O \
 #	-mcpu=i686 -malign-double -ffast-math -fstrict-aliasing \
-#	$(ALIGN) -funroll-loops -funroll-all-loops -fomit-frame-pointer 
+#	$(ALIGN) -funroll-loops -funroll-all-loops -fomit-frame-pointer
 ### for gcc 2.7.2.3 on 486 and up:
-#CFLAGS=-DPNG_THREAD_UNSAFE_OK -I$(ZLIBINC) -Wall -O \
+#CFLAGS=-DPNG_THREAD_UNSAFE_OK -I$(ZLIBINC) -W -Wall -O \
 #	-m486 -malign-double -ffast-math \
-#	$(ALIGN) -funroll-loops -funroll-all-loops -fomit-frame-pointer 
+#	$(ALIGN) -funroll-loops -funroll-all-loops -fomit-frame-pointer
 
 LDFLAGS=-L. -Wl,-rpath,. -L$(ZLIBLIB) -Wl,-rpath,$(ZLIBLIB) -lpng12 -lz -lm
 LDFLAGS_A=-L$(ZLIBLIB) -Wl,-rpath,$(ZLIBLIB) libpng.a -lz -lm
diff --git a/src/3rdparty/libpng/scripts/makefile.hp64 b/src/3rdparty/libpng/scripts/makefile.hp64
index c8895e7dbf..27f6c234cd 100644
--- a/src/3rdparty/libpng/scripts/makefile.hp64
+++ b/src/3rdparty/libpng/scripts/makefile.hp64
@@ -1,8 +1,11 @@
 # makefile for libpng, HPUX (10.20 and 11.00) using the ANSI/C product.
-# Copyright (C) 1999-2002 Glenn Randers-Pehrson
+# Copyright (C) 1999-2002, 2006, 2009 Glenn Randers-Pehrson
 # Copyright (C) 1995 Guy Eric Schalnat, Group 42
 # contributed by Jim Rice and updated by Chris Schleicher, Hewlett Packard
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Where the zlib library and include files are located
 ZLIBLIB=/opt/zlib/lib
@@ -18,7 +21,7 @@ ZLIBINC=/opt/zlib/include
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
@@ -227,9 +230,10 @@ pngget.o: png.h pngconf.h
 pngread.o: png.h pngconf.h
 pngrtran.o: png.h pngconf.h
 pngrutil.o: png.h pngconf.h
-pngtest.o: png.h pngconf.h
 pngtrans.o: png.h pngconf.h
 pngwrite.o: png.h pngconf.h
 pngwtran.o: png.h pngconf.h
 pngwutil.o: png.h pngconf.h
 pngpread.o: png.h pngconf.h
+
+pngtest.o: png.h pngconf.h
diff --git a/src/3rdparty/libpng/scripts/makefile.hpgcc b/src/3rdparty/libpng/scripts/makefile.hpgcc
index 785c1ed7c4..dc05d5a02d 100644
--- a/src/3rdparty/libpng/scripts/makefile.hpgcc
+++ b/src/3rdparty/libpng/scripts/makefile.hpgcc
@@ -1,14 +1,17 @@
 # makefile for libpng on HP-UX using GCC with the HP ANSI/C linker.
-# Copyright (C) 2002, 2006, 2007 Glenn Randers-Pehrson
+# Copyright (C) 2002, 2006-2008 Glenn Randers-Pehrson
 # Copyright (C) 2001, Laurent faillie
 # Copyright (C) 1998, 1999 Greg Roelofs
 # Copyright (C) 1996, 1997 Andreas Dilger
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
@@ -53,7 +56,7 @@ WARNMORE=-Wwrite-strings -Wpointer-arith -Wshadow \
 
 # for pgcc version 2.95.1, -O3 is buggy; don't use it.
 
-CFLAGS=-I$(ZLIBINC) -Wall -O3 -funroll-loops -DPNG_NO_MMX_CODE \
+CFLAGS=-I$(ZLIBINC) -W -Wall -O3 -funroll-loops -DPNG_NO_MMX_CODE \
 	$(ALIGN) # $(WARNMORE) -g -DPNG_DEBUG=5
 #LDFLAGS=-L. -Wl,-rpath,. -L$(ZLIBLIB) -Wl,-rpath,$(ZLIBLIB) -lpng12 -lz -lm
 LDFLAGS=-L. -L$(ZLIBLIB) -lpng12 -lz -lm
diff --git a/src/3rdparty/libpng/scripts/makefile.hpux b/src/3rdparty/libpng/scripts/makefile.hpux
index b0dfcdc9aa..31602190f7 100644
--- a/src/3rdparty/libpng/scripts/makefile.hpux
+++ b/src/3rdparty/libpng/scripts/makefile.hpux
@@ -2,7 +2,10 @@
 # Copyright (C) 1999-2002, 2006 Glenn Randers-Pehrson
 # Copyright (C) 1995 Guy Eric Schalnat, Group 42
 # contributed by Jim Rice and updated by Chris Schleicher, Hewlett Packard
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Where the zlib library and include files are located
 ZLIBLIB=/opt/zlib/lib
@@ -18,7 +21,7 @@ ZLIBINC=/opt/zlib/include
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
@@ -224,9 +227,10 @@ pngget.o: png.h pngconf.h
 pngread.o: png.h pngconf.h
 pngrtran.o: png.h pngconf.h
 pngrutil.o: png.h pngconf.h
-pngtest.o: png.h pngconf.h
 pngtrans.o: png.h pngconf.h
 pngwrite.o: png.h pngconf.h
 pngwtran.o: png.h pngconf.h
 pngwutil.o: png.h pngconf.h
 pngpread.o: png.h pngconf.h
+
+pngtest.o: png.h pngconf.h
diff --git a/src/3rdparty/libpng/scripts/makefile.ibmc b/src/3rdparty/libpng/scripts/makefile.ibmc
index f09a62c9e3..35d7f56101 100644
--- a/src/3rdparty/libpng/scripts/makefile.ibmc
+++ b/src/3rdparty/libpng/scripts/makefile.ibmc
@@ -1,7 +1,12 @@
 # Makefile for libpng (static)
 # IBM C version 3.x for Win32 and OS/2
+# Copyright (C) 2006 Glenn Randers-Pehrson
 # Copyright (C) 2000 Cosmin Truta
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
+
 # Notes:
 #   Derived from makefile.std
 #   All modules are compiled in C mode
@@ -53,19 +58,20 @@ clean:
 	$(RM) pngtest$(E)
 	$(RM) pngout.png
 
-png$(O): png.h pngconf.h
+png$(O):      png.h pngconf.h
 pngerror$(O): png.h pngconf.h
-pngget$(O): png.h pngconf.h
-pngmem$(O): png.h pngconf.h
+pngget$(O):   png.h pngconf.h
+pngmem$(O):   png.h pngconf.h
 pngpread$(O): png.h pngconf.h
-pngread$(O): png.h pngconf.h
-pngrio$(O): png.h pngconf.h
+pngread$(O):  png.h pngconf.h
+pngrio$(O):   png.h pngconf.h
 pngrtran$(O): png.h pngconf.h
 pngrutil$(O): png.h pngconf.h
-pngset$(O): png.h pngconf.h
-pngtest$(O): png.h pngconf.h
+pngset$(O):   png.h pngconf.h
 pngtrans$(O): png.h pngconf.h
-pngwio$(O): png.h pngconf.h
+pngwio$(O):   png.h pngconf.h
 pngwrite$(O): png.h pngconf.h
 pngwtran$(O): png.h pngconf.h
 pngwutil$(O): png.h pngconf.h
+
+pngtest$(O):  png.h pngconf.h
diff --git a/src/3rdparty/libpng/scripts/makefile.intel b/src/3rdparty/libpng/scripts/makefile.intel
index b0b523af08..88a2957601 100644
--- a/src/3rdparty/libpng/scripts/makefile.intel
+++ b/src/3rdparty/libpng/scripts/makefile.intel
@@ -1,12 +1,17 @@
 # Makefile for libpng
 # Microsoft Visual C++ with Intel C/C++ Compiler 4.0 and later
 
+# Copyright (C) 2006 Glenn Randers-Pehrson
 # Copyright (C) 2000, Pawel Mrochen, based on makefile.msc which is
 # copyright 1995 Guy Eric Schalnat, Group 42, Inc.
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # To use, do "nmake /f scripts\makefile.intel"
 
+# ------------------- Intel C/C++ Compiler 4.0 and later -------------------
 
 # Where the zlib library and include files are located
 ZLIBLIB=..\zlib
@@ -26,7 +31,6 @@ CALLING=r	# __fastcall
 
 # --------------------------------------------------------------------------
 
-
 CC=icl -c
 CFLAGS=-O2 -G$(CPU)$(CALLING) -Qip -Qunroll4 -I$(ZLIBINC) -nologo
 LD=link
@@ -73,9 +77,6 @@ pngrio$(O): png.h pngconf.h
 pngwio$(O): png.h pngconf.h
 	$(CC) $(CFLAGS) $*.c $(ERRFILE)
 
-pngtest$(O): png.h pngconf.h
-	$(CC) $(CFLAGS) $*.c $(ERRFILE)
-
 pngtrans$(O): png.h pngconf.h
 	$(CC) $(CFLAGS) $*.c $(ERRFILE)
 
@@ -95,6 +96,9 @@ libpng.lib: $(OBJS)
 pngtest.exe: pngtest.obj libpng.lib
 	$(LD) $(LDFLAGS) /OUT:pngtest.exe pngtest.obj libpng.lib $(ZLIBLIB)\zlib.lib
 
+pngtest$(O): png.h pngconf.h
+	$(CC) $(CFLAGS) $*.c $(ERRFILE)
+
 test: pngtest.exe
 	pngtest.exe
 
diff --git a/src/3rdparty/libpng/scripts/makefile.knr b/src/3rdparty/libpng/scripts/makefile.knr
index 44ee538a33..7b465856d7 100644
--- a/src/3rdparty/libpng/scripts/makefile.knr
+++ b/src/3rdparty/libpng/scripts/makefile.knr
@@ -1,7 +1,10 @@
 # makefile for libpng
-# Copyright (C) 2002 Glenn Randers-Pehrson
+# Copyright (C) 2002, 2006, 2009 Glenn Randers-Pehrson
 # Copyright (C) 1995 Guy Eric Schalnat, Group 42, Inc.
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # This makefile requires the file ansi2knr.c, which you can get
 # from the Ghostscript ftp site at ftp://ftp.cs.wisc.edu/ghost/
@@ -58,7 +61,7 @@ pngtest: pngtest.o libpng.a
 test: pngtest
 	./pngtest
 
-install: libpng.a
+install: libpng.a png.h pngconf.h
 	-@mkdir $(DESTDIR)$(INCPATH)
 	-@mkdir $(DESTDIR)$(INCPATH)/libpng
 	-@mkdir $(DESTDIR)$(LIBPATH)
@@ -92,8 +95,9 @@ pngread.o: png.h pngconf.h
 pngpread.o: png.h pngconf.h
 pngrtran.o: png.h pngconf.h
 pngrutil.o: png.h pngconf.h
-pngtest.o: png.h pngconf.h
 pngtrans.o: png.h pngconf.h
 pngwrite.o: png.h pngconf.h
 pngwtran.o: png.h pngconf.h
 pngwutil.o: png.h pngconf.h
+
+pngtest.o: png.h pngconf.h
diff --git a/src/3rdparty/libpng/scripts/makefile.linux b/src/3rdparty/libpng/scripts/makefile.linux
index b07c58f0f7..ba60a218d3 100644
--- a/src/3rdparty/libpng/scripts/makefile.linux
+++ b/src/3rdparty/libpng/scripts/makefile.linux
@@ -1,12 +1,16 @@
 # makefile for libpng.a and libpng12.so on Linux ELF with gcc
-# Copyright (C) 1998, 1999, 2002, 2006 Greg Roelofs and Glenn Randers-Pehrson
+# Copyright (C) 1998, 1999, 2002, 2006, 2008 Greg Roelofs and
+# Glenn Randers-Pehrson
 # Copyright (C) 1996, 1997 Andreas Dilger
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
@@ -47,7 +51,7 @@ WARNMORE=-Wwrite-strings -Wpointer-arith -Wshadow \
 
 # for pgcc version 2.95.1, -O3 is buggy; don't use it.
 
-CFLAGS=-I$(ZLIBINC) -Wall -O3 -funroll-loops -DPNG_NO_MMX_CODE \
+CFLAGS=-I$(ZLIBINC) -W -Wall -O3 -funroll-loops -DPNG_NO_MMX_CODE \
 	$(ALIGN) # $(WARNMORE) -g -DPNG_DEBUG=5
 
 LDFLAGS=-L. -Wl,-rpath,. -L$(ZLIBLIB) -Wl,-rpath,$(ZLIBLIB) -lpng12 -lz -lm
@@ -73,7 +77,7 @@ DI=$(DESTDIR)$(INCPATH)
 DL=$(DESTDIR)$(LIBPATH)
 DM=$(DESTDIR)$(MANPATH)
 
-OBJS = png.o pngset.o pngget.o pngrutil.o pngtrans.o pngwutil.o \
+OBJS =  png.o pngset.o pngget.o pngrutil.o pngtrans.o pngwutil.o \
 	pngread.o pngrio.o pngwio.o pngwrite.o pngrtran.o \
 	pngwtran.o pngmem.o pngerror.o pngpread.o
 
diff --git a/src/3rdparty/libpng/scripts/makefile.mingw b/src/3rdparty/libpng/scripts/makefile.mingw
index 6df86e8dba..50c52ea561 100644
--- a/src/3rdparty/libpng/scripts/makefile.mingw
+++ b/src/3rdparty/libpng/scripts/makefile.mingw
@@ -3,13 +3,16 @@
 #   of the library, and builds two copies of pngtest: one
 #   statically linked and one dynamically linked.
 #
-# Built from makefile.cygwin
-# Copyright (C) 2002, 2006 Soren Anderson, Charles Wilson,
+# Copyright (C) 2002, 2006, 2008 Soren Anderson, Charles Wilson,
 #    and Glenn Randers-Pehrson, based on makefile for linux-elf w/mmx by:
 # Copyright (C) 1998-2000, 2007 Greg Roelofs
 # Copyright (C) 1996, 1997 Andreas Dilger
-# For conditions of distribution and use, see copyright notice in png.h
 
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
+
+# Built from makefile.cygwin
 
 # This makefile intends to support building outside the src directory
 # if desired. When invoking it, specify an argument to SRCDIR on the
@@ -60,21 +63,21 @@ WARNMORE=-Wwrite-strings -Wpointer-arith -Wshadow \
 
 ### if you don't need thread safety, but want the asm accel
 #CFLAGS= $(strip $(MINGW_CCFLAGS) -DPNG_THREAD_UNSAFE_OK \
-#	$(addprefix -I,$(ZLIBINC)) -Wall -O $(ALIGN) -funroll-loops \
+#	$(addprefix -I,$(ZLIBINC)) -W -Wall -O $(ALIGN) -funroll-loops \
 #	-fomit-frame-pointer)  # $(WARNMORE) -g -DPNG_DEBUG=5
 ### if you need thread safety and want (minimal) asm accel
 #CFLAGS= $(strip $(MINGW_CCFLAGS) $(addprefix -I,$(ZLIBINC)) \
-#	-Wall -O $(ALIGN) -funroll-loops \
+#	-W -Wall -O $(ALIGN) -funroll-loops \
 #	-fomit-frame-pointer)  # $(WARNMORE) -g -DPNG_DEBUG=5
 ### Normal (non-asm) compilation
 CFLAGS= $(strip $(MINGW_CCFLAGS) $(addprefix -I,$(ZLIBINC)) \
-        -Wall -O3 $(ALIGN) -funroll-loops -DPNG_NO_MMX_CODE \
+        -W -Wall -O3 $(ALIGN) -funroll-loops -DPNG_NO_MMX_CODE \
 	-fomit-frame-pointer) # $(WARNMORE) -g -DPNG_DEBUG=5
 
 LIBNAME = libpng12
 PNGMAJ = 0
 MINGDLL = 12
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 SHAREDLIB=libpng$(MINGDLL).dll
@@ -284,6 +287,3 @@ pngwutil.o pngwutil.pic.o:	png.h pngconf.h pngwutil.c
 pngpread.o pngpread.pic.o:	png.h pngconf.h pngpread.c
 
 pngtest.o pngtest.pic.o:	png.h pngconf.h pngtest.c
-
-
-
diff --git a/src/3rdparty/libpng/scripts/makefile.mips b/src/3rdparty/libpng/scripts/makefile.mips
index f1a557df7f..0e7484f3ff 100644
--- a/src/3rdparty/libpng/scripts/makefile.mips
+++ b/src/3rdparty/libpng/scripts/makefile.mips
@@ -1,7 +1,10 @@
 # makefile for libpng
 # Copyright (C) Glenn Randers-Pehrson
 # Copyright (C) 1995 Guy Eric Schalnat, Group 42, Inc.
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # where make install puts libpng.a and png.h
 prefix=/usr/local
@@ -76,8 +79,9 @@ pngread.o: png.h pngconf.h
 pngpread.o: png.h pngconf.h
 pngrtran.o: png.h pngconf.h
 pngrutil.o: png.h pngconf.h
-pngtest.o: png.h pngconf.h
 pngtrans.o: png.h pngconf.h
 pngwrite.o: png.h pngconf.h
 pngwtran.o: png.h pngconf.h
 pngwutil.o: png.h pngconf.h
+
+pngtest.o: png.h pngconf.h
diff --git a/src/3rdparty/libpng/scripts/makefile.msc b/src/3rdparty/libpng/scripts/makefile.msc
index 1cbfd91498..ab95ff8018 100644
--- a/src/3rdparty/libpng/scripts/makefile.msc
+++ b/src/3rdparty/libpng/scripts/makefile.msc
@@ -1,6 +1,11 @@
 # makefile for libpng
 # Copyright (C) 1995 Guy Eric Schalnat, Group 42, Inc.
-# For conditions of distribution and use, see copyright notice in png.h
+# Copyright (C) 2006, 2009 Glenn Randers-Pehrson
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
+
 # Assumes that zlib.lib, zconf.h, and zlib.h have been copied to ..\zlib
 
 # -------- Microsoft C 5.1 and later, does not use assembler code --------
@@ -55,9 +60,6 @@ pngrio$(O): png.h pngconf.h
 pngwio$(O): png.h pngconf.h
 	$(CC) -c $(CFLAGS) $*.c $(ERRFILE)
 
-pngtest$(O): png.h pngconf.h
-	$(CC) -c $(CFLAGS) $*.c $(ERRFILE)
-
 pngtrans$(O): png.h pngconf.h
 	$(CC) -c $(CFLAGS) $*.c $(ERRFILE)
 
@@ -76,6 +78,9 @@ libpng.lib: $(OBJS1) $(OBJS2) $(OBJS3)
 	lib libpng $(OBJS2);
 	lib libpng $(OBJS3);
 
+pngtest$(O): png.h pngconf.h
+	$(CC) -c $(CFLAGS) $*.c $(ERRFILE)
+
 pngtest.exe: pngtest.obj libpng.lib
 	$(LD) $(LDFLAGS) pngtest.obj,,,libpng.lib ..\zlib\zlib.lib ;
 
diff --git a/src/3rdparty/libpng/scripts/makefile.ne12bsd b/src/3rdparty/libpng/scripts/makefile.ne12bsd
index 4037c55907..7457cbbc2a 100644
--- a/src/3rdparty/libpng/scripts/makefile.ne12bsd
+++ b/src/3rdparty/libpng/scripts/makefile.ne12bsd
@@ -2,8 +2,11 @@
 # make obj && make depend && make && make test
 # make includes && make install
 # Copyright (C) 2002 Patrick R.L. Welche
-# Copyright (C) 2007 Glenn Randers-Pehrson
-# For conditions of distribution and use, see copyright notice in png.h
+# Copyright (C) 2007, 2009 Glenn Randers-Pehrson
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # You should also run makefile.netbsd
 
@@ -14,7 +17,7 @@ INCSDIR=${LOCALBASE}/include/libpng12
 
 LIB=	png12
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.2.29
+SHLIB_MINOR=	1.2.40
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
@@ -23,7 +26,8 @@ MAN=	libpng.3 libpngpf.3 png.5
 
 CPPFLAGS+=-I${.CURDIR}
 
-# something like this for mmx assembler, but it core dumps for me at the moment
+# We should be able to do something like this instead of the manual
+# uncommenting, but it core dumps for me at the moment:
 # .if ${MACHINE_ARCH} == "i386"
 #   CPPFLAGS+=-DPNG_THREAD_UNSAFE_OK
 #   MKLINT= no
diff --git a/src/3rdparty/libpng/scripts/makefile.netbsd b/src/3rdparty/libpng/scripts/makefile.netbsd
index d12ecadf93..b334bfde7c 100644
--- a/src/3rdparty/libpng/scripts/makefile.netbsd
+++ b/src/3rdparty/libpng/scripts/makefile.netbsd
@@ -2,8 +2,11 @@
 # make obj && make depend && make && make test
 # make includes && make install
 # Copyright (C) 2002 Patrick R.L. Welche
-# Copyright (C) 2007 Glenn Randers-Pehrson
-# For conditions of distribution and use, see copyright notice in png.h
+# Copyright (C) 2007, 2009 Glenn Randers-Pehrson
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # You should also run makefile.ne0bsd
 
@@ -14,7 +17,7 @@ INCSDIR=${LOCALBASE}/include/libpng
 
 LIB=	png
 SHLIB_MAJOR=	3
-SHLIB_MINOR=	1.2.29
+SHLIB_MINOR=	1.2.40
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
@@ -23,7 +26,8 @@ MAN=	libpng.3 libpngpf.3 png.5
 
 CPPFLAGS+=-I${.CURDIR}
 
-# something like this for mmx assembler, but it core dumps for me at the moment
+# We should be able to do something like this instead of the manual
+# uncommenting, but it core dumps for me at the moment:
 # .if ${MACHINE_ARCH} == "i386"
 #   CPPFLAGS+=-DPNG_THREAD_UNSAFE_OK
 #   MKLINT= no
diff --git a/src/3rdparty/libpng/scripts/makefile.nommx b/src/3rdparty/libpng/scripts/makefile.nommx
index 1958cebb20..e2297d806c 100644
--- a/src/3rdparty/libpng/scripts/makefile.nommx
+++ b/src/3rdparty/libpng/scripts/makefile.nommx
@@ -1,13 +1,16 @@
 # makefile for libpng.a and libpng12.so on Linux ELF with gcc
-# Copyright (C) 1998, 1999, 2002, 2006, 2007 Greg Roelofs and
+# Copyright (C) 1998, 1999, 2002, 2006-2008 Greg Roelofs and
 # Glenn Randers-Pehrson
 # Copyright (C) 1996, 1997 Andreas Dilger
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
@@ -48,7 +51,7 @@ WARNMORE=-Wwrite-strings -Wpointer-arith -Wshadow \
 
 # for pgcc version 2.95.1, -O3 is buggy; don't use it.
 
-CFLAGS=-I$(ZLIBINC) -Wall -O3 -funroll-loops -DPNG_NO_MMX_CODE \
+CFLAGS=-I$(ZLIBINC) -W -Wall -O3 -funroll-loops -DPNG_NO_MMX_CODE \
 	$(ALIGN) # $(WARNMORE) -g -DPNG_DEBUG=5
 
 LDFLAGS=-L. -Wl,-rpath,. -L$(ZLIBLIB) -Wl,-rpath,$(ZLIBLIB) -lpng12 -lz -lm
@@ -233,20 +236,20 @@ writelock:
 
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
-png.o png.pic.o: png.h pngconf.h
-pngerror.o pngerror.pic.o: png.h pngconf.h
-pngrio.o pngrio.pic.o: png.h pngconf.h
-pngwio.o pngwio.pic.o: png.h pngconf.h
-pngmem.o pngmem.pic.o: png.h pngconf.h
-pngset.o pngset.pic.o: png.h pngconf.h
-pngget.o pngget.pic.o: png.h pngconf.h
-pngread.o pngread.pic.o: png.h pngconf.h
-pngrtran.o pngrtran.pic.o: png.h pngconf.h
-pngrutil.o pngrutil.pic.o: png.h pngconf.h
-pngtrans.o pngtrans.pic.o: png.h pngconf.h
-pngwrite.o pngwrite.pic.o: png.h pngconf.h
-pngwtran.o pngwtran.pic.o: png.h pngconf.h
-pngwutil.o pngwutil.pic.o: png.h pngconf.h
-pngpread.o pngpread.pic.o: png.h pngconf.h
-
-pngtest.o: png.h pngconf.h
+png.o png.pic.o:		png.h pngconf.h png.c
+pngerror.o pngerror.pic.o:	png.h pngconf.h pngerror.c
+pngrio.o pngrio.pic.o:		png.h pngconf.h pngrio.c
+pngwio.o pngwio.pic.o:		png.h pngconf.h pngwio.c
+pngmem.o pngmem.pic.o:		png.h pngconf.h pngmem.c
+pngset.o pngset.pic.o:		png.h pngconf.h pngset.c
+pngget.o pngget.pic.o:		png.h pngconf.h pngget.c
+pngread.o pngread.pic.o:	png.h pngconf.h pngread.c
+pngrtran.o pngrtran.pic.o:	png.h pngconf.h pngrtran.c
+pngrutil.o pngrutil.pic.o:	png.h pngconf.h pngrutil.c
+pngtrans.o pngtrans.pic.o:	png.h pngconf.h pngtrans.c
+pngwrite.o pngwrite.pic.o:	png.h pngconf.h pngwrite.c
+pngwtran.o pngwtran.pic.o:	png.h pngconf.h pngwtran.c
+pngwutil.o pngwutil.pic.o:	png.h pngconf.h pngwutil.c
+pngpread.o pngpread.pic.o:	png.h pngconf.h pngpread.c
+
+pngtest.o:			png.h pngconf.h pngtest.c
diff --git a/src/3rdparty/libpng/scripts/makefile.openbsd b/src/3rdparty/libpng/scripts/makefile.openbsd
index 7c2f1072ad..533c6b82de 100644
--- a/src/3rdparty/libpng/scripts/makefile.openbsd
+++ b/src/3rdparty/libpng/scripts/makefile.openbsd
@@ -1,14 +1,17 @@
 # makefile for libpng
 # Copyright (C) 1995 Guy Eric Schalnat, Group 42, Inc.
-# Copyright (C) 2007 Glenn Randers-Pehrson
-# For conditions of distribution and use, see copyright notice in png.h
+# Copyright (C) 2007-2008 Glenn Randers-Pehrson
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 PREFIX?= /usr/local
 LIBDIR=	${PREFIX}/lib
 MANDIR= ${PREFIX}/man/cat
 
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.2.29
+SHLIB_MINOR=	1.2.40
 
 LIB=	png
 SRCS=	png.c pngerror.c pngget.c pngmem.c pngpread.c \
@@ -17,8 +20,8 @@ SRCS=	png.c pngerror.c pngget.c pngmem.c pngpread.c \
 
 HDRS=	png.h pngconf.h
 
-CFLAGS+= -Wall
-CPPFLAGS+= -I${.CURDIR} -DPNG_NO_MMX_CODE 
+CFLAGS+= -W -Wall
+CPPFLAGS+= -I${.CURDIR} -DPNG_NO_MMX_CODE
 
 NOPROFILE= Yes
 
diff --git a/src/3rdparty/libpng/scripts/makefile.os2 b/src/3rdparty/libpng/scripts/makefile.os2
index 588067d25f..2df76adc93 100644
--- a/src/3rdparty/libpng/scripts/makefile.os2
+++ b/src/3rdparty/libpng/scripts/makefile.os2
@@ -1,5 +1,8 @@
 # makefile for libpng on OS/2 with gcc
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Related files: pngos2.def
 
@@ -12,7 +15,7 @@ ZLIBINC=../zlib
 WARNMORE=-Wwrite-strings -Wpointer-arith -Wshadow \
 	-Wmissing-declarations -Wtraditional -Wcast-align \
 	-Wstrict-prototypes -Wmissing-prototypes #-Wconversion
-CFLAGS=-I$(ZLIBINC) -Wall -O6 -funroll-loops -malign-loops=2 \
+CFLAGS=-I$(ZLIBINC) -W -Wall -O6 -funroll-loops -malign-loops=2 \
 	-malign-functions=2 #$(WARNMORE) -g -DPNG_DEBUG=5
 LDFLAGS=-L. -L$(ZLIBLIB) -lpng -lzdll -Zcrtdll
 AR=emxomfar
diff --git a/src/3rdparty/libpng/scripts/makefile.sco b/src/3rdparty/libpng/scripts/makefile.sco
index ac62735eba..186f79d10c 100644
--- a/src/3rdparty/libpng/scripts/makefile.sco
+++ b/src/3rdparty/libpng/scripts/makefile.sco
@@ -4,12 +4,15 @@
 # Copyright (C) 2002, 2006 Glenn Randers-Pehrson
 # Copyright (C) 1998 Greg Roelofs
 # Copyright (C) 1996, 1997 Andreas Dilger
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
diff --git a/src/3rdparty/libpng/scripts/makefile.sggcc b/src/3rdparty/libpng/scripts/makefile.sggcc
index 810f1dfbb8..3b5f7f2211 100644
--- a/src/3rdparty/libpng/scripts/makefile.sggcc
+++ b/src/3rdparty/libpng/scripts/makefile.sggcc
@@ -1,12 +1,15 @@
 # makefile for libpng.a and libpng12.so, SGI IRIX with 'cc'
 # Copyright (C) 2001-2002, 2006 Glenn Randers-Pehrson
 # Copyright (C) 1995 Guy Eric Schalnat, Group 42, Inc.
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Library name:
 LIBNAME=libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
@@ -212,10 +215,8 @@ test-installed:
 	./pngtesti pngtest.png
 
 clean:
-	$(RM_F) libpng.a pngtest pngtesti pngout.png libpng.pc libpng-config \
-	$(LIBSO) $(LIBSOMAJ)* \
-	$(OLDSOVER) \
-	so_locations
+	$(RM_F) libpng.a pngtest pngtesti pngout.png libpng.pc \
+        so_locations libpng-config $(LIBSO) $(LIBSOMAJ)* $(OLDSOVER)
 
 DOCS = ANNOUNCE CHANGES INSTALL KNOWNBUG LICENSE README TODO Y2KINFO
 writelock:
@@ -233,10 +234,10 @@ pngget.o: png.h pngconf.h
 pngread.o: png.h pngconf.h
 pngrtran.o: png.h pngconf.h
 pngrutil.o: png.h pngconf.h
-pngtest.o: png.h pngconf.h
 pngtrans.o: png.h pngconf.h
 pngwrite.o: png.h pngconf.h
 pngwtran.o: png.h pngconf.h
 pngwutil.o: png.h pngconf.h
 pngpread.o: png.h pngconf.h
 
+pngtest.o: png.h pngconf.h
diff --git a/src/3rdparty/libpng/scripts/makefile.sgi b/src/3rdparty/libpng/scripts/makefile.sgi
index 7892bdfa7d..cb48d8f28f 100644
--- a/src/3rdparty/libpng/scripts/makefile.sgi
+++ b/src/3rdparty/libpng/scripts/makefile.sgi
@@ -1,12 +1,15 @@
 # makefile for libpng.a and libpng12.so, SGI IRIX with 'cc'
 # Copyright (C) 2001-2002, 2006, 2007 Glenn Randers-Pehrson
 # Copyright (C) 1995 Guy Eric Schalnat, Group 42, Inc.
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Library name:
 LIBNAME=libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
@@ -236,10 +239,10 @@ pngget.o: png.h pngconf.h
 pngread.o: png.h pngconf.h
 pngrtran.o: png.h pngconf.h
 pngrutil.o: png.h pngconf.h
-pngtest.o: png.h pngconf.h
 pngtrans.o: png.h pngconf.h
 pngwrite.o: png.h pngconf.h
 pngwtran.o: png.h pngconf.h
 pngwutil.o: png.h pngconf.h
 pngpread.o: png.h pngconf.h
 
+pngtest.o: png.h pngconf.h
diff --git a/src/3rdparty/libpng/scripts/makefile.so9 b/src/3rdparty/libpng/scripts/makefile.so9
index 8391ba5ae1..d182f4d5a4 100644
--- a/src/3rdparty/libpng/scripts/makefile.so9
+++ b/src/3rdparty/libpng/scripts/makefile.so9
@@ -1,14 +1,17 @@
 # makefile for libpng on Solaris 9 (beta) with Forte cc
 # Updated by Chad Schrock for Solaris 9
 # Contributed by William L. Sebok, based on makefile.linux
-# Copyright (C) 2002, 2006 Glenn Randers-Pehrson
+# Copyright (C) 2002, 2006, 2008 Glenn Randers-Pehrson
 # Copyright (C) 1998-2001 Greg Roelofs
 # Copyright (C) 1996-1997 Andreas Dilger
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Library name:
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 LIBNAME = libpng12
 
@@ -47,7 +50,7 @@ ZLIBINC=/usr/include
 #WARNMORE=-Wwrite-strings -Wpointer-arith -Wshadow \
 	-Wmissing-declarations -Wtraditional -Wcast-align \
 	-Wstrict-prototypes -Wmissing-prototypes #-Wconversion
-#CFLAGS=-I$(ZLIBINC) -Wall -O3 $(WARNMORE) -g -DPNG_DEBUG=5 -DPNG_NO_MMX_CODE
+#CFLAGS=-I$(ZLIBINC) -W -Wall -O3 $(WARNMORE) -g -DPNG_DEBUG=5 -DPNG_NO_MMX_CODE
 CFLAGS=-I$(ZLIBINC) -O3 -DPNG_NO_MMX_CODE
 LDFLAGS=-L. -R. -L$(ZLIBLIB) -R$(ZLIBLIB) -lpng12 -lz -lm
 
diff --git a/src/3rdparty/libpng/scripts/makefile.solaris b/src/3rdparty/libpng/scripts/makefile.solaris
index 920cd3497a..65c1c08614 100644
--- a/src/3rdparty/libpng/scripts/makefile.solaris
+++ b/src/3rdparty/libpng/scripts/makefile.solaris
@@ -1,14 +1,17 @@
 # makefile for libpng on Solaris 2.x with gcc
-# Copyright (C) 2004, 2006, 2007 Glenn Randers-Pehrson
+# Copyright (C) 2004, 2006-2008 Glenn Randers-Pehrson
 # Contributed by William L. Sebok, based on makefile.linux
 # Copyright (C) 1998 Greg Roelofs
 # Copyright (C) 1996, 1997 Andreas Dilger
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
@@ -43,8 +46,7 @@ ZLIBINC=/usr/local/include
 WARNMORE=-Wwrite-strings -Wpointer-arith -Wshadow \
 	-Wmissing-declarations -Wtraditional -Wcast-align \
 	-Wstrict-prototypes -Wmissing-prototypes #-Wconversion
-CFLAGS=-I$(ZLIBINC) -Wall -O \
-	-DPNG_NO_MMX_CODE; \
+CFLAGS=-I$(ZLIBINC) -W -Wall -O -DPNG_NO_MMX_CODE; \
 	# $(WARNMORE) -g -DPNG_DEBUG=5
 LDFLAGS=-L. -R. -L$(ZLIBLIB) -R$(ZLIBLIB) -lpng12 -lz -lm
 
diff --git a/src/3rdparty/libpng/scripts/makefile.solaris-x86 b/src/3rdparty/libpng/scripts/makefile.solaris-x86
index 03c1de4060..581916ef45 100644
--- a/src/3rdparty/libpng/scripts/makefile.solaris-x86
+++ b/src/3rdparty/libpng/scripts/makefile.solaris-x86
@@ -1,14 +1,17 @@
 # makefile for libpng on Solaris 2.x with gcc
-# Copyright (C) 2004, 2006, 2007 Glenn Randers-Pehrson
+# Copyright (C) 2004, 2006-2008 Glenn Randers-Pehrson
 # Contributed by William L. Sebok, based on makefile.linux
 # Copyright (C) 1998 Greg Roelofs
 # Copyright (C) 1996, 1997 Andreas Dilger
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.29
+PNGMIN = 1.2.40
 PNGVER = $(PNGMAJ).$(PNGMIN)
 
 # Shared library names:
@@ -43,7 +46,7 @@ ZLIBINC=/usr/local/include
 WARNMORE=-Wwrite-strings -Wpointer-arith -Wshadow \
 	-Wmissing-declarations -Wtraditional -Wcast-align \
 	-Wstrict-prototypes -Wmissing-prototypes #-Wconversion
-CFLAGS=-I$(ZLIBINC) -Wall -O \
+CFLAGS=-I$(ZLIBINC) -W -Wall -O \
 	# $(WARNMORE) -g -DPNG_DEBUG=5
 LDFLAGS=-L. -R. -L$(ZLIBLIB) -R$(ZLIBLIB) -lpng12 -lz -lm
 
diff --git a/src/3rdparty/libpng/scripts/makefile.std b/src/3rdparty/libpng/scripts/makefile.std
index 9b1925d6a0..bb5268a2a2 100644
--- a/src/3rdparty/libpng/scripts/makefile.std
+++ b/src/3rdparty/libpng/scripts/makefile.std
@@ -1,7 +1,10 @@
 # makefile for libpng
 # Copyright (C) 2002, 2006 Glenn Randers-Pehrson
 # Copyright (C) 1995 Guy Eric Schalnat, Group 42, Inc.
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # where make install puts libpng.a and png.h
 prefix=/usr/local
@@ -83,10 +86,10 @@ pngget.o: png.h pngconf.h
 pngread.o: png.h pngconf.h
 pngrtran.o: png.h pngconf.h
 pngrutil.o: png.h pngconf.h
-pngtest.o: png.h pngconf.h
 pngtrans.o: png.h pngconf.h
 pngwrite.o: png.h pngconf.h
 pngwtran.o: png.h pngconf.h
 pngwutil.o: png.h pngconf.h
 pngpread.o: png.h pngconf.h
 
+pngtest.o: png.h pngconf.h
diff --git a/src/3rdparty/libpng/scripts/makefile.sunos b/src/3rdparty/libpng/scripts/makefile.sunos
index ff19591204..31dff77c10 100644
--- a/src/3rdparty/libpng/scripts/makefile.sunos
+++ b/src/3rdparty/libpng/scripts/makefile.sunos
@@ -1,7 +1,10 @@
 # makefile for libpng
 # Copyright (C) 2002, 2006 Glenn Randers-Pehrson
 # Copyright (C) 1995 Guy Eric Schalnat, Group 42, Inc.
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # where make install puts libpng.a and png.h
 prefix=/usr/local
@@ -88,10 +91,10 @@ pngget.o: png.h pngconf.h
 pngread.o: png.h pngconf.h
 pngrtran.o: png.h pngconf.h
 pngrutil.o: png.h pngconf.h
-pngtest.o: png.h pngconf.h
 pngtrans.o: png.h pngconf.h
 pngwrite.o: png.h pngconf.h
 pngwtran.o: png.h pngconf.h
 pngwutil.o: png.h pngconf.h
 pngpread.o: png.h pngconf.h
 
+pngtest.o: png.h pngconf.h
diff --git a/src/3rdparty/libpng/scripts/makefile.vcawin32 b/src/3rdparty/libpng/scripts/makefile.vcawin32
index 99f5430533..0b89d84e2f 100644
--- a/src/3rdparty/libpng/scripts/makefile.vcawin32
+++ b/src/3rdparty/libpng/scripts/makefile.vcawin32
@@ -1,17 +1,22 @@
 # makefile for libpng
+# Copyright (C) 2006,2009 Glenn Randers-Pehrson
 # Copyright (C) 1998 Tim Wegner
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
+
 # Assumes that zlib.lib, zconf.h, and zlib.h have been copied to ..\zlib
 # To use, do "nmake /f scripts\makefile.vcawin32"
 
-# -------- Microsoft Visual C++ 5.0 and later, uses assembler code --------
+# -------- Microsoft Visual C++ 2.0 and later, no assembler code --------
 # If you don't want to use assembler (MMX) code, use makefile.vcwin32 instead.
 
 # Compiler, linker, librarian, and other tools
 CC = cl
 LD = link
 AR = lib
-CFLAGS  = -DPNG_USE_PNGVCRD -nologo -MD -O2 -W3 -I..\zlib
+CFLAGS  = -nologo -DPNG_USE_PNGVCRD -MD -O2 -W3 -I..\zlib
 LDFLAGS = -nologo
 ARFLAGS = -nologo
 RM = del
@@ -64,9 +69,6 @@ pngrio$(O): png.h pngconf.h
 pngwio$(O): png.h pngconf.h
 	$(CC) -c $(CFLAGS) $*.c $(ERRFILE)
 
-pngtest$(O): png.h pngconf.h
-	$(CC) -c $(CFLAGS) $*.c $(ERRFILE)
-
 pngtrans$(O): png.h pngconf.h
 	$(CC) -c $(CFLAGS) $*.c $(ERRFILE)
 
@@ -83,6 +85,9 @@ libpng.lib: $(OBJS)
 	-$(RM) $@
 	$(AR) $(ARFLAGS) -out:$@ $(OBJS) $(ERRFILE)
 
+pngtest$(O): png.h pngconf.h
+	$(CC) -c $(CFLAGS) $*.c $(ERRFILE)
+
 pngtest.exe: pngtest$(O) libpng.lib
 	$(LD) $(LDFLAGS) -out:$@ pngtest$(O) libpng.lib ..\zlib\zlib.lib $(ERRFILE)
 
diff --git a/src/3rdparty/libpng/scripts/makefile.vcwin32 b/src/3rdparty/libpng/scripts/makefile.vcwin32
index fc6ece67de..8cd806a996 100644
--- a/src/3rdparty/libpng/scripts/makefile.vcwin32
+++ b/src/3rdparty/libpng/scripts/makefile.vcwin32
@@ -1,6 +1,11 @@
 # makefile for libpng
 # Copyright (C) 1998 Tim Wegner
-# For conditions of distribution and use, see copyright notice in png.h
+# Copyright (C) 2006,2009 Glenn Randers-Pehrson
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
+
 # Assumes that zlib.lib, zconf.h, and zlib.h have been copied to ..\zlib
 # To use, do "nmake /f scripts\makefile.vcwin32"
 
@@ -64,9 +69,6 @@ pngrio$(O): png.h pngconf.h
 pngwio$(O): png.h pngconf.h
 	$(CC) -c $(CFLAGS) $*.c $(ERRFILE)
 
-pngtest$(O): png.h pngconf.h
-	$(CC) -c $(CFLAGS) $*.c $(ERRFILE)
-
 pngtrans$(O): png.h pngconf.h
 	$(CC) -c $(CFLAGS) $*.c $(ERRFILE)
 
@@ -83,6 +85,9 @@ libpng.lib: $(OBJS)
 	-$(RM) $@
 	$(AR) $(ARFLAGS) -out:$@ $(OBJS) $(ERRFILE)
 
+pngtest$(O): png.h pngconf.h
+	$(CC) -c $(CFLAGS) $*.c $(ERRFILE)
+
 pngtest.exe: pngtest$(O) libpng.lib
 	$(LD) $(LDFLAGS) -out:$@ pngtest$(O) libpng.lib ..\zlib\zlib.lib $(ERRFILE)
 
diff --git a/src/3rdparty/libpng/scripts/makefile.watcom b/src/3rdparty/libpng/scripts/makefile.watcom
index 5e860fc06c..bbfeeeb77f 100644
--- a/src/3rdparty/libpng/scripts/makefile.watcom
+++ b/src/3rdparty/libpng/scripts/makefile.watcom
@@ -3,7 +3,10 @@
 
 # Copyright (C) 2000, Pawel Mrochen, based on makefile.msc which is
 # copyright 1995 Guy Eric Schalnat, Group 42, Inc.
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 # To use, do "wmake /f scripts\makefile.watcom"
 
diff --git a/src/3rdparty/libpng/scripts/makevms.com b/src/3rdparty/libpng/scripts/makevms.com
index b9e389555e..36d1190674 100644
--- a/src/3rdparty/libpng/scripts/makevms.com
+++ b/src/3rdparty/libpng/scripts/makevms.com
@@ -55,8 +55,6 @@ $  then
 $   dele pngtest.obj;*
 $   CALL MAKE png.OBJ "cc ''CCOPT' png" -
 	png.c png.h pngconf.h
-$   CALL MAKE pngpread.OBJ "cc ''CCOPT' pngpread" -
-					 pngpread.c png.h pngconf.h
 $   CALL MAKE pngset.OBJ "cc ''CCOPT' pngset" -
 	pngset.c png.h pngconf.h
 $   CALL MAKE pngget.OBJ "cc ''CCOPT' pngget" -
@@ -64,7 +62,7 @@ $   CALL MAKE pngget.OBJ "cc ''CCOPT' pngget" -
 $   CALL MAKE pngread.OBJ "cc ''CCOPT' pngread" -
 	pngread.c png.h pngconf.h
 $   CALL MAKE pngpread.OBJ "cc ''CCOPT' pngpread" -
-					 pngpread.c png.h pngconf.h
+	pngpread.c png.h pngconf.h
 $   CALL MAKE pngrtran.OBJ "cc ''CCOPT' pngrtran" -
 	pngrtran.c png.h pngconf.h
 $   CALL MAKE pngrutil.OBJ "cc ''CCOPT' pngrutil" -
diff --git a/src/3rdparty/libpng/scripts/pngos2.def b/src/3rdparty/libpng/scripts/pngos2.def
index 8ba7b41573..0f371c851b 100644
--- a/src/3rdparty/libpng/scripts/pngos2.def
+++ b/src/3rdparty/libpng/scripts/pngos2.def
@@ -2,7 +2,7 @@
 ; PNG.LIB module definition file for OS/2
 ;----------------------------------------
 
-; Version 1.2.29
+; Version 1.2.40
 
 LIBRARY		PNG
 DESCRIPTION	"PNG image compression library for OS/2"
diff --git a/src/3rdparty/libpng/scripts/pngw32.def b/src/3rdparty/libpng/scripts/pngw32.def
index 3ea55e6eb9..e455018b76 100644
--- a/src/3rdparty/libpng/scripts/pngw32.def
+++ b/src/3rdparty/libpng/scripts/pngw32.def
@@ -5,7 +5,7 @@
 LIBRARY
 
 EXPORTS
-;Version 1.2.29
+;Version 1.2.40
   png_build_grayscale_palette  @1
   png_check_sig        @2
   png_chunk_error      @3
@@ -189,6 +189,7 @@ EXPORTS
 ; Added at version 1.0.12
 ; For compatibility with 1.0.7-1.0.11
 ; png_info_init @174
+; png_read_init_3, png_info_init_3, and png_write_init_3 are deprecated.
   png_read_init_3    @175
   png_write_init_3    @176
   png_info_init_3 @177
diff --git a/src/3rdparty/libpng/scripts/smakefile.ppc b/src/3rdparty/libpng/scripts/smakefile.ppc
index e5c0278411..91df6c13d2 100644
--- a/src/3rdparty/libpng/scripts/smakefile.ppc
+++ b/src/3rdparty/libpng/scripts/smakefile.ppc
@@ -1,7 +1,10 @@
 # Amiga powerUP (TM) Makefile
 # makefile for libpng and SAS C V6.58/7.00 PPC compiler
 # Copyright (C) 1998 by Andreas R. Kleinert
-# For conditions of distribution and use, see copyright notice in png.h
+
+# This code is released under the libpng license.
+# For conditions of distribution and use, see the disclaimer
+# and license in png.h
 
 CC       = scppc
 CFLAGS   = NOSTKCHK NOSINT OPTIMIZE OPTGO OPTPEEP OPTINLOCAL OPTINL IDIR /zlib \
diff --git a/src/3rdparty/webkit/ChangeLog b/src/3rdparty/webkit/ChangeLog
index e2c1ef5aef..fb7dddf4f9 100644
--- a/src/3rdparty/webkit/ChangeLog
+++ b/src/3rdparty/webkit/ChangeLog
@@ -1,3 +1,114 @@
+2009-10-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [GTK] Add MathML to the build system
+        https://bugs.webkit.org/show_bug.cgi?id=30487
+
+        Add --enable-mathml to configure.
+
+        * configure.ac:
+
+2009-10-15  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] marshal stamp files are not cleaned after a distclean
+        https://bugs.webkit.org/show_bug.cgi?id=30156
+
+        Add the stamp files directly to cleanfiles. Also rearrange the
+        variable declarations so we don't miss any files that need to be
+        cleaned up during the clean targets.
+
+        * GNUmakefile.am:
+
+2009-10-15  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Help text fix - Web Sockets default is no, not yes.
+
+        * configure.ac:
+
+2009-10-12  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Rubberstamped by Eric Seidel.
+
+        [Gtk] Fix icu CFLAG for Darwin
+        https://bugs.webkit.org/show_bug.cgi?id=29517
+
+        Don't escape the srcdir variable. Also use $host instead of the
+        os_foo variables.
+
+        * autotools/webkit.m4:
+
+2009-10-12  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Use the SQLite3 headers from WebKitLibraries if sqlite3 is undetected
+        https://bugs.webkit.org/show_bug.cgi?id=29518
+
+        * configure.ac:
+
+2009-10-05  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Disable TCmalloc for Windows port at the present, because MinGW
+        hasn't got built-in pthread library.
+
+        * WebKit.pri:
+
+2009-10-02  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Disable a few more harmless MSVC warnings.
+
+        * WebKit.pri:
+
+2009-10-01  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, build fix.
+
+        [Qt] Symbian build break after r48976.
+        unix is set for Symbian in the Qt build system.
+
+        * WebKit.pri:
+
+2009-10-01  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Enable TCmalloc for the Linux, Mac and Windows Qt-port
+        https://bugs.webkit.org/show_bug.cgi?id=27029
+
+        Remove USE_SYSTEM_MALLOC for Linux, Mac and Windows Qt-port from WebKit.pri,
+        so these Qt-ports will use TCmalloc as other ports.
+
+        * WebKit.pri:
+
+2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GtkIMContext filtering interferes with DOM key events
+        https://bugs.webkit.org/show_bug.cgi?id=28733
+
+        Add new key event test ensuring that IME keypresses are handled.
+
+        * GNUmakefile.am:
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] data: uri support in media player
+        https://bugs.webkit.org/show_bug.cgi?id=29842
+
+        Check presence of gstreamer-pbutils-0.10.
+
+        * configure.ac:
+
 2009-09-26  David Kilzer  <ddkilzer@apple.com>
 
         GTK BUILD FIX: add ENABLE_ORIENTATION_EVENTS support to configure.ac
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
index b6d15320aa..b9167a80ef 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
@@ -27,6 +27,7 @@
 #define APICast_h
 
 #include "JSAPIValueWrapper.h"
+#include "JSGlobalObject.h"
 #include "JSValue.h"
 #include <wtf/Platform.h>
 #include <wtf/UnusedParam.h>
@@ -118,6 +119,7 @@ inline JSContextRef toRef(JSC::ExecState* e)
 
 inline JSGlobalContextRef toGlobalRef(JSC::ExecState* e)
 {
+    ASSERT(e == e->lexicalGlobalObject()->globalExec());
     return reinterpret_cast<JSGlobalContextRef>(e);
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
index 202b119502..c4bd7ad3c8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
@@ -41,9 +41,12 @@ public:
     
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
 
+protected:
+    static const unsigned StructureFlags = ImplementsHasInstance | JSObject::StructureFlags;
+
 private:
     virtual ConstructType getConstructData(ConstructData&);
     virtual const ClassInfo* classInfo() const { return &info; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
index 3a17fa2de0..0cf25c4362 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
@@ -41,7 +41,7 @@ public:
     // refactor the code so this override isn't necessary
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
 
 private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
index 86f2f32c21..d19890a884 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
@@ -50,9 +50,12 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | OverridesHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
 
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesHasInstance | OverridesMarkChildren | OverridesGetPropertyNames | Base::StructureFlags;
+
 private:
     virtual UString className() const;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
index c358a8426a..e6626b7060 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
@@ -25,6 +25,7 @@
 
 #include "config.h"
 #include "JSContextRef.h"
+#include "JSContextRefPrivate.h"
 
 #include "APICast.h"
 #include "InitializeThreading.h"
@@ -152,3 +153,12 @@ JSContextGroupRef JSContextGetGroup(JSContextRef ctx)
     ExecState* exec = toJS(ctx);
     return toRef(&exec->globalData());
 }
+
+JSGlobalContextRef JSContextGetGlobalContext(JSContextRef ctx)
+{
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    return toGlobalRef(exec->lexicalGlobalObject()->globalExec());
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageSourceQt.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRefPrivate.h
index dc5c03b6e9..ff014ec64e 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageSourceQt.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRefPrivate.h
@@ -1,8 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved. 
- * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
- *
- * All rights reserved.
+ * Copyright (C) 2009 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,45 +20,34 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "config.h"
-#include "ImageSource.h"
-#include "ImageDecoderQt.h"
-
-namespace WebCore {
+#ifndef JSContextRefPrivate_h
+#define JSContextRefPrivate_h
 
-NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
-{
-    return m_decoder ? m_decoder->imageAtIndex(index) : 0;
-}
+#include <JavaScriptCore/JSObjectRef.h>
+#include <JavaScriptCore/JSValueRef.h>
+#include <JavaScriptCore/WebKitAvailability.h>
 
-float ImageSource::frameDurationAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return 0;
+#ifndef __cplusplus
+#include <stdbool.h>
+#endif
 
-    // Many annoying ads specify a 0 duration to make an image flash as quickly
-    // as possible.  We follow WinIE's behavior and use a duration of 100 ms
-    // for any frames that specify a duration of <= 50 ms.  See
-    // <http://bugs.webkit.org/show_bug.cgi?id=14413> or Radar 4051389 for
-    // more.
-    const float duration = m_decoder->duration(index) / 1000.0f;
-    return (duration < 0.051f) ? 0.100f : duration;
-}
+#ifdef __cplusplus
+extern "C" {
+#endif
 
-bool ImageSource::frameHasAlphaAtIndex(size_t index)
-{
-    return frameIsCompleteAtIndex(index) && m_decoder->supportsAlpha() &&
-        m_decoder->imageAtIndex(index)->hasAlphaChannel();
-}
-
-bool ImageSource::frameIsCompleteAtIndex(size_t index)
-{
-    return m_decoder && m_decoder->imageAtIndex(index);
-}
+/*!
+@function
+@abstract Gets the global context of a JavaScript execution context.
+@param ctx The JSContext whose global context you want to get.
+@result ctx's global context.
+*/
+JS_EXPORT JSGlobalContextRef JSContextGetGlobalContext(JSContextRef ctx);
 
+#ifdef __cplusplus
 }
+#endif
 
-// vim: ts=4 sw=4 et
+#endif /* JSContextRefPrivate_h */
diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 05f90b994e..8d6c2df6a8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,17 +1,1180 @@
+2009-10-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Tightened up some put_by_id_transition code generation.
+        https://bugs.webkit.org/show_bug.cgi?id=30539
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition): No need to do object type
+        checks or read Structures and prototypes from objects: they're all known
+        constants at compile time.
+
+2009-10-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added a private API for getting a global context from a context, for
+        clients who want to preserve a context for a later callback.
+
+        * API/APICast.h:
+        (toGlobalRef): Added an ASSERT, since this function is used more often
+        than before.
+
+        * API/JSContextRef.cpp:
+        * API/JSContextRefPrivate.h: Added. The new API.
+
+        * API/tests/testapi.c:
+        (print_callAsFunction):
+        (main): Test the new API.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Build and export the new API.
+
+2009-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Tightened up some instanceof code generation.
+        https://bugs.webkit.org/show_bug.cgi?id=30488
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof): No need to do object type checks - 
+        cell type checks and ImplementsDefaultHasIntance checks implicitly
+        supersede object type checks.
+
+2009-10-18  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Use _stricmp and _strnicmp instead of deprecated stricmp and strnicmp.
+        https://bugs.webkit.org/show_bug.cgi?id=30474
+
+        stricmp and strnicmp are deprecated beginning in Visual
+        C++ 2005. Use _stricmp and _strnicmp instead in StringExtras.h.
+
+        * wtf/StringExtras.h:
+        (strncasecmp):
+        (strcasecmp):
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: apparently we shouldn't export those symbols?
+
+        * JavaScriptCore.exp:
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export some symbols.
+
+        * JavaScriptCore.exp:
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        structure typeinfo flags should be inherited.
+        https://bugs.webkit.org/show_bug.cgi?id=30468
+
+        Add StructureFlag constant to the various JSC classes and use
+        it for the TypeInfo construction.  This allows us to simply
+        accumulate flags by basing each classes StructureInfo on its parents.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fast for-in enumeration: Cache JSPropertyNameIterator; cache JSStrings
+        in JSPropertyNameIterator; inline more code.
+
+        1.024x as fast on SunSpider (fasta: 1.43x as fast).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetPropertyNames):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        * bytecompiler/BytecodeGenerator.h: Added a few extra operands to
+        op_get_pnames and op_next_pname so that we can track iteration state
+        in the register file instead of in the JSPropertyNameIterator. (To be
+        cacheable, the JSPropertyNameIterator must be stateless.)
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID): Updated for rename to
+        "normalizePrototypeChain" and removal of "isCacheable". 
+
+        (JSC::Interpreter::privateExecute): Updated for in-RegisterFile
+        iteration state tracking.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_pnames): Updated for in-RegisterFile
+        iteration state tracking.
+
+        (JSC::JIT::emit_op_next_pname): Inlined code generation for op_next_pname.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID): Updated for rename to
+        "normalizePrototypeChain" and removal of "isCacheable". 
+
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::): Added has_property and to_object stubs. Removed op_next_pname
+        stub, since has_property is all we need anymore.
+
+        * parser/Nodes.cpp:
+        (JSC::ForInNode::emitBytecode): Updated for in-RegisterFile
+        iteration state tracking.
+
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames): Don't do caching at this layer
+        anymore, since we don't create a JSPropertyNameIterator at this layer.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create): Do do caching at this layer.
+        (JSC::JSPropertyNameIterator::get):  Updated for in-RegisterFile
+        iteration state tracking.
+        (JSC::JSPropertyNameIterator::markChildren): Mark our JSStrings.
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::size):
+        (JSC::JSPropertyNameIterator::setCachedStructure):
+        (JSC::JSPropertyNameIterator::cachedStructure):
+        (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
+        (JSC::JSPropertyNameIterator::cachedPrototypeChain):
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::Structure::setEnumerationCache): Don't store iteration state in
+        a JSPropertyNameIterator. Do cache a JSPropertyNameIterator in a
+        Structure.
+
+        * runtime/JSValue.h:
+        (JSC::asCell):
+        * runtime/MarkStack.h: Make those mischievous #include gods happy.
+
+        * runtime/ObjectConstructor.cpp:
+
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain): Renamed countPrototypeChainEntriesAndCheckForProxies
+        to normalizePrototypeChain, since it changes dictionary prototypes to
+        non-dictionary objects.
+
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::PropertyNameArrayData):
+        (JSC::PropertyNameArray::data):
+        (JSC::PropertyNameArray::size):
+        (JSC::PropertyNameArray::begin):
+        (JSC::PropertyNameArray::end): Simplified some code here to help with
+        current and future refactoring.
+
+        * runtime/Protect.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition): No need to clear
+        the enumeration cache with adding / removing properties without
+        transition. It is an error to add / remove properties without transition
+        once an object has been observed, and we can ASSERT to catch that.
+
+        * runtime/Structure.h:
+        (JSC::Structure::enumerationCache): Changed the enumeration cache to
+        hold a JSPropertyNameIterator.
+
+        * runtime/StructureChain.cpp:
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::head): Removed StructureChain::isCacheable because
+        it was wrong-headed in two ways: (1) It gave up when a prototype was a
+        dictionary, but instead we want un-dictionary heavily accessed
+        prototypes; (2) It folded a test for hasDefaultGetPropertyNames() into
+        a generic test for "cacheable-ness", but hasDefaultGetPropertyNames()
+        is only releavant to for-in caching.
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a Debug_All configuration to build entire stack as debug.
+        Change Debug_Internal to:
+        - stop using _debug suffix for all WebKit/Safari binaries
+        - not use _debug as a DLL naming suffix
+        - use non-debug C runtime lib.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Debug build in makefile should build Debug_All.
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Renamed single configuration from "Release" to "all".
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Add Debug_All configuration.
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Last part -- replace HasDefaultGetPropertyNames with OverridesGetPropertyNames
+        flag.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesGetPropertyNames):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix, we can't use the simple hash there because the PlatformModuleVersion 
+        structure differs.
+
+        * wtf/Platform.h:
+
+2009-10-16  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement ExecutableAllocator for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29946
+
+        Tested with YARR JIT enabled for Symbian; 
+        This patch does not (yet) enable YARR JIT by default.
+
+        * JavaScriptCore.pri:
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorSymbian.cpp: Added.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+
+2009-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Part 2 -- Reverse the TypeInfo HasDefaultMark flag to OverridesMarkChildren, etc
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        (JSC::MarkStack::markChildren):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesMarkChildren):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+
+2009-10-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+        
+        Part 1. Reverse the HasStandardGetOwnPropertySlot flag.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSCell::fastGetOwnPropertySlot):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesGetOwnPropertySlot):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+2009-10-14  Darin Adler  <darin@apple.com>
+
+        Additions so fix for https://bugs.webkit.org/show_bug.cgi?id=18994
+        can build on Windows.
+
+        * wtf/MathExtras.h: Added llround and llroundf for Windows.
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Set ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH for plugins while we're still building stubs.
+
+        * wtf/Platform.h:
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Refactor ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        https://bugs.webkit.org/show_bug.cgi?id=30278
+
+        Move the definition of ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        from the make system into common code.
+
+        * wtf/Platform.h:
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        ARM compiler does not understand reinterpret_cast<void*>
+        https://bugs.webkit.org/show_bug.cgi?id=29034
+
+        Change reinterpret_cast<void*> to regular C style (void*) cast 
+        for the ARM RVCT compiler.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr): 
+        * jit/JITOpcodes.cpp: Cast to FunctionPtr first 
+           instead of directly casting to reinterpret_cast
+        * jit/JITStubCall.h: Ditto + change the type of m_stub
+          from void* to FunctionPtr.
+        (JSC::JITStubCall::JITStubCall): 
+        (JSC::JITStubCall::call):
+        * jit/JITStubs.cpp: Ditto.
+        (JSC::DEFINE_STUB_FUNCTION(EncodedJSValue, op_throw)):
+
+2009-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Re-enable the JIT.
+
+        * wtf/Platform.h:
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Support for String.trim(), String.trimLeft() and String.trimRight() methods
+        https://bugs.webkit.org/show_bug.cgi?id=26590
+
+        Implement trim, trimLeft, and trimRight
+
+        * runtime/StringPrototype.cpp:
+        (JSC::isTrimWhitespace):
+           Our normal string whitespace function does not include U+200B which
+           is needed for compatibility with mozilla's implementation of trim.
+           U+200B does not appear to be expected according to spec, however I am
+           choosing to be lax, and match mozilla behavior so have added this
+           exception.
+        (JSC::trimString):
+
+2009-10-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Eliminated some legacy bytecode weirdness.
+        
+        Use vPC[x] subscripting instead of ++vPC to access instruction operands.
+        This is simpler, and often more efficient.
+
+        To support this, and to remove use of hard-coded offsets in bytecode and
+        JIT code generation and dumping, calculate jump offsets from the beginning
+        of an instruction, rather than the middle or end.
+        
+        Also, use OPCODE_LENGTH instead of hard-coded constants for the sizes of
+        opcodes.
+        
+        SunSpider reports no change in JIT mode, and a 1.01x speedup in Interpreter
+        mode.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::printConditionalJump):
+        (JSC::CodeBlock::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJump):
+        (JSC::BytecodeGenerator::emitJumpIfTrue):
+        (JSC::BytecodeGenerator::emitJumpIfFalse):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+        (JSC::BytecodeGenerator::emitJumpScopes):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        (JSC::BytecodeGenerator::emitCatch):
+        (JSC::BytecodeGenerator::emitJumpSubroutine):
+        (JSC::prepareJumpTableForImmediateSwitch):
+        (JSC::prepareJumpTableForCharacterSwitch):
+        (JSC::prepareJumpTableForStringSwitch):
+        (JSC::BytecodeGenerator::endSwitch):
+        * bytecompiler/Label.h:
+        (JSC::Label::setLocation):
+        (JSC::Label::bind):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emitBinaryDoubleOp):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_loop):
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emitSlow_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emitSlow_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_loop_if_true):
+        (JSC::JIT::emitSlow_op_loop_if_true):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emitSlow_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emitSlow_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_jmp_scopes):
+
+2009-10-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Migrated some code that didn't belong out of Structure.
+        
+        SunSpider says maybe 1.03x faster.
+
+        * runtime/JSCell.h: Nixed Structure::markAggregate, and made marking of
+        a Structure's prototype the direct responsility of the object using it.
+        (Giving Structure a mark function was misleading because it implied that
+        all live structures get marked during GC, when they don't.)
+        
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::markChildren): Added code to mark prototypes stored
+        on the global object. Maybe this wasn't necessary, but now we don't have
+        to wonder.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::getEnumerableNamesFromClassInfoTable):
+        * runtime/JSObject.h:
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/PropertyNameArray.h:
+        * runtime/Structure.cpp:
+        * runtime/Structure.h:
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::enumerationCache): Moved property name gathering code
+        from Structure to JSObject because having a Structure iterate its JSObject
+        was a layering violation. A JSObject is implemented using a Structure; not
+        the other way around.
+
+2009-10-09  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the GTK release build.
+
+        * GNUmakefile.am: Include Grammar.cpp in release builds now that
+        AllInOneFile.cpp is gone.
+
+2009-10-09  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Rubber-stamped by Eric Seidel.
+
+        Add ARM JIT support for Gtk port (disabled by default)
+        https://bugs.webkit.org/show_bug.cgi?id=30228
+
+        * GNUmakefile.am:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Tiger build fix: added a few more variable initializations.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncSearch):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: added missing #include.
+
+        * jsc.cpp:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Tiger build fix: initialize variable whose initialization the compiler
+        can't otherwise figure out.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: updated exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Tiger build fix: fixed file name case.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        At long last, I pronounce the death of AllInOneFile.cpp.
+        
+        SunSpider reports a 1.01x speedup.
+
+        * AllInOneFile.cpp: Removed.
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added missing project files
+        to compilation stages.
+
+        * parser/Grammar.y:
+        * parser/Lexer.cpp:
+        * parser/Lexer.h:
+        (JSC::jscyylex):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/Collector.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::operator new):
+        * runtime/JSCell.h:
+        (JSC::JSCell::operator new):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::operator new):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::operator new):
+        * runtime/JSString.cpp:
+        * runtime/JSString.h:
+        (JSC::jsString):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString):
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructorPrivate::RegExpConstructorPrivate):
+        (JSC::RegExpConstructorPrivate::lastOvector):
+        (JSC::RegExpConstructorPrivate::tempOvector):
+        (JSC::RegExpConstructorPrivate::changeLastOvector):
+        (JSC::RegExpConstructor::performMatch):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        * yarr/RegexJIT.cpp:
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::executeRegex): Inlined a few things that Shark said
+        were hot, on the presumption that AllInOneFile.cpp used to inline them
+        automatically.
+
+2009-10-08  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix for JIT'ed op_call instructions (evals, constructs, etc.)
+        when !ENABLE(JIT_OPTIMIZE_CALL) && USE(JSVALUE32_64)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30201
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: removed no longer exported symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/5751979> Database code takes JSLock on secondary
+        thread, permanently slowing down JavaScript
+        
+        Removed the optional lock from Heap::protect, Heap::unprotect, and friends,
+        since WebCore no longer uses it.
+
+        * JavaScriptCore.exp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::protectedGlobalObjectCount):
+        (JSC::Heap::protectedObjectCount):
+        (JSC::Heap::protectedObjectTypeCounts):
+        * runtime/Collector.h:
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's IdentifierArena
+        https://bugs.webkit.org/show_bug.cgi?id=30158
+
+        Inherits IdentifierArena class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/parser/ParserArena.cpp:36.
+
+        * parser/ParserArena.h:
+
+2009-10-07  Adam Roben  <aroben@apple.com>
+
+        Export DateInstance::info in a way that works on Windows
+
+        Fixes <http://webkit.org/b/30171>
+        fast/dom/Window/window-postmessage-clone.html fails on Windows
+
+        Reviewed by Anders Carlsson.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Removed the export of DateInstance::info from here.
+
+        * runtime/DateInstance.h: Use JS_EXPORTDATA to export
+        DateInstance::info, which is the required way of exporting data on
+        Windows.
+
+2009-10-07  Jørgen Lind  <jorgen.lind@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        When enabling or disabling the JIT through .qmake.cache, make sure
+        to also toggle ENABLE_YARR_JIT.
+
+        * JavaScriptCore.pri:
+
+2009-10-06  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Linking fails with "relocation R_X86_64_PC32 against symbol
+        `cti_vm_throw'"
+        https://bugs.webkit.org/show_bug.cgi?id=28422
+
+        * jit/JITStubs.cpp:
+        Mark cti_vm_throw symbol as PLT-indirect symbol, so it doesn't end up
+        in text segment causing relocation errors on amd64 architecture.
+        Introduced new define SYMBOL_STRING_RELOCATION for such symbols.
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Windows linking fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Windows build fix.
+
+        * runtime/DateInstance.cpp:
+
+2009-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        It should be possible to post (clone) built-in JS objects to Workers
+        https://bugs.webkit.org/show_bug.cgi?id=22878
+
+        Expose helpers to throw correct exceptions during object graph walk
+        used for cloning and add a helper function to create Date instances
+        without going through the JS Date constructor function.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createTypeError):
+        * runtime/ExceptionHelpers.h:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        StringImpl needs a method to get an instance for another thread which doesn't copy the underlying buffer.
+        https://bugs.webkit.org/show_bug.cgi?id=30095
+
+        * wtf/CrossThreadRefCounted.h:
+        Removed an unused function and assert improvement.
+        (WTF::CrossThreadRefCounted::isOwnedByCurrentThread): Moved out common code from asserts.
+        (WTF::CrossThreadRefCounted::ref): Changed assert to use the common method.
+        (WTF::CrossThreadRefCounted::deref): Changed assert to use the common method.
+        (WTF::CrossThreadRefCounted::crossThreadCopy): Since this includes a potentially
+        non-threadsafe operation, add an assert that the class is owned by the current thread.
+
+2009-10-05  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add Symbian files to the list of excludes.
+
+        * wscript:
+
+2009-10-05  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove precompiled header from JavaScriptCore compilation to
+        prevent qmake warning during autonomous compilation.
+        https://bugs.webkit.org/show_bug.cgi?id=30069
+
+        * JavaScriptCore.pro:
+
+2009-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed the concept of a "fast access cutoff" in arrays, because it
+        punished some patterns of array access too much, and made things too
+        complex for inlining in some cases.
+        
+        1.3% speedup on SunSpider.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC::): Check m_vectorLength instead of m_fastAccessCutoff when
+        getting / putting from / to an array. Inline putting past the end of
+        the array.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSArray.h:
+        (JSC::JSArray::canGetIndex):
+        (JSC::JSArray::canSetIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::markChildrenDirect): Removed m_fastAccessCutoff, and
+        replaced with checks for JSValue() to detect reads and writes from / to
+        uninitialized parts of the array.
+
+2009-10-02  Jonni Rainisto  <jonni.rainisto@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Math.random() gives too low values on Win32 when _CRT_RAND_S is not defined
+        https://bugs.webkit.org/show_bug.cgi?id=29956
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber): Added PLATFORM(WIN_OS) to handle 15bit rand()
+
+2009-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Take one branch instead of two to test for JSValue().
+        
+        1.1% SunSpider speedup.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_create_arguments):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val): Test for the empty value tag, instead
+        of testing for the cell tag with a 0 payload.
+
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description): Added support for dumping the new empty value,
+        and deleted values, in debug builds.
+
+        * runtime/JSValue.h:
+        (JSC::JSValue::JSValue()): Construct JSValue() with the empty value tag.
+
+        (JSC::JSValue::JSValue(JSCell*)): Convert null pointer to the empty value
+        tag, to avoid having two different c++ versions of null / empty.
+
+        (JSC::JSValue::operator bool): Test for the empty value tag, instead
+        of testing for the cell tag with a 0 payload.
+
+2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=29989>
+        Safari version number shouldn't be exposed in WebKit code
+        
+        For a WebKit version of 532.3.4:
+        Product version is: 5.32.3.4 (was 4.0.3.0)
+        File version is: 5.32.3.4 (was 4.532.3.4)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc:
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Fix the Qt on Mac OS X build.
+
+        * wtf/FastMalloc.cpp:
+
+2009-10-02  Jørgen Lind  <jorgen.lind@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow enabling and disabling of the JIT through a qmake variable.
+
+        Qt's configure may set this variable through .qmake.cache if a
+        commandline option is given and/or the compile test for hwcap.h
+        failed/succeeded.
+
+        * JavaScriptCore.pri:
+
+2009-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-01  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29187
+
+        Don't inline ~ListRefPtr() to work around winscw compiler forward declaration
+        bug regarding templated classes.
+
+        The compiler bug is reported at:
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812
+
+        The change will be reverted when the above bug is fixed in winscw compiler.
+
+        * wtf/ListRefPtr.h:
+        (WTF::::~ListRefPtr):
+
+2009-10-01  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Allow custom memory allocation control for the whole JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=27029
+
+        Since in JavaScriptCore almost every class which has been instantiated by operator new is
+        inherited from FastAllocBase (bug #20422), we disable customizing global operator new for the Qt-port
+        when USE_SYSTEM_MALLOC=0.
+
+        Add #include <unistd.h> to FastMalloc.cpp because it's used by TCMalloc_PageHeap::scavengerThread().
+        (It's needed for the functionality of TCmalloc.)
+
+        Add TCSystemAlloc.cpp to JavaScriptCore.pri if USE_SYSTEM_MALLOC is disabled.
+
+        * JavaScriptCore.pri:
+        * wtf/FastMalloc.cpp:
+        (WTF::sleep):
+        * wtf/FastMalloc.h:
+
+2009-09-30  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by George Staikos.
+
+        Defines two pseudo-platforms for ARM and Thumb-2 instruction set.
+        https://bugs.webkit.org/show_bug.cgi?id=29122
+
+        Introduces WTF_PLATFORM_ARM_TRADITIONAL and WTF_PLATFORM_ARM_THUMB2
+        macros on ARM platforms. The PLATFORM(ARM_THUMB2) should be used
+        when Thumb-2 instruction set is the required target. The
+        PLATFORM(ARM_TRADITIONAL) is for generic ARM instruction set. In
+        case where the code is common the PLATFORM(ARM) have to be used.
+
+        Modified by George Wright  <gwright@rim.com> to correctly work
+        with the RVCT-defined __TARGET_ARCH_ARM and __TARGET_ARCH_THUMB
+        compiler macros, as well as adding readability changes.
+
+        * wtf/Platform.h:
+
+2009-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Devirtualise array toString conversion
+
+        Tweak the implementation of Array.prototype.toString to have a fast path
+        when acting on a true JSArray.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+
 2009-09-30  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Geoffrey Garen.
 
         Buildfix for platforms using JSVALUE32.
         https://bugs.webkit.org/show_bug.cgi?id=29915
 
         After http://trac.webkit.org/changeset/48905 the build broke in JSVALUE32 case.
+        Also removed unreachable code.
 
         * jit/JITArithmetic.cpp:
         (JSC::JIT::emit_op_add):
          - Declaration of "OperandTypes types" moved before first use.
          - Typos fixed: dst modified to result, regT2 added.
-         - Unnecessary code removed.
+         - Unreachable code removed.
         (JSC::JIT::emitSlow_op_add):
          - Missing declaration of "OperandTypes types" added.
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
index 15a0c0f5fa..4b316c8e7b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
@@ -1,7 +1,6 @@
 {
     'variables': {
         'javascriptcore_files': [
-            'AllInOneFile.cpp',
             'API/APICast.h',
             'API/JavaScript.h',
             'API/JavaScriptCore.h',
@@ -19,6 +18,7 @@
             'API/JSClassRef.h',
             'API/JSContextRef.cpp',
             'API/JSContextRef.h',
+            'API/JSContextRefPrivate.h',
             'API/JSObjectRef.cpp',
             'API/JSObjectRef.h',
             'API/JSProfilerPrivate.cpp',
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
index 2b08980b4b..89c483e08c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
@@ -137,7 +137,8 @@ SOURCES += \
     interpreter/RegisterFile.cpp
 
 symbian {
-    SOURCES += runtime/MarkStackSymbian.cpp
+    SOURCES += jit/ExecutableAllocatorSymbian.cpp \
+              runtime/MarkStackSymbian.cpp
 } else {
     win32-*|wince* {
         SOURCES += jit/ExecutableAllocatorWin.cpp \
@@ -148,6 +149,10 @@ symbian {
     }
 }
 
+!contains(DEFINES, USE_SYSTEM_MALLOC) {
+    SOURCES += wtf/TCSystemAlloc.cpp
+}
+
 # AllInOneFile.cpp helps gcc analize and optimize code
 # Other compilers may be able to do this at link time
 SOURCES += \
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
index 0cd2e1a9fc..a1affd4d6e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
@@ -16,7 +16,6 @@ CONFIG(QTDIR_build) {
     include($$QT_SOURCE_TREE/src/qbase.pri)
     INSTALLS =
     DESTDIR = $$OLDDESTDIR
-    PRECOMPILED_HEADER = $$PWD/../WebKit/qt/WebKit_pch.h
     DEFINES *= NDEBUG
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
index 568260a4f9..3681af8a8c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -69,7 +69,13 @@ public:
 
     template<typename FunctionType>
     explicit FunctionPtr(FunctionType* value)
+#if COMPILER(RVCT)
+     // RVTC compiler needs C-style cast as it fails with the following error
+     // Error:  #694: reinterpret_cast cannot cast away const or other type qualifiers
+        : m_value((void*)(value))
+#else
         : m_value(reinterpret_cast<void*>(value))
+#endif
     {
         ASSERT_VALID_CODE_POINTER(m_value);
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
index 6bac9b94c4..18ca2aeaa8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -135,11 +135,6 @@ NEVER_INLINE static const char* debugHookName(int debugHookID)
     return "";
 }
 
-static int locationForOffset(const Vector<Instruction>::const_iterator& begin, Vector<Instruction>::const_iterator& it, int offset)
-{
-    return it - begin + offset;
-}
-
 static void printUnaryOp(int location, Vector<Instruction>::const_iterator& it, const char* op)
 {
     int r0 = (++it)->u.operand;
@@ -156,11 +151,11 @@ static void printBinaryOp(int location, Vector<Instruction>::const_iterator& it,
     printf("[%4d] %s\t\t %s, %s, %s\n", location, op, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
 }
 
-static void printConditionalJump(const Vector<Instruction>::const_iterator& begin, Vector<Instruction>::const_iterator& it, int location, const char* op)
+static void printConditionalJump(const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator& it, int location, const char* op)
 {
     int r0 = (++it)->u.operand;
     int offset = (++it)->u.operand;
-    printf("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(r0).c_str(), offset, locationForOffset(begin, it, offset));
+    printf("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(r0).c_str(), offset, location + offset);
 }
 
 static void printGetByIdOp(int location, Vector<Instruction>::const_iterator& it, const Vector<Identifier>& m_identifiers, const char* op)
@@ -852,12 +847,12 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_jmp: {
             int offset = (++it)->u.operand;
-            printf("[%4d] jmp\t\t %d(->%d)\n", location, offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jmp\t\t %d(->%d)\n", location, offset, location + offset);
             break;
         }
         case op_loop: {
             int offset = (++it)->u.operand;
-            printf("[%4d] loop\t\t %d(->%d)\n", location, offset, locationForOffset(begin, it, offset));
+            printf("[%4d] loop\t\t %d(->%d)\n", location, offset, location + offset);
             break;
         }
         case op_jtrue: {
@@ -884,56 +879,56 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
             break;
         }
         case op_jnless: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
             break;
         }
         case op_jnlesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
             break;
         }
         case op_loop_if_less: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
             break;
         }
         case op_loop_if_lesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
             break;
         }
         case op_switch_imm: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, locationForOffset(begin, it, defaultTarget), registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
             break;
         }
         case op_switch_char: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, locationForOffset(begin, it, defaultTarget), registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
             break;
         }
         case op_switch_string: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, locationForOffset(begin, it, defaultTarget), registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
             break;
         }
         case op_new_func: {
@@ -1020,16 +1015,18 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             break;
         }
         case op_get_pnames: {
-            int r0 = (++it)->u.operand;
-            int r1 = (++it)->u.operand;
+            int r0 = it[0].u.operand;
+            int r1 = it[1].u.operand;
             printf("[%4d] get_pnames\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            it += OPCODE_LENGTH(op_get_pnames) - 1;
             break;
         }
         case op_next_pname: {
-            int dest = (++it)->u.operand;
-            int iter = (++it)->u.operand;
-            int offset = (++it)->u.operand;
-            printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(dest).c_str(), registerName(iter).c_str(), offset, locationForOffset(begin, it, offset));
+            int dest = it[0].u.operand;
+            int iter = it[4].u.operand;
+            int offset = it[5].u.operand;
+            printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(dest).c_str(), registerName(iter).c_str(), offset, location + offset);
+            it += OPCODE_LENGTH(op_next_pname) - 1;
             break;
         }
         case op_push_scope: {
@@ -1051,7 +1048,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         case op_jmp_scopes: {
             int scopeDelta = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jmp_scopes\t^%d, %d(->%d)\n", location, scopeDelta, offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jmp_scopes\t^%d, %d(->%d)\n", location, scopeDelta, offset, location + offset);
             break;
         }
         case op_catch: {
@@ -1074,7 +1071,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         case op_jsr: {
             int retAddrDst = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(retAddrDst).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(retAddrDst).c_str(), offset, location + offset);
             break;
         }
         case op_sret: {
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
index c9196ce546..8968252bcc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
@@ -152,8 +152,8 @@ namespace JSC {
         macro(op_strcat, 4) \
         macro(op_to_primitive, 3) \
         \
-        macro(op_get_pnames, 3) \
-        macro(op_next_pname, 4) \
+        macro(op_get_pnames, 6) \
+        macro(op_next_pname, 7) \
         \
         macro(op_push_scope, 2) \
         macro(op_pop_scope, 1) \
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 8951ce39f5..41b5c39803 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -608,8 +608,9 @@ void ALWAYS_INLINE BytecodeGenerator::rewindUnaryOp()
 
 PassRefPtr<Label> BytecodeGenerator::emitJump(Label* target)
 {
+    size_t begin = instructions().size();
     emitOpcode(target->isForward() ? op_jmp : op_loop);
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
@@ -624,10 +625,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindBinaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_loop_if_less);
             instructions().append(src1Index);
             instructions().append(src2Index);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_lesseq && !target->isForward()) {
@@ -639,10 +642,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindBinaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_loop_if_lesseq);
             instructions().append(src1Index);
             instructions().append(src2Index);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_eq_null && target->isForward()) {
@@ -653,9 +658,11 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindUnaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jeq_null);
             instructions().append(srcIndex);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_neq_null && target->isForward()) {
@@ -666,16 +673,20 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindUnaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jneq_null);
             instructions().append(srcIndex);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     }
 
+    size_t begin = instructions().size();
+
     emitOpcode(target->isForward() ? op_jtrue : op_loop_if_true);
     instructions().append(cond->index());
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
@@ -692,10 +703,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindBinaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jnless);
             instructions().append(src1Index);
             instructions().append(src2Index);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_lesseq) {
@@ -707,10 +720,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindBinaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jnlesseq);
             instructions().append(src1Index);
             instructions().append(src2Index);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_not) {
@@ -721,9 +736,11 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindUnaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jtrue);
             instructions().append(srcIndex);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_eq_null) {
@@ -734,9 +751,11 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindUnaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jneq_null);
             instructions().append(srcIndex);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_neq_null) {
@@ -747,34 +766,41 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindUnaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jeq_null);
             instructions().append(srcIndex);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     }
 
+    size_t begin = instructions().size();
     emitOpcode(op_jfalse);
     instructions().append(cond->index());
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionCall(RegisterID* cond, Label* target)
 {
+    size_t begin = instructions().size();
+
     emitOpcode(op_jneq_ptr);
     instructions().append(cond->index());
     instructions().append(m_scopeChain->globalObject()->d()->callFunction);
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionApply(RegisterID* cond, Label* target)
 {
+    size_t begin = instructions().size();
+
     emitOpcode(op_jneq_ptr);
     instructions().append(cond->index());
     instructions().append(m_scopeChain->globalObject()->d()->applyFunction);
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
@@ -1718,6 +1744,8 @@ PassRefPtr<Label> BytecodeGenerator::emitComplexJumpScopes(Label* target, Contro
         }
 
         if (nNormalScopes) {
+            size_t begin = instructions().size();
+
             // We need to remove a number of dynamic scopes to get to the next
             // finally block
             emitOpcode(op_jmp_scopes);
@@ -1726,14 +1754,14 @@ PassRefPtr<Label> BytecodeGenerator::emitComplexJumpScopes(Label* target, Contro
             // If topScope == bottomScope then there isn't actually a finally block
             // left to emit, so make the jmp_scopes jump directly to the target label
             if (topScope == bottomScope) {
-                instructions().append(target->offsetFrom(instructions().size()));
+                instructions().append(target->bind(begin, instructions().size()));
                 return target;
             }
 
             // Otherwise we just use jmp_scopes to pop a group of scopes and go
             // to the next instruction
             RefPtr<Label> nextInsn = newLabel();
-            instructions().append(nextInsn->offsetFrom(instructions().size()));
+            instructions().append(nextInsn->bind(begin, instructions().size()));
             emitLabel(nextInsn.get());
         }
 
@@ -1758,27 +1786,47 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpScopes(Label* target, int targetSco
     if (m_finallyDepth)
         return emitComplexJumpScopes(target, &m_scopeContextStack.last(), &m_scopeContextStack.last() - scopeDelta);
 
+    size_t begin = instructions().size();
+
     emitOpcode(op_jmp_scopes);
     instructions().append(scopeDelta);
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
-RegisterID* BytecodeGenerator::emitNextPropertyName(RegisterID* dst, RegisterID* iter, Label* target)
+RegisterID* BytecodeGenerator::emitGetPropertyNames(RegisterID* dst, RegisterID* base, RegisterID* i, RegisterID* size, Label* breakTarget)
+{
+    size_t begin = instructions().size();
+
+    emitOpcode(op_get_pnames);
+    instructions().append(dst->index());
+    instructions().append(base->index());
+    instructions().append(i->index());
+    instructions().append(size->index());
+    instructions().append(breakTarget->bind(begin, instructions().size()));
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitNextPropertyName(RegisterID* dst, RegisterID* base, RegisterID* i, RegisterID* size, RegisterID* iter, Label* target)
 {
+    size_t begin = instructions().size();
+
     emitOpcode(op_next_pname);
     instructions().append(dst->index());
+    instructions().append(base->index());
+    instructions().append(i->index());
+    instructions().append(size->index());
     instructions().append(iter->index());
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return dst;
 }
 
 RegisterID* BytecodeGenerator::emitCatch(RegisterID* targetRegister, Label* start, Label* end)
 {
 #if ENABLE(JIT)
-    HandlerInfo info = { start->offsetFrom(0), end->offsetFrom(0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, CodeLocationLabel() };
+    HandlerInfo info = { start->bind(0, 0), end->bind(0, 0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, CodeLocationLabel() };
 #else
-    HandlerInfo info = { start->offsetFrom(0), end->offsetFrom(0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth };
+    HandlerInfo info = { start->bind(0, 0), end->bind(0, 0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth };
 #endif
 
     m_codeBlock->addExceptionHandler(info);
@@ -1798,9 +1846,11 @@ RegisterID* BytecodeGenerator::emitNewError(RegisterID* dst, ErrorType type, JSV
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpSubroutine(RegisterID* retAddrDst, Label* finally)
 {
+    size_t begin = instructions().size();
+
     emitOpcode(op_jsr);
     instructions().append(retAddrDst->index());
-    instructions().append(finally->offsetFrom(instructions().size()));
+    instructions().append(finally->bind(begin, instructions().size()));
     emitLabel(newLabel().get()); // Record the fact that the next instruction is implicitly labeled, because op_sret will return to it.
     return finally;
 }
@@ -1870,7 +1920,7 @@ static void prepareJumpTableForImmediateSwitch(SimpleJumpTable& jumpTable, int32
         // We're emitting this after the clause labels should have been fixed, so 
         // the labels should not be "forward" references
         ASSERT(!labels[i]->isForward());
-        jumpTable.add(keyForImmediateSwitch(nodes[i], min, max), labels[i]->offsetFrom(switchAddress)); 
+        jumpTable.add(keyForImmediateSwitch(nodes[i], min, max), labels[i]->bind(switchAddress, switchAddress + 3)); 
     }
 }
 
@@ -1896,7 +1946,7 @@ static void prepareJumpTableForCharacterSwitch(SimpleJumpTable& jumpTable, int32
         // We're emitting this after the clause labels should have been fixed, so 
         // the labels should not be "forward" references
         ASSERT(!labels[i]->isForward());
-        jumpTable.add(keyForCharacterSwitch(nodes[i], min, max), labels[i]->offsetFrom(switchAddress)); 
+        jumpTable.add(keyForCharacterSwitch(nodes[i], min, max), labels[i]->bind(switchAddress, switchAddress + 3)); 
     }
 }
 
@@ -1910,7 +1960,7 @@ static void prepareJumpTableForStringSwitch(StringJumpTable& jumpTable, int32_t
         ASSERT(nodes[i]->isString());
         UString::Rep* clause = static_cast<StringNode*>(nodes[i])->value().ustring().rep();
         OffsetLocation location;
-        location.branchOffset = labels[i]->offsetFrom(switchAddress);
+        location.branchOffset = labels[i]->bind(switchAddress, switchAddress + 3);
         jumpTable.offsetTable.add(clause, location);
     }
 }
@@ -1921,23 +1971,23 @@ void BytecodeGenerator::endSwitch(uint32_t clauseCount, RefPtr<Label>* labels, E
     m_switchContextStack.removeLast();
     if (switchInfo.switchType == SwitchInfo::SwitchImmediate) {
         instructions()[switchInfo.bytecodeOffset + 1] = m_codeBlock->numberOfImmediateSwitchJumpTables();
-        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->offsetFrom(switchInfo.bytecodeOffset + 3);
+        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->bind(switchInfo.bytecodeOffset, switchInfo.bytecodeOffset + 3);
 
         SimpleJumpTable& jumpTable = m_codeBlock->addImmediateSwitchJumpTable();
-        prepareJumpTableForImmediateSwitch(jumpTable, switchInfo.bytecodeOffset + 3, clauseCount, labels, nodes, min, max);
+        prepareJumpTableForImmediateSwitch(jumpTable, switchInfo.bytecodeOffset, clauseCount, labels, nodes, min, max);
     } else if (switchInfo.switchType == SwitchInfo::SwitchCharacter) {
         instructions()[switchInfo.bytecodeOffset + 1] = m_codeBlock->numberOfCharacterSwitchJumpTables();
-        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->offsetFrom(switchInfo.bytecodeOffset + 3);
+        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->bind(switchInfo.bytecodeOffset, switchInfo.bytecodeOffset + 3);
         
         SimpleJumpTable& jumpTable = m_codeBlock->addCharacterSwitchJumpTable();
-        prepareJumpTableForCharacterSwitch(jumpTable, switchInfo.bytecodeOffset + 3, clauseCount, labels, nodes, min, max);
+        prepareJumpTableForCharacterSwitch(jumpTable, switchInfo.bytecodeOffset, clauseCount, labels, nodes, min, max);
     } else {
         ASSERT(switchInfo.switchType == SwitchInfo::SwitchString);
         instructions()[switchInfo.bytecodeOffset + 1] = m_codeBlock->numberOfStringSwitchJumpTables();
-        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->offsetFrom(switchInfo.bytecodeOffset + 3);
+        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->bind(switchInfo.bytecodeOffset, switchInfo.bytecodeOffset + 3);
 
         StringJumpTable& jumpTable = m_codeBlock->addStringSwitchJumpTable();
-        prepareJumpTableForStringSwitch(jumpTable, switchInfo.bytecodeOffset + 3, clauseCount, labels, nodes);
+        prepareJumpTableForStringSwitch(jumpTable, switchInfo.bytecodeOffset, clauseCount, labels, nodes);
     }
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 1a83ce995c..61de1739d2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -312,8 +312,8 @@ namespace JSC {
         PassRefPtr<Label> emitJumpSubroutine(RegisterID* retAddrDst, Label*);
         void emitSubroutineReturn(RegisterID* retAddrSrc);
 
-        RegisterID* emitGetPropertyNames(RegisterID* dst, RegisterID* base) { return emitUnaryOp(op_get_pnames, dst, base); }
-        RegisterID* emitNextPropertyName(RegisterID* dst, RegisterID* iter, Label* target);
+        RegisterID* emitGetPropertyNames(RegisterID* dst, RegisterID* base, RegisterID* i, RegisterID* size, Label* breakTarget);
+        RegisterID* emitNextPropertyName(RegisterID* dst, RegisterID* base, RegisterID* i, RegisterID* size, RegisterID* iter, Label* target);
 
         RegisterID* emitCatch(RegisterID*, Label* start, Label* end);
         void emitThrow(RegisterID* exc) { emitUnaryNoDstOp(op_throw, exc); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/Label.h b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/Label.h
index 0b3d038242..8cab1dbc00 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/Label.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/Label.h
@@ -51,19 +51,17 @@ namespace JSC {
             m_location = location;
 
             unsigned size = m_unresolvedJumps.size();
-            for (unsigned i = 0; i < size; ++i) {
-                unsigned j = m_unresolvedJumps[i];
-                m_codeBlock->instructions()[j].u.operand = m_location - j;
-            }
+            for (unsigned i = 0; i < size; ++i)
+                m_codeBlock->instructions()[m_unresolvedJumps[i].second].u.operand = m_location - m_unresolvedJumps[i].first;
         }
 
-        int offsetFrom(int location) const
+        int bind(int opcode, int offset) const
         {
             if (m_location == invalidLocation) {
-                m_unresolvedJumps.append(location);
+                m_unresolvedJumps.append(std::make_pair(opcode, offset));
                 return 0;
             }
-            return m_location - location;
+            return m_location - opcode;
         }
 
         void ref() { ++m_refCount; }
@@ -77,7 +75,7 @@ namespace JSC {
         bool isForward() const { return m_location == invalidLocation; }
 
     private:
-        typedef Vector<int, 8> JumpVector;
+        typedef Vector<std::pair<int, int>, 8> JumpVector;
 
         static const unsigned invalidLocation = UINT_MAX;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
index dd342656fa..63cf63558e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
@@ -51,9 +51,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultGetPropertyNames)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
         }
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | JSObject::StructureFlags;
+
     private:
         JSActivation* m_activation;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
index 71451d6d97..5b1be711b4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
@@ -236,6 +236,7 @@
 
 #include "JSObject.h"
 #include "JSString.h"
+#include "Lexer.h"
 #include "NodeConstructors.h"
 #include "NodeInfo.h"
 #include <stdlib.h>
@@ -257,7 +258,6 @@
 #define YYERROR_VERBOSE
 #endif
 
-int jscyylex(void* lvalp, void* llocp, void* globalPtr);
 int jscyyerror(const char*);
 
 static inline bool allowAutomaticSemicolon(JSC::Lexer&, int);
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
index f912298cbf..c8ff849942 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
@@ -4,7 +4,7 @@
 
 namespace JSC {
 
-static const struct HashTableValue stringTableValues[33] = {
+static const struct HashTableValue stringTableValues[36] = {
    { "toString", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
    { "valueOf", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
    { "charAt", DontEnum|Function, (intptr_t)stringProtoFuncCharAt, (intptr_t)1 },
@@ -37,9 +37,12 @@ static const struct HashTableValue stringTableValues[33] = {
    { "fontsize", DontEnum|Function, (intptr_t)stringProtoFuncFontsize, (intptr_t)1 },
    { "anchor", DontEnum|Function, (intptr_t)stringProtoFuncAnchor, (intptr_t)1 },
    { "link", DontEnum|Function, (intptr_t)stringProtoFuncLink, (intptr_t)1 },
+   { "trim", DontEnum|Function, (intptr_t)stringProtoFuncTrim, (intptr_t)0 },
+   { "trimLeft", DontEnum|Function, (intptr_t)stringProtoFuncTrimLeft, (intptr_t)0 },
+   { "trimRight", DontEnum|Function, (intptr_t)stringProtoFuncTrimRight, (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
 extern JSC_CONST_HASHTABLE HashTable stringTable =
-    { 71, 63, stringTableValues, 0 };
+    { 133, 127, stringTableValues, 0 };
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
index 847b1fad6a..53964ad62d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
@@ -91,8 +91,8 @@ static int depth(CodeBlock* codeBlock, ScopeChain& sc)
 #if USE(INTERPRETER)
 NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
-    int dst = (vPC + 1)->u.operand;
-    int property = (vPC + 2)->u.operand;
+    int dst = vPC[1].u.operand;
+    int property = vPC[2].u.operand;
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     ScopeChainIterator iter = scopeChain->begin();
@@ -121,9 +121,9 @@ NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vP
 {
     CodeBlock* codeBlock = callFrame->codeBlock();
 
-    int dst = (vPC + 1)->u.operand;
-    int property = (vPC + 2)->u.operand;
-    int skip = (vPC + 3)->u.operand + codeBlock->needsFullScopeChain();
+    int dst = vPC[1].u.operand;
+    int property = vPC[2].u.operand;
+    int skip = vPC[3].u.operand + codeBlock->needsFullScopeChain();
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     ScopeChainIterator iter = scopeChain->begin();
@@ -152,12 +152,12 @@ NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vP
 
 NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
-    int dst = (vPC + 1)->u.operand;
-    JSGlobalObject* globalObject = static_cast<JSGlobalObject*>((vPC + 2)->u.jsCell);
+    int dst = vPC[1].u.operand;
+    JSGlobalObject* globalObject = static_cast<JSGlobalObject*>(vPC[2].u.jsCell);
     ASSERT(globalObject->isGlobalObject());
-    int property = (vPC + 3)->u.operand;
-    Structure* structure = (vPC + 4)->u.structure;
-    int offset = (vPC + 5)->u.operand;
+    int property = vPC[3].u.operand;
+    Structure* structure = vPC[4].u.structure;
+    int offset = vPC[5].u.operand;
 
     if (structure == globalObject->structure()) {
         callFrame->r(dst) = JSValue(globalObject->getDirectOffset(offset));
@@ -192,16 +192,16 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
 
 NEVER_INLINE void Interpreter::resolveBase(CallFrame* callFrame, Instruction* vPC)
 {
-    int dst = (vPC + 1)->u.operand;
-    int property = (vPC + 2)->u.operand;
+    int dst = vPC[1].u.operand;
+    int property = vPC[2].u.operand;
     callFrame->r(dst) = JSValue(JSC::resolveBase(callFrame, callFrame->codeBlock()->identifier(property), callFrame->scopeChain()));
 }
 
 NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
-    int baseDst = (vPC + 1)->u.operand;
-    int propDst = (vPC + 2)->u.operand;
-    int property = (vPC + 3)->u.operand;
+    int baseDst = vPC[1].u.operand;
+    int propDst = vPC[2].u.operand;
+    int property = vPC[3].u.operand;
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     ScopeChainIterator iter = scopeChain->begin();
@@ -233,51 +233,6 @@ NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Inst
     return false;
 }
 
-NEVER_INLINE bool Interpreter::resolveBaseAndFunc(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
-{
-    int baseDst = (vPC + 1)->u.operand;
-    int funcDst = (vPC + 2)->u.operand;
-    int property = (vPC + 3)->u.operand;
-
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-
-    // FIXME: add scopeDepthIsZero optimization
-
-    ASSERT(iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    Identifier& ident = codeBlock->identifier(property);
-    JSObject* base;
-    do {
-        base = *iter;
-        PropertySlot slot(base);
-        if (base->getPropertySlot(callFrame, ident, slot)) {            
-            // ECMA 11.2.3 says that if we hit an activation the this value should be null.
-            // However, section 10.2.3 says that in the case where the value provided
-            // by the caller is null, the global object should be used. It also says
-            // that the section does not apply to internal functions, but for simplicity
-            // of implementation we use the global object anyway here. This guarantees
-            // that in host objects you always get a valid object for this.
-            // We also handle wrapper substitution for the global object at the same time.
-            JSObject* thisObj = base->toThisObject(callFrame);
-            JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception;
-            if (exceptionValue)
-                return false;
-
-            callFrame->r(baseDst) = JSValue(thisObj);
-            callFrame->r(funcDst) = JSValue(result);
-            return true;
-        }
-        ++iter;
-    } while (iter != end);
-
-    exceptionValue = createUndefinedVariableError(callFrame, ident, vPC - codeBlock->instructions().begin(), codeBlock);
-    return false;
-}
-
 #endif // USE(INTERPRETER)
 
 ALWAYS_INLINE CallFrame* Interpreter::slideRegisterWindowForCall(CodeBlock* newCodeBlock, RegisterFile* registerFile, CallFrame* callFrame, size_t registerOffset, int argc)
@@ -928,10 +883,10 @@ NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookID debugHook
 #if USE(INTERPRETER)
 NEVER_INLINE ScopeChainNode* Interpreter::createExceptionScope(CallFrame* callFrame, const Instruction* vPC)
 {
-    int dst = (++vPC)->u.operand;
+    int dst = vPC[1].u.operand;
     CodeBlock* codeBlock = callFrame->codeBlock();
-    Identifier& property = codeBlock->identifier((++vPC)->u.operand);
-    JSValue value = callFrame->r((++vPC)->u.operand).jsValue();
+    Identifier& property = codeBlock->identifier(vPC[2].u.operand);
+    JSValue value = callFrame->r(vPC[3].u.operand).jsValue();
     JSObject* scope = new (callFrame) JSStaticScopeObject(callFrame, property, value, DontDelete);
     callFrame->r(dst) = JSValue(scope);
 
@@ -983,22 +938,20 @@ NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock*
         return;
     }
 
-    StructureChain* protoChain = structure->prototypeChain(callFrame);
-    if (!protoChain->isCacheable()) {
-        vPC[0] = getOpcode(op_put_by_id_generic);
-        return;
-    }
-
     // Structure transition, cache transition info
     if (slot.type() == PutPropertySlot::NewProperty) {
         if (structure->isDictionary()) {
             vPC[0] = getOpcode(op_put_by_id_generic);
             return;
         }
+
+        // put_by_id_transition checks the prototype chain for setters.
+        normalizePrototypeChain(callFrame, baseCell);
+
         vPC[0] = getOpcode(op_put_by_id_transition);
         vPC[4] = structure->previousID();
         vPC[5] = structure;
-        vPC[6] = protoChain;
+        vPC[6] = structure->prototypeChain(callFrame);
         vPC[7] = slot.cachedOffset();
         codeBlock->refStructures(vPC);
         return;
@@ -1094,21 +1047,15 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         return;
     }
 
-    size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot);
+    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase());
     if (!count) {
         vPC[0] = getOpcode(op_get_by_id_generic);
         return;
     }
 
-    StructureChain* protoChain = structure->prototypeChain(callFrame);
-    if (!protoChain->isCacheable()) {
-        vPC[0] = getOpcode(op_get_by_id_generic);
-        return;
-    }
-
     vPC[0] = getOpcode(op_get_by_id_chain);
     vPC[4] = structure;
-    vPC[5] = protoChain;
+    vPC[5] = structure->prototypeChain(callFrame);
     vPC[6] = count;
     vPC[7] = slot.cachedOffset();
     codeBlock->refStructures(vPC);
@@ -1213,10 +1160,10 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Constructs a new empty Object instance using the original
            constructor, and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
         callFrame->r(dst) = JSValue(constructEmptyObject(callFrame));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_object);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_new_array) {
@@ -1227,13 +1174,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            The array will contain argCount elements with values
            taken from registers starting at register firstArg.
         */
-        int dst = (++vPC)->u.operand;
-        int firstArg = (++vPC)->u.operand;
-        int argCount = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int firstArg = vPC[2].u.operand;
+        int argCount = vPC[3].u.operand;
         ArgList args(callFrame->registers() + firstArg, argCount);
         callFrame->r(dst) = JSValue(constructArray(callFrame, args));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_array);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_new_regexp) {
@@ -1243,11 +1190,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            constructor from regexp regExp, and puts the result in
            register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int regExp = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int regExp = vPC[2].u.operand;
         callFrame->r(dst) = JSValue(new (globalData) RegExpObject(callFrame->scopeChain()->globalObject->regExpStructure(), callFrame->codeBlock()->regexp(regExp)));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_regexp);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_mov) {
@@ -1255,11 +1202,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
            Copies register src to register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = callFrame->r(src);
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_mov);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_eq) {
@@ -1269,9 +1216,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            as with the ECMAScript '==' operator, and puts the result
            as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
             callFrame->r(dst) = jsBoolean(src1.asInt32() == src2.asInt32());
         else {
@@ -1280,7 +1227,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_eq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_eq_null) {
@@ -1289,17 +1236,17 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Checks whether register src is null, as with the ECMAScript '!='
            operator, and puts the result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
 
         if (src.isUndefinedOrNull()) {
             callFrame->r(dst) = jsBoolean(true);
-            ++vPC;
+            vPC += OPCODE_LENGTH(op_eq_null);
             NEXT_INSTRUCTION();
         }
         
         callFrame->r(dst) = jsBoolean(src.isCell() && src.asCell()->structure()->typeInfo().masqueradesAsUndefined());
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_eq_null);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_neq) {
@@ -1309,9 +1256,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            equal, as with the ECMAScript '!=' operator, and puts the
            result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
             callFrame->r(dst) = jsBoolean(src1.asInt32() != src2.asInt32());
         else {
@@ -1320,7 +1267,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_neq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_neq_null) {
@@ -1329,17 +1276,17 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Checks whether register src is not null, as with the ECMAScript '!='
            operator, and puts the result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
 
         if (src.isUndefinedOrNull()) {
             callFrame->r(dst) = jsBoolean(false);
-            ++vPC;
+            vPC += OPCODE_LENGTH(op_neq_null);
             NEXT_INSTRUCTION();
         }
         
         callFrame->r(dst) = jsBoolean(!src.isCell() || !asCell(src)->structure()->typeInfo().masqueradesAsUndefined());
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_neq_null);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_stricteq) {
@@ -1349,12 +1296,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            equal, as with the ECMAScript '===' operator, and puts the
            result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         callFrame->r(dst) = jsBoolean(JSValue::strictEqual(src1, src2));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_stricteq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_nstricteq) {
@@ -1364,12 +1311,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            strictly equal, as with the ECMAScript '!==' operator, and
            puts the result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         callFrame->r(dst) = jsBoolean(!JSValue::strictEqual(src1, src2));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_nstricteq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_less) {
@@ -1379,14 +1326,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            with the ECMAScript '<' operator, and puts the result as
            a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         JSValue result = jsBoolean(jsLess(callFrame, src1, src2));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_less);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_lesseq) {
@@ -1396,14 +1343,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register src2, as with the ECMAScript '<=' operator, and
            puts the result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         JSValue result = jsBoolean(jsLessEq(callFrame, src1, src2));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_lesseq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_pre_inc) {
@@ -1412,7 +1359,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Converts register srcDst to number, adds one, and puts the result
            back in register srcDst.
         */
-        int srcDst = (++vPC)->u.operand;
+        int srcDst = vPC[1].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() < INT_MAX)
             callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() + 1);
@@ -1422,7 +1369,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(srcDst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_pre_inc);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_pre_dec) {
@@ -1431,7 +1378,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Converts register srcDst to number, subtracts one, and puts the result
            back in register srcDst.
         */
-        int srcDst = (++vPC)->u.operand;
+        int srcDst = vPC[1].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() > INT_MIN)
             callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() - 1);
@@ -1441,7 +1388,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(srcDst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_pre_dec);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_post_inc) {
@@ -1451,8 +1398,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            written to register dst, and the number plus one is written
            back to register srcDst.
         */
-        int dst = (++vPC)->u.operand;
-        int srcDst = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int srcDst = vPC[2].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() < INT_MAX) {
             callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() + 1);
@@ -1464,7 +1411,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = number;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_post_inc);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_post_dec) {
@@ -1474,8 +1421,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            written to register dst, and the number minus one is written
            back to register srcDst.
         */
-        int dst = (++vPC)->u.operand;
-        int srcDst = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int srcDst = vPC[2].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() > INT_MIN) {
             callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() - 1);
@@ -1487,7 +1434,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = number;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_post_dec);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_to_jsnumber) {
@@ -1496,8 +1443,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Converts register src to number, and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
 
         JSValue srcVal = callFrame->r(src).jsValue();
 
@@ -1509,7 +1456,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_to_jsnumber);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_negate) {
@@ -1518,8 +1465,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Converts register src to number, negates it, and puts the
            result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
         if (src.isInt32() && src.asInt32())
             callFrame->r(dst) = jsNumber(callFrame, -src.asInt32());
         else {
@@ -1528,7 +1475,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_negate);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_add) {
@@ -1538,9 +1485,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            in register dst. (JS add may be string concatenation or
            numeric add, depending on the types of the operands.)
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() + src2.asInt32());
         else {
@@ -1548,7 +1495,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_add);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_mul) {
@@ -1557,9 +1504,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Multiplies register src1 and register src2 (converted to
            numbers), and puts the product in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() >> 15)) // no overflow
                 callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() * src2.asInt32());
         else {
@@ -1568,7 +1515,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_mul);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_div) {
@@ -1578,15 +1525,15 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register divisor (converted to number), and puts the
            quotient in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue dividend = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue divisor = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue dividend = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue divisor = callFrame->r(vPC[3].u.operand).jsValue();
 
         JSValue result = jsNumber(callFrame, dividend.toNumber(callFrame) / divisor.toNumber(callFrame));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_div);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_mod) {
@@ -1596,15 +1543,15 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register divisor (converted to number), and puts the
            remainder in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue dividend = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue divisor = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue dividend = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue divisor = callFrame->r(vPC[3].u.operand).jsValue();
 
         if (dividend.isInt32() && divisor.isInt32() && divisor.asInt32() != 0) {
             JSValue result = jsNumber(callFrame, dividend.asInt32() % divisor.asInt32());
             ASSERT(result);
             callFrame->r(dst) = result;
-            ++vPC;
+            vPC += OPCODE_LENGTH(op_mod);
             NEXT_INSTRUCTION();
         }
 
@@ -1615,7 +1562,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue result = jsNumber(callFrame, fmod(d1, d2));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_mod);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_sub) {
@@ -1625,9 +1572,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            src1 (converted to number), and puts the difference in
            register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() - src2.asInt32());
         else {
@@ -1635,7 +1582,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_sub);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_lshift) {
@@ -1645,9 +1592,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register shift (converted to uint32), and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue val = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue shift = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue val = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue shift = callFrame->r(vPC[3].u.operand).jsValue();
 
         if (val.isInt32() && shift.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, val.asInt32() << (shift.asInt32() & 0x1f));
@@ -1657,7 +1604,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_lshift);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_rshift) {
@@ -1667,9 +1614,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            to int32) by register shift (converted to
            uint32), and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue val = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue shift = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue val = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue shift = callFrame->r(vPC[3].u.operand).jsValue();
 
         if (val.isInt32() && shift.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, val.asInt32() >> (shift.asInt32() & 0x1f));
@@ -1679,7 +1626,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_rshift);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_urshift) {
@@ -1689,9 +1636,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            to uint32) by register shift (converted to
            uint32), and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue val = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue shift = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue val = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue shift = callFrame->r(vPC[3].u.operand).jsValue();
         if (val.isUInt32() && shift.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, val.asInt32() >> (shift.asInt32() & 0x1f));
         else {
@@ -1700,7 +1647,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_urshift);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_bitand) {
@@ -1710,9 +1657,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            and register src2 (converted to int32), and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() & src2.asInt32());
         else {
@@ -1721,7 +1668,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_bitand);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_bitxor) {
@@ -1731,9 +1678,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            and register src2 (converted to int32), and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() ^ src2.asInt32());
         else {
@@ -1742,7 +1689,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_bitxor);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_bitor) {
@@ -1752,9 +1699,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            and register src2 (converted to int32), and puts the
            result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() | src2.asInt32());
         else {
@@ -1763,7 +1710,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_bitor);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_bitnot) {
@@ -1772,8 +1719,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Computes bitwise NOT of register src1 (converted to int32),
            and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
         if (src.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, ~src.asInt32());
         else {
@@ -1781,7 +1728,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_bitnot);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_not) {
@@ -1790,13 +1737,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Computes logical NOT of register src (converted to
            boolean), and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         JSValue result = jsBoolean(!callFrame->r(src).jsValue().toBoolean(callFrame));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_not);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_instanceof) {
@@ -1826,7 +1773,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = jsBoolean(result);
 
-        vPC += 5;
+        vPC += OPCODE_LENGTH(op_instanceof);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_typeof) {
@@ -1835,11 +1782,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Determines the type string for src according to ECMAScript
            rules, and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = JSValue(jsTypeStringForValue(callFrame, callFrame->r(src).jsValue()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_typeof);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_undefined) {
@@ -1849,12 +1796,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "undefined", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         JSValue v = callFrame->r(src).jsValue();
         callFrame->r(dst) = jsBoolean(v.isCell() ? v.asCell()->structure()->typeInfo().masqueradesAsUndefined() : v.isUndefined());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_undefined);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_boolean) {
@@ -1864,11 +1811,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "boolean", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = jsBoolean(callFrame->r(src).jsValue().isBoolean());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_boolean);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_number) {
@@ -1878,11 +1825,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "number", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = jsBoolean(callFrame->r(src).jsValue().isNumber());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_number);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_string) {
@@ -1892,11 +1839,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "string", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = jsBoolean(callFrame->r(src).jsValue().isString());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_string);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_object) {
@@ -1906,11 +1853,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "object", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = jsBoolean(jsIsObjectType(callFrame->r(src).jsValue()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_object);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_function) {
@@ -1920,11 +1867,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "function", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = jsBoolean(jsIsFunctionType(callFrame->r(src).jsValue()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_function);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_in) {
@@ -1936,9 +1883,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Raises an exception if register constructor is not an
            object.
         */
-        int dst = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
-        int base = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        int base = vPC[3].u.operand;
 
         JSValue baseVal = callFrame->r(base).jsValue();
         if (isInvalidParamForIn(callFrame, callFrame->codeBlock(), vPC, baseVal, exceptionValue))
@@ -1957,7 +1904,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = jsBoolean(baseObj->hasProperty(callFrame, property));
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_in);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve) {
@@ -1970,7 +1917,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (UNLIKELY(!resolve(callFrame, vPC, exceptionValue)))
             goto vm_throw;
 
-        vPC += 3;
+        vPC += OPCODE_LENGTH(op_resolve);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve_skip) {
@@ -1983,7 +1930,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (UNLIKELY(!resolveSkip(callFrame, vPC, exceptionValue)))
             goto vm_throw;
 
-        vPC += 4;
+        vPC += OPCODE_LENGTH(op_resolve_skip);
 
         NEXT_INSTRUCTION();
     }
@@ -1998,7 +1945,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (UNLIKELY(!resolveGlobal(callFrame, vPC, exceptionValue)))
             goto vm_throw;
         
-        vPC += 6;
+        vPC += OPCODE_LENGTH(op_resolve_global);
         
         NEXT_INSTRUCTION();
     }
@@ -2007,13 +1954,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
            Gets the global var at global slot index and places it in register dst.
          */
-        int dst = (++vPC)->u.operand;
-        JSGlobalObject* scope = static_cast<JSGlobalObject*>((++vPC)->u.jsCell);
+        int dst = vPC[1].u.operand;
+        JSGlobalObject* scope = static_cast<JSGlobalObject*>(vPC[2].u.jsCell);
         ASSERT(scope->isGlobalObject());
-        int index = (++vPC)->u.operand;
+        int index = vPC[3].u.operand;
 
         callFrame->r(dst) = scope->registerAt(index);
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_get_global_var);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_global_var) {
@@ -2021,13 +1968,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          
            Puts value into global slot index.
          */
-        JSGlobalObject* scope = static_cast<JSGlobalObject*>((++vPC)->u.jsCell);
+        JSGlobalObject* scope = static_cast<JSGlobalObject*>(vPC[1].u.jsCell);
         ASSERT(scope->isGlobalObject());
-        int index = (++vPC)->u.operand;
-        int value = (++vPC)->u.operand;
+        int index = vPC[2].u.operand;
+        int value = vPC[3].u.operand;
         
         scope->registerAt(index) = JSValue(callFrame->r(value).jsValue());
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_global_var);
         NEXT_INSTRUCTION();
     }            
     DEFINE_OPCODE(op_get_scoped_var) {
@@ -2036,9 +1983,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          Loads the contents of the index-th local from the scope skip nodes from
          the top of the scope chain, and places it in register dst
          */
-        int dst = (++vPC)->u.operand;
-        int index = (++vPC)->u.operand;
-        int skip = (++vPC)->u.operand + callFrame->codeBlock()->needsFullScopeChain();
+        int dst = vPC[1].u.operand;
+        int index = vPC[2].u.operand;
+        int skip = vPC[3].u.operand + callFrame->codeBlock()->needsFullScopeChain();
 
         ScopeChainNode* scopeChain = callFrame->scopeChain();
         ScopeChainIterator iter = scopeChain->begin();
@@ -2052,16 +1999,16 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ASSERT((*iter)->isVariableObject());
         JSVariableObject* scope = static_cast<JSVariableObject*>(*iter);
         callFrame->r(dst) = scope->registerAt(index);
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_get_scoped_var);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_scoped_var) {
         /* put_scoped_var index(n) skip(n) value(r)
 
          */
-        int index = (++vPC)->u.operand;
-        int skip = (++vPC)->u.operand + callFrame->codeBlock()->needsFullScopeChain();
-        int value = (++vPC)->u.operand;
+        int index = vPC[1].u.operand;
+        int skip = vPC[2].u.operand + callFrame->codeBlock()->needsFullScopeChain();
+        int value = vPC[3].u.operand;
 
         ScopeChainNode* scopeChain = callFrame->scopeChain();
         ScopeChainIterator iter = scopeChain->begin();
@@ -2075,7 +2022,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ASSERT((*iter)->isVariableObject());
         JSVariableObject* scope = static_cast<JSVariableObject*>(*iter);
         scope->registerAt(index) = JSValue(callFrame->r(value).jsValue());
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_scoped_var);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve_base) {
@@ -2088,7 +2035,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         resolveBase(callFrame, vPC);
 
-        vPC += 3;
+        vPC += OPCODE_LENGTH(op_resolve_base);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve_with_base) {
@@ -2106,7 +2053,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (UNLIKELY(!resolveBaseAndProperty(callFrame, vPC, exceptionValue)))
             goto vm_throw;
 
-        vPC += 4;
+        vPC += OPCODE_LENGTH(op_resolve_with_base);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_by_id) {
@@ -2129,7 +2076,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         tryCacheGetByID(callFrame, codeBlock, vPC, baseValue, ident, slot);
 
         callFrame->r(dst) = result;
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_get_by_id);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_by_id_self) {
@@ -2155,7 +2102,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 ASSERT(baseObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
                 callFrame->r(dst) = JSValue(baseObject->getDirectOffset(offset));
 
-                vPC += 8;
+                vPC += OPCODE_LENGTH(op_get_by_id_self);
                 NEXT_INSTRUCTION();
             }
         }
@@ -2189,7 +2136,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                     ASSERT(protoObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == protoObject->getDirectOffset(offset));
                     callFrame->r(dst) = JSValue(protoObject->getDirectOffset(offset));
 
-                    vPC += 8;
+                    vPC += OPCODE_LENGTH(op_get_by_id_proto);
                     NEXT_INSTRUCTION();
                 }
             }
@@ -2202,14 +2149,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         // Polymorphic self access caching currently only supported when JITting.
         ASSERT_NOT_REACHED();
         // This case of the switch must not be empty, else (op_get_by_id_self_list == op_get_by_id_chain)!
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_get_by_id_self_list);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_by_id_proto_list) {
         // Polymorphic prototype access caching currently only supported when JITting.
         ASSERT_NOT_REACHED();
         // This case of the switch must not be empty, else (op_get_by_id_proto_list == op_get_by_id_chain)!
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_get_by_id_proto_list);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_by_id_chain) {
@@ -2244,7 +2191,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                         ASSERT(baseObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
                         callFrame->r(dst) = JSValue(baseObject->getDirectOffset(offset));
 
-                        vPC += 8;
+                        vPC += OPCODE_LENGTH(op_get_by_id_chain);
                         NEXT_INSTRUCTION();
                     }
 
@@ -2274,7 +2221,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         CHECK_FOR_EXCEPTION();
 
         callFrame->r(dst) = result;
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_get_by_id_generic);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_array_length) {
@@ -2290,7 +2237,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (LIKELY(isJSArray(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
             callFrame->r(dst) = jsNumber(callFrame, asArray(baseValue)->length());
-            vPC += 8;
+            vPC += OPCODE_LENGTH(op_get_array_length);
             NEXT_INSTRUCTION();
         }
 
@@ -2310,7 +2257,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (LIKELY(isJSString(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
             callFrame->r(dst) = jsNumber(callFrame, asString(baseValue)->value().size());
-            vPC += 8;
+            vPC += OPCODE_LENGTH(op_get_string_length);
             NEXT_INSTRUCTION();
         }
 
@@ -2340,7 +2287,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         tryCachePutByID(callFrame, codeBlock, vPC, baseValue, slot);
 
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_put_by_id);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_by_id_transition) {
@@ -2385,7 +2332,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(callFrame->codeBlock()->identifier(vPC[2].u.operand))) == offset);
                 baseObject->putDirectOffset(offset, callFrame->r(value).jsValue());
 
-                vPC += 8;
+                vPC += OPCODE_LENGTH(op_put_by_id_transition);
                 NEXT_INSTRUCTION();
             }
         }
@@ -2420,7 +2367,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(callFrame->codeBlock()->identifier(vPC[2].u.operand))) == offset);
                 baseObject->putDirectOffset(offset, callFrame->r(value).jsValue());
 
-                vPC += 8;
+                vPC += OPCODE_LENGTH(op_put_by_id_replace);
                 NEXT_INSTRUCTION();
             }
         }
@@ -2447,7 +2394,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         baseValue.put(callFrame, ident, callFrame->r(value).jsValue(), slot);
         CHECK_FOR_EXCEPTION();
 
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_put_by_id_generic);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_del_by_id) {
@@ -2458,16 +2405,16 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            boolean indicating success (if true) or failure (if false)
            to register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int property = vPC[3].u.operand;
 
         JSObject* baseObj = callFrame->r(base).jsValue().toObject(callFrame);
         Identifier& ident = callFrame->codeBlock()->identifier(property);
         JSValue result = jsBoolean(baseObj->deleteProperty(callFrame, ident));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_del_by_id);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_by_val) {
@@ -2478,9 +2425,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            in register dst. property is nominally converted to string
            but numbers are treated more efficiently.
         */
-        int dst = (++vPC)->u.operand;
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int property = vPC[3].u.operand;
         
         JSValue baseValue = callFrame->r(base).jsValue();
         JSValue subscript = callFrame->r(property).jsValue();
@@ -2508,7 +2455,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_get_by_val);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_by_val) {
@@ -2522,9 +2469,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Unlike many opcodes, this one does not write any output to
            the register file.
         */
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
-        int value = (++vPC)->u.operand;
+        int base = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        int value = vPC[3].u.operand;
 
         JSValue baseValue = callFrame->r(base).jsValue();
         JSValue subscript = callFrame->r(property).jsValue();
@@ -2558,7 +2505,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         }
 
         CHECK_FOR_EXCEPTION();
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_by_val);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_del_by_val) {
@@ -2569,9 +2516,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            boolean indicating success (if true) or failure (if false)
            to register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int property = vPC[3].u.operand;
 
         JSObject* baseObj = callFrame->r(base).jsValue().toObject(callFrame); // may throw
 
@@ -2589,7 +2536,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_del_by_val);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_by_index) {
@@ -2604,13 +2551,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
            This opcode is mainly used to initialize array literals.
         */
-        int base = (++vPC)->u.operand;
-        unsigned property = (++vPC)->u.operand;
-        int value = (++vPC)->u.operand;
+        int base = vPC[1].u.operand;
+        unsigned property = vPC[2].u.operand;
+        int value = vPC[3].u.operand;
 
         callFrame->r(base).jsValue().put(callFrame, property, callFrame->r(value).jsValue());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_by_index);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_loop) {
@@ -2625,7 +2572,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 #if ENABLE(OPCODE_STATS)
         OpcodeStats::resetLastInstruction();
 #endif
-        int target = (++vPC)->u.operand;
+        int target = vPC[1].u.operand;
         CHECK_FOR_TIMEOUT();
         vPC += target;
         NEXT_INSTRUCTION();
@@ -2639,7 +2586,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 #if ENABLE(OPCODE_STATS)
         OpcodeStats::resetLastInstruction();
 #endif
-        int target = (++vPC)->u.operand;
+        int target = vPC[1].u.operand;
 
         vPC += target;
         NEXT_INSTRUCTION();
@@ -2653,15 +2600,15 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Additionally this loop instruction may terminate JS execution is
            the JS timeout is reached.
          */
-        int cond = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int cond = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
         if (callFrame->r(cond).jsValue().toBoolean(callFrame)) {
             vPC += target;
             CHECK_FOR_TIMEOUT();
             NEXT_INSTRUCTION();
         }
         
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_loop_if_true);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jtrue) {
@@ -2670,14 +2617,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Jumps to offset target from the current instruction, if and
            only if register cond converts to boolean as true.
         */
-        int cond = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int cond = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
         if (callFrame->r(cond).jsValue().toBoolean(callFrame)) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jtrue);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jfalse) {
@@ -2686,14 +2633,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Jumps to offset target from the current instruction, if and
            only if register cond converts to boolean as false.
         */
-        int cond = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int cond = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
         if (!callFrame->r(cond).jsValue().toBoolean(callFrame)) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jfalse);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jeq_null) {
@@ -2702,8 +2649,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Jumps to offset target from the current instruction, if and
            only if register src is null.
         */
-        int src = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int src = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
         JSValue srcValue = callFrame->r(src).jsValue();
 
         if (srcValue.isUndefinedOrNull() || (srcValue.isCell() && srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
@@ -2711,7 +2658,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jeq_null);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jneq_null) {
@@ -2720,8 +2667,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Jumps to offset target from the current instruction, if and
            only if register src is not null.
         */
-        int src = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int src = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
         JSValue srcValue = callFrame->r(src).jsValue();
 
         if (!srcValue.isUndefinedOrNull() || (srcValue.isCell() && !srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
@@ -2729,7 +2676,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jneq_null);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jneq_ptr) {
@@ -2738,16 +2685,16 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Jumps to offset target from the current instruction, if the value r is equal
            to ptr, using pointer equality.
          */
-        int src = (++vPC)->u.operand;
-        JSValue ptr = JSValue((++vPC)->u.jsCell);
-        int target = (++vPC)->u.operand;
+        int src = vPC[1].u.operand;
+        JSValue ptr = JSValue(vPC[2].u.jsCell);
+        int target = vPC[3].u.operand;
         JSValue srcValue = callFrame->r(src).jsValue();
         if (srcValue != ptr) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jneq_ptr);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_loop_if_less) {
@@ -2761,9 +2708,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Additionally this loop instruction may terminate JS execution is
            the JS timeout is reached.
          */
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        int target = (++vPC)->u.operand;
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
         
         bool result = jsLess(callFrame, src1, src2);
         CHECK_FOR_EXCEPTION();
@@ -2774,7 +2721,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
         
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_loop_if_less);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_loop_if_lesseq) {
@@ -2788,9 +2735,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Additionally this loop instruction may terminate JS execution is
            the JS timeout is reached.
         */
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        int target = (++vPC)->u.operand;
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
         
         bool result = jsLessEq(callFrame, src1, src2);
         CHECK_FOR_EXCEPTION();
@@ -2801,7 +2748,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
         
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_loop_if_lesseq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jnless) {
@@ -2812,9 +2759,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            target from the current instruction, if and only if the 
            result of the comparison is false.
         */
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        int target = (++vPC)->u.operand;
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
 
         bool result = jsLess(callFrame, src1, src2);
         CHECK_FOR_EXCEPTION();
@@ -2824,7 +2771,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jnless);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jnlesseq) {
@@ -2835,9 +2782,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            and then jumps to offset target from the current instruction,
            if and only if theresult of the comparison is false.
         */
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        int target = (++vPC)->u.operand;
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
 
         bool result = jsLessEq(callFrame, src1, src2);
         CHECK_FOR_EXCEPTION();
@@ -2847,7 +2794,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jnlesseq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_switch_imm) {
@@ -2859,9 +2806,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            table, and the value at jumpTable[scrutinee value] is non-zero, then
            that value is used as the jump offset, otherwise defaultOffset is used.
          */
-        int tableIndex = (++vPC)->u.operand;
-        int defaultOffset = (++vPC)->u.operand;
-        JSValue scrutinee = callFrame->r((++vPC)->u.operand).jsValue();
+        int tableIndex = vPC[1].u.operand;
+        int defaultOffset = vPC[2].u.operand;
+        JSValue scrutinee = callFrame->r(vPC[3].u.operand).jsValue();
         if (scrutinee.isInt32())
             vPC += callFrame->codeBlock()->immediateSwitchJumpTable(tableIndex).offsetForValue(scrutinee.asInt32(), defaultOffset);
         else {
@@ -2883,9 +2830,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            table, and the value at jumpTable[scrutinee value] is non-zero, then
            that value is used as the jump offset, otherwise defaultOffset is used.
          */
-        int tableIndex = (++vPC)->u.operand;
-        int defaultOffset = (++vPC)->u.operand;
-        JSValue scrutinee = callFrame->r((++vPC)->u.operand).jsValue();
+        int tableIndex = vPC[1].u.operand;
+        int defaultOffset = vPC[2].u.operand;
+        JSValue scrutinee = callFrame->r(vPC[3].u.operand).jsValue();
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else {
@@ -2906,9 +2853,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            jump table, then the value associated with the string is used as the 
            jump offset, otherwise defaultOffset is used.
          */
-        int tableIndex = (++vPC)->u.operand;
-        int defaultOffset = (++vPC)->u.operand;
-        JSValue scrutinee = callFrame->r((++vPC)->u.operand).jsValue();
+        int tableIndex = vPC[1].u.operand;
+        int defaultOffset = vPC[2].u.operand;
+        JSValue scrutinee = callFrame->r(vPC[3].u.operand).jsValue();
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else 
@@ -2923,12 +2870,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            constructor, using the rules for function declarations, and
            puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int func = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int func = vPC[2].u.operand;
 
         callFrame->r(dst) = JSValue(callFrame->codeBlock()->functionDecl(func)->make(callFrame, callFrame->scopeChain()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_func);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_new_func_exp) {
@@ -2939,8 +2886,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            constructor, using the rules for function expressions, and
            puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int funcIndex = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int funcIndex = vPC[2].u.operand;
 
         FunctionExecutable* function = callFrame->codeBlock()->functionExpr(funcIndex);
         JSFunction* func = function->make(callFrame, callFrame->scopeChain());
@@ -2959,7 +2906,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         callFrame->r(dst) = JSValue(func);
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_func_exp);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_call_eval) {
@@ -2992,7 +2939,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 goto vm_throw;
             callFrame->r(dst) = result;
 
-            vPC += 5;
+            vPC += OPCODE_LENGTH(op_call_eval);
             NEXT_INSTRUCTION();
         }
 
@@ -3066,7 +3013,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
             callFrame->r(dst) = returnValue;
 
-            vPC += 5;
+            vPC += OPCODE_LENGTH(op_call);
             NEXT_INSTRUCTION();
         }
 
@@ -3076,8 +3023,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         goto vm_throw;
     }
     DEFINE_OPCODE(op_load_varargs) {
-        int argCountDst = (++vPC)->u.operand;
-        int argsOffset = (++vPC)->u.operand;
+        int argCountDst = vPC[1].u.operand;
+        int argsOffset = vPC[2].u.operand;
         
         JSValue arguments = callFrame->r(argsOffset).jsValue();
         int32_t argCount = 0;
@@ -3149,7 +3096,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         }
         CHECK_FOR_EXCEPTION();
         callFrame->r(argCountDst) = Register::withInt(argCount + 1);
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_load_varargs);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_call_varargs) {
@@ -3220,7 +3167,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             
             callFrame->r(dst) = returnValue;
             
-            vPC += 5;
+            vPC += OPCODE_LENGTH(op_call_varargs);
             NEXT_INSTRUCTION();
         }
         
@@ -3242,12 +3189,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            This opcode should only be used immediately before op_ret.
         */
 
-        int src = (++vPC)->u.operand;
+        int src = vPC[1].u.operand;
         ASSERT(callFrame->codeBlock()->needsFullScopeChain());
 
         asActivation(callFrame->r(src).jsValue())->copyRegisters(callFrame->optionalCalleeArguments());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_tear_off_activation);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_tear_off_arguments) {
@@ -3268,7 +3215,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (callFrame->optionalCalleeArguments())
             callFrame->optionalCalleeArguments()->copyRegisters();
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_tear_off_arguments);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_ret) {
@@ -3281,7 +3228,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register base to those of the calling function.
         */
 
-        int result = (++vPC)->u.operand;
+        int result = vPC[1].u.operand;
 
         if (callFrame->codeBlock()->needsFullScopeChain())
             callFrame->scopeChain()->deref();
@@ -3316,7 +3263,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         for (size_t count = codeBlock->m_numVars; i < count; ++i)
             callFrame->r(i) = jsUndefined();
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_enter);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_enter_with_activation) {
@@ -3338,12 +3285,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         for (size_t count = codeBlock->m_numVars; i < count; ++i)
             callFrame->r(i) = jsUndefined();
 
-        int dst = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
         JSActivation* activation = new (globalData) JSActivation(callFrame, static_cast<FunctionExecutable*>(codeBlock->ownerExecutable()));
         callFrame->r(dst) = JSValue(activation);
         callFrame->setScopeChain(callFrame->scopeChain()->copy()->push(activation));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_enter_with_activation);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_convert_this) {
@@ -3358,12 +3305,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            block.
         */
 
-        int thisRegister = (++vPC)->u.operand;
+        int thisRegister = vPC[1].u.operand;
         JSValue thisVal = callFrame->r(thisRegister).jsValue();
         if (thisVal.needsThisConversion())
             callFrame->r(thisRegister) = JSValue(thisVal.toThisObject(callFrame));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_convert_this);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_init_arguments) {
@@ -3377,7 +3324,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            block.
          */
         callFrame->r(RegisterFile::ArgumentsRegister) = JSValue();
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_init_arguments);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_create_arguments) {
@@ -3393,7 +3340,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
              callFrame->setCalleeArguments(arguments);
              callFrame->r(RegisterFile::ArgumentsRegister) = JSValue(arguments);
          }
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_create_arguments);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_construct) {
@@ -3471,7 +3418,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = JSValue(returnValue);
 
-            vPC += 7;
+            vPC += OPCODE_LENGTH(op_construct);
             NEXT_INSTRUCTION();
         }
 
@@ -3489,32 +3436,32 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         int dst = vPC[1].u.operand;
         if (LIKELY(callFrame->r(dst).jsValue().isObject())) {
-            vPC += 3;
+            vPC += OPCODE_LENGTH(op_construct_verify);
             NEXT_INSTRUCTION();
         }
 
         int override = vPC[2].u.operand;
         callFrame->r(dst) = callFrame->r(override);
 
-        vPC += 3;
+        vPC += OPCODE_LENGTH(op_construct_verify);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_strcat) {
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
-        int count = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
+        int count = vPC[3].u.operand;
 
         callFrame->r(dst) = concatenateStrings(callFrame, &callFrame->registers()[src], count);
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_strcat);
 
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_to_primitive) {
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
 
         callFrame->r(dst) = callFrame->r(src).jsValue().toPrimitive(callFrame);
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_to_primitive);
 
         NEXT_INSTRUCTION();
     }
@@ -3525,7 +3472,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            of the current scope chain.  The contents of the register scope
            are replaced by the result of toObject conversion of the scope.
         */
-        int scope = (++vPC)->u.operand;
+        int scope = vPC[1].u.operand;
         JSValue v = callFrame->r(scope).jsValue();
         JSObject* o = v.toObject(callFrame);
         CHECK_FOR_EXCEPTION();
@@ -3533,7 +3480,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         callFrame->r(scope) = JSValue(o);
         callFrame->setScopeChain(callFrame->scopeChain()->push(o));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_push_scope);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_pop_scope) {
@@ -3543,47 +3490,69 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         callFrame->setScopeChain(callFrame->scopeChain()->pop());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_pop_scope);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_pnames) {
-        /* get_pnames dst(r) base(r)
+        /* get_pnames dst(r) base(r) i(n) size(n) breakTarget(offset)
 
            Creates a property name list for register base and puts it
-           in register dst. This is not a true JavaScript value, just
-           a synthetic value used to keep the iteration state in a
-           register.
+           in register dst, initializing i and size for iteration. If
+           base is undefined or null, jumps to breakTarget.
         */
-        int dst = (++vPC)->u.operand;
-        int base = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int i = vPC[3].u.operand;
+        int size = vPC[4].u.operand;
+        int breakTarget = vPC[5].u.operand;
+
+        JSValue v = callFrame->r(base).jsValue();
+        if (v.isUndefinedOrNull()) {
+            vPC += breakTarget;
+            NEXT_INSTRUCTION();
+        }
+
+        JSObject* o = v.toObject(callFrame);
+        Structure* structure = o->structure();
+        JSPropertyNameIterator* jsPropertyNameIterator = structure->enumerationCache();
+        if (!jsPropertyNameIterator || jsPropertyNameIterator->cachedPrototypeChain() != structure->prototypeChain(callFrame))
+            jsPropertyNameIterator = JSPropertyNameIterator::create(callFrame, o);
 
-        callFrame->r(dst) = JSPropertyNameIterator::create(callFrame, callFrame->r(base).jsValue());
-        ++vPC;
+        callFrame->r(dst) = jsPropertyNameIterator;
+        callFrame->r(base) = JSValue(o);
+        callFrame->r(i) = Register::withInt(0);
+        callFrame->r(size) = Register::withInt(jsPropertyNameIterator->size());
+        vPC += OPCODE_LENGTH(op_get_pnames);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_next_pname) {
-        /* next_pname dst(r) iter(r) target(offset)
+        /* next_pname dst(r) base(r) i(n) size(n) iter(r) target(offset)
 
-           Tries to copies the next name from property name list in
-           register iter. If there are names left, then copies one to
-           register dst, and jumps to offset target. If there are none
-           left, invalidates the iterator and continues to the next
+           Copies the next name from the property name list in
+           register iter to dst, then jumps to offset target. If there are no
+           names left, invalidates the iterator and continues to the next
            instruction.
         */
-        int dst = (++vPC)->u.operand;
-        int iter = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int i = vPC[3].u.operand;
+        int size = vPC[4].u.operand;
+        int iter = vPC[5].u.operand;
+        int target = vPC[6].u.operand;
 
         JSPropertyNameIterator* it = callFrame->r(iter).propertyNameIterator();
-        if (JSValue temp = it->next(callFrame)) {
-            CHECK_FOR_TIMEOUT();
-            callFrame->r(dst) = JSValue(temp);
-            vPC += target;
-            NEXT_INSTRUCTION();
+        while (callFrame->r(i).i() != callFrame->r(size).i()) {
+            JSValue key = it->get(callFrame, asObject(callFrame->r(base).jsValue()), callFrame->r(i).i());
+            callFrame->r(i) = Register::withInt(callFrame->r(i).i() + 1);
+            if (key) {
+                CHECK_FOR_TIMEOUT();
+                callFrame->r(dst) = key;
+                vPC += target;
+                NEXT_INSTRUCTION();
+            }
         }
-        it->invalidate();
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_next_pname);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jmp_scopes) {
@@ -3593,8 +3562,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            specified by immediate number count, then jumps to offset
            target.
         */
-        int count = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int count = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
 
         ScopeChainNode* tmp = callFrame->scopeChain();
         while (count--)
@@ -3617,7 +3586,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          */
         callFrame->setScopeChain(createExceptionScope(callFrame, vPC));
 
-        vPC += 4;
+        vPC += OPCODE_LENGTH(op_push_new_scope);
         NEXT_INSTRUCTION();
     }
 #if HAVE(COMPUTED_GOTO)
@@ -3632,11 +3601,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         ASSERT(exceptionValue);
         ASSERT(!globalData->exception);
-        int ex = (++vPC)->u.operand;
+        int ex = vPC[1].u.operand;
         callFrame->r(ex) = exceptionValue;
         exceptionValue = JSValue();
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_catch);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_throw) {
@@ -3650,7 +3619,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            else the script returns control to the nearest native caller.
         */
 
-        int ex = (++vPC)->u.operand;
+        int ex = vPC[1].u.operand;
         exceptionValue = callFrame->r(ex).jsValue();
 
         handler = throwException(callFrame, exceptionValue, vPC - callFrame->codeBlock()->instructions().begin(), true);
@@ -3670,14 +3639,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            constant message as the message string. The result is
            written to register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int type = (++vPC)->u.operand;
-        int message = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int type = vPC[2].u.operand;
+        int message = vPC[3].u.operand;
 
         CodeBlock* codeBlock = callFrame->codeBlock();
         callFrame->r(dst) = JSValue(Error::create(callFrame, (ErrorType)type, callFrame->r(message).jsValue().toString(callFrame), codeBlock->lineNumberForBytecodeOffset(callFrame, vPC - codeBlock->instructions().begin()), codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_error);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_end) {
@@ -3692,7 +3661,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             ASSERT(scopeChain->refCount > 1);
             scopeChain->deref();
         }
-        int result = (++vPC)->u.operand;
+        int result = vPC[1].u.operand;
         return callFrame->r(result).jsValue();
     }
     DEFINE_OPCODE(op_put_getter) {
@@ -3706,9 +3675,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Unlike many opcodes, this one does not write any output to
            the register file.
         */
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
-        int function = (++vPC)->u.operand;
+        int base = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        int function = vPC[3].u.operand;
 
         ASSERT(callFrame->r(base).jsValue().isObject());
         JSObject* baseObj = asObject(callFrame->r(base).jsValue());
@@ -3716,7 +3685,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ASSERT(callFrame->r(function).jsValue().isObject());
         baseObj->defineGetter(callFrame, ident, asObject(callFrame->r(function).jsValue()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_getter);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_setter) {
@@ -3730,9 +3699,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Unlike many opcodes, this one does not write any output to
            the register file.
         */
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
-        int function = (++vPC)->u.operand;
+        int base = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        int function = vPC[3].u.operand;
 
         ASSERT(callFrame->r(base).jsValue().isObject());
         JSObject* baseObj = asObject(callFrame->r(base).jsValue());
@@ -3740,7 +3709,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ASSERT(callFrame->r(function).jsValue().isObject());
         baseObj->defineSetter(callFrame, ident, asObject(callFrame->r(function).jsValue()), 0);
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_setter);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_method_check) {
@@ -3753,9 +3722,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Places the address of the next instruction into the retAddrDst
            register and jumps to offset target from the current instruction.
         */
-        int retAddrDst = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
-        callFrame->r(retAddrDst) = vPC + 1;
+        int retAddrDst = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
+        callFrame->r(retAddrDst) = vPC + OPCODE_LENGTH(op_jsr);
 
         vPC += target;
         NEXT_INSTRUCTION();
@@ -3767,7 +3736,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          differs from op_jmp because the target address is stored in a
          register, not as an immediate.
         */
-        int retAddrSrc = (++vPC)->u.operand;
+        int retAddrSrc = vPC[1].u.operand;
         vPC = callFrame->r(retAddrSrc).vPC();
         NEXT_INSTRUCTION();
     }
@@ -3777,13 +3746,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          Notifies the debugger of the current state of execution. This opcode
          is only generated while the debugger is attached.
         */
-        int debugHookID = (++vPC)->u.operand;
-        int firstLine = (++vPC)->u.operand;
-        int lastLine = (++vPC)->u.operand;
+        int debugHookID = vPC[1].u.operand;
+        int firstLine = vPC[2].u.operand;
+        int lastLine = vPC[3].u.operand;
 
         debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_debug);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_profile_will_call) {
@@ -3797,7 +3766,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (*enabledProfilerReference)
             (*enabledProfilerReference)->willExecute(callFrame, callFrame->r(function).jsValue());
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_profile_will_call);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_profile_did_call) {
@@ -3811,7 +3780,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (*enabledProfilerReference)
             (*enabledProfilerReference)->didExecute(callFrame, callFrame->r(function).jsValue());
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_profile_did_call);
         NEXT_INSTRUCTION();
     }
     vm_throw: {
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
index 3046b28b38..e17b055d12 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
@@ -129,7 +129,6 @@ namespace JSC {
         NEVER_INLINE bool resolveGlobal(CallFrame*, Instruction*, JSValue& exceptionValue);
         NEVER_INLINE void resolveBase(CallFrame*, Instruction* vPC);
         NEVER_INLINE bool resolveBaseAndProperty(CallFrame*, Instruction*, JSValue& exceptionValue);
-        NEVER_INLINE bool resolveBaseAndFunc(CallFrame*, Instruction*, JSValue& exceptionValue);
         NEVER_INLINE ScopeChainNode* createExceptionScope(CallFrame*, const Instruction* vPC);
 
         void tryCacheGetByID(CallFrame*, CodeBlock*, Instruction*, JSValue baseValue, const Identifier& propertyName, const PropertySlot&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
index 3274fcc676..1d15ef03d6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
@@ -78,6 +78,9 @@ private:
     struct Allocation {
         char* pages;
         size_t size;
+#if PLATFORM(SYMBIAN)
+        RChunk* chunk;
+#endif
     };
     typedef Vector<Allocation, 2> AllocationList;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
new file mode 100644
index 0000000000..c96ecae3b7
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, 
+ *  Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+
+#include "ExecutableAllocator.h"
+
+#if ENABLE(ASSEMBLER) && PLATFORM(SYMBIAN)
+
+#include <e32hal.h>
+#include <e32std.h>
+
+// Set the page size to 256 Kb to compensate for moving memory model limitation
+const size_t MOVING_MEM_PAGE_SIZE = 256 * 1024; 
+
+namespace JSC {
+
+void ExecutableAllocator::intializePageSize()
+{
+#if PLATFORM_ARM_ARCH(5)
+    // The moving memory model (as used in ARMv5 and earlier platforms)
+    // on Symbian OS limits the number of chunks for each process to 16. 
+    // To mitigate this limitation increase the pagesize to 
+    // allocate less of larger chunks.
+    ExecutableAllocator::pageSize = MOVING_MEM_PAGE_SIZE;
+#else
+    TInt page_size;
+    UserHal::PageSizeInBytes(page_size);
+    ExecutableAllocator::pageSize = page_size;
+#endif
+}
+
+ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t n)
+{
+    RChunk* codeChunk = new RChunk();
+
+    TInt errorCode = codeChunk->CreateLocalCode(n, n);
+
+    char* allocation = reinterpret_cast<char*>(codeChunk->Base());
+    if (!allocation)
+        CRASH();
+    ExecutablePool::Allocation alloc = { allocation, n, codeChunk };
+    return alloc;
+}
+
+void ExecutablePool::systemRelease(const ExecutablePool::Allocation& alloc)
+{ 
+    alloc.chunk->Close();
+    delete alloc.chunk;
+}
+
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+#error "ASSEMBLER_WX_EXCLUSIVE not yet suported on this platform."
+#endif
+
+}
+
+#endif // HAVE(ASSEMBLER)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
index ea8434ebb9..fa0ac2e1ca 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
@@ -202,7 +202,6 @@ void JIT::privateCompileMainPass()
         DEFINE_BINARY_OP(op_less)
         DEFINE_BINARY_OP(op_lesseq)
         DEFINE_BINARY_OP(op_urshift)
-        DEFINE_UNARY_OP(op_get_pnames)
         DEFINE_UNARY_OP(op_is_boolean)
         DEFINE_UNARY_OP(op_is_function)
         DEFINE_UNARY_OP(op_is_number)
@@ -241,6 +240,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_get_by_id)
         DEFINE_OP(op_get_by_val)
         DEFINE_OP(op_get_global_var)
+        DEFINE_OP(op_get_pnames)
         DEFINE_OP(op_get_scoped_var)
         DEFINE_OP(op_instanceof)
         DEFINE_OP(op_jeq_null)
@@ -489,21 +489,21 @@ JITCode JIT::privateCompile()
             ASSERT(record.type == SwitchRecord::Immediate || record.type == SwitchRecord::Character); 
             ASSERT(record.jumpTable.simpleJumpTable->branchOffsets.size() == record.jumpTable.simpleJumpTable->ctiOffsets.size());
 
-            record.jumpTable.simpleJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + record.defaultOffset]);
+            record.jumpTable.simpleJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + record.defaultOffset]);
 
             for (unsigned j = 0; j < record.jumpTable.simpleJumpTable->branchOffsets.size(); ++j) {
                 unsigned offset = record.jumpTable.simpleJumpTable->branchOffsets[j];
-                record.jumpTable.simpleJumpTable->ctiOffsets[j] = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + offset]) : record.jumpTable.simpleJumpTable->ctiDefault;
+                record.jumpTable.simpleJumpTable->ctiOffsets[j] = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + offset]) : record.jumpTable.simpleJumpTable->ctiDefault;
             }
         } else {
             ASSERT(record.type == SwitchRecord::String);
 
-            record.jumpTable.stringJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + record.defaultOffset]);
+            record.jumpTable.stringJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + record.defaultOffset]);
 
             StringJumpTable::StringOffsetTable::iterator end = record.jumpTable.stringJumpTable->offsetTable.end();            
             for (StringJumpTable::StringOffsetTable::iterator it = record.jumpTable.stringJumpTable->offsetTable.begin(); it != end; ++it) {
                 unsigned offset = it->second.branchOffset;
-                it->second.ctiOffset = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + offset]) : record.jumpTable.stringJumpTable->ctiDefault;
+                it->second.ctiOffset = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + offset]) : record.jumpTable.stringJumpTable->ctiDefault;
             }
         }
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
index 0712743f19..9406d1f236 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
@@ -386,6 +386,8 @@ namespace JSC {
 
         Address addressFor(unsigned index, RegisterID base = callFrameRegister);
 
+        void testPrototype(Structure*, JumpList& failureCases);
+
 #if USE(JSVALUE32_64)
         Address tagFor(unsigned index, RegisterID base = callFrameRegister);
         Address payloadFor(unsigned index, RegisterID base = callFrameRegister);
@@ -713,6 +715,7 @@ namespace JSC {
         void emit_op_new_func_exp(Instruction*);
         void emit_op_new_object(Instruction*);
         void emit_op_new_regexp(Instruction*);
+        void emit_op_get_pnames(Instruction*);
         void emit_op_next_pname(Instruction*);
         void emit_op_not(Instruction*);
         void emit_op_nstricteq(Instruction*);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
index 7afc1f2559..8cda482040 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
@@ -98,16 +98,16 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT3, regT2);
         notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(LessThanOrEqual, regT2, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+        addJump(branch32(LessThanOrEqual, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
     } else if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
         notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
     } else {
         emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
         notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
         notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThanOrEqual, regT0, regT2), target + 3);
+        addJump(branch32(GreaterThanOrEqual, regT0, regT2), target);
     }
 
     if (!supportsFloatingPoint()) {
@@ -145,7 +145,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+    emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 }
 
 void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
@@ -161,16 +161,16 @@ void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT3, regT2);
         notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(LessThan, regT2, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+        addJump(branch32(LessThan, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
     } else if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
         notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
     } else {
         emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
         notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
         notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThan, regT0, regT2), target + 3);
+        addJump(branch32(GreaterThan, regT0, regT2), target);
     }
 
     if (!supportsFloatingPoint()) {
@@ -208,7 +208,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+    emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 }
 
 // LeftShift (<<)
@@ -829,11 +829,11 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 break;
             case op_jnless:
                 emitLoadDouble(op1, fpRegT2);
-                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT0, fpRegT2), dst + 3);
+                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT0, fpRegT2), dst);
                 break;
             case op_jnlesseq:
                 emitLoadDouble(op1, fpRegT2);
-                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT2), dst + 3);
+                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT2), dst);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -882,11 +882,11 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 break;
             case op_jnless:
                 emitLoadDouble(op2, fpRegT1);
-                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), dst + 3);
+                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), dst);
                 break;
             case op_jnlesseq:
                 emitLoadDouble(op2, fpRegT1);
-                addJump(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), dst + 3);
+                addJump(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), dst);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -1313,7 +1313,7 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(op2imm)), target + 3);
+        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(op2imm)), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
@@ -1322,13 +1322,13 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
 #else
         int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
 #endif
-        addJump(branch32(LessThanOrEqual, regT1, Imm32(op1imm)), target + 3);
+        addJump(branch32(LessThanOrEqual, regT1, Imm32(op1imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
 
-        addJump(branch32(GreaterThanOrEqual, regT0, regT1), target + 3);
+        addJump(branch32(GreaterThanOrEqual, regT0, regT1), target);
     }
 }
 
@@ -1365,7 +1365,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1382,7 +1382,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         stubCall.addArgument(regT0);
         stubCall.addArgument(op2, regT2);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 
     } else if (isOperandConstantImmediateInt(op1)) {
         linkSlowCase(iter);
@@ -1406,7 +1406,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1423,7 +1423,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 
     } else {
         linkSlowCase(iter);
@@ -1452,7 +1452,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1475,7 +1475,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
     }
 }
 
@@ -1498,7 +1498,7 @@ void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-        addJump(branch32(GreaterThan, regT0, Imm32(op2imm)), target + 3);
+        addJump(branch32(GreaterThan, regT0, Imm32(op2imm)), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
@@ -1507,13 +1507,13 @@ void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 #else
         int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
 #endif
-        addJump(branch32(LessThan, regT1, Imm32(op1imm)), target + 3);
+        addJump(branch32(LessThan, regT1, Imm32(op1imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
 
-        addJump(branch32(GreaterThan, regT0, regT1), target + 3);
+        addJump(branch32(GreaterThan, regT0, regT1), target);
     }
 }
 
@@ -1550,7 +1550,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1567,7 +1567,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
         stubCall.addArgument(regT0);
         stubCall.addArgument(op2, regT2);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 
     } else if (isOperandConstantImmediateInt(op1)) {
         linkSlowCase(iter);
@@ -1591,7 +1591,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1608,7 +1608,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 
     } else {
         linkSlowCase(iter);
@@ -1637,7 +1637,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1660,7 +1660,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
     }
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
index 4fd24d2c3e..cfaa69f6c9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
@@ -236,19 +236,17 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
     int argCount = instruction[3].u.operand;
     int registerOffset = instruction[4].u.operand;
 
-    Jump wasEval1;
-    Jump wasEval2;
+    Jump wasEval;
     if (opcodeID == op_call_eval) {
         JITStubCall stubCall(this, cti_op_call_eval);
         stubCall.addArgument(callee);
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
-        wasEval1 = branchTest32(NonZero, regT0);
-        wasEval2 = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+        wasEval = branch32(NotEqual, regT1, Imm32(JSValue::EmptyValueTag));
     }
 
-    emitLoad(callee, regT1, regT2);
+    emitLoad(callee, regT1, regT0);
 
     if (opcodeID == op_call)
         compileOpCallSetupArgs(instruction);
@@ -256,12 +254,12 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
         compileOpConstructSetupArgs(instruction);
 
     emitJumpSlowCaseIfNotJSCell(callee, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
 
     // First, in the case of a construct, allocate the new object.
     if (opcodeID == op_construct) {
         JITStubCall(this, cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
-        emitLoad(callee, regT1, regT2);
+        emitLoad(callee, regT1, regT0);
     }
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
@@ -271,12 +269,10 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
 
     emitNakedCall(m_globalData->jitStubs.ctiVirtualCall());
 
-    if (opcodeID == op_call_eval) {
-        wasEval1.link(this);
-        wasEval2.link(this);
-    }
+    if (opcodeID == op_call_eval)
+        wasEval.link(this);
 
-    emitStore(dst, regT1, regT0);;
+    emitStore(dst, regT1, regT0);
 
     sampleCodeBlock(m_codeBlock);
 }
@@ -306,16 +302,14 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     int argCount = instruction[3].u.operand;
     int registerOffset = instruction[4].u.operand;
 
-    Jump wasEval1;
-    Jump wasEval2;
+    Jump wasEval;
     if (opcodeID == op_call_eval) {
         JITStubCall stubCall(this, cti_op_call_eval);
         stubCall.addArgument(callee);
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
-        wasEval1 = branchTest32(NonZero, regT0);
-        wasEval2 = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+        wasEval = branch32(NotEqual, regT1, Imm32(JSValue::EmptyValueTag));
     }
 
     emitLoad(callee, regT1, regT0);
@@ -359,10 +353,8 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     // Call to the callee
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall();
     
-    if (opcodeID == op_call_eval) {
-        wasEval1.link(this);
-        wasEval2.link(this);
-    }
+    if (opcodeID == op_call_eval)
+        wasEval.link(this);
 
     // Put the return value in dst. In the interpreter, op_ret does this.
     emitStore(dst, regT1, regT0);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
index 7059cc8930..e10d1059b6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
@@ -33,6 +33,7 @@
 #include "JSArray.h"
 #include "JSCell.h"
 #include "JSFunction.h"
+#include "JSPropertyNameIterator.h"
 #include "LinkBuffer.h"
 
 namespace JSC {
@@ -248,10 +249,8 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
 
     // Check for an exception
-    // FIXME: Maybe we can optimize this comparison to JSValue().
     move(ImmPtr(&globalData->exception), regT2);
-    Jump sawException1 = branch32(NotEqual, tagFor(0, regT2), Imm32(JSValue::CellTag));
-    Jump sawException2 = branch32(NonZero, payloadFor(0, regT2), Imm32(0));
+    Jump sawException = branch32(NotEqual, tagFor(0, regT2), Imm32(JSValue::EmptyValueTag));
 
     // Grab the return address.
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT3);
@@ -264,13 +263,12 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     ret();
 
     // Handle an exception
-    sawException1.link(this);
-    sawException2.link(this);
+    sawException.link(this);
     // Grab the return address.
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
     move(ImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
-    move(ImmPtr(reinterpret_cast<void*>(ctiVMThrowTrampoline)), regT2);
+    move(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
     restoreReturnAddressBeforeReturn(regT2);
@@ -348,14 +346,14 @@ void JIT::emit_op_end(Instruction* currentInstruction)
 void JIT::emit_op_jmp(Instruction* currentInstruction)
 {
     unsigned target = currentInstruction[1].u.operand;
-    addJump(jump(), target + 1);
+    addJump(jump(), target);
 }
 
 void JIT::emit_op_loop(Instruction* currentInstruction)
 {
     unsigned target = currentInstruction[1].u.operand;
     emitTimeoutCheck();
-    addJump(jump(), target + 1);
+    addJump(jump(), target);
 }
 
 void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
@@ -369,21 +367,21 @@ void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT1, regT0);
         addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op1).asInt32())), target);
         return;
     }
     
     if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
         addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+        addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
         return;
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
     addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
     addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-    addJump(branch32(LessThan, regT0, regT2), target + 3);
+    addJump(branch32(LessThan, regT0, regT2), target);
 }
 
 void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -400,7 +398,7 @@ void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowC
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
 }
 
 void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
@@ -414,21 +412,21 @@ void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT1, regT0);
         addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op1).asInt32())), target);
         return;
     }
 
     if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
         addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(LessThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+        addJump(branch32(LessThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
         return;
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
     addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
     addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-    addJump(branch32(LessThanOrEqual, regT0, regT2), target + 3);
+    addJump(branch32(LessThanOrEqual, regT0, regT2), target);
 }
 
 void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -445,7 +443,7 @@ void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<Slo
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
 }
 
 void JIT::emit_op_new_object(Instruction* currentInstruction)
@@ -460,30 +458,20 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
     unsigned baseVal = currentInstruction[3].u.operand;
     unsigned proto = currentInstruction[4].u.operand;
 
-    // Load the operands (baseVal, proto, and value respectively) into registers.
+    // Load the operands into registers.
     // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.
-    emitLoadPayload(proto, regT1);
-    emitLoadPayload(baseVal, regT0);
     emitLoadPayload(value, regT2);
+    emitLoadPayload(baseVal, regT0);
+    emitLoadPayload(proto, regT1);
 
-    // Check that baseVal & proto are cells.
-    emitJumpSlowCaseIfNotJSCell(proto);
+    // Check that value, baseVal, and proto are cells.
+    emitJumpSlowCaseIfNotJSCell(value);
     emitJumpSlowCaseIfNotJSCell(baseVal);
+    emitJumpSlowCaseIfNotJSCell(proto);
 
-    // Check that baseVal is an object, that it 'ImplementsHasInstance' but that it does not 'OverridesHasInstance'.
+    // Check that baseVal 'ImplementsDefaultHasInstance'.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType))); // FIXME: Maybe remove this test.
-    addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsHasInstance))); // FIXME: TOT checks ImplementsDefaultHasInstance.
-
-    // If value is not an Object, return false.
-    emitLoadTag(value, regT0);
-    Jump valueIsImmediate = branch32(NotEqual, regT0, Imm32(JSValue::CellTag));
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    Jump valueIsNotObject = branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)); // FIXME: Maybe remove this test.
-
-    // Check proto is object.
-    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
 
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
@@ -491,16 +479,14 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
     move(Imm32(JSValue::TrueTag), regT0);
     Label loop(this);
 
-    // Load the prototype of the object in regT2.  If this is equal to regT1 - WIN!
+    // Load the prototype of the cell in regT2.  If this is equal to regT1 - WIN!
     // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
     loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
     load32(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
     Jump isInstance = branchPtr(Equal, regT2, regT1);
-    branch32(NotEqual, regT2, Imm32(0), loop);
+    branchTest32(NonZero, regT2).linkTo(loop, this);
 
     // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
-    valueIsImmediate.link(this);
-    valueIsNotObject.link(this);
     move(Imm32(JSValue::FalseTag), regT0);
 
     // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
@@ -515,11 +501,10 @@ void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCas
     unsigned baseVal = currentInstruction[3].u.operand;
     unsigned proto = currentInstruction[4].u.operand;
 
+    linkSlowCaseIfNotJSCell(iter, value);
     linkSlowCaseIfNotJSCell(iter, baseVal);
     linkSlowCaseIfNotJSCell(iter, proto);
     linkSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
 
     JITStubCall stubCall(this, cti_op_instanceof);
     stubCall.addArgument(value);
@@ -674,12 +659,12 @@ void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
     emitLoad(cond, regT1, regT0);
 
     Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
-    addJump(branch32(NotEqual, regT0, Imm32(0)), target + 2);
+    addJump(branch32(NotEqual, regT0, Imm32(0)), target);
     Jump isNotZero = jump();
 
     isNotInteger.link(this);
 
-    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target + 2);
+    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target);
     addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::FalseTag)));
 
     isNotZero.link(this);
@@ -695,7 +680,7 @@ void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowC
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(cond);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 2);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
 }
 
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
@@ -788,11 +773,11 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
     emitLoad(cond, regT1, regT0);
 
     Jump isTrue = branch32(Equal, regT1, Imm32(JSValue::TrueTag));
-    addJump(branch32(Equal, regT1, Imm32(JSValue::FalseTag)), target + 2);
+    addJump(branch32(Equal, regT1, Imm32(JSValue::FalseTag)), target);
 
     Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
     Jump isTrue2 = branch32(NotEqual, regT0, Imm32(0));
-    addJump(jump(), target + 2);
+    addJump(jump(), target);
 
     if (supportsFloatingPoint()) {
         isNotInteger.link(this);
@@ -801,7 +786,7 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
 
         zeroDouble(fpRegT0);
         emitLoadDouble(cond, fpRegT1);
-        addJump(branchDouble(DoubleEqual, fpRegT0, fpRegT1), target + 2);
+        addJump(branchDouble(DoubleEqual, fpRegT0, fpRegT1), target);
     } else
         addSlowCase(isNotInteger);
 
@@ -818,7 +803,7 @@ void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEnt
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(cond);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(Zero, regT0), target + 2); // Inverted.
+    emitJumpSlowToHot(branchTest32(Zero, regT0), target); // Inverted.
 }
 
 void JIT::emit_op_jtrue(Instruction* currentInstruction)
@@ -829,11 +814,11 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
     emitLoad(cond, regT1, regT0);
 
     Jump isFalse = branch32(Equal, regT1, Imm32(JSValue::FalseTag));
-    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target + 2);
+    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target);
 
     Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
     Jump isFalse2 = branch32(Equal, regT0, Imm32(0));
-    addJump(jump(), target + 2);
+    addJump(jump(), target);
 
     if (supportsFloatingPoint()) {
         isNotInteger.link(this);
@@ -842,7 +827,7 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
 
         zeroDouble(fpRegT0);
         emitLoadDouble(cond, fpRegT1);
-        addJump(branchDouble(DoubleNotEqual, fpRegT0, fpRegT1), target + 2);
+        addJump(branchDouble(DoubleNotEqual, fpRegT0, fpRegT1), target);
     } else
         addSlowCase(isNotInteger);
 
@@ -859,7 +844,7 @@ void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntr
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(cond);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 2);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
 }
 
 void JIT::emit_op_jeq_null(Instruction* currentInstruction)
@@ -873,7 +858,7 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
@@ -884,7 +869,7 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
     set32(Equal, regT1, Imm32(JSValue::UndefinedTag), regT1);
     or32(regT2, regT1);
 
-    addJump(branchTest32(NonZero, regT1), target + 2);
+    addJump(branchTest32(NonZero, regT1), target);
 
     wasNotImmediate.link(this);
 }
@@ -900,7 +885,7 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
@@ -911,7 +896,7 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
     set32(Equal, regT1, Imm32(JSValue::UndefinedTag), regT1);
     or32(regT2, regT1);
 
-    addJump(branchTest32(Zero, regT1), target + 2);
+    addJump(branchTest32(Zero, regT1), target);
 
     wasNotImmediate.link(this);
 }
@@ -923,8 +908,8 @@ void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
     unsigned target = currentInstruction[3].u.operand;
 
     emitLoad(src, regT1, regT0);
-    addJump(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)), target + 3);
-    addJump(branchPtr(NotEqual, regT0, ImmPtr(ptr)), target + 3);
+    addJump(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)), target);
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(ptr)), target);
 }
 
 void JIT::emit_op_jsr(Instruction* currentInstruction)
@@ -932,7 +917,7 @@ void JIT::emit_op_jsr(Instruction* currentInstruction)
     int retAddrDst = currentInstruction[1].u.operand;
     int target = currentInstruction[2].u.operand;
     DataLabelPtr storeLocation = storePtrWithPatch(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
-    addJump(jump(), target + 2);
+    addJump(jump(), target);
     m_jsrSites.append(JSRInfo(storeLocation, label()));
 }
 
@@ -1198,23 +1183,109 @@ void JIT::emit_op_throw(Instruction* currentInstruction)
 #endif
 }
 
+void JIT::emit_op_get_pnames(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int i = currentInstruction[3].u.operand;
+    int size = currentInstruction[4].u.operand;
+    int breakTarget = currentInstruction[5].u.operand;
+
+    JumpList isNotObject;
+
+    emitLoad(base, regT1, regT0);
+    if (!m_codeBlock->isKnownNotImmediate(base))
+        isNotObject.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+    if (base != m_codeBlock->thisRegister()) {
+        loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+        isNotObject.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    }
+
+    // We could inline the case where you have a valid cache, but
+    // this call doesn't seem to be hot.
+    Label isObject(this);
+    JITStubCall getPnamesStubCall(this, cti_op_get_pnames);
+    getPnamesStubCall.addArgument(regT0);
+    getPnamesStubCall.call(dst);
+    load32(Address(regT0, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStringsSize)), regT3);
+    store32(Imm32(0), addressFor(i));
+    store32(regT3, addressFor(size));
+    Jump end = jump();
+
+    isNotObject.link(this);
+    addJump(branch32(Equal, regT1, Imm32(JSValue::NullTag)), breakTarget);
+    addJump(branch32(Equal, regT1, Imm32(JSValue::UndefinedTag)), breakTarget);
+    JITStubCall toObjectStubCall(this, cti_to_object);
+    toObjectStubCall.addArgument(regT1, regT0);
+    toObjectStubCall.call(base);
+    jump().linkTo(isObject, this);
+    
+    end.link(this);
+}
+
 void JIT::emit_op_next_pname(Instruction* currentInstruction)
 {
     int dst = currentInstruction[1].u.operand;
-    int iter = currentInstruction[2].u.operand;
-    int target = currentInstruction[3].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int i = currentInstruction[3].u.operand;
+    int size = currentInstruction[4].u.operand;
+    int it = currentInstruction[5].u.operand;
+    int target = currentInstruction[6].u.operand;
+    
+    JumpList callHasProperty;
+
+    Label begin(this);
+    load32(addressFor(i), regT0);
+    Jump end = branch32(Equal, regT0, addressFor(size));
+
+    // Grab key @ i
+    loadPtr(addressFor(it), regT1);
+    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStrings)), regT2);
+    load32(BaseIndex(regT2, regT0, TimesEight), regT2);
+    store32(Imm32(JSValue::CellTag), tagFor(dst));
+    store32(regT2, payloadFor(dst));
 
-    load32(Address(callFrameRegister, (iter * sizeof(Register))), regT0);
+    // Increment i
+    add32(Imm32(1), regT0);
+    store32(regT0, addressFor(i));
+
+    // Verify that i is valid:
+    loadPtr(addressFor(base), regT0);
+
+    // Test base's structure
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    callHasProperty.append(branchPtr(NotEqual, regT2, Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure)))));
 
-    JITStubCall stubCall(this, cti_op_next_pname);
+    // Test base's prototype chain
+    loadPtr(Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedPrototypeChain))), regT3);
+    loadPtr(Address(regT3, OBJECT_OFFSETOF(StructureChain, m_vector)), regT3);
+    addJump(branchTestPtr(Zero, Address(regT3)), target);
+
+    Label checkPrototype(this);
+    callHasProperty.append(branch32(Equal, Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), Imm32(JSValue::NullTag)));
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    callHasProperty.append(branchPtr(NotEqual, regT2, Address(regT3)));
+    addPtr(Imm32(sizeof(Structure*)), regT3);
+    branchTestPtr(NonZero, Address(regT3)).linkTo(checkPrototype, this);
+
+    // Continue loop.
+    addJump(jump(), target);
+
+    // Slow case: Ask the object if i is valid.
+    callHasProperty.link(this);
+    loadPtr(addressFor(dst), regT1);
+    JITStubCall stubCall(this, cti_has_property);
     stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
     stubCall.call();
 
-    Jump endOfIter = branchTestPtr(Zero, regT0);
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeIndex + OPCODE_LENGTH(op_next_pname), dst, regT1, regT0);
-    addJump(jump(), target + 3);
-    endOfIter.link(this);
+    // Test for valid key.
+    addJump(branchTest32(NonZero, regT0), target);
+    jump().linkTo(begin, this);
+
+    // End of loop.
+    end.link(this);
 }
 
 void JIT::emit_op_push_scope(Instruction* currentInstruction)
@@ -1237,7 +1308,7 @@ void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
     emitLoad(src, regT1, regT0);
 
     Jump isInt32 = branch32(Equal, regT1, Imm32(JSValue::Int32Tag));
-    addSlowCase(branch32(AboveOrEqual, regT1, Imm32(JSValue::DeletedValueTag)));
+    addSlowCase(branch32(AboveOrEqual, regT1, Imm32(JSValue::EmptyValueTag)));
     isInt32.link(this);
 
     if (src != dst)
@@ -1284,7 +1355,7 @@ void JIT::emit_op_jmp_scopes(Instruction* currentInstruction)
     JITStubCall stubCall(this, cti_op_jmp_scopes);
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.call();
-    addJump(jump(), currentInstruction[2].u.operand + 2);
+    addJump(jump(), currentInstruction[2].u.operand);
 }
 
 void JIT::emit_op_switch_imm(Instruction* currentInstruction)
@@ -1381,8 +1452,7 @@ void JIT::emit_op_enter_with_activation(Instruction* currentInstruction)
 
 void JIT::emit_op_create_arguments(Instruction*)
 {
-    Jump argsNotCell = branch32(NotEqual, tagFor(RegisterFile::ArgumentsRegister, callFrameRegister), Imm32(JSValue::CellTag));
-    Jump argsNotNull = branchTestPtr(NonZero, payloadFor(RegisterFile::ArgumentsRegister, callFrameRegister));
+    Jump argsCreated = branch32(NotEqual, tagFor(RegisterFile::ArgumentsRegister, callFrameRegister), Imm32(JSValue::EmptyValueTag));
 
     // If we get here the arguments pointer is a null cell - i.e. arguments need lazy creation.
     if (m_codeBlock->m_numParameters == 1)
@@ -1390,8 +1460,7 @@ void JIT::emit_op_create_arguments(Instruction*)
     else
         JITStubCall(this, cti_op_create_arguments).call();
 
-    argsNotCell.link(this);
-    argsNotNull.link(this);
+    argsCreated.link(this);
 }
     
 void JIT::emit_op_init_arguments(Instruction*)
@@ -1754,7 +1823,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
     move(ImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
-    move(ImmPtr(reinterpret_cast<void*>(ctiVMThrowTrampoline)), regT2);
+    move(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
     restoreReturnAddressBeforeReturn(regT2);
@@ -1830,8 +1899,8 @@ void JIT::emit_op_end(Instruction* currentInstruction)
 void JIT::emit_op_jmp(Instruction* currentInstruction)
 {
     unsigned target = currentInstruction[1].u.operand;
-    addJump(jump(), target + 1);
-    RECORD_JUMP_TARGET(target + 1);
+    addJump(jump(), target);
+    RECORD_JUMP_TARGET(target);
 }
 
 void JIT::emit_op_loop(Instruction* currentInstruction)
@@ -1839,7 +1908,7 @@ void JIT::emit_op_loop(Instruction* currentInstruction)
     emitTimeoutCheck();
 
     unsigned target = currentInstruction[1].u.operand;
-    addJump(jump(), target + 1);
+    addJump(jump(), target);
 }
 
 void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
@@ -1857,7 +1926,7 @@ void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target + 3);
+        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
@@ -1866,12 +1935,12 @@ void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
 #else
         int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
 #endif
-        addJump(branch32(GreaterThan, regT0, Imm32(op1imm)), target + 3);
+        addJump(branch32(GreaterThan, regT0, Imm32(op1imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
-        addJump(branch32(LessThan, regT0, regT1), target + 3);
+        addJump(branch32(LessThan, regT0, regT1), target);
     }
 }
 
@@ -1890,12 +1959,12 @@ void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-        addJump(branch32(LessThanOrEqual, regT0, Imm32(op2imm)), target + 3);
+        addJump(branch32(LessThanOrEqual, regT0, Imm32(op2imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
-        addJump(branch32(LessThanOrEqual, regT0, regT1), target + 3);
+        addJump(branch32(LessThanOrEqual, regT0, regT1), target);
     }
 }
 
@@ -1906,30 +1975,26 @@ void JIT::emit_op_new_object(Instruction* currentInstruction)
 
 void JIT::emit_op_instanceof(Instruction* currentInstruction)
 {
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned value = currentInstruction[2].u.operand;
+    unsigned baseVal = currentInstruction[3].u.operand;
+    unsigned proto = currentInstruction[4].u.operand;
+
     // Load the operands (baseVal, proto, and value respectively) into registers.
     // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.
-    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
-    emitGetVirtualRegister(currentInstruction[4].u.operand, regT1);
-    emitGetVirtualRegister(currentInstruction[2].u.operand, regT2);
+    emitGetVirtualRegister(value, regT2);
+    emitGetVirtualRegister(baseVal, regT0);
+    emitGetVirtualRegister(proto, regT1);
 
     // Check that baseVal & proto are cells.
-    emitJumpSlowCaseIfNotJSCell(regT0);
-    emitJumpSlowCaseIfNotJSCell(regT1);
+    emitJumpSlowCaseIfNotJSCell(regT2, value);
+    emitJumpSlowCaseIfNotJSCell(regT0, baseVal);
+    emitJumpSlowCaseIfNotJSCell(regT1, proto);
 
-    // Check that baseVal is an object, that it 'ImplementsHasInstance' but that it does not 'OverridesHasInstance'.
+    // Check that baseVal 'ImplementsDefaultHasInstance'.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
     addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
 
-    // If value is not an Object, return false.
-    Jump valueIsImmediate = emitJumpIfNotJSCell(regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    Jump valueIsNotObject = branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType));
-
-    // Check proto is object.
-    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
-
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
     // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.
@@ -1941,16 +2006,14 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
     loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
     loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
     Jump isInstance = branchPtr(Equal, regT2, regT1);
-    branchPtr(NotEqual, regT2, ImmPtr(JSValue::encode(jsNull())), loop);
+    emitJumpIfJSCell(regT2).linkTo(loop, this);
 
     // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
-    valueIsImmediate.link(this);
-    valueIsNotObject.link(this);
     move(ImmPtr(JSValue::encode(jsBoolean(false))), regT0);
 
     // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
     isInstance.link(this);
-    emitPutVirtualRegister(currentInstruction[1].u.operand);
+    emitPutVirtualRegister(dst);
 }
 
 void JIT::emit_op_new_func(Instruction* currentInstruction)
@@ -2127,9 +2190,9 @@ void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
     Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
-    addJump(emitJumpIfImmediateInteger(regT0), target + 2);
+    addJump(emitJumpIfImmediateInteger(regT0), target);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target + 2);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target);
     addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
 
     isZero.link(this);
@@ -2196,14 +2259,14 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
     unsigned target = currentInstruction[2].u.operand;
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))), target + 2);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))), target);
     Jump isNonZero = emitJumpIfImmediateInteger(regT0);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))), target + 2);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))), target);
     addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))));
 
     isNonZero.link(this);
-    RECORD_JUMP_TARGET(target + 2);
+    RECORD_JUMP_TARGET(target);
 };
 void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 {
@@ -2215,16 +2278,16 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
     andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNull()))), target + 2);            
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNull()))), target);            
 
     wasNotImmediate.link(this);
-    RECORD_JUMP_TARGET(target + 2);
+    RECORD_JUMP_TARGET(target);
 };
 void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 {
@@ -2236,16 +2299,16 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
     andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsNull()))), target + 2);            
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsNull()))), target);            
 
     wasNotImmediate.link(this);
-    RECORD_JUMP_TARGET(target + 2);
+    RECORD_JUMP_TARGET(target);
 }
 
 void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
@@ -2255,9 +2318,9 @@ void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
     unsigned target = currentInstruction[3].u.operand;
     
     emitGetVirtualRegister(src, regT0);
-    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue(ptr)))), target + 3);            
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue(ptr)))), target);            
 
-    RECORD_JUMP_TARGET(target + 3);
+    RECORD_JUMP_TARGET(target);
 }
 
 void JIT::emit_op_jsr(Instruction* currentInstruction)
@@ -2265,10 +2328,10 @@ void JIT::emit_op_jsr(Instruction* currentInstruction)
     int retAddrDst = currentInstruction[1].u.operand;
     int target = currentInstruction[2].u.operand;
     DataLabelPtr storeLocation = storePtrWithPatch(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
-    addJump(jump(), target + 2);
+    addJump(jump(), target);
     m_jsrSites.append(JSRInfo(storeLocation, label()));
     killLastResultRegister();
-    RECORD_JUMP_TARGET(target + 2);
+    RECORD_JUMP_TARGET(target);
 }
 
 void JIT::emit_op_sret(Instruction* currentInstruction)
@@ -2320,13 +2383,13 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
     Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
-    addJump(emitJumpIfImmediateInteger(regT0), target + 2);
+    addJump(emitJumpIfImmediateInteger(regT0), target);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target + 2);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target);
     addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
 
     isZero.link(this);
-    RECORD_JUMP_TARGET(target + 2);
+    RECORD_JUMP_TARGET(target);
 }
 
 void JIT::emit_op_neq(Instruction* currentInstruction)
@@ -2377,15 +2440,110 @@ void JIT::emit_op_throw(Instruction* currentInstruction)
 #endif
 }
 
+void JIT::emit_op_get_pnames(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int i = currentInstruction[3].u.operand;
+    int size = currentInstruction[4].u.operand;
+    int breakTarget = currentInstruction[5].u.operand;
+
+    JumpList isNotObject;
+
+    emitGetVirtualRegister(base, regT0);
+    if (!m_codeBlock->isKnownNotImmediate(base))
+        isNotObject.append(emitJumpIfNotJSCell(regT0));
+    if (base != m_codeBlock->thisRegister()) {
+        loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+        isNotObject.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    }
+
+    // We could inline the case where you have a valid cache, but
+    // this call doesn't seem to be hot.
+    Label isObject(this);
+    JITStubCall getPnamesStubCall(this, cti_op_get_pnames);
+    getPnamesStubCall.addArgument(regT0);
+    getPnamesStubCall.call(dst);
+    load32(Address(regT0, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStringsSize)), regT3);
+    store32(Imm32(0), addressFor(i));
+    store32(regT3, addressFor(size));
+    Jump end = jump();
+
+    isNotObject.link(this);
+    move(regT0, regT1);
+    and32(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT1);
+    addJump(branch32(Equal, regT1, Imm32(JSImmediate::FullTagTypeNull)), breakTarget);
+
+    JITStubCall toObjectStubCall(this, cti_to_object);
+    toObjectStubCall.addArgument(regT0);
+    toObjectStubCall.call(base);
+    jump().linkTo(isObject, this);
+    
+    end.link(this);
+}
+
 void JIT::emit_op_next_pname(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, cti_op_next_pname);
-    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int i = currentInstruction[3].u.operand;
+    int size = currentInstruction[4].u.operand;
+    int it = currentInstruction[5].u.operand;
+    int target = currentInstruction[6].u.operand;
+    
+    JumpList callHasProperty;
+
+    Label begin(this);
+    load32(addressFor(i), regT0);
+    Jump end = branch32(Equal, regT0, addressFor(size));
+
+    // Grab key @ i
+    loadPtr(addressFor(it), regT1);
+    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStrings)), regT2);
+    loadPtr(BaseIndex(regT2, regT0, TimesEight), regT2);
+    emitPutVirtualRegister(dst, regT2);
+
+    // Increment i
+    add32(Imm32(1), regT0);
+    store32(regT0, addressFor(i));
+
+    // Verify that i is valid:
+    emitGetVirtualRegister(base, regT0);
+
+    // Test base's structure
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    callHasProperty.append(branchPtr(NotEqual, regT2, Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure)))));
+
+    // Test base's prototype chain
+    loadPtr(Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedPrototypeChain))), regT3);
+    loadPtr(Address(regT3, OBJECT_OFFSETOF(StructureChain, m_vector)), regT3);
+    addJump(branchTestPtr(Zero, Address(regT3)), target);
+
+    Label checkPrototype(this);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
+    callHasProperty.append(emitJumpIfNotJSCell(regT2));
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    callHasProperty.append(branchPtr(NotEqual, regT2, Address(regT3)));
+    addPtr(Imm32(sizeof(Structure*)), regT3);
+    branchTestPtr(NonZero, Address(regT3)).linkTo(checkPrototype, this);
+
+    // Continue loop.
+    addJump(jump(), target);
+
+    // Slow case: Ask the object if i is valid.
+    callHasProperty.link(this);
+    emitGetVirtualRegister(dst, regT1);
+    JITStubCall stubCall(this, cti_has_property);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
     stubCall.call();
-    Jump endOfIter = branchTestPtr(Zero, regT0);
-    emitPutVirtualRegister(currentInstruction[1].u.operand);
-    addJump(jump(), currentInstruction[3].u.operand + 3);
-    endOfIter.link(this);
+
+    // Test for valid key.
+    addJump(branchTest32(NonZero, regT0), target);
+    jump().linkTo(begin, this);
+
+    // End of loop.
+    end.link(this);
 }
 
 void JIT::emit_op_push_scope(Instruction* currentInstruction)
@@ -2469,8 +2627,8 @@ void JIT::emit_op_jmp_scopes(Instruction* currentInstruction)
     JITStubCall stubCall(this, cti_op_jmp_scopes);
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.call();
-    addJump(jump(), currentInstruction[2].u.operand + 2);
-    RECORD_JUMP_TARGET(currentInstruction[2].u.operand + 2);
+    addJump(jump(), currentInstruction[2].u.operand);
+    RECORD_JUMP_TARGET(currentInstruction[2].u.operand);
 }
 
 void JIT::emit_op_switch_imm(Instruction* currentInstruction)
@@ -2696,32 +2854,20 @@ void JIT::emitSlow_op_to_primitive(Instruction* currentInstruction, Vector<SlowC
 
 void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    // The slow void JIT::emitSlow_that handles accesses to arrays (below) may jump back up to here. 
-    Label beginGetByValSlow(this);
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
 
-    Jump notImm = getSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    emitFastArithIntToImmNoCheck(regT1, regT1);
+    linkSlowCase(iter); // property int32 check
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base array check
+    linkSlowCase(iter); // vector length check
+    linkSlowCase(iter); // empty value
 
-    notImm.link(this);
     JITStubCall stubCall(this, cti_op_get_by_val);
-    stubCall.addArgument(regT0);
-    stubCall.addArgument(regT1);
-    stubCall.call(currentInstruction[1].u.operand);
-    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
-
-    // This is slow void JIT::emitSlow_that handles accesses to arrays above the fast cut-off.
-    // First, check if this is an access to the vector
-    linkSlowCase(iter);
-    branch32(AboveOrEqual, regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength)), beginGetByValSlow);
-
-    // okay, missed the fast region, but it is still in the vector.  Get the value.
-    loadPtr(BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT2);
-    // Check whether the value loaded is zero; if so we need to return undefined.
-    branchTestPtr(Zero, regT2, beginGetByValSlow);
-    move(regT2, regT0);
-    emitPutVirtualRegister(currentInstruction[1].u.operand, regT0);
+    stubCall.addArgument(base, regT2);
+    stubCall.addArgument(property, regT2);
+    stubCall.call(dst);
 }
 
 void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -2735,14 +2881,14 @@ void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowC
         stubCall.addArgument(regT0);
         stubCall.addArgument(op2, regT2);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         linkSlowCase(iter);
         JITStubCall stubCall(this, cti_op_loop_if_less);
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT0);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     } else {
         linkSlowCase(iter);
         linkSlowCase(iter);
@@ -2750,7 +2896,7 @@ void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowC
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     }
 }
 
@@ -2764,7 +2910,7 @@ void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<Slo
         stubCall.addArgument(regT0);
         stubCall.addArgument(currentInstruction[2].u.operand, regT2);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     } else {
         linkSlowCase(iter);
         linkSlowCase(iter);
@@ -2772,36 +2918,26 @@ void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<Slo
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     }
 }
 
 void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    // Normal slow cases - either is not an immediate imm, or is an array.
-    Jump notImm = getSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    emitFastArithIntToImmNoCheck(regT1, regT1);
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
 
-    notImm.link(this); {
-        JITStubCall stubCall(this, cti_op_put_by_val);
-        stubCall.addArgument(regT0);
-        stubCall.addArgument(regT1);
-        stubCall.addArgument(currentInstruction[3].u.operand, regT2);
-        stubCall.call();
-        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_put_by_val));
-    }
+    linkSlowCase(iter); // property int32 check
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base not array check
+    linkSlowCase(iter); // in vector check
 
-    // slow cases for immediate int accesses to arrays
-    linkSlowCase(iter);
-    linkSlowCase(iter); {
-        JITStubCall stubCall(this, cti_op_put_by_val_array);
-        stubCall.addArgument(regT0);
-        stubCall.addArgument(regT1);
-        stubCall.addArgument(currentInstruction[3].u.operand, regT2);
-        stubCall.call();
-    }
+    JITStubCall stubPutByValCall(this, cti_op_put_by_val);
+    stubPutByValCall.addArgument(regT0);
+    stubPutByValCall.addArgument(property, regT2);
+    stubPutByValCall.addArgument(value, regT2);
+    stubPutByValCall.call();
 }
 
 void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -2810,7 +2946,7 @@ void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowC
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(regT0);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand + 2);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand);
 }
 
 void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -2828,7 +2964,7 @@ void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEnt
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(regT0);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(Zero, regT0), currentInstruction[2].u.operand + 2); // inverted!
+    emitJumpSlowToHot(branchTest32(Zero, regT0), currentInstruction[2].u.operand); // inverted!
 }
 
 void JIT::emitSlow_op_bitnot(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -2845,7 +2981,7 @@ void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntr
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(regT0);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand + 2);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand);
 }
 
 void JIT::emitSlow_op_bitxor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -2911,16 +3047,20 @@ void JIT::emitSlow_op_nstricteq(Instruction* currentInstruction, Vector<SlowCase
 
 void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned value = currentInstruction[2].u.operand;
+    unsigned baseVal = currentInstruction[3].u.operand;
+    unsigned proto = currentInstruction[4].u.operand;
+
+    linkSlowCaseIfNotJSCell(iter, value);
+    linkSlowCaseIfNotJSCell(iter, baseVal);
+    linkSlowCaseIfNotJSCell(iter, proto);
     linkSlowCase(iter);
     JITStubCall stubCall(this, cti_op_instanceof);
-    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
-    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
-    stubCall.addArgument(currentInstruction[4].u.operand, regT2);
-    stubCall.call(currentInstruction[1].u.operand);
+    stubCall.addArgument(value, regT2);
+    stubCall.addArgument(baseVal, regT2);
+    stubCall.addArgument(proto, regT2);
+    stubCall.call(dst);
 }
 
 void JIT::emitSlow_op_call(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
index 08b3096287..424111191d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -273,11 +273,14 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
     addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
     emitJumpSlowCaseIfNotJSCell(base, regT1);
     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff))));
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT0);
-    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
-    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
+    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::EmptyValueTag)));
+
     emitStore(dst, regT1, regT0);
     map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_val), dst, regT1, regT0);
 }
@@ -288,35 +291,16 @@ void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCas
     unsigned base = currentInstruction[2].u.operand;
     unsigned property = currentInstruction[3].u.operand;
 
-    // The slow void JIT::emitSlow_that handles accesses to arrays (below) may jump back up to here. 
-    Label callGetByValJITStub(this);
-
     linkSlowCase(iter); // property int32 check
     linkSlowCaseIfNotJSCell(iter, base); // base cell check
     linkSlowCase(iter); // base array check
+    linkSlowCase(iter); // vector length check
+    linkSlowCase(iter); // empty value
 
     JITStubCall stubCall(this, cti_op_get_by_val);
     stubCall.addArgument(base);
     stubCall.addArgument(property);
     stubCall.call(dst);
-
-    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
-
-    linkSlowCase(iter); // array fast cut-off check
-
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT0);
-    branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength)), callGetByValJITStub);
-
-    // Missed the fast region, but it is still in the vector.
-    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
-    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
-
-    // FIXME: Maybe we can optimize this comparison to JSValue().
-    Jump skip = branch32(NotEqual, regT0, Imm32(0));
-    branch32(Equal, regT1, Imm32(JSValue::CellTag), callGetByValJITStub);
-
-    skip.link(this);
-    emitStore(dst, regT1, regT0);
 }
 
 void JIT::emit_op_put_by_val(Instruction* currentInstruction)
@@ -330,24 +314,27 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
     addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
     emitJumpSlowCaseIfNotJSCell(base, regT1);
     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
-
-    Jump inFastVector = branch32(Below, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff)));
-
-    // Check if the access is within the vector.
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength))));
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
 
-    // This is a write to the slow part of the vector; first, we have to check if this would be the first write to this location.
-    // FIXME: should be able to handle initial write to array; increment the the number of items in the array, and potentially update fast access cutoff. 
-    Jump skip = branch32(NotEqual, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::CellTag));
-    addSlowCase(branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), Imm32(0)));
-    skip.link(this);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
 
-    inFastVector.link(this);
+    Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::EmptyValueTag));
 
+    Label storeResult(this);
     emitLoad(value, regT1, regT0);
     store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))); // payload
     store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4)); // tag
+    Jump end = jump();
+
+    empty.link(this);
+    add32(Imm32(1), Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+    branch32(Below, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
+
+    add32(Imm32(1), regT2, regT0);
+    store32(regT0, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+    jump().linkTo(storeResult, this);
+
+    end.link(this);
 }
 
 void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -359,24 +346,13 @@ void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCas
     linkSlowCase(iter); // property int32 check
     linkSlowCaseIfNotJSCell(iter, base); // base cell check
     linkSlowCase(iter); // base not array check
+    linkSlowCase(iter); // in vector check
 
     JITStubCall stubPutByValCall(this, cti_op_put_by_val);
     stubPutByValCall.addArgument(base);
     stubPutByValCall.addArgument(property);
     stubPutByValCall.addArgument(value);
     stubPutByValCall.call();
-
-    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
-
-    // Slow cases for immediate int accesses to arrays.
-    linkSlowCase(iter); // in vector check
-    linkSlowCase(iter); // written to slot check
-
-    JITStubCall stubCall(this, cti_op_put_by_val_array);
-    stubCall.addArgument(regT1, regT0);
-    stubCall.addArgument(regT2);
-    stubCall.addArgument(value);
-    stubCall.call();
 }
 
 void JIT::emit_op_get_by_id(Instruction* currentInstruction)
@@ -545,22 +521,26 @@ void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID res
     load32(Address(temp, offset + 4), resultTag);
 }
 
+void JIT::testPrototype(Structure* structure, JumpList& failureCases)
+{
+    if (structure->m_prototype.isNull())
+        return;
+
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&asCell(structure->m_prototype)->m_structure), ImmPtr(asCell(structure->m_prototype)->m_structure)));
+}
+
 void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
 {
     // It is assumed that regT0 contains the basePayload and regT1 contains the baseTag.  The value can be found on the stack.
 
     JumpList failureCases;
     failureCases.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
-
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    failureCases.append(branchPtr(NotEqual, regT2, ImmPtr(oldStructure)));
+    failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
+    testPrototype(oldStructure, failureCases);
 
     // Verify that nothing in the prototype chain has a setter for this property. 
-    for (RefPtr<Structure>* it = chain->head(); *it; ++it) {
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        failureCases.append(branchPtr(NotEqual, regT2, ImmPtr(it->get())));
-    }
+    for (RefPtr<Structure>* it = chain->head(); *it; ++it)
+        testPrototype(it->get(), failureCases);
 
     // Reallocate property storage if needed.
     Call callTarget;
@@ -958,12 +938,16 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
 
 void JIT::emit_op_get_by_val(Instruction* currentInstruction)
 {
-    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegisters(base, regT0, property, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT1);
 #if USE(JSVALUE64)
     // This is technically incorrect - we're zero-extending an int32.  On the hot path this doesn't matter.
-    // We check the value as if it was a uint32 against the m_fastAccessCutoff - which will always fail if
-    // number was signed since m_fastAccessCutoff is always less than intmax (since the total allocation
+    // We check the value as if it was a uint32 against the m_vectorLength - which will always fail if
+    // number was signed since m_vectorLength is always less than intmax (since the total allocation
     // size is always less than 4Gb).  As such zero extending wil have been correct (and extending the value
     // to 64-bits is necessary since it's used in the address calculation.  We zero extend rather than sign
     // extending since it makes it easier to re-tag the value in the slow case.
@@ -971,21 +955,25 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
 #else
     emitFastArithImmToInt(regT1);
 #endif
-    emitJumpSlowCaseIfNotJSCell(regT0);
+    emitJumpSlowCaseIfNotJSCell(regT0, base);
     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
 
-    // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
-    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff))));
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
 
-    // Get the value from the vector
     loadPtr(BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0);
-    emitPutVirtualRegister(currentInstruction[1].u.operand);
+    addSlowCase(branchTestPtr(Zero, regT0));
+
+    emitPutVirtualRegister(dst);
 }
 
 void JIT::emit_op_put_by_val(Instruction* currentInstruction)
 {
-    emitGetVirtualRegisters(currentInstruction[1].u.operand, regT0, currentInstruction[2].u.operand, regT1);
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegisters(base, regT0, property, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT1);
 #if USE(JSVALUE64)
     // See comment in op_get_by_val.
@@ -993,23 +981,29 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
 #else
     emitFastArithImmToInt(regT1);
 #endif
-    emitJumpSlowCaseIfNotJSCell(regT0);
+    emitJumpSlowCaseIfNotJSCell(regT0, base);
     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
 
-    // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
-    Jump inFastVector = branch32(Below, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff)));
-    // No; oh well, check if the access if within the vector - if so, we may still be okay.
-    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength))));
 
-    // This is a write to the slow part of the vector; first, we have to check if this would be the first write to this location.
-    // FIXME: should be able to handle initial write to array; increment the the number of items in the array, and potentially update fast access cutoff. 
-    addSlowCase(branchTestPtr(Zero, BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))));
+    Jump empty = branchTestPtr(Zero, BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
 
-    // All good - put the value into the array.
-    inFastVector.link(this);
-    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
+    Label storeResult(this);
+    emitGetVirtualRegister(value, regT0);
     storePtr(regT0, BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+    Jump end = jump();
+    
+    empty.link(this);
+    add32(Imm32(1), Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+    branch32(Below, regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
+
+    move(regT1, regT0);
+    add32(Imm32(1), regT0);
+    store32(regT0, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+    jump().linkTo(storeResult, this);
+
+    end.link(this);
 }
 
 void JIT::emit_op_put_by_index(Instruction* currentInstruction)
@@ -1357,35 +1351,27 @@ void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID res
     } 
 }
 
+void JIT::testPrototype(Structure* structure, JumpList& failureCases)
+{
+    if (structure->m_prototype.isNull())
+        return;
+
+    move(ImmPtr(&asCell(structure->m_prototype)->m_structure), regT2);
+    move(ImmPtr(asCell(structure->m_prototype)->m_structure), regT3);
+    failureCases.append(branchPtr(NotEqual, Address(regT2), regT3));
+}
+
 void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
 {
     JumpList failureCases;
     // Check eax is an object of the right Structure.
     failureCases.append(emitJumpIfNotJSCell(regT0));
     failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
-    JumpList successCases;
-
-    // ecx = baseObject
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    // proto(ecx) = baseObject->structure()->prototype()
-    failureCases.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
+    testPrototype(oldStructure, failureCases);
 
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
-    
     // ecx = baseObject->m_structure
-    for (RefPtr<Structure>* it = chain->head(); *it; ++it) {
-        // null check the prototype
-        successCases.append(branchPtr(Equal, regT2, ImmPtr(JSValue::encode(jsNull()))));
-
-        // Check the structure id
-        failureCases.append(branchPtr(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(it->get())));
-        
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        failureCases.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
-    }
-
-    successCases.link(this);
+    for (RefPtr<Structure>* it = chain->head(); *it; ++it)
+        testPrototype(it->get(), failureCases);
 
     Call callTarget;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
index cb5354b9b8..c5ed9e3a48 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
@@ -26,7 +26,7 @@
 #ifndef JITStubCall_h
 #define JITStubCall_h
 
-#include <wtf/Platform.h>
+#include "MacroAssemblerCodeRef.h"
 
 #if ENABLE(JIT)
 
@@ -36,7 +36,7 @@ namespace JSC {
     public:
         JITStubCall(JIT* jit, JSObject* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Cell)
             , m_stackIndex(stackIndexStart)
         {
@@ -44,7 +44,7 @@ namespace JSC {
 
         JITStubCall(JIT* jit, JSPropertyNameIterator* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Cell)
             , m_stackIndex(stackIndexStart)
         {
@@ -52,7 +52,7 @@ namespace JSC {
 
         JITStubCall(JIT* jit, void* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(VoidPtr)
             , m_stackIndex(stackIndexStart)
         {
@@ -60,7 +60,7 @@ namespace JSC {
 
         JITStubCall(JIT* jit, int (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Int)
             , m_stackIndex(stackIndexStart)
         {
@@ -68,7 +68,7 @@ namespace JSC {
 
         JITStubCall(JIT* jit, bool (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Int)
             , m_stackIndex(stackIndexStart)
         {
@@ -76,7 +76,7 @@ namespace JSC {
 
         JITStubCall(JIT* jit, void (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Void)
             , m_stackIndex(stackIndexStart)
         {
@@ -85,7 +85,7 @@ namespace JSC {
 #if USE(JSVALUE32_64)
         JITStubCall(JIT* jit, EncodedJSValue (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Value)
             , m_stackIndex(stackIndexStart)
         {
@@ -171,7 +171,7 @@ namespace JSC {
 
             m_jit->restoreArgumentReference();
             JIT::Call call = m_jit->call();
-            m_jit->m_calls.append(CallRecord(call, m_jit->m_bytecodeIndex, m_stub));
+            m_jit->m_calls.append(CallRecord(call, m_jit->m_bytecodeIndex, m_stub.value()));
 
 #if ENABLE(OPCODE_SAMPLING)
             if (m_jit->m_bytecodeIndex != (unsigned)-1)
@@ -225,7 +225,7 @@ namespace JSC {
         static const size_t stackIndexStart = 1; // Index 0 is reserved for restoreArgumentReference().
 
         JIT* m_jit;
-        void* m_stub;
+        FunctionPtr m_stub;
         enum { Void, VoidPtr, Int, Value, Cell } m_returnType;
         size_t m_stackIndex;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
index 065b7ea477..90ea807a3a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
@@ -75,6 +75,12 @@ namespace JSC {
 #define THUMB_FUNC_PARAM(name)
 #endif
 
+#if PLATFORM(LINUX) && PLATFORM(X86_64)
+#define SYMBOL_STRING_RELOCATION(name) #name "@plt"
+#else
+#define SYMBOL_STRING_RELOCATION(name) SYMBOL_STRING(name)
+#endif
+
 #if USE(JSVALUE32_64)
 
 #if COMPILER(GCC) && PLATFORM(X86)
@@ -112,7 +118,7 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 #if !USE(JIT_STUB_ARGUMENT_VA_LIST)
     "movl %esp, %ecx" "\n"
 #endif
-    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "addl $0x3c, %esp" "\n"
     "popl %ebx" "\n"
     "popl %edi" "\n"
@@ -175,7 +181,7 @@ asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "movq %rsp, %rdi" "\n"
-    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "addq $0x48, %rsp" "\n"
     "popq %rbx" "\n"
     "popq %r15" "\n"
@@ -239,7 +245,7 @@ asm volatile (
 ".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "cpy r0, sp" "\n"
-    "bl " SYMBOL_STRING(cti_vm_throw) "\n"
+    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "ldr r6, [sp, #0x2c]" "\n"
     "ldr r5, [sp, #0x28]" "\n"
     "ldr r4, [sp, #0x24]" "\n"
@@ -365,7 +371,7 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 #if !USE(JIT_STUB_ARGUMENT_VA_LIST)
     "movl %esp, %ecx" "\n"
 #endif
-    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "addl $0x1c, %esp" "\n"
     "popl %ebx" "\n"
     "popl %edi" "\n"
@@ -434,7 +440,7 @@ asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "movq %rsp, %rdi" "\n"
-    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "addq $0x78, %rsp" "\n"
     "popq %rbx" "\n"
     "popq %r15" "\n"
@@ -498,7 +504,7 @@ asm volatile (
 ".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "cpy r0, sp" "\n"
-    "bl " SYMBOL_STRING(cti_vm_throw) "\n"
+    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "ldr r6, [sp, #0x2c]" "\n"
     "ldr r5, [sp, #0x28]" "\n"
     "ldr r4, [sp, #0x24]" "\n"
@@ -554,7 +560,7 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "mov lr, r6" "\n"
     "add r8, pc, #4" "\n"
     "str r8, [sp, #-4]!" "\n"
-    "b " SYMBOL_STRING(cti_vm_throw) "\n"
+    "b " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
 
 // Both has the same return sequence
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
@@ -694,11 +700,15 @@ NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* co
 
     // Structure transition, cache transition info
     if (slot.type() == PutPropertySlot::NewProperty) {
-        StructureChain* prototypeChain = structure->prototypeChain(callFrame);
-        if (!prototypeChain->isCacheable() || structure->isDictionary()) {
+        if (structure->isDictionary()) {
             ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_put_by_id_generic));
             return;
         }
+
+        // put_by_id_transition checks the prototype chain for setters.
+        normalizePrototypeChain(callFrame, baseCell);
+
+        StructureChain* prototypeChain = structure->prototypeChain(callFrame);
         stubInfo->initPutByIdTransition(structure->previousID(), structure, prototypeChain);
         JIT::compilePutByIdTransition(callFrame->scopeChain()->globalData, codeBlock, stubInfo, structure->previousID(), structure, slot.cachedOffset(), prototypeChain, returnAddress);
         return;
@@ -774,17 +784,13 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
         return;
     }
 
-    size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot);
+    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase());
     if (!count) {
         stubInfo->accessType = access_get_by_id_generic;
         return;
     }
 
     StructureChain* prototypeChain = structure->prototypeChain(callFrame);
-    if (!prototypeChain->isCacheable()) {
-        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_generic));
-        return;
-    }
     stubInfo->initGetByIdChain(structure, prototypeChain);
     JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, slot.cachedOffset(), returnAddress);
 }
@@ -1326,15 +1332,11 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
             ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
-    } else if (size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot)) {
-        StructureChain* protoChain = structure->prototypeChain(callFrame);
-        if (!protoChain->isCacheable()) {
-            ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
-            return JSValue::encode(result);
-        }
-        
+    } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase())) {
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
+
+        StructureChain* protoChain = structure->prototypeChain(callFrame);
         JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, slot.cachedOffset());
 
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
@@ -1412,7 +1414,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_instanceof)
 
     // ECMA-262 15.3.5.3:
     // Throw an exception either if baseVal is not an object, or if it does not implement 'HasInstance' (i.e. is a function).
-    TypeInfo typeInfo(UnspecifiedType, 0);
+    TypeInfo typeInfo(UnspecifiedType);
     if (!baseVal.isObject() || !(typeInfo = asObject(baseVal)->structure()->typeInfo()).implementsHasInstance()) {
         CallFrame* callFrame = stackFrame.callFrame;
         CodeBlock* codeBlock = callFrame->codeBlock();
@@ -1942,28 +1944,6 @@ DEFINE_STUB_FUNCTION(void, op_put_by_val)
     CHECK_FOR_EXCEPTION_AT_END();
 }
 
-DEFINE_STUB_FUNCTION(void, op_put_by_val_array)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    CallFrame* callFrame = stackFrame.callFrame;
-    JSValue baseValue = stackFrame.args[0].jsValue();
-    int i = stackFrame.args[1].int32();
-    JSValue value = stackFrame.args[2].jsValue();
-
-    ASSERT(isJSArray(stackFrame.globalData, baseValue));
-
-    if (LIKELY(i >= 0))
-        asArray(baseValue)->JSArray::put(callFrame, i, value);
-    else {
-        Identifier property(callFrame, UString::from(i));
-        PutPropertySlot slot;
-        baseValue.put(callFrame, property, value, slot);
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
 DEFINE_STUB_FUNCTION(void, op_put_by_val_byte_array)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2672,7 +2652,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_throw)
 
     if (!handler) {
         *stackFrame.exception = exceptionValue;
-        STUB_SET_RETURN_ADDRESS(reinterpret_cast<void*>(ctiOpThrowNotCaught));
+        STUB_SET_RETURN_ADDRESS(FunctionPtr(ctiOpThrowNotCaught).value());
         return JSValue::encode(jsNull());
     }
 
@@ -2687,18 +2667,22 @@ DEFINE_STUB_FUNCTION(JSPropertyNameIterator*, op_get_pnames)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSPropertyNameIterator::create(stackFrame.callFrame, stackFrame.args[0].jsValue());
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSObject* o = stackFrame.args[0].jsObject();
+    Structure* structure = o->structure();
+    JSPropertyNameIterator* jsPropertyNameIterator = structure->enumerationCache();
+    if (!jsPropertyNameIterator || jsPropertyNameIterator->cachedPrototypeChain() != structure->prototypeChain(callFrame))
+        jsPropertyNameIterator = JSPropertyNameIterator::create(callFrame, o);
+    return jsPropertyNameIterator;
 }
 
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_next_pname)
+DEFINE_STUB_FUNCTION(int, has_property)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSPropertyNameIterator* it = stackFrame.args[0].propertyNameIterator();
-    JSValue temp = it->next(stackFrame.callFrame);
-    if (!temp)
-        it->invalidate();
-    return JSValue::encode(temp);
+    JSObject* base = stackFrame.args[0].jsObject();
+    JSString* property = stackFrame.args[1].jsString();
+    return base->hasProperty(stackFrame.callFrame, Identifier(stackFrame.callFrame, property->value()));
 }
 
 DEFINE_STUB_FUNCTION(JSObject*, op_push_scope)
@@ -3039,6 +3023,14 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, vm_throw)
     return JSValue::encode(exceptionValue);
 }
 
+DEFINE_STUB_FUNCTION(EncodedJSValue, to_object)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    return JSValue::encode(stackFrame.args[0].jsValue().toObject(callFrame));
+}
+
 } // namespace JSC
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
index 46973eed03..ccbcd2a25f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
@@ -63,6 +63,7 @@ namespace JSC {
         int32_t asInt32;
 
         JSValue jsValue() { return JSValue::decode(asEncodedJSValue); }
+        JSObject* jsObject() { return static_cast<JSObject*>(asPointer); }
         Identifier& identifier() { return *static_cast<Identifier*>(asPointer); }
         int32_t int32() { return asInt32; }
         CodeBlock* codeBlock() { return static_cast<CodeBlock*>(asPointer); }
@@ -285,7 +286,6 @@ extern "C" {
     EncodedJSValue JIT_STUB cti_op_mod(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_mul(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_negate(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_op_next_pname(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_not(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_nstricteq(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_post_dec(STUB_ARGS_DECLARATION);
@@ -307,6 +307,7 @@ extern "C" {
     EncodedJSValue JIT_STUB cti_op_typeof(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_urshift(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_vm_throw(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_to_object(STUB_ARGS_DECLARATION);
     JSObject* JIT_STUB cti_op_construct_JSConstruct(STUB_ARGS_DECLARATION);
     JSObject* JIT_STUB cti_op_new_array(STUB_ARGS_DECLARATION);
     JSObject* JIT_STUB cti_op_new_error(STUB_ARGS_DECLARATION);
@@ -332,6 +333,7 @@ extern "C" {
     int JIT_STUB cti_op_loop_if_lesseq(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_loop_if_true(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_timeout_check(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_has_property(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_create_arguments(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_create_arguments_no_params(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_debug(STUB_ARGS_DECLARATION);
@@ -345,7 +347,6 @@ extern "C" {
     void JIT_STUB cti_op_put_by_id_generic(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_by_index(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_by_val(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_put_by_val_array(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_by_val_byte_array(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_getter(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_setter(STUB_ARGS_DECLARATION);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
index 9399b1a9e3..b6bc0aad3f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
@@ -29,6 +29,7 @@
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "JSLock.h"
+#include "JSString.h"
 #include "PrototypeFunction.h"
 #include "SamplingTool.h"
 #include <math.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/jsc.pro b/src/3rdparty/webkit/JavaScriptCore/jsc.pro
deleted file mode 100644
index ba880ffbda..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/jsc.pro
+++ /dev/null
@@ -1,31 +0,0 @@
-TEMPLATE = app
-TARGET = jsc
-DESTDIR = .
-SOURCES = jsc.cpp
-QT -= gui
-CONFIG -= app_bundle
-CONFIG += building-libs
-win32-*: CONFIG += console
-win32-msvc*: CONFIG += exceptions_off stl_off
-
-include($$PWD/../WebKit.pri)
-
-CONFIG += link_pkgconfig
-
-QMAKE_RPATHDIR += $$OUTPUT_DIR/lib
-
-isEmpty(OUTPUT_DIR):OUTPUT_DIR=$$PWD/..
-CONFIG(debug, debug|release) {
-    OBJECTS_DIR = obj/debug
-} else { # Release
-    OBJECTS_DIR = obj/release
-}
-OBJECTS_DIR_WTR = $$OBJECTS_DIR$${QMAKE_DIR_SEP}
-include($$PWD/JavaScriptCore.pri)
-
-lessThan(QT_MINOR_VERSION, 4) {
-    DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
-}
-
-*-g++*:QMAKE_CXXFLAGS_RELEASE -= -O2
-*-g++*:QMAKE_CXXFLAGS_RELEASE += -O3
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
index 85fd16321c..6d953dfed1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
@@ -27,6 +27,7 @@
 
 #include "JSObject.h"
 #include "JSString.h"
+#include "Lexer.h"
 #include "NodeConstructors.h"
 #include "NodeInfo.h"
 #include <stdlib.h>
@@ -48,7 +49,6 @@
 #define YYERROR_VERBOSE
 #endif
 
-int jscyylex(void* lvalp, void* llocp, void* globalPtr);
 int jscyyerror(const char*);
 
 static inline bool allowAutomaticSemicolon(JSC::Lexer&, int);
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
index 785b219fe7..df3083834f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
@@ -46,12 +46,6 @@ using namespace JSC;
 #include "Lookup.h"
 #include "Lexer.lut.h"
 
-// A bridge for yacc from the C world to the C++ world.
-int jscyylex(void* lvalp, void* llocp, void* globalData)
-{
-    return static_cast<JSGlobalData*>(globalData)->lexer->lex(lvalp, llocp);
-}
-
 namespace JSC {
 
 static const UChar byteOrderMark = 0xFEFF;
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h
index 174e05a8c4..c76696cf3b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h
@@ -136,6 +136,12 @@ namespace JSC {
         return (convertHex(c1, c2) << 8) | convertHex(c3, c4);
     }
 
+    // A bridge for yacc from the C world to the C++ world.
+    inline int jscyylex(void* lvalp, void* llocp, void* globalData)
+    {
+        return static_cast<JSGlobalData*>(globalData)->lexer->lex(lvalp, llocp);
+    }
+
 } // namespace JSC
 
 #endif // Lexer_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
index 3bd318a04c..b1e317e468 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
@@ -1468,14 +1468,16 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     if (!m_lexpr->isLocation())
         return emitThrowError(generator, ReferenceError, "Left side of for-in statement is not a reference.");
 
-    RefPtr<Label> continueTarget = generator.newLabel(); 
-
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
 
     if (m_init)
         generator.emitNode(generator.ignoredResult(), m_init);
-    RegisterID* forInBase = generator.emitNode(m_expr);
-    RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), forInBase);
+
+    RefPtr<RegisterID> base = generator.newTemporary();
+    generator.emitNode(base.get(), m_expr);
+    RefPtr<RegisterID> i = generator.newTemporary();
+    RefPtr<RegisterID> size = generator.newTemporary();
+    RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), base.get(), i.get(), size.get(), scope->breakTarget());
     generator.emitJump(scope->continueTarget());
 
     RefPtr<Label> loopStart = generator.newLabel();
@@ -1517,7 +1519,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
-    generator.emitNextPropertyName(propertyName, iter.get(), loopStart.get());
+    generator.emitNextPropertyName(propertyName, base.get(), i.get(), size.get(), iter.get(), loopStart.get());
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     generator.emitLabel(scope->breakTarget());
     return dst;
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h
index 2fd4fc1410..eef8e93939 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h
@@ -34,7 +34,7 @@ namespace JSC {
     class ParserArenaDeletable;
     class ParserArenaRefCounted;
 
-    class IdentifierArena {
+    class IdentifierArena : public FastAllocBase {
     public:
         ALWAYS_INLINE const Identifier& makeIdentifier(JSGlobalData*, const UChar* characters, size_t length);
         const Identifier& makeNumericIdentifier(JSGlobalData*, double number);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
index 5be84a27a3..9b674a2fad 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
@@ -85,9 +85,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
         }
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
+
     private:
         void getArgumentsData(CallFrame*, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp
index 0237fd4d53..fb44494051 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp
@@ -50,7 +50,7 @@ ArrayConstructor::ArrayConstructor(ExecState* exec, NonNullPassRefPtr<Structure>
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().isArray, arrayConstructorIsArray), DontEnum);
 }
 
-static JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args)
+static inline JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args)
 {
     // a single numeric argument denotes the array size (!)
     if (args.size() == 1 && args.at(0).isNumber()) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
index 86e3f1b09c..7a894478c6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -149,10 +149,11 @@ static void putProperty(ExecState* exec, JSObject* obj, const Identifier& proper
 
 JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.inherits(&JSArray::info))
+    bool isRealArray = isJSArray(&exec->globalData(), thisValue);
+    if (!isRealArray && !thisValue.inherits(&JSArray::info))
         return throwError(exec, TypeError);
-    JSObject* thisObj = asArray(thisValue);
-
+    JSArray* thisObj = asArray(thisValue);
+    
     HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
     if (arrayVisitedElements.size() >= MaxSecondaryThreadReentryDepth) {
         if (!isMainThread() || arrayVisitedElements.size() >= MaxMainThreadReentryDepth)
@@ -163,34 +164,48 @@ JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue
     if (alreadyVisited)
         return jsEmptyString(exec); // return an empty string, avoiding infinite recursion.
 
-    Vector<UChar, 256> strBuffer;
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    unsigned totalSize = length ? length - 1 : 0;
+    Vector<RefPtr<UString::Rep>, 256> strBuffer(length);
     for (unsigned k = 0; k < length; k++) {
-        if (k >= 1)
-            strBuffer.append(',');
-        if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
-            break;
-        }
-
-        JSValue element = thisObj->get(exec, k);
+        JSValue element;
+        if (isRealArray && thisObj->canGetIndex(k))
+            element = thisObj->getIndex(k);
+        else
+            element = thisObj->get(exec, k);
+        
         if (element.isUndefinedOrNull())
             continue;
-
+        
         UString str = element.toString(exec);
-        strBuffer.append(str.data(), str.size());
-
+        strBuffer[k] = str.rep();
+        totalSize += str.size();
+        
         if (!strBuffer.data()) {
             JSObject* error = Error::create(exec, GeneralError, "Out of memory");
             exec->setException(error);
         }
-
+        
         if (exec->hadException())
             break;
     }
     arrayVisitedElements.remove(thisObj);
-    return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
+    if (!totalSize)
+        return jsEmptyString(exec);
+    Vector<UChar> buffer;
+    buffer.reserveCapacity(totalSize);
+    if (!buffer.data())
+        return throwError(exec, GeneralError, "Out of memory");
+        
+    for (unsigned i = 0; i < length; i++) {
+        if (i)
+            buffer.append(',');
+        if (RefPtr<UString::Rep> rep = strBuffer[i])
+            buffer.append(rep->data(), rep->size());
+    }
+    ASSERT(buffer.size() == totalSize);
+    unsigned finalSize = buffer.size();
+    return jsString(exec, UString(buffer.releaseBuffer(), finalSize, false));
 }
 
 JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
index 28f796aaad..69c2e51349 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
@@ -34,7 +34,7 @@ namespace JSC {
         
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
index 01e36c401c..a69115c2a7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
@@ -1043,16 +1043,6 @@ void Heap::markStackObjectsConservatively(MarkStack& markStack)
 #endif
 }
 
-void Heap::setGCProtectNeedsLocking()
-{
-    // Most clients do not need to call this, with the notable exception of WebCore.
-    // Clients that use shared heap have JSLock protection, while others are supposed
-    // to do explicit locking. WebCore violates this contract in Database code,
-    // which calls gcUnprotect from a secondary thread.
-    if (!m_protectedValuesMutex)
-        m_protectedValuesMutex.set(new Mutex);
-}
-
 void Heap::protect(JSValue k)
 {
     ASSERT(k);
@@ -1061,13 +1051,7 @@ void Heap::protect(JSValue k)
     if (!k.isCell())
         return;
 
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
     m_protectedValues.add(k.asCell());
-
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
 }
 
 void Heap::unprotect(JSValue k)
@@ -1078,28 +1062,16 @@ void Heap::unprotect(JSValue k)
     if (!k.isCell())
         return;
 
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
     m_protectedValues.remove(k.asCell());
-
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
 }
 
 void Heap::markProtectedObjects(MarkStack& markStack)
 {
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
     ProtectCountSet::iterator end = m_protectedValues.end();
     for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it) {
         markStack.append(it->first);
         markStack.drain();
     }
-
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
 }
 
 template <HeapType heapType> size_t Heap::sweep()
@@ -1291,9 +1263,6 @@ size_t Heap::globalObjectCount()
 
 size_t Heap::protectedGlobalObjectCount()
 {
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
     size_t count = 0;
     if (JSGlobalObject* head = m_globalData->head) {
         JSGlobalObject* o = head;
@@ -1304,23 +1273,12 @@ size_t Heap::protectedGlobalObjectCount()
         } while (o != head);
     }
 
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
-
     return count;
 }
 
 size_t Heap::protectedObjectCount()
 {
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
-    size_t result = m_protectedValues.size();
-
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
-
-    return result;
+    return m_protectedValues.size();
 }
 
 static const char* typeName(JSCell* cell)
@@ -1342,16 +1300,10 @@ HashCountedSet<const char*>* Heap::protectedObjectTypeCounts()
 {
     HashCountedSet<const char*>* counts = new HashCountedSet<const char*>;
 
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
     ProtectCountSet::iterator end = m_protectedValues.end();
     for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it)
         counts->add(typeName(it->first));
 
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
-
     return counts;
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
index 0ecff190e4..9ca9d18f01 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
@@ -71,14 +71,6 @@ namespace JSC {
 
         void destroy();
 
-#ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-        // We can inline these functions because everything is compiled as
-        // one file, so the heapAllocate template definitions are available.
-        // However, allocateNumber is used via jsNumberCell outside JavaScriptCore.
-        // Thus allocateNumber needs to provide a non-inline version too.
-        void* inlineAllocateNumber(size_t s) { return heapAllocate<NumberHeap>(s); }
-        void* inlineAllocate(size_t s) { return heapAllocate<PrimaryHeap>(s); }
-#endif
         void* allocateNumber(size_t);
         void* allocate(size_t);
 
@@ -96,7 +88,6 @@ namespace JSC {
         };
         Statistics statistics() const;
 
-        void setGCProtectNeedsLocking();
         void protect(JSValue);
         void unprotect(JSValue);
 
@@ -151,7 +142,6 @@ namespace JSC {
         CollectorHeap primaryHeap;
         CollectorHeap numberHeap;
 
-        OwnPtr<Mutex> m_protectedValuesMutex; // Only non-null if the client explicitly requested it via setGCPrtotectNeedsLocking().
         ProtectCountSet m_protectedValues;
 
         HashSet<MarkedArgumentBuffer*>* m_markListSet;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
index 6b479ae43a..4cd58f5ae0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
@@ -22,6 +22,8 @@
 #include "config.h"
 #include "DateInstance.h"
 
+#include "JSGlobalObject.h"
+
 #include <math.h>
 #include <wtf/DateMath.h>
 #include <wtf/MathExtras.h>
@@ -45,6 +47,13 @@ DateInstance::DateInstance(NonNullPassRefPtr<Structure> structure)
 {
 }
 
+DateInstance::DateInstance(ExecState* exec, double time)
+    : JSWrapperObject(exec->lexicalGlobalObject()->dateStructure())
+    , m_cache(0)
+{
+    setInternalValue(jsNumber(exec, timeClip(time)));
+}
+
 DateInstance::~DateInstance()
 {
     delete m_cache;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
index c8edc2faaa..36d90b144b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
@@ -31,6 +31,7 @@ namespace JSC {
 
     class DateInstance : public JSWrapperObject {
     public:
+        DateInstance(ExecState*, double);
         explicit DateInstance(NonNullPassRefPtr<Structure>);
         virtual ~DateInstance();
 
@@ -41,7 +42,7 @@ namespace JSC {
         bool getTime(double& milliseconds, int& offset) const;
         bool getUTCTime(double& milliseconds) const;
 
-        static const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo info;
 
         void msToGregorianDateTime(double, bool outputIsUTC, WTF::GregorianDateTime&) const;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
index caed2d4f37..5fe4f47aa7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
@@ -39,8 +39,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
+
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | DateInstance::StructureFlags;
+
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
index cc18b95e97..5bead90d9f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -66,6 +66,11 @@ JSValue createStackOverflowError(ExecState* exec)
     return createError(exec, RangeError, "Maximum call stack size exceeded.");
 }
 
+JSValue createTypeError(ExecState* exec, const char* message)
+{
+    return createError(exec, TypeError, message);
+}
+
 JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
     int startOffset = 0;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
index 4c5bec1079..e739d0954c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
@@ -44,6 +44,7 @@ namespace JSC {
     
     JSValue createInterruptedExecutionException(JSGlobalData*);
     JSValue createStackOverflowError(ExecState*);
+    JSValue createTypeError(ExecState*, const char* message);
     JSValue createUndefinedVariableError(ExecState*, const Identifier&, unsigned bytecodeOffset, CodeBlock*);
     JSNotAnObjectErrorStub* createNotAnObjectErrorStub(ExecState*, bool isNull);
     JSObject* createInvalidParamError(ExecState*, const char* op, JSValue, unsigned bytecodeOffset, CodeBlock*);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
index 0e38549745..d1d6a1d1bc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
@@ -34,7 +34,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto)
         {
-            return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags));
         }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
index 73dd85473a..68e9ea3cce 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
@@ -50,7 +50,7 @@ namespace JSC {
         void setSetter(JSObject* setter) { m_setter = setter; }
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(GetterSetterType));
+            return Structure::create(prototype, TypeInfo(GetterSetterType, OverridesMarkChildren));
         }
     private:
         virtual bool isGetterSetter() const;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
index b62ad3eeb5..389b1c34c2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
@@ -37,9 +37,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
+    protected:
+        static const unsigned StructureFlags = ImplementsHasInstance | OverridesMarkChildren | OverridesGetPropertyNames | PrototypeFunction::StructureFlags;
+
     private:
         virtual void markChildren(MarkStack&);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
index fdd5cc1c9c..de9a1d6ecb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
@@ -42,10 +42,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot | HasDefaultMark)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
         }
 
     protected:
+        static const unsigned StructureFlags = ImplementsHasInstance | JSObject::StructureFlags;
+
         InternalFunction(NonNullPassRefPtr<Structure> structure) : JSObject(structure) { }
         InternalFunction(JSGlobalData*, NonNullPassRefPtr<Structure>, const Identifier&);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
index 88a8493870..aca550e2f6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
@@ -39,7 +39,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType));
+            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren | OverridesGetPropertyNames));
         }
 
         
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
index 583b988f18..ee9819106a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
@@ -66,7 +66,10 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); }
+
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
 
     private:
         struct JSActivationData : public JSVariableObjectData {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
index c471dacb02..fd9e7b2e4c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
@@ -136,9 +136,7 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure)
     unsigned initialCapacity = 0;
 
     m_storage = static_cast<ArrayStorage*>(fastZeroedMalloc(storageSize(initialCapacity)));
-    m_storage->m_vectorLength = initialCapacity;
-
-    m_fastAccessCutoff = 0;
+    m_vectorLength = initialCapacity;
 
     checkConsistency();
 }
@@ -150,7 +148,7 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength)
 
     m_storage = static_cast<ArrayStorage*>(fastMalloc(storageSize(initialCapacity)));
     m_storage->m_length = initialLength;
-    m_storage->m_vectorLength = initialCapacity;
+    m_vectorLength = initialCapacity;
     m_storage->m_numValuesInVector = 0;
     m_storage->m_sparseValueMap = 0;
     m_storage->lazyCreationData = 0;
@@ -159,8 +157,6 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength)
     for (size_t i = 0; i < initialCapacity; ++i)
         vector[i] = JSValue();
 
-    m_fastAccessCutoff = 0;
-
     checkConsistency();
 
     Heap::heap(this)->reportExtraMemoryCost(initialCapacity * sizeof(JSValue));
@@ -173,7 +169,7 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, const ArgList& list)
 
     m_storage = static_cast<ArrayStorage*>(fastMalloc(storageSize(initialCapacity)));
     m_storage->m_length = initialCapacity;
-    m_storage->m_vectorLength = initialCapacity;
+    m_vectorLength = initialCapacity;
     m_storage->m_numValuesInVector = initialCapacity;
     m_storage->m_sparseValueMap = 0;
 
@@ -182,8 +178,6 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, const ArgList& list)
     for (ArgList::const_iterator it = list.begin(); it != end; ++it, ++i)
         m_storage->m_vector[i] = *it;
 
-    m_fastAccessCutoff = initialCapacity;
-
     checkConsistency();
 
     Heap::heap(this)->reportExtraMemoryCost(storageSize(initialCapacity));
@@ -207,7 +201,7 @@ bool JSArray::getOwnPropertySlot(ExecState* exec, unsigned i, PropertySlot& slot
         return false;
     }
 
-    if (i < storage->m_vectorLength) {
+    if (i < m_vectorLength) {
         JSValue& valueSlot = storage->m_vector[i];
         if (valueSlot) {
             slot.setValueSlot(&valueSlot);
@@ -253,8 +247,8 @@ bool JSArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& proper
     if (isArrayIndex) {
         if (i >= m_storage->m_length)
             return false;
-        if (i < m_storage->m_vectorLength) {
-            JSValue value = m_storage->m_vector[i];
+        if (i < m_vectorLength) {
+            JSValue& value = m_storage->m_vector[i];
             if (value) {
                 descriptor.setDescriptor(value, 0);
                 return true;
@@ -305,7 +299,7 @@ void JSArray::put(ExecState* exec, unsigned i, JSValue value)
         m_storage->m_length = length;
     }
 
-    if (i < m_storage->m_vectorLength) {
+    if (i < m_vectorLength) {
         JSValue& valueSlot = m_storage->m_vector[i];
         if (valueSlot) {
             valueSlot = value;
@@ -313,8 +307,7 @@ void JSArray::put(ExecState* exec, unsigned i, JSValue value)
             return;
         }
         valueSlot = value;
-        if (++m_storage->m_numValuesInVector == m_storage->m_length)
-            m_fastAccessCutoff = m_storage->m_length;
+        ++m_storage->m_numValuesInVector;
         checkConsistency();
         return;
     }
@@ -352,8 +345,7 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
         if (increaseVectorLength(i + 1)) {
             storage = m_storage;
             storage->m_vector[i] = value;
-            if (++storage->m_numValuesInVector == storage->m_length)
-                m_fastAccessCutoff = storage->m_length;
+            ++storage->m_numValuesInVector;
             checkConsistency();
         } else
             throwOutOfMemoryError(exec);
@@ -363,7 +355,7 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
     // Decide how many values it would be best to move from the map.
     unsigned newNumValuesInVector = storage->m_numValuesInVector + 1;
     unsigned newVectorLength = increasedVectorLength(i + 1);
-    for (unsigned j = max(storage->m_vectorLength, MIN_SPARSE_ARRAY_INDEX); j < newVectorLength; ++j)
+    for (unsigned j = max(m_vectorLength, MIN_SPARSE_ARRAY_INDEX); j < newVectorLength; ++j)
         newNumValuesInVector += map->contains(j);
     if (i >= MIN_SPARSE_ARRAY_INDEX)
         newNumValuesInVector -= map->contains(i);
@@ -386,7 +378,7 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
         return;
     }
 
-    unsigned vectorLength = storage->m_vectorLength;
+    unsigned vectorLength = m_vectorLength;
 
     Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
 
@@ -404,7 +396,7 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
 
     storage->m_vector[i] = value;
 
-    storage->m_vectorLength = newVectorLength;
+    m_vectorLength = newVectorLength;
     storage->m_numValuesInVector = newNumValuesInVector;
 
     m_storage = storage;
@@ -431,7 +423,7 @@ bool JSArray::deleteProperty(ExecState* exec, unsigned i)
 
     ArrayStorage* storage = m_storage;
 
-    if (i < storage->m_vectorLength) {
+    if (i < m_vectorLength) {
         JSValue& valueSlot = storage->m_vector[i];
         if (!valueSlot) {
             checkConsistency();
@@ -439,8 +431,6 @@ bool JSArray::deleteProperty(ExecState* exec, unsigned i)
         }
         valueSlot = JSValue();
         --storage->m_numValuesInVector;
-        if (m_fastAccessCutoff > i)
-            m_fastAccessCutoff = i;
         checkConsistency();
         return true;
     }
@@ -472,7 +462,7 @@ void JSArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNa
 
     ArrayStorage* storage = m_storage;
 
-    unsigned usedVectorLength = min(storage->m_length, storage->m_vectorLength);
+    unsigned usedVectorLength = min(storage->m_length, m_vectorLength);
     for (unsigned i = 0; i < usedVectorLength; ++i) {
         if (storage->m_vector[i])
             propertyNames.add(Identifier::from(exec, i));
@@ -494,7 +484,7 @@ bool JSArray::increaseVectorLength(unsigned newLength)
 
     ArrayStorage* storage = m_storage;
 
-    unsigned vectorLength = storage->m_vectorLength;
+    unsigned vectorLength = m_vectorLength;
     ASSERT(newLength > vectorLength);
     ASSERT(newLength <= MAX_STORAGE_VECTOR_INDEX);
     unsigned newVectorLength = increasedVectorLength(newLength);
@@ -503,7 +493,7 @@ bool JSArray::increaseVectorLength(unsigned newLength)
         return false;
 
     Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
-    storage->m_vectorLength = newVectorLength;
+    m_vectorLength = newVectorLength;
 
     for (unsigned i = vectorLength; i < newVectorLength; ++i)
         storage->m_vector[i] = JSValue();
@@ -521,10 +511,7 @@ void JSArray::setLength(unsigned newLength)
     unsigned length = m_storage->m_length;
 
     if (newLength < length) {
-        if (m_fastAccessCutoff > newLength)
-            m_fastAccessCutoff = newLength;
-
-        unsigned usedVectorLength = min(length, storage->m_vectorLength);
+        unsigned usedVectorLength = min(length, m_vectorLength);
         for (unsigned i = newLength; i < usedVectorLength; ++i) {
             JSValue& valueSlot = storage->m_vector[i];
             bool hadValue = valueSlot;
@@ -563,20 +550,13 @@ JSValue JSArray::pop()
 
     JSValue result;
 
-    if (m_fastAccessCutoff > length) {
-        JSValue& valueSlot = m_storage->m_vector[length];
-        result = valueSlot;
-        ASSERT(result);
-        valueSlot = JSValue();
-        --m_storage->m_numValuesInVector;
-        m_fastAccessCutoff = length;
-    } else if (length < m_storage->m_vectorLength) {
+    if (length < m_vectorLength) {
         JSValue& valueSlot = m_storage->m_vector[length];
-        result = valueSlot;
-        valueSlot = JSValue();
-        if (result)
+        if (valueSlot) {
             --m_storage->m_numValuesInVector;
-        else
+            result = valueSlot;
+            valueSlot = JSValue();
+        } else
             result = jsUndefined();
     } else {
         result = jsUndefined();
@@ -604,11 +584,10 @@ void JSArray::push(ExecState* exec, JSValue value)
 {
     checkConsistency();
 
-    if (m_storage->m_length < m_storage->m_vectorLength) {
-        ASSERT(!m_storage->m_vector[m_storage->m_length]);
+    if (m_storage->m_length < m_vectorLength) {
         m_storage->m_vector[m_storage->m_length] = value;
-        if (++m_storage->m_numValuesInVector == ++m_storage->m_length)
-            m_fastAccessCutoff = m_storage->m_length;
+        ++m_storage->m_numValuesInVector;
+        ++m_storage->m_length;
         checkConsistency();
         return;
     }
@@ -618,8 +597,8 @@ void JSArray::push(ExecState* exec, JSValue value)
         if (!map || map->isEmpty()) {
             if (increaseVectorLength(m_storage->m_length + 1)) {
                 m_storage->m_vector[m_storage->m_length] = value;
-                if (++m_storage->m_numValuesInVector == ++m_storage->m_length)
-                    m_fastAccessCutoff = m_storage->m_length;
+                ++m_storage->m_numValuesInVector;
+                ++m_storage->m_length;
                 checkConsistency();
                 return;
             }
@@ -837,7 +816,7 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
     if (!m_storage->m_length)
         return;
 
-    unsigned usedVectorLength = min(m_storage->m_length, m_storage->m_vectorLength);
+    unsigned usedVectorLength = min(m_storage->m_length, m_vectorLength);
 
     AVLTree<AVLTreeAbstractorForArrayCompare, 44> tree; // Depth 44 is enough for 2^31 items
     tree.abstractor().m_exec = exec;
@@ -886,7 +865,7 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
 
     if (SparseArrayValueMap* map = m_storage->m_sparseValueMap) {
         newUsedVectorLength += map->size();
-        if (newUsedVectorLength > m_storage->m_vectorLength) {
+        if (newUsedVectorLength > m_vectorLength) {
             // Check that it is possible to allocate an array large enough to hold all the entries.
             if ((newUsedVectorLength > MAX_STORAGE_VECTOR_LENGTH) || !increaseVectorLength(newUsedVectorLength)) {
                 throwOutOfMemoryError(exec);
@@ -926,7 +905,6 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
         m_storage->m_vector[i] = JSValue();
 
-    m_fastAccessCutoff = newUsedVectorLength;
     m_storage->m_numValuesInVector = newUsedVectorLength;
 
     checkConsistency(SortConsistencyCheck);
@@ -934,10 +912,16 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
 
 void JSArray::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
 {
-    unsigned fastAccessLength = min(m_storage->m_length, m_fastAccessCutoff);
+    JSValue* vector = m_storage->m_vector;
+    unsigned vectorEnd = min(m_storage->m_length, m_vectorLength);
     unsigned i = 0;
-    for (; i < fastAccessLength; ++i)
-        args.append(getIndex(i));
+    for (; i < vectorEnd; ++i) {
+        JSValue& v = vector[i];
+        if (!v)
+            break;
+        args.append(v);
+    }
+
     for (; i < m_storage->m_length; ++i)
         args.append(get(exec, i));
 }
@@ -946,12 +930,17 @@ void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSiz
 {
     ASSERT(m_storage->m_length == maxSize);
     UNUSED_PARAM(maxSize);
-    unsigned fastAccessLength = min(m_storage->m_length, m_fastAccessCutoff);
+    JSValue* vector = m_storage->m_vector;
+    unsigned vectorEnd = min(m_storage->m_length, m_vectorLength);
     unsigned i = 0;
-    for (; i < fastAccessLength; ++i)
-        buffer[i] = getIndex(i);
-    uint32_t size = m_storage->m_length;
-    for (; i < size; ++i)
+    for (; i < vectorEnd; ++i) {
+        JSValue& v = vector[i];
+        if (!v)
+            break;
+        buffer[i] = v;
+    }
+
+    for (; i < m_storage->m_length; ++i)
         buffer[i] = get(exec, i);
 }
 
@@ -961,7 +950,7 @@ unsigned JSArray::compactForSorting()
 
     ArrayStorage* storage = m_storage;
 
-    unsigned usedVectorLength = min(m_storage->m_length, storage->m_vectorLength);
+    unsigned usedVectorLength = min(m_storage->m_length, m_vectorLength);
 
     unsigned numDefined = 0;
     unsigned numUndefined = 0;
@@ -985,7 +974,7 @@ unsigned JSArray::compactForSorting()
 
     if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
         newUsedVectorLength += map->size();
-        if (newUsedVectorLength > storage->m_vectorLength) {
+        if (newUsedVectorLength > m_vectorLength) {
             // Check that it is possible to allocate an array large enough to hold all the entries - if not,
             // exception is thrown by caller.
             if ((newUsedVectorLength > MAX_STORAGE_VECTOR_LENGTH) || !increaseVectorLength(newUsedVectorLength))
@@ -1006,7 +995,6 @@ unsigned JSArray::compactForSorting()
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
         storage->m_vector[i] = JSValue();
 
-    m_fastAccessCutoff = newUsedVectorLength;
     storage->m_numValuesInVector = newUsedVectorLength;
 
     checkConsistency(SortConsistencyCheck);
@@ -1032,30 +1020,27 @@ void JSArray::checkConsistency(ConsistencyCheckType type)
     if (type == SortConsistencyCheck)
         ASSERT(!m_storage->m_sparseValueMap);
 
-    ASSERT(m_fastAccessCutoff <= m_storage->m_length);
-    ASSERT(m_fastAccessCutoff <= m_storage->m_numValuesInVector);
-
     unsigned numValuesInVector = 0;
-    for (unsigned i = 0; i < m_storage->m_vectorLength; ++i) {
+    for (unsigned i = 0; i < m_vectorLength; ++i) {
         if (JSValue value = m_storage->m_vector[i]) {
             ASSERT(i < m_storage->m_length);
             if (type != DestructorConsistencyCheck)
                 value->type(); // Likely to crash if the object was deallocated.
             ++numValuesInVector;
         } else {
-            ASSERT(i >= m_fastAccessCutoff);
             if (type == SortConsistencyCheck)
                 ASSERT(i >= m_storage->m_numValuesInVector);
         }
     }
     ASSERT(numValuesInVector == m_storage->m_numValuesInVector);
+    ASSERT(numValuesInVector <= m_storage->m_length);
 
     if (m_storage->m_sparseValueMap) {
         SparseArrayValueMap::iterator end = m_storage->m_sparseValueMap->end();
         for (SparseArrayValueMap::iterator it = m_storage->m_sparseValueMap->begin(); it != end; ++it) {
             unsigned index = it->first;
             ASSERT(index < m_storage->m_length);
-            ASSERT(index >= m_storage->m_vectorLength);
+            ASSERT(index >= m_vectorLength);
             ASSERT(index <= MAX_ARRAY_INDEX);
             ASSERT(it->second);
             if (type != DestructorConsistencyCheck)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
index 12768a441c..8c224517cd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
@@ -29,7 +29,6 @@ namespace JSC {
 
     struct ArrayStorage {
         unsigned m_length;
-        unsigned m_vectorLength;
         unsigned m_numValuesInVector;
         SparseArrayValueMap* m_sparseValueMap;
         void* lazyCreationData; // A JSArray subclass can use this to fill the vector lazily.
@@ -63,18 +62,24 @@ namespace JSC {
         void push(ExecState*, JSValue);
         JSValue pop();
 
-        bool canGetIndex(unsigned i) { return i < m_fastAccessCutoff; }
+        bool canGetIndex(unsigned i) { return i < m_vectorLength && m_storage->m_vector[i]; }
         JSValue getIndex(unsigned i)
         {
             ASSERT(canGetIndex(i));
             return m_storage->m_vector[i];
         }
 
-        bool canSetIndex(unsigned i) { return i < m_fastAccessCutoff; }
-        JSValue setIndex(unsigned i, JSValue v)
+        bool canSetIndex(unsigned i) { return i < m_vectorLength; }
+        void setIndex(unsigned i, JSValue v)
         {
             ASSERT(canSetIndex(i));
-            return m_storage->m_vector[i] = v;
+            JSValue& x = m_storage->m_vector[i];
+            if (!x) {
+                ++m_storage->m_numValuesInVector;
+                if (i >= m_storage->m_length)
+                    m_storage->m_length = i + 1;
+            }
+            x = v;
         }
 
         void fillArgList(ExecState*, MarkedArgumentBuffer&);
@@ -82,12 +87,13 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
         
         inline void markChildrenDirect(MarkStack& markStack);
 
     protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
@@ -110,7 +116,7 @@ namespace JSC {
         enum ConsistencyCheckType { NormalConsistencyCheck, DestructorConsistencyCheck, SortConsistencyCheck };
         void checkConsistency(ConsistencyCheckType = NormalConsistencyCheck);
 
-        unsigned m_fastAccessCutoff;
+        unsigned m_vectorLength;
         ArrayStorage* m_storage;
     };
 
@@ -139,7 +145,7 @@ namespace JSC {
         
         ArrayStorage* storage = m_storage;
 
-        unsigned usedVectorLength = std::min(storage->m_length, storage->m_vectorLength);
+        unsigned usedVectorLength = std::min(storage->m_length, m_vectorLength);
         markStack.appendValues(storage->m_vector, usedVectorLength, MayContainNullValues);
 
         if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
@@ -152,7 +158,7 @@ namespace JSC {
     inline void MarkStack::markChildren(JSCell* cell)
     {
         ASSERT(Heap::isCellMarked(cell));
-        if (cell->structure()->typeInfo().hasDefaultMark()) {
+        if (!cell->structure()->typeInfo().overridesMarkChildren()) {
 #ifdef NDEBUG
             asObject(cell)->markChildrenDirect(*this);
 #else
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
index 90d39f0905..5e5003b188 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
@@ -45,7 +45,7 @@ JSByteArray::JSByteArray(ExecState* exec, NonNullPassRefPtr<Structure> structure
     
 PassRefPtr<Structure> JSByteArray::createStructure(JSValue prototype)
 {
-    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark));
+    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
index 006f4a2f7a..fe6e124d6f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
@@ -91,6 +91,9 @@ namespace JSC {
 
         WTF::ByteArray* storage() const { return m_storage.get(); }
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
+
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
         JSByteArray(VPtrStealingHackType) 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
index aa9325269a..fae056eb7a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
@@ -78,11 +78,7 @@ extern const double Inf = NaNInf.doubles.Inf_Double;
 
 void* JSCell::operator new(size_t size, ExecState* exec)
 {
-#ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-    return exec->heap()->inlineAllocate(size);
-#else
     return exec->heap()->allocate(size);
-#endif
 }
 
 bool JSCell::getUInt32(uint32_t&) const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
index 503c6c4093..16a5131516 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
@@ -112,14 +112,6 @@ namespace JSC {
         Structure* m_structure;
     };
 
-    // FIXME: We should deprecate this and just use JSValue::asCell() instead.
-    JSCell* asCell(JSValue);
-
-    inline JSCell* asCell(JSValue value)
-    {
-        return value.asCell();
-    }
-
     inline JSCell::JSCell(Structure* structure)
         : m_structure(structure)
     {
@@ -162,11 +154,7 @@ namespace JSC {
 
     inline void* JSCell::operator new(size_t size, JSGlobalData* globalData)
     {
-#ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-        return globalData->heap.inlineAllocate(size);
-#else
         return globalData->heap.allocate(size);
-#endif
     }
 
     // --- JSValue inlines ----------------------------
@@ -342,11 +330,6 @@ namespace JSC {
             append(value.asCell());
     }
 
-    inline void Structure::markAggregate(MarkStack& markStack)
-    {
-        markStack.append(m_prototype);
-    }
-
     inline Heap* Heap::heap(JSValue v)
     {
         if (!v.isCell())
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
index a9ac63eabe..b4356c4969 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
@@ -61,7 +61,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
         }
 
         NativeFunction nativeFunction()
@@ -72,6 +72,9 @@ namespace JSC {
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
 
+    protected:
+        const static unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesMarkChildren | OverridesGetPropertyNames | InternalFunction::StructureFlags;
+
     private:
         JSFunction(NonNullPassRefPtr<Structure>);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
index 3bb281ef15..cf3f1d175b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -89,7 +89,7 @@ static inline void markIfNeeded(MarkStack& markStack, JSValue v)
 static inline void markIfNeeded(MarkStack& markStack, const RefPtr<Structure>& s)
 {
     if (s)
-        s->markAggregate(markStack);
+        markIfNeeded(markStack, s->storedPrototype());
 }
 
 JSGlobalObject::~JSGlobalObject()
@@ -394,6 +394,21 @@ void JSGlobalObject::markChildren(MarkStack& markStack)
     markIfNeeded(markStack, d()->methodCallDummy);
 
     markIfNeeded(markStack, d()->errorStructure);
+    markIfNeeded(markStack, d()->argumentsStructure);
+    markIfNeeded(markStack, d()->arrayStructure);
+    markIfNeeded(markStack, d()->booleanObjectStructure);
+    markIfNeeded(markStack, d()->callbackConstructorStructure);
+    markIfNeeded(markStack, d()->callbackFunctionStructure);
+    markIfNeeded(markStack, d()->callbackObjectStructure);
+    markIfNeeded(markStack, d()->dateStructure);
+    markIfNeeded(markStack, d()->emptyObjectStructure);
+    markIfNeeded(markStack, d()->errorStructure);
+    markIfNeeded(markStack, d()->functionStructure);
+    markIfNeeded(markStack, d()->numberObjectStructure);
+    markIfNeeded(markStack, d()->prototypeFunctionStructure);
+    markIfNeeded(markStack, d()->regExpMatchesArrayStructure);
+    markIfNeeded(markStack, d()->regExpStructure);
+    markIfNeeded(markStack, d()->stringObjectStructure);
 
     // No need to mark the other structures, because their prototypes are all
     // guaranteed to be referenced elsewhere.
@@ -448,11 +463,7 @@ void JSGlobalObject::copyGlobalsTo(RegisterFile& registerFile)
 
 void* JSGlobalObject::operator new(size_t size, JSGlobalData* globalData)
 {
-#ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-    return globalData->heap.inlineAllocate(size);
-#else
     return globalData->heap.allocate(size);
-#endif
 }
 
 void JSGlobalObject::destroyJSGlobalObjectData(void* jsGlobalObjectData)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
index 2106783e22..720d3a56da 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
@@ -267,10 +267,13 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
     protected:
+
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
+
         struct GlobalPropertyInfo {
             GlobalPropertyInfo(const Identifier& i, JSValue v, unsigned a)
                 : identifier(i)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
index 0d9aca6ef4..a271c4e494 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
@@ -62,10 +62,13 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
      private:
+        
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
+
         // JSValue methods
         virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
         virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
index 6a48081632..309488fed2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
@@ -68,23 +68,15 @@ namespace JSC {
 
         void* operator new(size_t size, ExecState* exec)
         {
-    #ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-            return exec->heap()->inlineAllocateNumber(size);
-    #else
             return exec->heap()->allocateNumber(size);
-    #endif
         }
 
         void* operator new(size_t size, JSGlobalData* globalData)
         {
-    #ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-            return globalData->heap.inlineAllocateNumber(size);
-    #else
             return globalData->heap.allocateNumber(size);
-    #endif
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, NeedsThisConversion | HasDefaultMark)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, OverridesGetOwnPropertySlot | NeedsThisConversion)); }
 
     private:
         JSNumberCell(JSGlobalData* globalData, double value)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
index 65c98036bd..ec3fa40966 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
@@ -41,11 +41,14 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
         static void markStringifiers(MarkStack&, Stringifier*);
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | JSObject::StructureFlags;
+
     private:
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
index db2a9b207e..6932deda97 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
@@ -42,6 +42,25 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSObject);
 
+static inline void getEnumerablePropertyNames(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames)
+{
+    // Add properties from the static hashtables of properties
+    for (; classInfo; classInfo = classInfo->parentClass) {
+        const HashTable* table = classInfo->propHashTable(exec);
+        if (!table)
+            continue;
+        table->initializeIfNeeded(exec);
+        ASSERT(table->table);
+
+        int hashSizeMask = table->compactSize - 1;
+        const HashEntry* entry = table->table;
+        for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
+            if (entry->key() && !(entry->attributes() & DontEnum))
+                propertyNames.add(entry->key());
+        }
+    }
+}
+
 void JSObject::markChildren(MarkStack& markStack)
 {
 #ifndef NDEBUG
@@ -424,12 +443,29 @@ bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyNa
 
 void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    m_structure->getEnumerablePropertyNames(exec, propertyNames, this);
+    getOwnPropertyNames(exec, propertyNames);
+
+    if (prototype().isNull())
+        return;
+
+    JSObject* prototype = asObject(this->prototype());
+    while(1) {
+        if (prototype->structure()->typeInfo().overridesGetPropertyNames()) {
+            prototype->getPropertyNames(exec, propertyNames);
+            break;
+        }
+        prototype->getOwnPropertyNames(exec, propertyNames);
+        JSValue nextProto = prototype->prototype();
+        if (nextProto.isNull())
+            break;
+        prototype = asObject(nextProto);
+    }
 }
 
 void JSObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    m_structure->getOwnEnumerablePropertyNames(exec, propertyNames, this);
+    m_structure->getEnumerablePropertyNames(propertyNames);
+    getEnumerablePropertyNames(exec, classInfo(), propertyNames);
 }
 
 bool JSObject::toBoolean(ExecState*) const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
index 84b5f4b318..1dbab945f9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
@@ -207,10 +207,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
     protected:
+        static const unsigned StructureFlags = 0;
+
         void addAnonymousSlots(unsigned count);
         void putAnonymousValue(unsigned index, JSValue value)
         {
@@ -368,7 +370,7 @@ ALWAYS_INLINE bool JSObject::getOwnPropertySlot(ExecState* exec, const Identifie
 
 ALWAYS_INLINE bool JSCell::fastGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (structure()->typeInfo().hasStandardGetOwnPropertySlot())
+    if (!structure()->typeInfo().overridesGetOwnPropertySlot())
         return asObject(this)->inlineGetOwnPropertySlot(exec, propertyName, slot);
     return getOwnPropertySlot(exec, propertyName, slot);
 }
@@ -682,7 +684,7 @@ ALWAYS_INLINE void JSObject::markChildrenDirect(MarkStack& markStack)
 {
     JSCell::markChildren(markStack);
 
-    m_structure->markAggregate(markStack);
+    markStack.append(prototype());
     
     PropertyStorage storage = propertyStorage();
     size_t storageSize = m_structure->propertyStorageSize();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index e08a3d9e8e..2cd9f75dc9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -29,26 +29,56 @@
 #include "config.h"
 #include "JSPropertyNameIterator.h"
 
+#include "JSGlobalObject.h"
+
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSPropertyNameIterator);
 
-JSPropertyNameIterator::~JSPropertyNameIterator()
+JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject* o)
 {
+    ASSERT(!o->structure()->enumerationCache() ||
+            o->structure()->enumerationCache()->cachedStructure() != o->structure() ||
+            o->structure()->enumerationCache()->cachedPrototypeChain() != o->structure()->prototypeChain(exec));
+
+    PropertyNameArray propertyNames(exec);
+    o->getPropertyNames(exec, propertyNames);
+    JSPropertyNameIterator* jsPropertyNameIterator = new (exec) JSPropertyNameIterator(exec, propertyNames.data());
+
+    if (o->structure()->isDictionary())
+        return jsPropertyNameIterator;
+
+    if (o->structure()->typeInfo().overridesGetPropertyNames())
+        return jsPropertyNameIterator;
+    
+    size_t count = normalizePrototypeChain(exec, o);
+    StructureChain* structureChain = o->structure()->prototypeChain(exec);
+    RefPtr<Structure>* structure = structureChain->head();
+    for (size_t i = 0; i < count; ++i) {
+        if (structure[i]->typeInfo().overridesGetPropertyNames())
+            return jsPropertyNameIterator;
+    }
+
+    jsPropertyNameIterator->setCachedPrototypeChain(structureChain);
+    jsPropertyNameIterator->setCachedStructure(o->structure());
+    o->structure()->setEnumerationCache(jsPropertyNameIterator);
+    return jsPropertyNameIterator;
 }
 
-void JSPropertyNameIterator::markChildren(MarkStack& markStack)
+JSValue JSPropertyNameIterator::get(ExecState* exec, JSObject* base, size_t i)
 {
-    JSCell::markChildren(markStack);
-    if (m_object)
-        markStack.append(m_object);
+    JSValue& identifier = m_jsStrings[i];
+    if (m_cachedStructure == base->structure() && m_cachedPrototypeChain == base->structure()->prototypeChain(exec))
+        return identifier;
+
+    if (!base->hasProperty(exec, Identifier(exec, asString(identifier)->value())))
+        return JSValue();
+    return identifier;
 }
 
-void JSPropertyNameIterator::invalidate()
+void JSPropertyNameIterator::markChildren(MarkStack& markStack)
 {
-    ASSERT(m_position == m_end);
-    m_object = 0;
-    m_data.clear();
+    markStack.appendValues(m_jsStrings.get(), m_jsStringsSize, MayContainNullValues);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
index d2849a891b..0559e0b5ee 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -31,6 +31,7 @@
 
 #include "JSObject.h"
 #include "JSString.h"
+#include "Operations.h"
 #include "PropertyNameArray.h"
 
 namespace JSC {
@@ -39,73 +40,51 @@ namespace JSC {
     class JSObject;
 
     class JSPropertyNameIterator : public JSCell {
-    public:
-        static JSPropertyNameIterator* create(ExecState*, JSValue);
-
-        virtual ~JSPropertyNameIterator();
-
-        virtual void markChildren(MarkStack&);
+        friend class JIT;
 
-        JSValue next(ExecState*);
-        void invalidate();
+    public:
+        static JSPropertyNameIterator* create(ExecState*, JSObject*);
         
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType));
+            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren));
         }
+
+        virtual void markChildren(MarkStack&);
+
+        JSValue get(ExecState*, JSObject*, size_t i);
+        size_t size() { return m_jsStringsSize; }
+
+        void setCachedStructure(Structure* structure) { m_cachedStructure = structure; }
+        Structure* cachedStructure() { return m_cachedStructure; }
+
+        void setCachedPrototypeChain(NonNullPassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
+        StructureChain* cachedPrototypeChain() { return m_cachedPrototypeChain.get(); }
+
     private:
-        JSPropertyNameIterator(ExecState*);
-        JSPropertyNameIterator(ExecState*, JSObject*, PassRefPtr<PropertyNameArrayData> propertyNameArrayData);
+        JSPropertyNameIterator(ExecState*, PropertyNameArrayData* propertyNameArrayData);
 
-        JSObject* m_object;
-        RefPtr<PropertyNameArrayData> m_data;
-        PropertyNameArrayData::const_iterator m_position;
-        PropertyNameArrayData::const_iterator m_end;
+        Structure* m_cachedStructure;
+        RefPtr<StructureChain> m_cachedPrototypeChain;
+        size_t m_jsStringsSize;
+        OwnArrayPtr<JSValue> m_jsStrings;
     };
 
-inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec)
+inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, PropertyNameArrayData* propertyNameArrayData)
     : JSCell(exec->globalData().propertyNameIteratorStructure.get())
-    , m_object(0)
-    , m_position(0)
-    , m_end(0)
+    , m_cachedStructure(0)
+    , m_jsStringsSize(propertyNameArrayData->propertyNameVector().size())
+    , m_jsStrings(new JSValue[m_jsStringsSize])
 {
+    PropertyNameArrayData::PropertyNameVector& propertyNameVector = propertyNameArrayData->propertyNameVector();
+    for (size_t i = 0; i < m_jsStringsSize; ++i)
+        m_jsStrings[i] = jsOwnedString(exec, propertyNameVector[i].ustring());
 }
 
-inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, JSObject* object, PassRefPtr<PropertyNameArrayData> propertyNameArrayData)
-    : JSCell(exec->globalData().propertyNameIteratorStructure.get())
-    , m_object(object)
-    , m_data(propertyNameArrayData)
-    , m_position(m_data->begin())
-    , m_end(m_data->end())
-{
-}
-
-inline JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSValue v)
+inline void Structure::setEnumerationCache(JSPropertyNameIterator* enumerationCache)
 {
-    if (v.isUndefinedOrNull())
-        return new (exec) JSPropertyNameIterator(exec);
-
-    JSObject* o = v.toObject(exec);
-    PropertyNameArray propertyNames(exec);
-    o->getPropertyNames(exec, propertyNames);
-    return new (exec) JSPropertyNameIterator(exec, o, propertyNames.releaseData());
-}
-
-inline JSValue JSPropertyNameIterator::next(ExecState* exec)
-{
-    if (m_position == m_end)
-        return JSValue();
-
-    if (m_data->cachedStructure() == m_object->structure() && m_data->cachedPrototypeChain() == m_object->structure()->prototypeChain(exec))
-        return jsOwnedString(exec, (*m_position++).ustring());
-
-    do {
-        if (m_object->hasProperty(exec, *m_position))
-            return jsOwnedString(exec, (*m_position++).ustring());
-        m_position++;
-    } while (m_position != m_end);
-
-    return JSValue();
+    ASSERT(!isDictionary());
+    m_enumerationCache = enumerationCache;
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
index 5eb0e4b235..2542878064 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -57,7 +57,10 @@ namespace JSC{
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
         void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); }
+
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
 
     private:
         JSStaticScopeObjectData* d() { return static_cast<JSStaticScopeObjectData*>(JSVariableObject::d); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
index 91ddaebce7..20ba8684f6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
@@ -139,45 +139,4 @@ bool JSString::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Proper
     return JSString::getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSString* jsString(JSGlobalData* globalData, const UString& s)
-{
-    int size = s.size();
-    if (!size)
-        return globalData->smallStrings.emptyString(globalData);
-    if (size == 1) {
-        UChar c = s.data()[0];
-        if (c <= 0xFF)
-            return globalData->smallStrings.singleCharacterString(globalData, c);
-    }
-    return new (globalData) JSString(globalData, s);
-}
-    
-JSString* jsSubstring(JSGlobalData* globalData, const UString& s, unsigned offset, unsigned length)
-{
-    ASSERT(offset <= static_cast<unsigned>(s.size()));
-    ASSERT(length <= static_cast<unsigned>(s.size()));
-    ASSERT(offset + length <= static_cast<unsigned>(s.size()));
-    if (!length)
-        return globalData->smallStrings.emptyString(globalData);
-    if (length == 1) {
-        UChar c = s.data()[offset];
-        if (c <= 0xFF)
-            return globalData->smallStrings.singleCharacterString(globalData, c);
-    }
-    return new (globalData) JSString(globalData, UString::Rep::create(s.rep(), offset, length));
-}
-
-JSString* jsOwnedString(JSGlobalData* globalData, const UString& s)
-{
-    int size = s.size();
-    if (!size)
-        return globalData->smallStrings.emptyString(globalData);
-    if (size == 1) {
-        UChar c = s.data()[0];
-        if (c <= 0xFF)
-            return globalData->smallStrings.singleCharacterString(globalData, c);
-    }
-    return new (globalData) JSString(globalData, s, JSString::HasOtherOwner);
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
index 1e46551057..39dfe751cb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
@@ -92,7 +92,7 @@ namespace JSC {
         bool canGetIndex(unsigned i) { return i < static_cast<unsigned>(m_value.size()); }
         JSString* getIndex(JSGlobalData*, unsigned);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, NeedsThisConversion | HasDefaultMark)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion)); }
 
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
@@ -169,6 +169,47 @@ namespace JSC {
         return jsSingleCharacterSubstring(globalData, m_value, i);
     }
 
+    inline JSString* jsString(JSGlobalData* globalData, const UString& s)
+    {
+        int size = s.size();
+        if (!size)
+            return globalData->smallStrings.emptyString(globalData);
+        if (size == 1) {
+            UChar c = s.data()[0];
+            if (c <= 0xFF)
+                return globalData->smallStrings.singleCharacterString(globalData, c);
+        }
+        return new (globalData) JSString(globalData, s);
+    }
+        
+    inline JSString* jsSubstring(JSGlobalData* globalData, const UString& s, unsigned offset, unsigned length)
+    {
+        ASSERT(offset <= static_cast<unsigned>(s.size()));
+        ASSERT(length <= static_cast<unsigned>(s.size()));
+        ASSERT(offset + length <= static_cast<unsigned>(s.size()));
+        if (!length)
+            return globalData->smallStrings.emptyString(globalData);
+        if (length == 1) {
+            UChar c = s.data()[offset];
+            if (c <= 0xFF)
+                return globalData->smallStrings.singleCharacterString(globalData, c);
+        }
+        return new (globalData) JSString(globalData, UString::Rep::create(s.rep(), offset, length));
+    }
+
+    inline JSString* jsOwnedString(JSGlobalData* globalData, const UString& s)
+    {
+        int size = s.size();
+        if (!size)
+            return globalData->smallStrings.emptyString(globalData);
+        if (size == 1) {
+            UChar c = s.data()[0];
+            if (c <= 0xFF)
+                return globalData->smallStrings.singleCharacterString(globalData, c);
+        }
+        return new (globalData) JSString(globalData, s, JSString::HasOtherOwner);
+    }
+
     inline JSString* jsEmptyString(ExecState* exec) { return jsEmptyString(&exec->globalData()); }
     inline JSString* jsString(ExecState* exec, const UString& s) { return jsString(&exec->globalData(), s); }
     inline JSString* jsSingleCharacterString(ExecState* exec, UChar c) { return jsSingleCharacterString(&exec->globalData(), c); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
index 279510bff3..7c8960071d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
@@ -40,9 +40,9 @@ namespace JSC {
     static const unsigned OverridesHasInstance = 1 << 2;
     static const unsigned ImplementsDefaultHasInstance = 1 << 3;
     static const unsigned NeedsThisConversion = 1 << 4;
-    static const unsigned HasStandardGetOwnPropertySlot = 1 << 5;
-    static const unsigned HasDefaultMark = 1 << 6;
-    static const unsigned HasDefaultGetPropertyNames = 1 << 7;
+    static const unsigned OverridesGetOwnPropertySlot = 1 << 5;
+    static const unsigned OverridesMarkChildren = 1 << 6;
+    static const unsigned OverridesGetPropertyNames = 1 << 7;
 
     class TypeInfo {
         friend class JIT;
@@ -63,9 +63,9 @@ namespace JSC {
         bool implementsHasInstance() const { return m_flags & ImplementsHasInstance; }
         bool overridesHasInstance() const { return m_flags & OverridesHasInstance; }
         bool needsThisConversion() const { return m_flags & NeedsThisConversion; }
-        bool hasStandardGetOwnPropertySlot() const { return m_flags & HasStandardGetOwnPropertySlot; }
-        bool hasDefaultMark() const { return m_flags & HasDefaultMark; }
-        bool hasDefaultGetPropertyNames() const { return m_flags & HasDefaultGetPropertyNames; }
+        bool overridesGetOwnPropertySlot() const { return m_flags & OverridesGetOwnPropertySlot; }
+        bool overridesMarkChildren() const { return m_flags & OverridesMarkChildren; }
+        bool overridesGetPropertyNames() const { return m_flags & OverridesGetPropertyNames; }
         unsigned flags() const { return m_flags; }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
index 39a4093d46..699c1cd7cc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
@@ -110,7 +110,10 @@ char* JSValue::description()
 {
     static const size_t size = 32;
     static char description[size];
-    if (isInt32())
+
+    if (!*this)
+        snprintf(description, size, "<JSValue()>");
+    else if (isInt32())
         snprintf(description, size, "Int32: %d", asInt32());
     else if (isDouble())
         snprintf(description, size, "Double: %lf", asDouble());
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
index 58e74b18c7..1063cdcd52 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
@@ -213,7 +213,8 @@ namespace JSC {
         enum { FalseTag =        0xfffffffc };
         enum { NullTag =         0xfffffffb };
         enum { UndefinedTag =    0xfffffffa };
-        enum { DeletedValueTag = 0xfffffff9 };
+        enum { EmptyValueTag =   0xfffffff9 };
+        enum { DeletedValueTag = 0xfffffff8 };
 
         enum { LowestTag =  DeletedValueTag };
 
@@ -372,6 +373,14 @@ namespace JSC {
         return static_cast<uint32_t>(val);
     }
 
+    // FIXME: We should deprecate this and just use JSValue::asCell() instead.
+    JSCell* asCell(JSValue);
+
+    inline JSCell* asCell(JSValue value)
+    {
+        return value.asCell();
+    }
+
     ALWAYS_INLINE int32_t JSValue::toInt32(ExecState* exec) const
     {
         if (isInt32())
@@ -427,7 +436,7 @@ namespace JSC {
 
     inline JSValue::JSValue()
     {
-        u.asBits.tag = CellTag;
+        u.asBits.tag = EmptyValueTag;
         u.asBits.payload = 0;
     }
 
@@ -463,19 +472,26 @@ namespace JSC {
 
     inline JSValue::JSValue(JSCell* ptr)
     {
-        u.asBits.tag = CellTag;
+        if (ptr)
+            u.asBits.tag = CellTag;
+        else
+            u.asBits.tag = EmptyValueTag;
         u.asBits.payload = reinterpret_cast<int32_t>(ptr);
     }
 
     inline JSValue::JSValue(const JSCell* ptr)
     {
-        u.asBits.tag = CellTag;
+        if (ptr)
+            u.asBits.tag = CellTag;
+        else
+            u.asBits.tag = EmptyValueTag;
         u.asBits.payload = reinterpret_cast<int32_t>(const_cast<JSCell*>(ptr));
     }
 
     inline JSValue::operator bool() const
     {
-        return u.asBits.payload || tag() != CellTag;
+        ASSERT(tag() != DeletedValueTag);
+        return tag() != EmptyValueTag;
     }
 
     inline bool JSValue::operator==(const JSValue& other) const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
index 66e78c3851..d8b1479c03 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
@@ -60,10 +60,11 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
         
     protected:
+        static const unsigned StructureFlags = OverridesGetPropertyNames | JSObject::StructureFlags;
         // Subclasses of JSVariableObject can subclass this struct to add data
         // without increasing their own size (since there's a hard limit on the
         // size of a JSCell).
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
index 723b75d440..191ff3b910 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
@@ -38,7 +38,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultGetPropertyNames | HasDefaultMark));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
index ba00057e02..ea09f5432b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
@@ -47,7 +47,7 @@ namespace JSC {
         }
 
         ALWAYS_INLINE void append(JSValue);
-        ALWAYS_INLINE void append(JSCell*);
+        void append(JSCell*);
         
         ALWAYS_INLINE void appendValues(Register* values, size_t count, MarkSetProperties properties = NoNullValues)
         {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
index fee5ec5eb8..7f474b8298 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
@@ -37,8 +37,11 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
+
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | JSObject::StructureFlags;
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
index 908c55f04b..cf19b6f962 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
@@ -39,11 +39,14 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasDefaultMark | HasDefaultGetPropertyNames)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
         }
 
         enum { NaNValue, NegInfinity, PosInfinity, MaxValue, MinValue };
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | InternalFunction::StructureFlags;
+
     private:
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
index ca3923d8fc..8223a90a38 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
@@ -30,17 +30,19 @@ namespace JSC {
         explicit NumberObject(NonNullPassRefPtr<Structure>);
 
         static const ClassInfo info;
-#if USE(JSVALUE32)
+
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
+
+    protected:
+#if USE(JSVALUE32)
+        static const unsigned StructureFlags = OverridesMarkChildren | JSWrapperObject::StructureFlags;
 #else
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
-        {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
-        }
+        static const unsigned StructureFlags = JSWrapperObject::StructureFlags;
 #endif
+
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
index a456423f1e..837d5a6f3c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -125,6 +125,7 @@ JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState* exec,
     return description;
 }
 
+// FIXME: Use the enumeration cache.
 JSValue JSC_HOST_CALL objectConstructorKeys(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     if (!args.at(0).isObject())
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
index 5da9e38390..1aa68b3a00 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
@@ -224,15 +224,15 @@ namespace JSC {
         return jsAddSlowCase(callFrame, v1, v2);
     }
 
-    inline size_t countPrototypeChainEntriesAndCheckForProxies(CallFrame* callFrame, JSValue baseValue, const PropertySlot& slot)
+    inline size_t normalizePrototypeChain(CallFrame* callFrame, JSValue base, JSValue slotBase)
     {
-        JSCell* cell = asCell(baseValue);
+        JSCell* cell = asCell(base);
         size_t count = 0;
 
-        while (slot.slotBase() != cell) {
+        while (slotBase != cell) {
             JSValue v = cell->structure()->prototypeForLookup(callFrame);
 
-            // If we didn't find slotBase in baseValue's prototype chain, then baseValue
+            // If we didn't find slotBase in base's prototype chain, then base
             // must be a proxy for another object.
 
             if (v.isNull())
@@ -252,6 +252,25 @@ namespace JSC {
         return count;
     }
 
+    inline size_t normalizePrototypeChain(CallFrame* callFrame, JSCell* base)
+    {
+        size_t count = 0;
+        while (1) {
+            JSValue v = base->structure()->prototypeForLookup(callFrame);
+            if (v.isNull())
+                return count;
+
+            base = asCell(v);
+
+            // Since we're accessing a prototype in a loop, it's a good bet that it
+            // should not be treated as a dictionary.
+            if (base->structure()->isDictionary())
+                asObject(base)->setStructure(Structure::fromDictionaryTransition(base->structure()));
+
+            ++count;
+        }
+    }
+
     ALWAYS_INLINE JSValue resolveBase(CallFrame* callFrame, Identifier& property, ScopeChainNode* scopeChain)
     {
         ScopeChainIterator iter = scopeChain->begin();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
index 0878e73f87..c28b6a4553 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
@@ -21,6 +21,9 @@
 #include "config.h"
 #include "PropertyNameArray.h"
 
+#include "Structure.h"
+#include "StructureChain.h"
+
 namespace JSC {
 
 static const size_t setThreshold = 20;
@@ -44,7 +47,7 @@ void PropertyNameArray::add(UString::Rep* identifier)
             return;
     }
 
-    m_data->propertyNameVector().append(Identifier(m_globalData, identifier));
+    addKnownUnique(identifier);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h
index afcc83ff05..3dbcc9df74 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h
@@ -23,45 +23,35 @@
 
 #include "CallFrame.h"
 #include "Identifier.h"
-#include "Structure.h"
 #include <wtf/HashSet.h>
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/Vector.h>
 
 namespace JSC {
+    
+    class Structure;
+    class StructureChain;
 
+    // FIXME: Rename to PropertyNameArray.
     class PropertyNameArrayData : public RefCounted<PropertyNameArrayData> {
     public:
         typedef Vector<Identifier, 20> PropertyNameVector;
-        typedef PropertyNameVector::const_iterator const_iterator;
 
         static PassRefPtr<PropertyNameArrayData> create() { return adoptRef(new PropertyNameArrayData); }
 
-        const_iterator begin() const { return m_propertyNameVector.begin(); }
-        const_iterator end() const { return m_propertyNameVector.end(); }
-
         PropertyNameVector& propertyNameVector() { return m_propertyNameVector; }
 
-        void setCachedStructure(Structure* structure) { m_cachedStructure = structure; }
-        Structure* cachedStructure() const { return m_cachedStructure; }
-
-        void setCachedPrototypeChain(NonNullPassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
-        StructureChain* cachedPrototypeChain() { return m_cachedPrototypeChain.get(); }
-
     private:
         PropertyNameArrayData()
-            : m_cachedStructure(0)
         {
         }
 
         PropertyNameVector m_propertyNameVector;
-        Structure* m_cachedStructure;
-        RefPtr<StructureChain> m_cachedPrototypeChain;
     };
 
+    // FIXME: Rename to PropertyNameArrayBuilder.
     class PropertyNameArray {
     public:
-        typedef PropertyNameArrayData::const_iterator const_iterator;
-
         PropertyNameArray(JSGlobalData* globalData)
             : m_data(PropertyNameArrayData::create())
             , m_globalData(globalData)
@@ -82,21 +72,18 @@ namespace JSC {
         void add(UString::Rep*);
         void addKnownUnique(UString::Rep* identifier) { m_data->propertyNameVector().append(Identifier(m_globalData, identifier)); }
 
-        size_t size() const { return m_data->propertyNameVector().size(); }
-
         Identifier& operator[](unsigned i) { return m_data->propertyNameVector()[i]; }
         const Identifier& operator[](unsigned i) const { return m_data->propertyNameVector()[i]; }
 
-        const_iterator begin() const { return m_data->begin(); }
-        const_iterator end() const { return m_data->end(); }
-
         void setData(PassRefPtr<PropertyNameArrayData> data) { m_data = data; }
         PropertyNameArrayData* data() { return m_data.get(); }
-
         PassRefPtr<PropertyNameArrayData> releaseData() { return m_data.release(); }
 
-        void setShouldCache(bool shouldCache) { m_shouldCache = shouldCache; }
-        bool shouldCache() const { return m_shouldCache; }
+        // FIXME: Remove these functions.
+        typedef PropertyNameArrayData::PropertyNameVector::const_iterator const_iterator;
+        size_t size() const { return m_data->propertyNameVector().size(); }
+        const_iterator begin() const { return m_data->propertyNameVector().begin(); }
+        const_iterator end() const { return m_data->propertyNameVector().end(); }
 
     private:
         typedef HashSet<UString::Rep*, PtrHash<UString::Rep*> > IdentifierSet;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h
index 224164d2f9..a0d5443dce 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h
@@ -22,8 +22,8 @@
 #ifndef Protect_h
 #define Protect_h
 
-#include "JSCell.h"
 #include "Collector.h"
+#include "JSValue.h"
 
 namespace JSC {
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
index dbf2d44ae2..c609e083a3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -90,28 +90,6 @@ const ClassInfo RegExpConstructor::info = { "Function", &InternalFunction::info,
 @end
 */
 
-struct RegExpConstructorPrivate : FastAllocBase {
-    // Global search cache / settings
-    RegExpConstructorPrivate()
-        : lastNumSubPatterns(0)
-        , multiline(false)
-        , lastOvectorIndex(0)
-    {
-    }
-
-    const Vector<int, 32>& lastOvector() const { return ovector[lastOvectorIndex]; }
-    Vector<int, 32>& lastOvector() { return ovector[lastOvectorIndex]; }
-    Vector<int, 32>& tempOvector() { return ovector[lastOvectorIndex ? 0 : 1]; }
-    void changeLastOvector() { lastOvectorIndex = lastOvectorIndex ? 0 : 1; }
-
-    UString input;
-    UString lastInput;
-    Vector<int, 32> ovector[2];
-    unsigned lastNumSubPatterns : 30;
-    bool multiline : 1;
-    unsigned lastOvectorIndex : 1;
-};
-
 RegExpConstructor::RegExpConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, RegExpPrototype* regExpPrototype)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, "RegExp"))
     , d(new RegExpConstructorPrivate)
@@ -123,30 +101,6 @@ RegExpConstructor::RegExpConstructor(ExecState* exec, NonNullPassRefPtr<Structur
     putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly | DontDelete | DontEnum);
 }
 
-/* 
-  To facilitate result caching, exec(), test(), match(), search(), and replace() dipatch regular
-  expression matching through the performMatch function. We use cached results to calculate, 
-  e.g., RegExp.lastMatch and RegExp.leftParen.
-*/
-void RegExpConstructor::performMatch(RegExp* r, const UString& s, int startOffset, int& position, int& length, int** ovector)
-{
-    position = r->match(s, startOffset, &d->tempOvector());
-
-    if (ovector)
-        *ovector = d->tempOvector().data();
-
-    if (position != -1) {
-        ASSERT(!d->tempOvector().isEmpty());
-
-        length = d->tempOvector()[1] - d->tempOvector()[0];
-
-        d->input = s;
-        d->lastInput = s;
-        d->changeLastOvector();
-        d->lastNumSubPatterns = r->numSubpatterns();
-    }
-}
-
 RegExpMatchesArray::RegExpMatchesArray(ExecState* exec, RegExpConstructorPrivate* data)
     : JSArray(exec->lexicalGlobalObject()->regExpMatchesArrayStructure(), data->lastNumSubPatterns + 1)
 {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
index f8bccf4289..f9ca9cf1cd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
@@ -22,6 +22,7 @@
 #define RegExpConstructor_h
 
 #include "InternalFunction.h"
+#include "RegExp.h"
 #include <wtf/OwnPtr.h>
 
 namespace JSC {
@@ -30,13 +31,35 @@ namespace JSC {
     class RegExpPrototype;
     struct RegExpConstructorPrivate;
 
+    struct RegExpConstructorPrivate : FastAllocBase {
+        // Global search cache / settings
+        RegExpConstructorPrivate()
+            : lastNumSubPatterns(0)
+            , multiline(false)
+            , lastOvectorIndex(0)
+        {
+        }
+
+        const Vector<int, 32>& lastOvector() const { return ovector[lastOvectorIndex]; }
+        Vector<int, 32>& lastOvector() { return ovector[lastOvectorIndex]; }
+        Vector<int, 32>& tempOvector() { return ovector[lastOvectorIndex ? 0 : 1]; }
+        void changeLastOvector() { lastOvectorIndex = lastOvectorIndex ? 0 : 1; }
+
+        UString input;
+        UString lastInput;
+        Vector<int, 32> ovector[2];
+        unsigned lastNumSubPatterns : 30;
+        bool multiline : 1;
+        unsigned lastOvectorIndex : 1;
+    };
+
     class RegExpConstructor : public InternalFunction {
     public:
         RegExpConstructor(ExecState*, NonNullPassRefPtr<Structure>, RegExpPrototype*);
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance | HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
@@ -59,6 +82,9 @@ namespace JSC {
         JSValue getLeftContext(ExecState*) const;
         JSValue getRightContext(ExecState*) const;
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | InternalFunction::StructureFlags;
+
     private:
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
@@ -78,6 +104,30 @@ namespace JSC {
         return static_cast<RegExpConstructor*>(asObject(value));
     }
 
+    /* 
+      To facilitate result caching, exec(), test(), match(), search(), and replace() dipatch regular
+      expression matching through the performMatch function. We use cached results to calculate, 
+      e.g., RegExp.lastMatch and RegExp.leftParen.
+    */
+    inline void RegExpConstructor::performMatch(RegExp* r, const UString& s, int startOffset, int& position, int& length, int** ovector)
+    {
+        position = r->match(s, startOffset, &d->tempOvector());
+
+        if (ovector)
+            *ovector = d->tempOvector().data();
+
+        if (position != -1) {
+            ASSERT(!d->tempOvector().isEmpty());
+
+            length = d->tempOvector()[1] - d->tempOvector()[0];
+
+            d->input = s;
+            d->lastInput = s;
+            d->changeLastOvector();
+            d->lastNumSubPatterns = r->numSubpatterns();
+        }
+    }
+
 } // namespace JSC
 
 #endif // RegExpConstructor_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
index 877d7b6390..679d072ccf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
@@ -159,7 +159,7 @@ bool RegExpObject::match(ExecState* exec, const ArgList& args)
     }
 
     int position;
-    int length;
+    int length = 0;
     regExpConstructor->performMatch(d->regExp.get(), input, static_cast<int>(d->lastIndex), position, length);
     if (position < 0) {
         d->lastIndex = 0;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
index f5a9340561..3117c86fda 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
@@ -49,9 +49,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | JSObject::StructureFlags;
+
     private:
         bool match(ExecState*, const ArgList&);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
index 944f6ba8f2..84e1ad24a0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
@@ -48,10 +48,11 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
     protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSWrapperObject::StructureFlags;
         StringObject(NonNullPassRefPtr<Structure>, JSString*);
   };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
index 0cba83d5cb..69e1939635 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -44,9 +44,11 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, MasqueradesAsUndefined | HasDefaultMark)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
         }
 
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | MasqueradesAsUndefined | OverridesGetPropertyNames | StringObject::StructureFlags;
+
         virtual bool toBoolean(ExecState*) const { return false; }
     };
  
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
index b57732abe7..a0713b8dda 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
@@ -25,6 +25,7 @@
 #include "CachedCall.h"
 #include "Error.h"
 #include "Executable.h"
+#include "JSGlobalObjectFunctions.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "ObjectPrototype.h"
@@ -72,6 +73,10 @@ static JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState*, JSObject*, JSVa
 static JSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState*, JSObject*, JSValue, const ArgList&);
 
+static JSValue JSC_HOST_CALL stringProtoFuncTrim(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncTrimLeft(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncTrimRight(ExecState*, JSObject*, JSValue, const ArgList&);
+
 }
 
 #include "StringPrototype.lut.h"
@@ -117,6 +122,9 @@ const ClassInfo StringPrototype::info = { "String", &StringObject::info, 0, Exec
     fontsize              stringProtoFuncFontsize          DontEnum|Function       1
     anchor                stringProtoFuncAnchor            DontEnum|Function       1
     link                  stringProtoFuncLink              DontEnum|Function       1
+    trim                  stringProtoFuncTrim              DontEnum|Function       0
+    trimLeft              stringProtoFuncTrimLeft          DontEnum|Function       0
+    trimRight             stringProtoFuncTrimRight         DontEnum|Function       0
 @end
 */
 
@@ -249,7 +257,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
                 return jsNull();
             while (true) {
                 int matchIndex;
-                int matchLen;
+                int matchLen = 0;
                 int* ovector;
                 regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
                 if (matchIndex < 0)
@@ -290,7 +298,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
         } else {
             do {
                 int matchIndex;
-                int matchLen;
+                int matchLen = 0;
                 int* ovector;
                 regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
                 if (matchIndex < 0)
@@ -485,7 +493,7 @@ JSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec, JSObject*, JSValue t
     }
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
     int pos;
-    int matchLength;
+    int matchLength = 0;
     regExpConstructor->performMatch(reg.get(), u, 0, pos, matchLength);
     if (!(reg->global())) {
         // case without 'g' flag is handled like RegExp.prototype.exec
@@ -535,7 +543,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState* exec, JSObject*, JSValue
     }
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
     int pos;
-    int matchLength;
+    int matchLength = 0;
     regExpConstructor->performMatch(reg.get(), u, 0, pos, matchLength);
     return jsNumber(exec, pos);
 }
@@ -899,4 +907,51 @@ JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue th
     return jsNontrivialString(exec, UString(buffer, bufferSize, false));
 }
 
+enum {
+    TrimLeft = 1,
+    TrimRight = 2
+};
+
+static inline bool isTrimWhitespace(UChar c)
+{
+    return isStrWhiteSpace(c) || c == 0x200b;
+}
+
+static inline JSValue trimString(ExecState* exec, JSValue thisValue, int trimKind)
+{
+    UString str = thisValue.toThisString(exec);
+    int left = 0;
+    if (trimKind & TrimLeft) {
+        while (left < str.size() && isTrimWhitespace(str[left]))
+            left++;
+    }
+    int right = str.size();
+    if (trimKind & TrimRight) {
+        while (right > left && isTrimWhitespace(str[right - 1]))
+            right--;
+    }
+
+    // Don't gc allocate a new string if we don't have to.
+    if (left == 0 && right == str.size() && thisValue.isString())
+        return thisValue;
+
+    return jsString(exec, str.substr(left, right - left));
+}
+
+JSValue JSC_HOST_CALL stringProtoFuncTrim(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
+{
+    return trimString(exec, thisValue, TrimLeft | TrimRight);
+}
+
+JSValue JSC_HOST_CALL stringProtoFuncTrimLeft(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
+{
+    return trimString(exec, thisValue, TrimLeft);
+}
+
+JSValue JSC_HOST_CALL stringProtoFuncTrimRight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
+{
+    return trimString(exec, thisValue, TrimRight);
+}
+    
+    
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
index 7209b5fe0e..a11050f7dd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
@@ -28,9 +28,10 @@
 
 #include "Identifier.h"
 #include "JSObject.h"
+#include "JSPropertyNameIterator.h"
+#include "Lookup.h"
 #include "PropertyNameArray.h"
 #include "StructureChain.h"
-#include "Lookup.h"
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/RefPtr.h>
 
@@ -159,9 +160,9 @@ Structure::~Structure()
             m_previous->table.removeAnonymousSlotTransition(m_anonymousSlotsInPrevious);
 
     }
-
-    if (m_cachedPropertyNameArrayData)
-        m_cachedPropertyNameArrayData->setCachedStructure(0);
+    
+    if (m_enumerationCache)
+        m_enumerationCache->setCachedStructure(0);
 
     if (m_propertyTable) {
         unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
@@ -282,59 +283,6 @@ void Structure::materializePropertyMap()
     }
 }
 
-void Structure::getOwnEnumerablePropertyNames(ExecState* exec, PropertyNameArray& propertyNames, JSObject* baseObject)
-{
-    getEnumerableNamesFromPropertyTable(propertyNames);
-    getEnumerableNamesFromClassInfoTable(exec, baseObject->classInfo(), propertyNames);
-}
-
-void Structure::getEnumerablePropertyNames(ExecState* exec, PropertyNameArray& propertyNames, JSObject* baseObject)
-{
-    bool shouldCache = propertyNames.shouldCache() && !(propertyNames.size() || isDictionary());
-
-    if (shouldCache && m_cachedPropertyNameArrayData) {
-        if (m_cachedPropertyNameArrayData->cachedPrototypeChain() == prototypeChain(exec)) {
-            propertyNames.setData(m_cachedPropertyNameArrayData);
-            return;
-        }
-        clearEnumerationCache();
-    }
-
-    baseObject->getOwnPropertyNames(exec, propertyNames);
-
-    if (m_prototype.isObject()) {
-        propertyNames.setShouldCache(false); // No need for our prototypes to waste memory on caching, since they're not being enumerated directly.
-        JSObject* prototype = asObject(m_prototype);
-        while(1) {
-            if (!prototype->structure()->typeInfo().hasDefaultGetPropertyNames()) {
-                prototype->getPropertyNames(exec, propertyNames);
-                break;
-            }
-            prototype->getOwnPropertyNames(exec, propertyNames);
-            JSValue nextProto = prototype->prototype();
-            if (!nextProto.isObject())
-                break;
-            prototype = asObject(nextProto);
-        }
-    }
-
-    if (shouldCache) {
-        StructureChain* protoChain = prototypeChain(exec);
-        m_cachedPropertyNameArrayData = propertyNames.data();
-        if (!protoChain->isCacheable())
-            return;
-        m_cachedPropertyNameArrayData->setCachedPrototypeChain(protoChain);
-        m_cachedPropertyNameArrayData->setCachedStructure(this);
-    }
-}
-
-void Structure::clearEnumerationCache()
-{
-    if (m_cachedPropertyNameArrayData)
-        m_cachedPropertyNameArrayData->setCachedStructure(0);
-    m_cachedPropertyNameArrayData.clear();
-}
-
 void Structure::growPropertyStorageCapacity()
 {
     if (m_propertyStorageCapacity == JSObject::inlineStorageCapacity)
@@ -598,25 +546,25 @@ PassRefPtr<Structure> Structure::fromDictionaryTransition(Structure* structure)
 
 size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
+    ASSERT(!m_enumerationCache);
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
     size_t offset = put(propertyName, attributes, specificValue);
     if (propertyStorageSize() > propertyStorageCapacity())
         growPropertyStorageCapacity();
-    clearEnumerationCache();
     return offset;
 }
 
 size_t Structure::removePropertyWithoutTransition(const Identifier& propertyName)
 {
     ASSERT(isUncacheableDictionary());
+    ASSERT(!m_enumerationCache);
 
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
     size_t offset = remove(propertyName);
-    clearEnumerationCache();
     return offset;
 }
 
@@ -1057,7 +1005,7 @@ static int comparePropertyMapEntryIndices(const void* a, const void* b)
     return 0;
 }
 
-void Structure::getEnumerableNamesFromPropertyTable(PropertyNameArray& propertyNames)
+void Structure::getEnumerablePropertyNames(PropertyNameArray& propertyNames)
 {
     materializePropertyMapIfNecessary();
     if (!m_propertyTable)
@@ -1114,25 +1062,6 @@ void Structure::getEnumerableNamesFromPropertyTable(PropertyNameArray& propertyN
     }
 }
 
-void Structure::getEnumerableNamesFromClassInfoTable(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames)
-{
-    // Add properties from the static hashtables of properties
-    for (; classInfo; classInfo = classInfo->parentClass) {
-        const HashTable* table = classInfo->propHashTable(exec);
-        if (!table)
-            continue;
-        table->initializeIfNeeded(exec);
-        ASSERT(table->table);
-
-        int hashSizeMask = table->compactSize - 1;
-        const HashEntry* entry = table->table;
-        for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
-            if (entry->key() && !(entry->attributes() & DontEnum))
-                propertyNames.add(entry->key());
-        }
-    }
-}
-
 #if DO_PROPERTYMAP_CONSTENCY_CHECK
 
 void Structure::checkConsistency()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
index ed9f6e5985..2496c1b4d4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
@@ -30,6 +30,8 @@
 #include "JSType.h"
 #include "JSValue.h"
 #include "PropertyMapHashTable.h"
+#include "PropertyNameArray.h"
+#include "Protect.h"
 #include "StructureChain.h"
 #include "StructureTransitionTable.h"
 #include "JSTypeInfo.h"
@@ -76,8 +78,6 @@ namespace JSC {
 
         ~Structure();
 
-        void markAggregate(MarkStack&);
-
         // These should be used with caution.  
         size_t addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t removePropertyWithoutTransition(const Identifier& propertyName);
@@ -116,9 +116,6 @@ namespace JSC {
             return hasTransition(propertyName._ustring.rep(), attributes);
         }
 
-        void getEnumerablePropertyNames(ExecState*, PropertyNameArray&, JSObject*);
-        void getOwnEnumerablePropertyNames(ExecState*, PropertyNameArray&, JSObject*);
-
         bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
         void setHasGetterSetterProperties(bool hasGetterSetterProperties) { m_hasGetterSetterProperties = hasGetterSetterProperties; }
 
@@ -127,6 +124,10 @@ namespace JSC {
         JSCell* specificValue() { return m_specificValueInPrevious; }
         void despecifyDictionaryFunction(const Identifier& propertyName);
 
+        void setEnumerationCache(JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
+        JSPropertyNameIterator* enumerationCache() { return m_enumerationCache.get(); }
+        void getEnumerablePropertyNames(PropertyNameArray&);
+
     private:
         Structure(JSValue prototype, const TypeInfo&);
         
@@ -140,8 +141,6 @@ namespace JSC {
         size_t put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t remove(const Identifier& propertyName);
         void addAnonymousSlots(unsigned slotCount);
-        void getEnumerableNamesFromPropertyTable(PropertyNameArray&);
-        void getEnumerableNamesFromClassInfoTable(ExecState*, const ClassInfo*, PropertyNameArray&);
 
         void expandPropertyMapHashTable();
         void rehashPropertyMapHashTable();
@@ -162,8 +161,6 @@ namespace JSC {
             materializePropertyMap();
         }
 
-        void clearEnumerationCache();
-
         signed char transitionCount() const
         {
             // Since the number of transitions is always the same as m_offset, we keep the size of Structure down by not storing both.
@@ -189,7 +186,7 @@ namespace JSC {
 
         StructureTransitionTable table;
 
-        RefPtr<PropertyNameArrayData> m_cachedPropertyNameArrayData;
+        ProtectedPtr<JSPropertyNameIterator> m_enumerationCache;
 
         PropertyMapHashTable* m_propertyTable;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
index 6e8a0ee256..085876c496 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
@@ -46,18 +46,4 @@ StructureChain::StructureChain(Structure* head)
     m_vector[i] = 0;
 }
 
-bool StructureChain::isCacheable() const
-{
-    uint32_t i = 0;
-    
-    while (m_vector[i]) {
-        // Both classes of dictionary structure may change arbitrarily so we can't cache them
-        if (m_vector[i]->isDictionary())
-            return false;
-        if (!m_vector[i++]->typeInfo().hasDefaultGetPropertyNames())
-            return false;
-    }
-    return true;
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h
index c48749d29b..816b66d505 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h
@@ -36,10 +36,11 @@ namespace JSC {
     class Structure;
 
     class StructureChain : public RefCounted<StructureChain> {
+        friend class JIT;
+
     public:
         static PassRefPtr<StructureChain> create(Structure* head) { return adoptRef(new StructureChain(head)); }
         RefPtr<Structure>* head() { return m_vector.get(); }
-        bool isCacheable() const;
 
     private:
         StructureChain(Structure* head);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wscript b/src/3rdparty/webkit/JavaScriptCore/wscript
index 9dd37c960a..7a5ba1bca6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wscript
+++ b/src/3rdparty/webkit/JavaScriptCore/wscript
@@ -30,7 +30,7 @@ import commands
 from settings import *
 
 jscore_excludes = ['jsc.cpp', 'ucptable.cpp', 'GOwnPtr.cpp']
-jscore_excludes.extend(get_excludes(jscore_dir, ['*CF.cpp']))
+jscore_excludes.extend(get_excludes(jscore_dir, ['*CF.cpp', '*Symbian.cpp']))
 
 sources = []
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CrossThreadRefCounted.h b/src/3rdparty/webkit/JavaScriptCore/wtf/CrossThreadRefCounted.h
index 6a0521121e..f682f0d71d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/CrossThreadRefCounted.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CrossThreadRefCounted.h
@@ -70,10 +70,6 @@ namespace WTF {
             return !m_refCounter.hasOneRef() || (m_threadSafeRefCounter && !m_threadSafeRefCounter->hasOneRef());
         }
 
-#ifndef NDEBUG
-        bool mayBePassedToAnotherThread() const { ASSERT(!m_threadId); return m_refCounter.hasOneRef(); }
-#endif
-
     private:
         CrossThreadRefCounted(T* data, ThreadSafeSharedBase* threadedCounter)
             : m_threadSafeRefCounter(threadedCounter)
@@ -92,6 +88,10 @@ namespace WTF {
 
         void threadSafeDeref();
 
+#ifndef NDEBUG
+        bool isOwnedByCurrentThread() const { return !m_threadId || m_threadId == currentThread(); }
+#endif
+
         RefCountedBase m_refCounter;
         ThreadSafeSharedBase* m_threadSafeRefCounter;
         T* m_data;
@@ -103,7 +103,7 @@ namespace WTF {
     template<class T>
     void CrossThreadRefCounted<T>::ref()
     {
-        ASSERT(!m_threadId || m_threadId == currentThread());
+        ASSERT(isOwnedByCurrentThread());
         m_refCounter.ref();
 #ifndef NDEBUG
         // Store the threadId as soon as the ref count gets to 2.
@@ -119,7 +119,7 @@ namespace WTF {
     template<class T>
     void CrossThreadRefCounted<T>::deref()
     {
-        ASSERT(!m_threadId || m_threadId == currentThread());
+        ASSERT(isOwnedByCurrentThread());
         if (m_refCounter.derefBase()) {
             threadSafeDeref();
             delete this;
@@ -146,10 +146,12 @@ namespace WTF {
     template<class T>
     PassRefPtr<CrossThreadRefCounted<T> > CrossThreadRefCounted<T>::crossThreadCopy()
     {
+        ASSERT(isOwnedByCurrentThread());
         if (m_threadSafeRefCounter)
             m_threadSafeRefCounter->ref();
         else
             m_threadSafeRefCounter = new ThreadSafeSharedBase(2);
+
         return adoptRef(new CrossThreadRefCounted<T>(m_data, m_threadSafeRefCounter));
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
index a9472c98d5..6cd8ef055e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
@@ -379,6 +379,9 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 #include <stdarg.h>
 #include <stddef.h>
 #include <stdio.h>
+#if PLATFORM(UNIX)
+#include <unistd.h>
+#endif
 #if COMPILER(MSVC)
 #ifndef WIN32_LEAN_AND_MEAN
 #define WIN32_LEAN_AND_MEAN
@@ -391,6 +394,7 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 #if PLATFORM(DARWIN)
 #include "MallocZoneSupport.h"
 #include <wtf/HashSet.h>
+#include <wtf/Vector.h>
 #endif
 
 #ifndef PRIuS
@@ -2274,7 +2278,7 @@ static inline TCMalloc_PageHeap* getPageHeap()
 #define pageheap getPageHeap()
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-#if PLATFORM(WIN)
+#if PLATFORM(WIN_OS)
 static void sleep(unsigned seconds)
 {
     ::Sleep(seconds * 1000);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
index b23e7b0a1b..ca0961c967 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
@@ -213,6 +213,9 @@ using WTF::fastMallocAllow;
 // debug-only code to make sure we don't use the system malloc via the default operator
 // new by accident.
 
+// We musn't customize the global operator new and delete for the Qt port.
+#if !PLATFORM(QT)
+
 WTF_PRIVATE_INLINE void* operator new(size_t size) { return fastMalloc(size); }
 WTF_PRIVATE_INLINE void* operator new(size_t size, const std::nothrow_t&) throw() { return fastMalloc(size); }
 WTF_PRIVATE_INLINE void operator delete(void* p) { fastFree(p); }
@@ -224,4 +227,6 @@ WTF_PRIVATE_INLINE void operator delete[](void* p, const std::nothrow_t&) throw(
 
 #endif
 
+#endif
+
 #endif /* WTF_FastMalloc_h */
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ListRefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ListRefPtr.h
index d863226b01..8bf6447446 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ListRefPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ListRefPtr.h
@@ -44,6 +44,9 @@ namespace WTF {
         template <typename U> ListRefPtr& operator=(const PassRefPtr<U>& o) { RefPtr<T>::operator=(o); return *this; }
     };
 
+    // Remove inline for winscw compiler to prevent the compiler agressively resolving
+    // T::ref() in RefPtr<T>'s copy constructor.  The bug is reported at:
+    // https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
     template <typename T> 
 #if !COMPILER(WINSCW)
     inline
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
index 324300d3a1..556230eb8c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
@@ -102,6 +102,8 @@ inline bool signbit(double x) { struct ieee_double *p = (struct ieee_double *)&x
 
 #if COMPILER(MSVC) || COMPILER(RVCT)
 
+inline long long llround(double num) { return static_cast<long long>(num > 0 ? num + 0.5 : ceil(num - 0.5)); }
+inline long long llroundf(float num) { return static_cast<long long>(num > 0 ? num + 0.5f : ceil(num - 0.5f)); }
 inline long lround(double num) { return static_cast<long>(num > 0 ? num + 0.5 : ceil(num - 0.5)); }
 inline long lroundf(float num) { return static_cast<long>(num > 0 ? num + 0.5f : ceilf(num - 0.5f)); }
 inline double round(double num) { return num > 0 ? floor(num + 0.5) : ceil(num - 0.5); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
index 9fbfa85ef9..7151b51499 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
@@ -231,40 +231,94 @@
 #if   defined(arm) \
    || defined(__arm__)
 #define WTF_PLATFORM_ARM 1
+
 #if defined(__ARMEB__)
 #define WTF_PLATFORM_BIG_ENDIAN 1
-#elif !defined(__ARM_EABI__) && !defined(__EABI__) && !defined(__VFP_FP__)
+
+#elif !defined(__ARM_EABI__) \
+   && !defined(__EABI__) \
+   && !defined(__VFP_FP__)
 #define WTF_PLATFORM_MIDDLE_ENDIAN 1
+
 #endif
-#define ARM_ARCH_VERSION 3
-#if defined(__ARM_ARCH_4__) || defined(__ARM_ARCH_4T__) || defined(__MARM_ARMV4__) \
-    || defined(_ARMV4I_)
-#undef ARM_ARCH_VERSION
+
+/* Set ARM_ARCH_VERSION */
+#if   defined(__ARM_ARCH_4__) \
+   || defined(__ARM_ARCH_4T__) \
+   || defined(__MARM_ARMV4__) \
+   || defined(_ARMV4I_)
 #define ARM_ARCH_VERSION 4
-#endif
-#if defined(__ARM_ARCH_5__) || defined(__ARM_ARCH_5T__) \
-        || defined(__ARM_ARCH_5E__) || defined(__ARM_ARCH_5TE__) \
-        || defined(__ARM_ARCH_5TEJ__) || defined(__MARM_ARMV5__)
-#undef ARM_ARCH_VERSION
+
+#elif defined(__ARM_ARCH_5__) \
+   || defined(__ARM_ARCH_5T__) \
+   || defined(__ARM_ARCH_5E__) \
+   || defined(__ARM_ARCH_5TE__) \
+   || defined(__ARM_ARCH_5TEJ__) \
+   || defined(__MARM_ARMV5__)
 #define ARM_ARCH_VERSION 5
-#endif
-#if defined(__ARM_ARCH_6__) || defined(__ARM_ARCH_6J__) \
-     || defined(__ARM_ARCH_6K__) || defined(__ARM_ARCH_6Z__) \
-     || defined(__ARM_ARCH_6ZK__) || defined(__ARMV6__)
-#undef ARM_ARCH_VERSION
+
+#elif defined(__ARM_ARCH_6__) \
+   || defined(__ARM_ARCH_6J__) \
+   || defined(__ARM_ARCH_6K__) \
+   || defined(__ARM_ARCH_6Z__) \
+   || defined(__ARM_ARCH_6ZK__) \
+   || defined(__ARM_ARCH_6T2__) \
+   || defined(__ARMV6__)
 #define ARM_ARCH_VERSION 6
-#endif
-#if defined(__ARM_ARCH_7A__)
-#undef ARM_ARCH_VERSION
+
+#elif defined(__ARM_ARCH_7A__) \
+   || defined(__ARM_ARCH_7R__)
 #define ARM_ARCH_VERSION 7
+
+/* RVCT sets _TARGET_ARCH_ARM */
+#elif defined(__TARGET_ARCH_ARM)
+#define ARM_ARCH_VERSION __TARGET_ARCH_ARM
+
+#else
+#define ARM_ARCH_VERSION 0
+
 #endif
+
+/* Set THUMB_ARM_VERSION */
+#if   defined(__ARM_ARCH_4T__)
+#define THUMB_ARCH_VERSION 1
+
+#elif defined(__ARM_ARCH_5T__) \
+   || defined(__ARM_ARCH_5TE__) \
+   || defined(__ARM_ARCH_5TEJ__)
+#define THUMB_ARCH_VERSION 2
+
+#elif defined(__ARM_ARCH_6J__) \
+   || defined(__ARM_ARCH_6K__) \
+   || defined(__ARM_ARCH_6Z__) \
+   || defined(__ARM_ARCH_6ZK__) \
+   || defined(__ARM_ARCH_6M__)
+#define THUMB_ARCH_VERSION 3
+
+#elif defined(__ARM_ARCH_6T2__) \
+   || defined(__ARM_ARCH_7__) \
+   || defined(__ARM_ARCH_7A__) \
+   || defined(__ARM_ARCH_7R__) \
+   || defined(__ARM_ARCH_7M__)
+#define THUMB_ARCH_VERSION 4
+
+/* RVCT sets __TARGET_ARCH_THUMB */
+#elif defined(__TARGET_ARCH_THUMB)
+#define THUMB_ARCH_VERSION __TARGET_ARCH_THUMB
+
+#else
+#define THUMB_ARCH_VERSION 0
+#endif
+
 /* On ARMv5 and below the natural alignment is required. */
 #if !defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_ARCH_VERSION <= 5
 #define ARM_REQUIRE_NATURAL_ALIGNMENT 1
 #endif
+
 /* Defines two pseudo-platforms for ARM and Thumb-2 instruction set. */
 #if !defined(WTF_PLATFORM_ARM_TRADITIONAL) && !defined(WTF_PLATFORM_ARM_THUMB2)
-#  if defined(thumb2) || defined(__thumb2__)
+#  if defined(thumb2) || defined(__thumb2__) \
+  || ((defined(__thumb) || defined(__thumb__)) && THUMB_ARCH_VERSION == 4)
 #    define WTF_PLATFORM_ARM_TRADITIONAL 0
 #    define WTF_PLATFORM_ARM_THUMB2 1
 #  elif PLATFORM_ARM_ARCH(4)
@@ -805,6 +859,10 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #define WARN_UNUSED_RETURN
 #endif
 
+#if !ENABLE(NETSCAPE_PLUGIN_API) || (ENABLE(NETSCAPE_PLUGIN_API) && ((PLATFORM(UNIX) && (PLATFORM(QT) || PLATFORM(WX))) || PLATFORM(GTK)))
+#define ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 1
+#endif
+
 /* Set up a define for a common error that is intended to cause a build error -- thus the space after Error. */
 #define WTF_PLATFORM_CFNETWORK Error USE_macro_should_be_used_with_CFNETWORK
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
index 0e6e20830d..52fb13084e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
@@ -82,6 +82,23 @@ double randomNumber()
     return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
 #elif PLATFORM(WINCE)
     return genrand_res53();
+#elif PLATFORM(WIN_OS)
+    uint32_t part1 = rand() & (RAND_MAX - 1);
+    uint32_t part2 = rand() & (RAND_MAX - 1);
+    uint32_t part3 = rand() & (RAND_MAX - 1);
+    uint32_t part4 = rand() & (RAND_MAX - 1);
+    // rand only provides 15 bits on Win32
+    uint64_t fullRandom = part1;
+    fullRandom <<= 15;
+    fullRandom |= part2;
+    fullRandom <<= 15;
+    fullRandom |= part3;
+    fullRandom <<= 15;
+    fullRandom |= part4;
+
+    // Mask off the low 53bits
+    fullRandom &= (1LL << 53) - 1;
+    return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
 #else
     uint32_t part1 = rand() & (RAND_MAX - 1);
     uint32_t part2 = rand() & (RAND_MAX - 1);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
index 559e3f2ffe..1120d65473 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
@@ -75,12 +75,12 @@ inline char* strdup(const char* strSource)
 
 inline int strncasecmp(const char* s1, const char* s2, size_t len)
 {
-    return strnicmp(s1, s2, len);
+    return _strnicmp(s1, s2, len);
 }
 
 inline int strcasecmp(const char* s1, const char* s2)
 {
-    return stricmp(s1, s2);
+    return _stricmp(s1, s2);
 }
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
index d777424546..b635a451d5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
@@ -1400,14 +1400,6 @@ void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const
     }
 }
 
-int executeRegex(RegexCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output, int outputArraySize)
-{
-    if (JSRegExp* fallback = jitObject.getFallback())
-        return (jsRegExpExecute(fallback, input, length, start, output, outputArraySize) < 0) ? -1 : output[0];
-
-    return jitObject.execute(input, start, length, output);
-}
-
 }}
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
index 5b0df9dde0..1872f21009 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
@@ -82,7 +82,14 @@ private:
 };
 
 void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase = false, bool multiline = false);
-int executeRegex(RegexCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output, int outputArraySize);
+
+inline int executeRegex(RegexCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output, int outputArraySize)
+{
+    if (JSRegExp* fallback = jitObject.getFallback())
+        return (jsRegExpExecute(fallback, input, length, start, output, outputArraySize) < 0) ? -1 : output[0];
+
+    return jitObject.execute(input, start, length, output);
+}
 
 } } // namespace JSC::Yarr
 
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 7f50b5cc53..488c6a0f90 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,8 +4,8 @@ This is a snapshot of the Qt port of WebKit from
 
 The commit imported was from the
 
-        qtwebkit-4.6-snapshot-30092009-2 branch/tag
+        qtwebkit-4.6-snapshot-22102009 branch/tag
 
 and has the sha1 checksum
 
-        284ebfc0df42d408d99838507c1ed335fba9bcf0
+        0639bb8e812c8923287cd5523248ca64fa5f7a50
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 493a64d1e5..4e5dff8527 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,3 +1,4124 @@
+2009-10-20  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Set EnabledAtRuntime for WebSocket in DOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=29896
+
+        Supported by chromium/v8 only.
+        Add WebSocket::isAvailable()/setIsAvailable(bool) to control v8
+        bindings.
+        Remove Settings::experimentalWebSocketsEnabled() and
+        setExperimentalWebSocketsEnabled(bool).
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::setIsAvailable):
+        (WebCore::WebSocket::isAvailable):
+        * websockets/WebSocket.h:
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION: Dromaeo DOM test is 14% slower
+        https://bugs.webkit.org/show_bug.cgi?id=30273
+
+        Whoops, make prototype bindings actually use the StructureFlags.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-10-19  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Better implementation of WebCore::ScriptString for the V8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29909
+
+        WebCore::ScriptString is used for XMLHttpRequest's responseText attribute which is
+        shared with JavaScript.  Thus, simply using a WebCore::String and copying the value
+        is pretty inefficient, especially since responseText is built up with a sequence of
+        operator+= calls.  JSC builds use a JSC::UString to share the buffer when possible,
+        this patch adopts a similar approach for V8.
+
+        No new tests, behavior is unchanged and covered by LayoutTests/http/tests/xmlhttprequest
+
+        * WebCore.gypi:
+        * bindings/v8/ScriptString.h:
+        (WebCore::ScriptString::ScriptString):
+        (WebCore::ScriptString::operator String):
+        (WebCore::ScriptString::isNull):
+        (WebCore::ScriptString::size):
+        (WebCore::ScriptString::operator=):
+        (WebCore::ScriptString::operator+=):
+        (WebCore::ScriptString::v8StringOrNull):
+        * bindings/v8/ScriptStringImpl.cpp: Added.
+        (WebCore::ScriptStringImpl::ScriptStringImpl):
+        (WebCore::ScriptStringImpl::~ScriptStringImpl):
+        (WebCore::ScriptStringImpl::toString):
+        (WebCore::ScriptStringImpl::isNull):
+        (WebCore::ScriptStringImpl::size):
+        (WebCore::ScriptStringImpl::append):
+        * bindings/v8/ScriptStringImpl.h: Added.
+        (WebCore::ScriptStringImpl::ScriptStringImpl):
+        (WebCore::ScriptStringImpl::v8StringHandle):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r49837.
+        http://trac.webkit.org/changeset/49837
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setStandardFontFamily):
+        (WebCore::Settings::setFixedFontFamily):
+        (WebCore::Settings::setSerifFontFamily):
+        (WebCore::Settings::setSansSerifFontFamily):
+        (WebCore::Settings::setCursiveFontFamily):
+        (WebCore::Settings::setFantasyFontFamily):
+        * page/Settings.h:
+        (WebCore::Settings::standardFontFamily):
+        (WebCore::Settings::fixedFontFamily):
+        (WebCore::Settings::serifFontFamily):
+        (WebCore::Settings::sansSerifFontFamily):
+        (WebCore::Settings::cursiveFontFamily):
+        (WebCore::Settings::fantasyFontFamily):
+        * platform/text/UScriptCode.h: Removed.
+
+2009-10-19  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Check COMPILER(MSVC) instead of PLATFORM(WIN_OS) to avoid the use of vasprintf.
+        https://bugs.webkit.org/show_bug.cgi?id=30473
+
+        vasprintf is missing in MSVC. Use COMPILER(MSVC) guards instead of
+        PLALTFORM(WIN_OS) guards.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::error):
+
+2009-10-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20797
+
+        Make generic font family getters/setters accept an additional
+        argument (script code). It has a default value so that if an embedder
+        does not have/want a per-script font family setting, call-sites
+        don't have to be changed.
+        This is to prepare for fixing bug 10874 (font selection is not
+        language-dependent) and bug 18085.
+
+        There should be no change in layout and no new layout test
+        is added.
+
+        * WebCore.base.exp:
+        * page/Settings.cpp:
+        * page/Settings.h:
+        * platform/text/UScriptCode.h: Added. This is for ports that
+          do not use ICU. the part of ICU's common/unicode/uscript.h
+          that defines script code enum was copied. To keep enums compatible
+          with those in ICU, we don't generate the list out of Scripts.txt
+          of the Unicode Data base or CLDR's data.
+
+2009-10-19  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Clarify usage of SuddenTermination API. No code change.
+
+        * platform/SuddenTermination.h:
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: Dromaeo DOM test is 14% slower
+        https://bugs.webkit.org/show_bug.cgi?id=30273
+
+        Make DOM bindings automatically inherit correct structure
+        flags rather than being needlessly conservative.  This is
+        done by making the bindings generator use the same model
+        for TypeInfo flags that we now use in JSC.
+
+        This gains us about 1% of this regression back.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-19  Robin Qiu  <robin.qiu@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fixed a bug on nested SVG <use> elements.
+        https://bugs.webkit.org/show_bug.cgi?id=26117
+        When a <use> element refer to another <use> element which has
+        child/children, the instance tree built for this <use> element
+        is incorrect (more nodes than expected).
+
+        Test: svg/dom/use-on-use-with-child.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildInstanceTree):
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Small changes to fully invalidate and update the JavaScriptCallFrame.
+
+        <rdar://problem/7020755> JSDebugger crashes after reloading from a breakpoint
+        https://bugs.webkit.org/show_bug.cgi?id=27146
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/JavaScriptCallFrame.h:
+        (WebCore::JavaScriptCallFrame::invalidate):
+        (WebCore::JavaScriptCallFrame::update):
+
+2009-10-19  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        Remove "source" from storage events
+        https://bugs.webkit.org/show_bug.cgi?id=30536
+
+        Remove "source" from storage events per
+        http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
+
+        This was removed because it makes it introduces synchronous access that can
+        cross the event loop boundry (since a storage event can fire from one process
+        and be handled in another).
+
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::StorageEvent):
+        (WebCore::StorageEvent::initStorageEvent):
+        * storage/StorageEvent.h:
+        (WebCore::StorageEvent::uri):
+        * storage/StorageEvent.idl:
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ResourceLoadNotifier::activeDocumentLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30533
+
+        Removing this method from ResourceLoadNotifier better decouples the
+        notifier from FrameLoader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::requestFromDelegate):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        * loader/ResourceLoadNotifier.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move sendRemainingDelegateMessages to ResourceLoadNotifier
+        https://bugs.webkit.org/show_bug.cgi?id=30531
+
+        This method is about notifying folks and doesn't interact with the rest
+        of FrameLoader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
+        * loader/FrameLoader.h:
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::sendRemainingDelegateMessages):
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bypass popup blocker using click event
+        https://bugs.webkit.org/show_bug.cgi?id=21501
+
+        Keep track of which events were generated by JavaScript and use that
+        inforation when figuring out if we're processing a user gesture.
+
+        Test: http/tests/security/popup-blocked-from-fake-event.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGestureEvent):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent):
+        * dom/Event.cpp:
+        (WebCore::Event::Event):
+        * dom/Event.h:
+        (WebCore::Event::createdByDOM):
+        (WebCore::Event::setCreatedByDOM):
+
+2009-10-19  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fixing a typo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30543
+
+        * platform/sql/SQLiteDatabase.h:
+
+2009-10-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Manual Test for crash caused by JS accessing DOMWindow which is disconnected from the Frame.
+        https://bugs.webkit.org/show_bug.cgi?id=30544
+
+        * manual-tests/crash-on-accessing-domwindow-without-frame.html: Added.
+
+2009-10-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Flash at end of opacity/transform transition sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=30501
+        
+        When a transition finishes, there window of time between when the animation is
+        removed, and the final style set on the GraphicsLayer. This caused the layer to revert
+        to its old appearance for one or two frames. To avoid this, we set the final
+        transform or opacity at the start of the transition; we know that the animation
+        will override the final value for as long as its running.
+        
+        No test because this is a very transient effect that can't be captured
+        in a test.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateLayerOpacity):
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::startTransition):
+        * rendering/RenderLayerBacking.h:
+
+2009-10-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add more stop characters into console completions.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30477
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+
+2009-10-19  Marshall Culpepper  <mculpepper@appcelerator.com>
+
+        Reviewed by Adam Roben.
+
+        implemented ClipboardWin::files()
+        https://bugs.webkit.org/show_bug.cgi?id=29666
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::files):
+
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add support for link relations in HTMLAnchorElement and implement rel="noreferrer".
+
+        https://bugs.webkit.org/show_bug.cgi?id=28986
+
+        Tests: http/tests/navigation/no-referrer-reset.html
+               http/tests/navigation/no-referrer-same-window.html
+               http/tests/navigation/no-referrer-subframe.html
+               http/tests/navigation/no-referrer-target-blank.html
+
+        * WebCore.base.exp: Update FrameLoader::loadFrameRequest export symbol
+        * html/HTMLAnchorElement.cpp: Add support for link relations and implement noreferrer
+        (WebCore::HTMLAnchorElement::HTMLAnchorElement):
+        (WebCore::HTMLAnchorElement::defaultEventHandler):
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        (WebCore::HTMLAnchorElement::hasRel):
+        (WebCore::HTMLAnchorElement::setRel):
+        * html/HTMLAnchorElement.h: Add support for link relations and implement noreferrer
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::createWindow):
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected): Add parameter for referrer policy
+        (WebCore::FrameLoader::loadFrameRequest): Add parameter for referrer policy
+        (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy): Suppress opener if requested by ReferrerPolicy
+        * loader/FrameLoader.h: Update urlSelected and loadFrameRequest prototypes
+        * loader/FrameLoaderTypes.h: Add enum for referrer policy
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected): Update call to urlSelected()
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::defaultEventHandler): Update call to urlSelected()
+
+
+2009-10-19  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Dimitri Glazkov (dglazkov@chromium.org).
+
+        [v8] typeof(HTMLMediaElement) should return undefined if media
+        engine is not available
+        https://bugs.webkit.org/show_bug.cgi?id=30343
+
+        Check for availability of the media engine to disable
+        HTMLMediaElement, HTMLAudioElement, HTMLVideoElement, MediaError
+        in runtime.
+
+        Try runs and review in Chromium:
+        http://codereview.chromium.org/276011
+
+        Test: manual-tests/chromium/media-player-not-available.html
+
+        The above test can work work in Chromium. Testing procedures:
+        1. Remove all media support libraries in Chromium (e.g. ffmpeg libraries)
+        2. Open Chromium with above test page
+        3. Verify the test results according to the test page
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Declare enabler methods.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        Report enabled only if media player is available.
+        * manual-tests/chromium/media-player-not-available.html: Added.
+        Manual test, following instruction in this test for procedures.
+        * page/DOMWindow.idl:
+        Mark HTMLMediaElement, HTMLAudioElement, HTMLVideElement, MediaError
+        as enabled at runtime.
+
+2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Refactor out some of the code in paint() into paintPanScrollIcon()
+        and paintScrollbars() in preparation of some Qt API changes.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::paint):
+        * platform/ScrollView.h:
+
+2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Make the local static panScrollIcon into a Image* instead
+        of a RefPtr<Image>.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+
+2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by David Levin.
+
+        Forcefully set antialiasing for Chromium media controls.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30521
+
+        Before it was nondeterministiacally being enabled based on the previous state of GraphicsContext.
+
+        Covered by existing layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Added setShouldAntialias(true).
+
+2009-10-19  Jens Alfke  <jens@mooseyard.com>
+
+        Reviewed by Darin Adler.
+
+        Optimize string upper/lowercasing
+        https://bugs.webkit.org/show_bug.cgi?id=30261
+        
+        - Added AtomicString::upper() and lower()
+        - Further optimized StringImpl::lower()
+        - Removed StringImpl::isLower()
+        - Added QualifiedName::localNameUpper(), which is cached, thereby saving
+          thousands of upper() calls and string allocations.
+ 
+         * dom/Element.cpp:
+         (WebCore::Element::setAttribute): Call AtomicString::lower()
+         * dom/QualifiedName.cpp:
+         (WebCore::QualifiedName::localNameUpper): New method
+         * dom/QualifiedName.h: Added localNameUpper() method
+         * dom/StyledElement.cpp:
+         (WebCore::StyledElement::parseMappedAttribute):  Call AtomicString::lower()
+         * html/HTMLDocument.cpp:
+         (WebCore::HTMLDocument::createElement): Call AtomicString::lower()
+         * html/HTMLElement.cpp:
+         (WebCore::HTMLElement::nodeName): Call localNameUpper()
+         * platform/text/AtomicString.cpp:
+         (WebCore::AtomicString::lower): New method
+         (WebCore::AtomicString::upper): New method
+         * platform/text/AtomicString.h: Added lower() and upper()
+         * platform/text/StringImpl.cpp: Removed isLower()
+         (WebCore::StringImpl::lower): Further optimization of initial loop
+         * platform/text/StringImpl.h: Removed isLower()
+ 
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        If a call to a plugin's invokeMethod, invokeDefault or construct
+        returns false, throw an exception into JS.        
+
+        https://bugs.webkit.org/show_bug.cgi?id=30239
+
+        Test: plugins/netscape-invoke-failure.html
+
+        * bindings/v8/V8NPObject.cpp: Check return values of invokeMethod, invokeDefault and construct.
+        (npObjectInvokeImpl):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod): Check return value
+        (JSC::Bindings::CInstance::invokeDefaultMethod): Check return value
+        (JSC::Bindings::CInstance::invokeConstruct): Check return value
+
+2009-10-16  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix for chromium/skia canvas arc start/end positions, when the arc is
+        >= 360 degrees.
+        https://bugs.webkit.org/show_bug.cgi?id=30449
+
+        Covered by new test:
+        LayoutTests/fast/canvas/arc360.html
+
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::addArc):
+
+2009-10-19  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix uninitialized variable reference in Element::removeAttribute().
+        https://bugs.webkit.org/show_bug.cgi?id=30502
+
+        * dom/Element.cpp:
+        (WebCore::Element::removeAttribute):
+
+2009-10-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30463
+        Remove HTML5 media element 'loadend' event
+
+        * dom/EventNames.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute): Remove 'loadend'.
+        (WebCore::HTMLMediaElement::loadInternal): Ditto.
+        (WebCore::HTMLMediaElement::noneSupported): Ditto.
+        (WebCore::HTMLMediaElement::mediaEngineError): Ditto.
+        (WebCore::HTMLMediaElement::setNetworkState): Ditto.
+        (WebCore::HTMLMediaElement::userCancelledLoad): Ditto.
+
+2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Remove deletion of outgoing FormData object when reply is finished.
+        The buffers will be destroyed a bit later, when the QNetworkReply is deleted.
+        Bug: https://bugs.webkit.org/show_bug.cgi?id=29551
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2009-10-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix hard-to-reproduce crash in HTMLTokenizer by avoiding a rare
+        fastRealloc edge case.
+        https://bugs.webkit.org/show_bug.cgi?id=29313
+
+        No test, the crash shows up occasionally in crash dumps, we weren't able
+        to reproduce it locally.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::enlargeScriptBuffer): Added an early exit to
+            avoid calling fastRealloc with the size of 0.
+
+2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Use fillRect() instead of drawRect() to fix Chromium media controls rendering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30371
+
+        Chromium Mac layout tests will need to be rebaselined.  Existing layout tests for Linux/Win still pass.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Use fillRect() instead of drawRect().
+
+2009-10-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Crash in DOMWindow::clearTimeout etc when DOMWindow is not connected to a frame.
+        https://bugs.webkit.org/show_bug.cgi?id=29832
+
+        Need to make sure the script caches are reset when frame gets disconnected from still-alive DOMWindow.
+        This will prevent JS from calling DOMWindow methods that can not be completed w/o the frame.
+
+        I am not sure it's possible to test this since the only file that repros the problem need ~10 seconds to cause crash.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::~Frame): Right after frame disconnects from DOMWindow, clear WindowShell.
+
+2009-10-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed build warning fix.
+        [Qt] Apply changes to WebCore.pro introduced in r49778
+
+        * WebCore.pro: Removed svg/graphics/filters/SVGFEGaussianBlur.h from HEADERS
+
+2009-10-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move feGaussianBlur from WebCore/svg to WebCore/platform
+        [https://bugs.webkit.org/show_bug.cgi?id=30495]
+
+        This patch moves SVGFRGaussianBlur from svg/graphics/filters
+        to platform/graphics/filters/FEGaussianBlur. This is needed
+        for shadow support on Qt and Cairo.
+        No change in functionality, therfore no new test case needed.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FEGaussianBlur.cpp: Added.
+        * platform/graphics/filters/FEGaussianBlur.h: Added.
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp: Removed.
+        * svg/graphics/filters/SVGFEGaussianBlur.h: Removed.
+
+2009-10-19  Yael Aharon  <yael.aharon@nokia.com>
+
+        Unreviewed.
+
+        Added reviewer name to r49574.
+
+2009-10-19  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30489
+        [Gtk] The document frame/html container claims to be parentless
+
+        Work around for the parentless claim made by the accessible associated
+        with the embedded WebView. When we identify this condition, get the
+        widget's parent, and then get the AtkObject from that. Admittedly an ugly
+        hack, but we'll need it for Yelp and other Gtk+/GNOME applications which
+        plan to switch over to WebKit.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+
+2009-10-19  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        Handle duration queries properly
+        https://bugs.webkit.org/show_bug.cgi?id=29999
+
+        Previously duration queries failed to handle unknown duration
+        and didn't treat the returned duration as an unsigned.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix build on Windows.
+
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Don't crash when client is 0.
+        
+        Client is 0 when we use QWebPage without a QWebView or QGraphicsWebView.
+        In addition, setFrameRect()/updatePluginWidget() is called even if the
+        plugin was not succesfully loaded. updatePluginWidget() updates the
+        window rect which is, in theory, useful to draw something that indicates
+        that we didn't load successfully.
+        
+        So, a status check is added to setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30380
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Fix crash when QWebPage is deleted after QWebView.
+        
+        Fixes various sources of crashes:
+        1. The PluginContainer is a child of QWebView. When the view gets deleted,
+        the PluginView is not notified about the deletion of PluginContainer.
+        2. QWebView destructor does not set client to 0.
+        3. Sometimes pending paint events are sent after the plugin has died, so add
+        a check in PluginView::setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30354
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::~PluginContainerQt):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-19  Jakob Truelsen  <antialize@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+        Allow one to customize the minimal and maximal shrink factors used when printing.
+
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::begin):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setPrintingMinimumShrinkFactor):
+        (WebCore::Settings::setPrintingMaximumShrinkFactor):
+        * page/Settings.h:
+        (WebCore::Settings::printingMinimumShrinkFactor):
+        (WebCore::Settings::printingMaximumShrinkFactor):
+
+2009-10-18  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fixes issue where doubleclicking a word could select following adjacent newlines.
+        https://bugs.webkit.org/show_bug.cgi?id=30234
+
+        Tests: platform/mac/editing/selection/doubleclick-should-not-expand-across-lines.html
+               platform/mac/editing/selection/script-tests/TEMPLATE.html
+               platform/win/editing/selection/doubleclick-should-not-expand-across-lines.html
+               platform/win/editing/selection/script-tests/TEMPLATE.html
+
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::appendTrailingWhitespace):
+
+2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        CURL build fix, use proper header name.
+
+        * platform/network/curl/ResourceHandleManager.h:
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Properties on Arrays and NodeLists are not logged correctly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30485
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray):
+        (WebInspector.ConsoleView.prototype._printArray):
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: touching WebCore so that it
+        initiated inspector frontend deployment on Windows.
+
+        Web Inspector: frontend files are not deployed in Windows
+        incremental build.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::unbind):
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Title of dir(["test", "test2"]) should be Array
+
+        https://bugs.webkit.org/show_bug.cgi?id=30486
+
+        Test: inspector/console-tests.html
+
+        * inspector/front-end/InjectedScript.js:
+
+2009-10-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        REGRESSION: SVG Mask doesn't work for maskContentUnits="objectBoundingBox"
+        [https://bugs.webkit.org/show_bug.cgi?id=30480]
+
+        Patch for SVGMaskElement landed in r49598 should correct the location of
+        the mask image graphics context. It only corrects the location for userSpaceOnUse
+        mode in maskContentUnits but breaks objectBoundingBoxMode.
+        The maskDestRect shouldn't be moved. It is not responsible for the correct context
+        postioin but for the correct position of the mask image.
+        This patch calculates the context postion independently from the maskDestRect.
+        It also uses lineareRGB color space for masking on CG now. This is the default
+        color space for masking operations.
+        We already have tests for both maskContentUnits modes.
+
+            *svg/W3C-SVG-1.1/masking-intro-01-f.svg
+            *svg/custom/mask-with-default-value.svg
+
+        Some tests needed new pixel tests because of the new color space.
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-10-18  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Use v8::Integer::NewFromUnsigned when converting unsigneds into V8's numbers.
+        That is notably faster for small numbers (most common case).
+        https://bugs.webkit.org/show_bug.cgi?id=30493
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [GTK] Add MathML to the build system
+        https://bugs.webkit.org/show_bug.cgi?id=30487
+
+        Add MathML sources if MathML support is enabled.
+
+        * GNUmakefile.am:
+
+2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Non-PCH build fix. Added missing header.
+
+        * bridge/runtime_root.h:
+
+2009-10-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Compositing layers not correctly updated after partial layout
+        https://bugs.webkit.org/show_bug.cgi?id=30425
+        
+        When a partial layout happened, for example as the result of a postion-change-only
+        layout, then some compositing layer positions were not correctly updated. To fix
+        this, updateLayerPositions() now carries along a flag that is set at the rootmost
+        layer being updated, and used to determine when we hit the first compositing layer
+        in this update. RenderLayerBacking::updateAfterLayout() makes use of this information
+        to do a full geometry update on that layer, which is thus the rootmost compositing
+        layer that is being updated.
+
+        Test: compositing/geometry/partial-layout-update.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        * rendering/RenderLayerBacking.h:
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Add support for proxies in CURL.
+ 
+        https://bugs.webkit.org/show_bug.cgi?id=30446
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::setProxyInfo):
+        (WebCore::ResourceHandleManager::initializeHandle):
+        * platform/network/curl/ResourceHandleManager.h:
+        (WebCore::ResourceHandleManager::):
+
+2009-10-18  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez
+
+        https://bugs.webkit.org/show_bug.cgi?id=25901
+        Use ATK_ROLE_SECTION for divTag and ATK_ROLE_LABEL for labelTag
+
+        Replaces the use of ATK_ROLE_PANEL with the expected accessible roles.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_role):
+
+2009-10-17  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Cleanup SVGElement code, preparing for animVal support
+        https://bugs.webkit.org/show_bug.cgi?id=30466
+
+        Add new SynchronizablePropertyController and move the code for SVG property <-> XML attribute synchronization
+        from SVGElement. This is a further preparation for animVal support, where SynchronizablePropertyController will
+        be used to control the start/end state of an animated property.
+
+        We're currently tracking animated properties that need synchronization, generalize this concept and use
+        it to track their creation (bound to certain SVG*Element classes) as well as a flag determing the need
+        of synchronization (no SVG DOM object wrappers, no synchronization needed).
+
+        No change in functionality, thus no tests.
+
+        * GNUmakefile.am: Add 'SynchronizablePropertyController.cpp/h' to build
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * svg/SVGAllInOne.cpp: Ditto.
+        * svg/SVGAnimatedProperty.h: Add registerProperty() function 
+        (WebCore::::SVGAnimatedProperty): Call registerProperty() function  
+        (WebCore::::registerProperty): Add new registerProperty() function, announcing new properties to SynchronizablePropertyController.
+        * svg/SVGAnimatedTemplate.h: Use propertyController() method, to access the new functions moved from SVGElement.
+        (WebCore::lookupOrCreateWrapper):
+        * svg/SVGElement.cpp: Adapt to code moving to SynchronizablePropertyController.
+        (WebCore::SVGElement::updateAnimatedSVGAttribute):
+        * svg/SVGElement.h: Move handling SVG property synchronization to SynchronizablePropertyController.
+        (WebCore::SVGElement::propertyController): Expose reference to SynchronizablePropertyController object.
+        * svg/SVGViewSpec.cpp: Reorder initialization order of contextElement, leading to possible crashes.
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        (WebCore::SVGViewSpec::viewTarget):
+        * svg/SVGViewSpec.h: Ditto.
+        (WebCore::SVGViewSpec::contextElement):
+        * svg/SynchronizablePropertyController.cpp: Added.
+        (WebCore::SynchronizablePropertyController::SynchronizablePropertyController):
+        (WebCore::SynchronizablePropertyController::registerProperty):
+        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
+        (WebCore::SynchronizablePropertyController::synchronizeProperty):
+        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
+        (WebCore::SynchronizablePropertyController::startAnimation):
+        (WebCore::SynchronizablePropertyController::stopAnimation):
+        * svg/SynchronizablePropertyController.h: Added.
+        (WebCore::SynchronizableProperty::SynchronizableProperty):
+        (WebCore::SynchronizableProperty::isHashTableDeletedValue):
+        (WebCore::SynchronizableProperty::operator==):
+        (WebCore::SynchronizablePropertyHash::hash):
+        (WebCore::SynchronizablePropertyHash::equal):
+        (WebCore::SynchronizablePropertyHashTraits::constructDeletedValue):
+        (WebCore::SynchronizablePropertyHashTraits::isDeletedValue):
+
+2009-10-17  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25413
+        [GTK] Please expose the level of headings
+
+        Exposes the heading level as an attribute of the AtkObject.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (addAttributeToSet):
+        (webkit_accessible_get_attributes):
+        (webkit_accessible_class_init):
+
+2009-10-17  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        EventHandler::eventLoopHandleMouseDragged needs ENABLE(DRAG_SUPPORT) guards
+        https://bugs.webkit.org/show_bug.cgi?id=30472
+
+        Put ENABLE(DRAG_SUPPORT) guards around EventHandler::eventLoopHandleMouseDragged
+        in EventHandler.cpp. MSVC fails to compile when DRAG_SUPPORT not enabled.
+
+        * page/EventHandler.cpp:
+
+2009-10-17  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] Video controls not zoomed / transformed correctly
+        https://bugs.webkit.org/show_bug.cgi?id=30461
+
+        Draw the images in the controls scaled.
+
+        No new tests. With this change Chromium will pass the following tests:
+        LayoutTests/media/video-controls-zoomed.html
+        LayoutTests/media/video-controls-transformed.html
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaButton):
+        Pass along the target rect directly.
+        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
+        Adjust the thumb slide applied with the scale factor.
+
+2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Gtk] Build fix for WebKitGtk after r49723.
+
+        Add bindings/js/JSExceptionBase.* to the build.
+
+        * GNUmakefile.am:
+
+2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r49723.
+
+        Add bindings/js/JSExceptionBase.cpp to the build.
+
+        * WebCore.pro:
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30456
+        Fixes for new Debug_All Windows build configuration.
+
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::findCFNetworkModule): Ask for the correct library instead of guessing.
+        * platform/win/ScrollbarThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+        * rendering/RenderMediaControls.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+        * rendering/RenderThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+
+2009-10-16  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to determine whether a plug-in has ever been halted.
+
+        Part of <rdar://problem/7312158>.
+
+        Reviewed by Dan Bernstein.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        Initialize m_hasBeenHalted.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::hasBeenHalted):
+        Return m_hasBeenHalted.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+        Set m_hasBeenHalted.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        @charset rule after the first byte causes the rest of css to be ignored
+        https://bugs.webkit.org/show_bug.cgi?id=18265
+
+        Apparently we're supposed to tolerate whitespace before the charset
+        rule so folks can write code like this:
+
+        <style>
+        @charset "utf-8"
+        ...
+        </style>
+
+        I'm told this is one of the top compatability problems in China.
+        Tests: fast/css/comment-before-charset-external.html
+               fast/css/comment-before-charset.html
+               fast/css/many-spaces-before-charset.html
+               fast/css/space-before-charset-external.html
+               fast/css/space-before-charset.html
+
+        * css/CSSGrammar.y:
+
+2009-10-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes part of <http://webkit.org/b/30412>.
+        Web Inspector should get human readable DOM Exceptions.
+
+        Add a description field to ExceptionBase, and call it through 
+        reportException which allows the user/developer to get a more detailed
+        and coherent error explanation through the Web Inspector.
+
+        This only applies to exceptions that come from a script on the page when
+        it is run. DOM Exceptions that come from the code run in the console, or DOM
+        exceptions that are caught and logged will come in a future patch.
+
+        Tests: inspector/uncaught-dom1-exception.html
+               inspector/uncaught-dom3-exception.html
+               inspector/uncaught-dom8-exception.html
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::reportException):
+        * bindings/js/JSExceptionBase.cpp: Added.
+        (WebCore::toExceptionBase):
+        * bindings/js/JSExceptionBase.h: Added.
+        * dom/ExceptionBase.cpp:
+        (WebCore::ExceptionBase::ExceptionBase):
+        * dom/ExceptionBase.h:
+        (WebCore::ExceptionBase::description):
+        * dom/ExceptionCode.cpp:
+        (WebCore::):
+        (WebCore::getExceptionCodeDescription):
+        * dom/ExceptionCode.h:
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: forgot to check in this #include.
+
+        * bridge/runtime_root.h:
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transform layer gets stuck with the wrong transform after an animation ends
+        <rdar://problem/7311662>
+
+        Work around a CoreAnimation bug which causes an animated transform layer to
+        end up with a stale transform.
+        
+        Test: compositing/animation/state-at-end-event-transform-layer.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::bug7311367Workaround):
+        (WebCore::GraphicsLayerCA::removeAnimationFromLayer):
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        After running a transition with an end event listener, can't change the transform
+        https://bugs.webkit.org/show_bug.cgi?id=30454
+        
+        Fix an issue where, if a document had any listener for webkitTransitionEnd or webkitAnimationEnd,
+        the animations would not get cleaned up correctly, which broke subsequent changes of transform.
+        
+        Now, we always clean up the animations right after queuing up the end events.
+
+        Tests: animations/state-at-end-event.html
+               transitions/move-after-transition.html
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::onAnimationEnd):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::onAnimationEnd):
+
+2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Handle the Enter Key in the Elements Tree Hierarchy
+        https://bugs.webkit.org/show_bug.cgi?id=30428
+
+        TextNode => Edit Text Node
+        Has Attributes => Edit First Attribute
+        No Attributes => Start Editing New Attribute
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent): handle the "Enter" key
+        (WebInspector.ElementsTreeElement.prototype.set hovered): only add new attribute button on nodes with attributes
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute): prevent moving backwards where there are no attributes
+        (WebInspector.ElementsTreeElement.prototype._startEditingFromEvent): renamed to be clearer
+        (WebInspector.ElementsTreeElement.prototype._startEditing): transition to the appropriate edit state for a tree element
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix header indent style for FrameLoader and friends
+        https://bugs.webkit.org/show_bug.cgi?id=30430
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::frame):
+        (WebCore::FrameLoader::policyChecker):
+        (WebCore::FrameLoader::history):
+        (WebCore::FrameLoader::notifier):
+        (WebCore::FrameLoader::isLoadingMainResource):
+        (WebCore::FrameLoader::documentLoader):
+        (WebCore::FrameLoader::policyDocumentLoader):
+        (WebCore::FrameLoader::provisionalDocumentLoader):
+        (WebCore::FrameLoader::state):
+        (WebCore::FrameLoader::client):
+        (WebCore::FrameLoader::url):
+        (WebCore::FrameLoader::isLoadingFromCachedPage):
+        (WebCore::FrameLoader::committingFirstRealLoad):
+        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
+        (WebCore::FrameLoader::creatingInitialEmptyDocument):
+        * loader/HistoryController.h:
+        (WebCore::HistoryController::currentItem):
+        (WebCore::HistoryController::provisionalItem):
+        * loader/PolicyCallback.h:
+        (WebCore::PolicyCallback::request):
+        * loader/PolicyChecker.h:
+        (WebCore::PolicyChecker::loadType):
+        (WebCore::PolicyChecker::setLoadType):
+        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
+        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
+        * loader/RedirectScheduler.h:
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a Debug_All configuration to build entire stack as debug.
+        Change Debug_Internal to:
+        - stop using _debug suffix for all WebKit/Safari binaries
+        - not use _debug as a DLL naming suffix
+        - use non-debug C runtime lib.
+
+        * WebCore.vcproj/QTMovieWin.vcproj: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.make: Debug build in makefile should build Debug_All.
+        * WebCore.vcproj/WebCore.sln: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.submit.sln: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.vcproj: Add Debug_All configuration.
+        * WebCore.vcproj/WebCoreGenerated.vcproj: Renamed single configuration from "Release" to "all".
+
+2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49693, because it broke Chromium build.
+        http://trac.webkit.org/changeset/49693
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Updated media resource selection algorithm to reflect latest HTML 5 specification.
+
+        Noticable changes:
+            -  Elements with no source should have their network state set to NETWORK_EMPTY as opposed to NETWORK_NO_SOURCE
+            -  Empty string ("") is now considered a valid URL resolving to the current page and will be loaded
+
+        Tests: media/video-src-empty.html
+               media/video-src-none.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=30407
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectMediaResource): Updated code and comments to match spec.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Insecure plug-ins don't trigger mixed content
+        https://bugs.webkit.org/show_bug.cgi?id=30431
+
+        Added the missing check.
+
+        Test: http/tests/security/mixedContent/insecure-plugin-in-iframe.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadPlugin):
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Set autobuffer to true and schedule load in V8 audio element constructor.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30448
+
+        Covered by existing tests.
+
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Set autobuffer to true and schedule load.
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove FIXME in RenderMediaControlsChromium as bug was fixed upstream.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30422
+
+        Covered by existing media layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Removed round() and FIXME.
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix Chromium media controls to render a disabled play button when the element is unintialized.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30410
+
+        Covered by existing layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaPlayButton): Include check for NETWORK_EMPTY to render disabled play button.
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Last part -- replace HasDefaultGetPropertyNames with OverridesGetPropertyNames
+        flag.
+
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-16  Steven Knight  <sgk@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30447
+        Handle long link lines by building .idl-generated bindings in a
+        separate webcore_bindings library target.  Avoid Visual Studio
+        dependency issues by building additional generated .cpp and .h files
+        in a separate webcore_bindings_sources target.
+
+        Chrome should still build and test successfully.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Transform transitions that used to be accelerated are no longer so
+        https://bugs.webkit.org/show_bug.cgi?id=30453
+
+        The change in r49633, to not run accelerated animations/transitions on layers that
+        are not attached, broke accelerated transitions/animations in many cases where they start
+        as soon as the page loads. This change reverts the code that tests for the GraphicsLayer being
+        attached.
+        
+        No test, because it's not possible from a test to know whether a transition is accelerated or not.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+
+2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix, build the MSW source to get methods that use the MSW version of
+        PlatformModuleVersion.
+
+        * wscript:
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.  Add back MIMETypeRegistryChromium with the right
+        casing.
+
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Added.
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
+        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageResourceMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMETypeForEncoding):
+        (WebCore::MIMETypeRegistry::isSupportedJavaScriptMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedMediaMIMEType):
+        (WebCore::MIMETypeRegistry::isJavaAppletMIMEType):
+        (WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension):
+        (WebCore::dummyHashSet):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageResourceMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypesForEncoding):
+        (WebCore::MIMETypeRegistry::getSupportedNonImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedMediaMIMETypes):
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        MimeTypeRegistryChromium is mis-casen
+        https://bugs.webkit.org/show_bug.cgi?id=30441
+
+        Change the case of MimeTypeRegistryChromium to match other platforms.
+
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
+        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
+
+2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Change EmptyPluginHalterClient in SVGImage to be non-static, to
+        match changes made http://trac.webkit.org/changeset/49385.
+        https://bugs.webkit.org/show_bug.cgi?id=30403
+
+        Run the following layout test sequence:
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-01-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-03-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-04-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-05-b.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-06-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-08-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-09-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-10-t.svg
+          LayoutTests/svg/carto.net/scrollbar.svg
+          LayoutTests/svg/carto.net/selectionlist.svg
+
+        selectionlist.svg should not crash.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged): Made EmptyPluginHalterClient non-static.
+
+2009-10-16  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add beforeload event support to V8DOMWrapper
+
+        https://bugs.webkit.org/show_bug.cgi?id=30413
+
+        LayoutTests/fast/dom/beforeload/frame-before-load.html
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        MimeTypeRegistryChromium is mis-casen
+        https://bugs.webkit.org/show_bug.cgi?id=30441
+
+        Change the case of MimeTypeRegistryChromium to match other platforms.
+
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
+        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Chrome doesn't set Content-Type for file upload when the file extension
+        is not recognized
+        https://bugs.webkit.org/show_bug.cgi?id=30433
+
+        Apparently, getMIMETypeForPath is supposed to return
+        application/octet-stream when it doesn't have a better MIME type.
+
+        * platform/chromium/MimeTypeRegistryChromium.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Pull out r49676 as it caused build breakges on Symbian
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Crash fix when loading NPAPI plugins on Qt/Mac
+
+        There's no guarantee that the plist will be valid even if we
+        ask the plugin to create it. Crash obverved with iGetter.
+
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-10-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix for Chromium/skia's implementation of canvas's isPointInPath().
+        https://bugs.webkit.org/show_bug.cgi?id=30402
+
+        Covered by LayoutTests/fast/canvas/pointInPath.html.
+
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-10-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor ResourceLoadNotifier out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30379
+
+        These methods have virtually no interaction with the rest of
+        FrameLoader.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::FrameLoader::sendRemainingDelegateMessages):
+        (WebCore::FrameLoader::requestFromDelegate):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::notifier):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::receivedError):
+        * loader/ResourceLoadNotifier.cpp: Added.
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        * loader/ResourceLoadNotifier.h: Added.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        (WebCore::ResourceLoader::didFinishLoadingOnePart):
+        (WebCore::ResourceLoader::didFail):
+        (WebCore::ResourceLoader::didCancel):
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
+
+2009-10-15  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
+        (https://bugs.webkit.org/show_bug.cgi?id=30427)
+        
+        Remove no longer needed methods from ChromiumDataObject.
+
+        No new tests (no functional change)
+
+        * platform/chromium/ChromiumDataObject.h:
+
+2009-10-16  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Need a way to inform the application when a Netscape plugin is created or deleted
+        https://bugs.webkit.org/show_bug.cgi?id=30179
+
+        Inform the application when a plugin is created or destroyed, but only if the 
+        application registered for these notifications.
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-16  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Default language translation should be determined by locale settings,
+        e.g., "en-US".
+        https://bugs.webkit.org/show_bug.cgi?id=29653
+
+        Test: fast/js/navigator-language.html
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Crash fix when loading NPAPI plugins on Qt/Mac
+
+        There's no guarantee that the plist will be valid even if we
+        ask the plugin to create it. Crash obverved with iGetter.
+
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-10-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix for Chromium/skia's implementation of canvas's isPointInPath().
+        https://bugs.webkit.org/show_bug.cgi?id=30402
+
+        Covered by LayoutTests/fast/canvas/pointInPath.html.
+
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-10-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor ResourceLoadNotifier out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30379
+
+        These methods have virtually no interaction with the rest of
+        FrameLoader.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::FrameLoader::sendRemainingDelegateMessages):
+        (WebCore::FrameLoader::requestFromDelegate):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::notifier):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::receivedError):
+        * loader/ResourceLoadNotifier.cpp: Added.
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        * loader/ResourceLoadNotifier.h: Added.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        (WebCore::ResourceLoader::didFinishLoadingOnePart):
+        (WebCore::ResourceLoader::didFail):
+        (WebCore::ResourceLoader::didCancel):
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
+
+2009-10-15  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
+        (https://bugs.webkit.org/show_bug.cgi?id=30427)
+        
+        Remove no longer needed methods from ChromiumDataObject.
+
+        No new tests (no functional change)
+
+        * platform/chromium/ChromiumDataObject.h:
+
+2009-10-15  Daniel Bates  <dbates@webkit.org>
+
+        No review, rolling out r49644.
+        http://trac.webkit.org/changeset/49644
+        
+        We need to think about this change some more. See bug #30418 
+        for more details.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-10-14  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to determine whether a node is a halted plug-in.
+
+        Part of <rdar://problem/7273354> Halted plug-ins should restart on
+        mouseover
+
+        https://bugs.webkit.org/show_bug.cgi?id=30151
+
+        Reviewed by Darin Adler.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        Initialize m_isHalted.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::isHalted):
+        Return m_isHalted.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+        Set m_isHalted to true.
+        (WebCore::PluginView::restart):
+        clear m_isHalted.
+
+2009-10-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Build fix for QtWebKit after r49649.
+
+        Change JSC::HasNonDefaultMark to OverridesMarkChildren in createStructure function.
+
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed - build fix.
+
+        Web Inspector: add file missing in r49648
+
+        * inspector/front-end/TestController.js: Added.
+        (WebInspector.TestController):
+        (WebInspector.TestController.prototype.waitUntilDone):
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Part 2 -- Reverse the TypeInfo HasDefaultMark flag to OverridesMarkChildren, etc
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: introduce test controller with waitUntilDone
+        on frontend side.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30400
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/TestController.js: Added.
+        (WebInspector.TestController):
+        (WebInspector.TestController.prototype.waitUntilDone):
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.evaluateForTestInFrontend):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+
+2009-10-15  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27895
+        
+        Fixes an issue in which injecting an inline event handler whose value ends in a single-line
+        JavaScript comment can bypass the XSSAuditor. Similarly fixes this issue with respect to
+        the HTML Base element, HTML Object element, inline and external script tags, and
+        JavaScript multi-line variants of all of these attacks.
+
+        Tests: http/tests/security/xssAuditor/base-href-comment.html
+               http/tests/security/xssAuditor/iframe-javascript-url-comment.html
+               http/tests/security/xssAuditor/img-onerror-HTML-comment.html
+               http/tests/security/xssAuditor/img-onerror-comment.html
+               http/tests/security/xssAuditor/object-tag-comment.html
+               http/tests/security/xssAuditor/script-tag-comment-HTML-entity.html
+               http/tests/security/xssAuditor/script-tag-comment.html
+               http/tests/security/xssAuditor/script-tag-with-source-comment.html
+
+        * page/XSSAuditor.cpp: Added constant minAttackLength.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::findInRequest): Added parameter context. Only looks at up 
+        to minAttackLength of script code plus context (if any).
+        * page/XSSAuditor.h:
+
+2009-10-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Currently, Skia clip paths are 1-bit. This patch makes our path
+        clipping anti-aliased for non-canvas drawing.
+
+        http://code.google.com/p/chromium/issues/detail?id=5927
+        https://bugs.webkit.org/show_bug.cgi?id=28820
+        http://www.imperialviolet.org/2009/09/02/anti-aliased-clipping.html
+
+        Already covered by layout tests. New baselines will be needed in the
+        Chromium tree.
+
+        (Reland. First landed in r49329, reverted in r49330 due to Windows
+        build break)
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::clip):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::canvasClip):
+        (WebCore::GraphicsContext::clipPath):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::clipPathAntiAliased):
+        (PlatformContextSkia::restore):
+        (PlatformContextSkia::applyAntiAliasedClipPaths):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+
+2009-10-15  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7295738> No way to mute/unmute a movie in full screen video mode
+
+        * WebCore.Video.exp: Export muted and setMute.
+
+2009-10-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transitions fail to run sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=26770
+
+        Fix an issue where we could attempt to start accelerated animations or transitions on
+        GraphicsLayer that were not rooted (because of visibility:hidden), which would leave
+        the AnimationController's m_waitingForResponse flag in a state that killed subsequent
+        software transitions.
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::endAnimationUpdate):
+        (WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
+        (WebCore::AnimationControllerPrivate::addToStartTimeResponseWaitList):
+        (WebCore::AnimationControllerPrivate::startTimeResponse):
+        * page/animation/AnimationControllerPrivate.h:
+        Make some methods non-inline for ease of debugging (these are not hot methods).
+        Rename m_waitingForAResponse to m_waitingForResponse.
+        
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::hasAncestor):
+        New method to report whether the receiver has the given layer as an ancestor. Used for checking
+        whether a layer is rooted.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        Don't try to start accelerated animations or transitions on non-rooted GraphicsLayers.
+
+2009-10-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Refactor ProfilesPanel to support multiple profile types
+
+        Data describing different profile types are now stored in distinct objects.
+        https://bugs.webkit.org/show_bug.cgi?id=30332
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView.profileCallback):
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileView.prototype._sortData):
+        (WebInspector.CPUProfileType):
+        (WebInspector.CPUProfileType.prototype.get buttonTooltip):
+        (WebInspector.CPUProfileType.prototype.get buttonStyle):
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
+        (WebInspector.CPUProfile):
+        (WebInspector.CPUProfile.prototype.get title):
+        (WebInspector.CPUProfile.prototype.get uid):
+        (WebInspector.CPUProfile.prototype.get head):
+        (WebInspector.CPUProfile.prototype.createView):
+        (WebInspector.CPUProfile.prototype.viewForProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType):
+        (WebInspector.ProfileType.prototype.get buttonTooltip):
+        (WebInspector.ProfileType.prototype.get buttonStyle):
+        (WebInspector.ProfileType.prototype.get buttonCaption):
+        (WebInspector.ProfileType.prototype.get id):
+        (WebInspector.ProfileType.prototype.get name):
+        (WebInspector.ProfileType.prototype.buttonClicked):
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems.clickHandler):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.reset):
+        (WebInspector.ProfilesPanel.prototype.registerProfileType):
+        (WebInspector.ProfilesPanel.prototype._makeKey):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype.getProfileType):
+        (WebInspector.ProfilesPanel.prototype.showProfileForURL):
+        (WebInspector.ProfilesPanel.prototype.updateProfileTypeButtons):
+        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
+        (WebInspector.ProfilesPanel.prototype.get searchableViews):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.addProfileHeader):
+        (WebInspector.setRecordingProfile):
+        (WebInspector.linkifyStringAsFragment):
+        (WebInspector.showProfileForURL):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Enable inspector layout tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30014
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GStreamer] READY state doesn't mean "enough data"
+        https://bugs.webkit.org/show_bug.cgi?id=30003
+
+        STATE_READY means MediaPlayer::HaveNothing
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::updateStates):
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30002
+
+        implement cancelLoad
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::cancelLoad):
+
+2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30353
+        
+        Fix race condition, leading to a deadlock
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (webkit_video_sink_unlock_stop):
+        (webkit_video_sink_stop):
+        (webkit_video_sink_start):
+        (webkit_video_sink_class_init):
+        Fix race condition in unlock/render that would lead to deadlocks.
+
+2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30374
+        
+        Check if caps are valid before parsing them
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+        Check if caps are valid before parsing them in ::naturalSize().
+        This prevents assertions if the natural size should be calculated
+        before the video caps are negotiated.
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30006
+        [GStreamer] Unnecessary checks for Messages types in callbacks
+
+        refactored gst message callbacks into a single one
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::duration):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-10-15  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Adele Peterson.
+
+        Anchor elements should be mouse focusable regardless isLink flag.
+        https://bugs.webkit.org/show_bug.cgi?id=26856
+
+        * html/HTMLAnchorElement.cpp:
+        * html/HTMLAnchorElement.h:
+
+2009-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sort XCode project file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Return correct shorthand property name for 
+        background-repeat-x, background-repeat-y, background-position-x,
+        background-position-y, -webkit-mask-position-x, -webkit-mask-position-y,
+        -webkit-mask-repeat-x, -webkit-mask-repeat-y.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28972
+
+        Test: fast/backgrounds/repeat/background-repeat-shorthand.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Migrate profiles to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Create and update frontend script objects only when
+        web inspector is visible.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30376
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::pruneResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
+        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+
+2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Fix Windows build.
+
+        * dom/Document.idl:
+
+2009-10-14  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        [HTML5] Add document.head
+        https://bugs.webkit.org/show_bug.cgi?id=30232
+
+        Test is fast/dom/document-head.html
+
+        * dom/Document.idl: added readonly attribute head
+
+2009-10-14  Matt Mueller  <mattm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Check FNonNeg after the unit switch to avoid valgrind uninitialised conditional reference in WebCore::CSSParser::validUnit.  See http://crbug.com/20939.
+        https://bugs.webkit.org/show_bug.cgi?id=30347
+        https://bugs.webkit.org/show_bug.cgi?id=22772
+
+        Covered by running LayoutTests/fast/css/invalid-percentage-property.html under valgrind.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit):
+
+2009-10-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Move scrolling code from FrameLoader to FrameView
+        https://bugs.webkit.org/show_bug.cgi?id=30370
+
+        This code is about controlling the Frame's view, not about loading
+        stuff into the frame.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::finishedParsing):
+        (WebCore::FrameLoader::scrollToAnchor):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToFragment):
+        (WebCore::FrameView::scrollToAnchor):
+        * page/FrameView.h:
+
+2009-10-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+        
+        Part 1. Reverse the HasStandardGetOwnPropertySlot flag.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        [XSSAuditor] Add an exception for local files
+        https://bugs.webkit.org/show_bug.cgi?id=30352
+
+        Reduce XSS auditor false positives by always letting pages load scripts
+        from their own host. We don't actually know of any false positives
+        that this prevents, but it seems like a good idea.
+
+        One subtly is that we don't add this exception for scripts that have a
+        query string because (1) URLs with query strings are more apt to
+        confuse servers and (2) it is much less common to load scripts with a
+        query string.
+
+        Tests: http/tests/security/xssAuditor/script-tag-with-source-same-host-with-query.html
+               http/tests/security/xssAuditor/script-tag-with-source-same-host.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+
+2009-10-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Kill virtual contextElement() method spread all over SVG code
+        https://bugs.webkit.org/show_bug.cgi?id=30183
+
+        Remove virtual contextElement() function from all SVG*Element classes, as all animated properties live in the
+        SVG*Element classes now instead of the SVGFitToViewBox / SVGURIReference / SVGExternalResourcesRequired
+        subclasses. This is a first step to working animVal support. More patches will follow that depend on this change.
+
+        Remove "This file is part of the KDE project" from several files, change my old mail adress wildfox -> zimmermann,
+        and remove vim modelines on all files I touched. No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGAltGlyphElement.h: Remove virtual contextElement() method.
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::::synchronize):
+        (WebCore::::startAnimation):
+        (WebCore::::stopAnimation):
+        * svg/SVGAnimationElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGCircleElement.h: Ditto.
+        * svg/SVGClipPathElement.h: Ditto.
+        * svg/SVGCursorElement.h: Ditto.
+        * svg/SVGDefsElement.h: Ditto.
+        * svg/SVGEllipseElement.h: Ditto.
+        * svg/SVGExternalResourcesRequired.h: Remove pure-virtual contextElement() method.
+        * svg/SVGFEImageElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGFELightElement.h: Remove virtual contextElement() method.
+        * svg/SVGFEMergeNodeElement.h: Ditto.
+        * svg/SVGFilterElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGFilterPrimitiveStandardAttributes.h: Remove virtual contextElement() method.
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::parseViewBox): Add Document* parameter - we used to fetch the Document pointer from the context element.
+        (WebCore::SVGFitToViewBox::parseMappedAttribute): Ditto.
+        * svg/SVGFitToViewBox.h: Remove pure-virtual contextElement() method.
+        * svg/SVGFontElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGForeignObjectElement.h: Ditto.
+        * svg/SVGGElement.h: Ditto.
+        * svg/SVGGradientElement.h: Ditto.
+        * svg/SVGImageElement.h: Ditto.
+        * svg/SVGLineElement.h: Ditto.
+        * svg/SVGMPathElement.h: Ditto. Fix license indention.
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGMarkerElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGMaskElement.h: Ditto.
+        * svg/SVGPathElement.h: Ditto.
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGPatternElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::updateAnimatedSVGAttribute): synchronizeProperty<...>() has been renamed to PropertySynchronizer<...>::synchronize().
+        * svg/SVGPolyElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGRectElement.h: Ditto.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGSVGElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGScriptElement.h: Ditto.
+        * svg/SVGSwitchElement.h: Ditto.
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGSymbolElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGTRefElement.h: Remove virtual contextElement() method.
+        * svg/SVGTextContentElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGTextPathElement.h: Remove virtual contextElement() method.
+        * svg/SVGUseElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGViewElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::setViewBoxString): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        (WebCore::SVGViewSpec::parseViewSpec): Ditto.
+        * svg/SVGViewSpec.h: Devirtualize contextElement() method, it's the only place where contextElement() remains needed.
+
+2009-10-14  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Masking with wrong offset
+        [https://bugs.webkit.org/show_bug.cgi?id=30325]
+
+        SVGMaskElement moves the mask image graphics context to the wrong location.
+        In objectBoundingBoxMode the maskDestRect gets translated. This transformation
+        is not used in the later calculation. Fix by consistenly calculating the translation
+        offsets from the final mask destination rect.
+
+        Test: svg/custom/mask-with-default-value.svg
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-10-14  Kevin Decker  <kdecker@apple.com>
+
+        Rubberstamped by Jon Honeycutt.
+        
+        Export a few more showSubstituteImage() related methods.
+        
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-14  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Stringify CSS units manually (without printf) to make the formatting
+        locale-insensitive and obey CSS spec with respect to large values.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=18994
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::appendCSSDouble):
+        (WebCore::formatWithUnits):
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-14  Mark Seaborn  <mseaborn@google.com>
+
+        Reviewed by Darin Adler.
+
+        Check error return value in Perl build script
+        https://bugs.webkit.org/show_bug.cgi?id=30316
+
+        * css/makevalues.pl: Die if gperf fails.
+
+2009-10-14  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG wrong filterRegions for userSpaceOnUse and percentage values
+        [https://bugs.webkit.org/show_bug.cgi?id=30330]
+
+        Some clean-up of the SVG filter calculation code. This clean-up
+        also fixes the problem with percentage and userSpaceInUse mode.
+
+        Test: svg/filters/subRegion-in-userSpace.svg
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        * platform/graphics/filters/FilterEffect.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::buildFilter):
+        (WebCore::SVGFilterElement::canvasResource):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        (WebCore::SVGResourceFilter::~SVGResourceFilter):
+        (WebCore::SVGResourceFilter::addFilterEffect):
+        (WebCore::SVGResourceFilter::prepareFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::create):
+        * svg/graphics/filters/SVGFilter.cpp:
+        (WebCore::SVGFilter::SVGFilter):
+        (WebCore::SVGFilter::calculateEffectSubRegion):
+        (WebCore::SVGFilter::create):
+        * svg/graphics/filters/SVGFilter.h:
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        The last change fixed the problem, removing diagnostic printfs.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        CURL build fix for versions < 7.18.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::setDefersLoading):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        One more round of changes to figure out why the webgl 
+        tests are crashing on the build bot. Here I am trying
+        to see if we can create a software renderer. I am also
+        printing the found pixel formats.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Yael Aharon  <yael.aharon@nokia.com>
+ 
+        Reviewed by Simon Hausmann.
+ 
+        Enabling NPAPI plugin support on Qt Webkit for S60 platform
+        https://bugs.webkit.org/show_bug.cgi?id=29302
+
+        Also implemented by Mahesh Kulkarni<mahesh.kulkarni@nokia.com>, 
+        Rohini Ananth <rohini.ananth@nokia.com> and help from Norbert Lesr
+        <norbert.leser@nokia.com>
+         
+        * WebCore.pro:
+        Enabling ENABLE_NETSCAPE_PLUGIN_API for S60 and added S60 specific 
+        new plugin files to be compiled under symbian: macro
+
+        * bridge/npapi.h:
+        Added NPEvent and NPRegion definition for Symbian
+
+        * plugins/PluginPackage.h:
+        Added S60 specific plugin interface and plugin loader variables
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::unload): Added !PLATFORM(SYMBIAN) macro.
+        Default implementation to be used only for non-symbian platform
+        * plugins/PluginDatabase.cpp:
+        Macro !SYMBIAN checking
+        * plugins/PluginView.h:
+        Add Symbian to platforms that support setNPWindowIfNeeded
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect): Add Symbian to platforms that
+        call setNPWindowRect from setFrameRect
+         
+        Added folder 'symbian' which contains implementation files for S60
+        platform-specific NPAPI plugin functionality, under /plugins folder
+        * plugins/symbian
+        * plugins/symbian/npinterface.h:
+        Plugin Interface to be implemented by S60 NPAPI plugins 
+        * plugins/symbian/PluginContainerSymbian.h:
+        * plugins/symbian/PluginContainerSymbian.cpp:
+        * plugins/symbian/PluginDatabaseSymbian.cpp:
+        * plugins/symbian/PluginViewSymbian.cpp:
+        * plugins/symbian/PluginPackageSymbian.cpp:
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        More changes to figure out why the webgl tests are crashing on the build bot.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Round non-integer line height values.
+
+        Change webkit to rounding non-integer line height values
+        instead of truncating them. This fixes a layout test
+        failure on Windows and matches the calculation in IE and Firefox. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=24434
+
+        Test: fast/css/line-height-rounding.html
+              fast/forms/textarea-scrollbar-height.htm
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::lineHeight):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::computedLineHeight):
+
+2009-10-13  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Removes the persistent setting for InspectorTimelineAgent and renames timeline related
+        interfaces to be more consistent with the JavaScript profiler.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::startTimelineProfiler):
+        (WebCore::InspectorBackend::stopTimelineProfiler):
+        (WebCore::InspectorBackend::timelineProfilerEnabled):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::startTimelineProfiler):
+        (WebCore::InspectorController::stopTimelineProfiler):
+        (WebCore::InspectorController::timelineProfilerEnabled):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::timelineProfilerWasStarted):
+        (WebCore::InspectorFrontend::timelineProfilerWasStopped):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.timelineProfilerWasStarted):
+        (WebInspector.timelineProfilerWasStopped):
+
+2009-10-01  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix crash when loading invalid image data
+        https://bugs.webkit.org/show_bug.cgi?id=29980
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::setImageSizeForAltText):
+
+2009-10-09  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for NULL ptr deref in canvas's toDataURL().
+        https://bugs.webkit.org/show_bug.cgi?id=30254
+
+        Test: fast/canvas/canvas-toDataURL-crash.html
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::toDataURL):
+
+2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed, reverting r49558 since it broke profiler tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        ImageDecoderQt: Minor tweaks to the decoder
+
+        - Only cache the data when we start to use it.
+        - Start with a repetition count of none for normal images.
+        - Do not use canRead as this will trigger parsing of the full image
+        - Cope with a GIF failing to decode the first frame, do not
+          set m_failed to true if decoding the first frame failed
+        - Inform the QImageReader about the format that was detected
+        - Always create a ImageDecoderQt when when we have more
+        than four byte.
+
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create): Always create QImageReader for a significant speed up
+        (WebCore::ImageDecoderQt::ImageDecoderQt): Initialize m_repetitionCount to cAnimationNone
+        (WebCore::ImageDecoderQt::setData): Only call ImageDecoder::setData when everything has been received
+        (WebCore::ImageDecoderQt::isSizeAvailable): Do not check m_failed twice.
+        (WebCore::ImageDecoderQt::filenameExtension): Convert from QByteArray to String
+        (WebCore::ImageDecoderQt::frameBufferAtIndex): Check for m_failed before trying to decode
+        (WebCore::ImageDecoderQt::internalDecodeSize): Fail if the size is QSize()
+        (WebCore::ImageDecoderQt::forceLoadEverything): Handle the case were decoding the first frame fails
+        * platform/graphics/qt/ImageDecoderQt.h: Change the m_format type
+
+2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Migrate profiles to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-13  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Don't collect call frame properties until they're needed for completion.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30334
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions): if call frame id is specified and the expression is empty collect frame properties.
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain): don't send call frame properties until they're needed.
+        * inspector/front-end/ScriptsPanel.js:
+
+>>>>>>> .r49765
+2009-10-13  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29106
+        [Qt] make CachedResourceHandle.h compile in winscw Symbian compiler.
+
+        Don't inline constructor CachedResourceHandle<T>(R*) to stop winscw
+        compiler aggressively resolve inheritance of class R.  
+        
+        The winscw compiler bug is reported at:
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
+        
+        The change should be reverted when the above bug is fixed in winscw compiler.
+
+        * loader/CachedResourceHandle.h:
+        (WebCore::::CachedResourceHandle):
+
+2009-10-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49554, because it broke Win and Chromium builds.
+        http://trac.webkit.org/changeset/49554
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Stringify CSS units manually (without printf) to make the formatting
+        locale-insensitive and obey CSS spec with respect to large values.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=18994
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::appendCSSDouble):
+        (WebCore::formatWithUnits):
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by David Levin.
+
+        Make grippy lines vertical on horizontal scrollbars in Linux Chrome.
+        While we're rebaselining scrollbars, fix an off by one in the vertical
+        scrollbar rendering too.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30319
+
+        Tests: this is covered by every pixel test involving scrollbars.
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+
+2009-10-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Fix issue where clientX and clientY on MouseEvents were wrong when
+        the page was zoomed and scrolled.
+
+        Test: fast/events/clientXY-in-zoom-and-scroll.html
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::contentsX): Take page zoom into account.
+        (WebCore::contentsY): Ditto.
+
+2009-10-13  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Change the order of arguments on some of the user stylesheet/script functions.  Split the removal functions
+        out into separate ones for scripts and stylesheets.
+
+        * WebCore.base.exp:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScriptToWorld):
+        (WebCore::PageGroup::addUserStyleSheetToWorld):
+        (WebCore::PageGroup::removeUserScriptFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetFromWorld):
+        (WebCore::PageGroup::removeUserScriptsFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userScripts):
+        (WebCore::PageGroup::userStyleSheets):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Chrome's "Skia" theme paints select controls backwards in RTL.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30320
+
+        Test: fast/text/international/bidi-menulist.html
+        (The test is about something else, but it includes RTL selects.)
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMenuList): flip the arrow position in RTL case.
+
+2009-10-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30318
+        ScriptExecutionContext is not anymore needed to create an EventListener - remove old code.
+        It's a followup to r48884. It removed the need to pass the ScritpExecutionContext
+        into EventListener constructor but did not remove the code pulling ScriptExecutionContext.
+
+        Tests:
+        Test adds event listener to a DocumentType Node which is created without a document
+        and then dispatches the event after attaching a node to the tree. Event
+        should fire when node is attached to the tree.
+
+        * fast/events/add-event-without-document-expected.txt: Added.
+        * fast/events/add-event-without-document.html: Added.
+
+        All changes in files below are the same - remove the code that calls
+        EventTarget::scriptExecutionContext and checks it for NULL.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+
+2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=30289
+
+        Cleaned up bitrot in SharedWorker V8 bindings.
+
+        * WebCore.gypi:
+        Removed default implementation of SharedWorkerRepository so Chromium can provide its own.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        Added V8SharedWorkerContext.cpp.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        Added case statements for SHAREDWORKER and SHAREDWORKERCONTEXT.
+        * bindings/v8/V8Index.cpp:
+        Now includes V8SharedWorkerContext.h to allow supporting SharedWorkers.
+        * bindings/v8/V8Index.h:
+        Added definition for SHAREDWORKERCONTEXT wrapper.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        Added includes for SharedWorker.h and SharedWorkerContext.h.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Reorganized Worker field indexes to be clearer, and fixed mismatch in worker field index.
+        Also added field indexes for SharedWorkers.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        Added runtime enabler for the SharedWorker constructor.
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Cleaned up bitrot (various APIs have changed since this file was written).
+        * page/DOMWindow.idl:
+        Added EnabledAtRuntime flag to window.SharedWorker.
+
+2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30345
+        HTTP tests for credential handling fail on Tiger
+
+        We cannot prevent NSURLConnection from doing its credentil handling on Tiger anyway; so
+        let it do its work without intervention. Once again, we pass explicitly passed credentials
+        in URL, fixing regressions from Safari 3.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+
+2009-10-13  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Adam Barth.
+
+        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+
+        Reworked and added to the getter/setter interface in ChromiumDataObject:
+        - added contains...() methods to just query the state
+        - added containsValid...URL() methods for URL data members
+        - removed takeFileNames() as this was too type-dependent
+        - changed return type of fileNames() to Vector<String>
+        - added interface methods to allow appending to and iteration over file names
+
+        No new tests (no functional behavior changed).
+
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::containsMainURL):
+        (WebCore::ChromiumDataObject::containsValidMainURL):
+        (WebCore::ChromiumDataObject::containsMainURLTitle):
+        (WebCore::ChromiumDataObject::containsTextPlain):
+        (WebCore::ChromiumDataObject::containsTextHTML):
+        (WebCore::ChromiumDataObject::containsHTMLBaseURL):
+        (WebCore::ChromiumDataObject::containsValidHTMLBaseURL):
+        (WebCore::ChromiumDataObject::containsContent):
+        (WebCore::ChromiumDataObject::containsContentFileExtension):
+        (WebCore::ChromiumDataObject::containsContentFileName):
+        (WebCore::ChromiumDataObject::setContentFileName):
+        (WebCore::ChromiumDataObject::containsFileNames):
+        (WebCore::ChromiumDataObject::fileNames):
+        (WebCore::ChromiumDataObject::clearFileNames):
+        (WebCore::ChromiumDataObject::countFileNames):
+        (WebCore::ChromiumDataObject::fileNameAt):
+        (WebCore::ChromiumDataObject::setFileNames):
+        (WebCore::ChromiumDataObject::appendToFileNames):
+        (WebCore::ChromiumDataObject::popFileName):
+
+2009-10-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Temporary debugging changes to figure out why the webgl tests are crashing on the build bot.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Visibility:visible inside a compositing layer doesn't make the element visible
+        https://bugs.webkit.org/show_bug.cgi?id=30339
+        
+        When deciding if a layer had any renderable content, RenderLayerBacking::paintIntoLayer()
+        only consulted hasVisibleContent(), which does not take into a account child layers which
+        may be visible. We also have to consult hasVisibleDescendant() as well.
+
+        Test: compositing/compositing-visible-descendant.html
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasVisibleDescendant):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Refactor ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        https://bugs.webkit.org/show_bug.cgi?id=30278
+
+        Move the definition of ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 
+        from the make system into common code.
+
+        Enable ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH if NETSCAPE_PLUGIN_API 
+        support is not enabled.
+
+        Remove notImplemented() from PluginPackageNone.cpp and 
+        PluginDataNone.cpp make them just empty functions.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * plugins/PluginDataNone.cpp:
+        (WebCore::PluginData::initPlugins):
+        (WebCore::PluginData::refresh):
+        * plugins/PluginPackageNone.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        (WebCore::PluginPackage::fetchInfo):
+        (WebCore::PluginPackage::load):
+
+2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30150
+        <rdar://problem/7283540> REGRESSION: Crash when accessing clipboardData.types
+
+        Test: editing/pasteboard/crash-accessing-clipboardData-types.html
+
+        * platform/mac/ClipboardMac.mm: (WebCore::addHTMLClipboardTypesForCocoaType): The String
+        class doesn't have operator bool, it's operator NSString* that is invoked instead, and it
+        converts null strings to non-null @"".
+
+2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+
+        Reviewed by Dimitri Glazkov.
+
+        window attributes (like localStorage) that are disabled at runtime are still visible
+        https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        Adding codegen/bindings to support runtime disabling of attributes.
+
+        No new tests (only supported by chrome currently)
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Refactored the guts of GenerateBatchedAttributeData into a separate GenerateSingleBatchedAttribute with a passed-in indentation level to allow generating a single BatchedAttribute struct.
+        Added support for the EnabledAtRuntime extended attribute, which generates a call to the appropriate XXXXEnabled() API before adding the attribute to the instance.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::batchConfigureAttributes):
+        Refactored attribute setting code into a common inline routine.
+        * bindings/v8/V8Proxy.h:
+        (WebCore::configureAttribute):
+        Inline function which configures a single attribute given a BatchedAttribute struct.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added (DECLARE_)ACCESSOR_RUNTIME_ENABLER to allow enabling attributes at runtime.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        Added code to enable window.Audio only if MediaPlayer.isAvailable() == true
+        * page/DOMWindow.idl:
+        Added [EnabledAtRuntime] extended attribute to the Audio attribute.
+
+2009-10-13  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27457
+        Added support for static validation on type=email input elements as per
+        HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#e-mail-state
+
+        Test: fast/forms/ValidityState-typeMismatch-email.html
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch): ValidityState.typeMismatch
+        performs validation on type=email input elements now.
+        (WebCore::ValidityState::isValidEmailAddress): simple validation method 
+        * html/ValidityState.h:
+
+2009-10-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Event listeners installed on a window object returned from window.open() don't work
+        https://bugs.webkit.org/show_bug.cgi?id=28716
+
+        Tests: http/tests/security/window-events-clear-domain.html
+               http/tests/security/window-events-clear-port.html
+               http/tests/security/window-events-pass.html
+
+        * dom/Document.cpp: Split code of Document::clear() in a way to avoid removing all
+        window event handlers when implicitOpen is called. It is called in 2 cases - on
+        committing loaded content (no need to clean handlers) and on document.open() (needs to remove handlers).
+
+        (WebCore::Document::open): in addition to calling implicitOpen it also removes window
+        event handlers, to preserve the behavior of document.open().
+
+        (WebCore::Document::implicitOpen): includes the part of removed Document::clear() that
+        does not remove window event handlers.
+
+        * dom/Document.h: Removed clear().
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): add check to avoid removing window event handlers
+        if we transition from temporary empty document to a loaded one.
+
+        (WebCore::FrameLoader::didOpenURL): Remove closeURL() which was called twice when loading.
+        (WebCore::FrameLoader::finishedLoadingDocument): add closeURL() to compensate for change above.
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix a leak in the inspector by calling didRemoveNode with
+        an error code when it fails, instead of returning from the
+        Backend.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::removeNode):
+        * inspector/front-end/ElementsTreeOutline.js:
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30337>.
+        Web Inspector: Should be able to delete nodes from the Elements Tree.
+        
+        When the delete key is pressed and a element is selected in the tree,
+        the element should be deleted from the Elements Tree and the DOM.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::removeNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didRemoveNode):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent):
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix REGRESSION(49479): Mouseover on resources graph doesn't show timings.
+        
+        Set pointer-events: none on the new overlay so mouseover events are passed
+        to the resources graph so we can show timings.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-13  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins : Remove all traces of winId. Use ownerWidget() instead.
+        
+        This is a bug for two reasons:
+        1. Everytime we use winId(), we end up creating a native widget. This causes an
+        unnecessary copy of contents from the backing store to the native widget.
+        2. Neither windowed nor windowless plugins require the winId of the QWebView or
+        QGraphicsView.
+        
+        Introduce ownerWidget() which returns a QWidget * without creating a native widget
+        (as opposed to QWidget::find(winId)).
+
+       https://bugs.webkit.org/show_bug.cgi?id=30170
+
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepthPerComponent):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QWebPageClient.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::setSharedXEventFields):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+
+2009-10-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build system fix. Typo in a filename.
+
+        * GNUmakefile.am:
+
+2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+        Alter profile link format to enable multiple profile types
+        https://bugs.webkit.org/show_bug.cgi?id=30253
+
+        The new profile URL includes the profile type along with the
+        profile title and uid.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.linkifyStringAsFragment):
+
+2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix same-named profiles grouping in the Profiles panel.
+
+        The tree node re-parenting while adding a new group node was broken.
+         
+        https://bugs.webkit.org/show_bug.cgi?id=30299
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfile):
+
+2009-10-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Enforce async interaction between inspector controller and frontend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30300
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.dispatch.delayDispatch):
+        (WebInspector.dispatch):
+
+2009-10-12  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix issue caretRangeFromPoint() returns wrong result for a zoomed and 
+        scrolled page.
+        https://bugs.webkit.org/show_bug.cgi?id=30034
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint): calculate the correct point 
+        relative to document when the page is zoomed and scrolled.
+        (WebCore::Document::caretRangeFromPoint): calculate the correct point 
+        relative to document when the page is zoomed and scrolled.
+
+2009-10-12  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        JavaScript bindings of WebSocket addEventListener/removeEventListener
+        https://bugs.webkit.org/show_bug.cgi?id=29841
+
+        Test: fast/websockets/websocket-event-target.html
+
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * websockets/WebSocket.idl:
+
+2009-10-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29078
+        <rdar://problem/7288221>
+
+        Add a mechanism to blacklist certain codecs.  Initially, just blacklist UTF-7 as HTML5 encourages.
+
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::pruneBlacklistedCodecs):
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+
+2009-10-09  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add support for the beforeload event to frames.  Complete support of the beforeload event by making sure
+        its wrapper gets properly constructed (so that the URL field of the event can be accessed).  Add support
+        for the Objective-C wrapper class as well.
+
+        Added fast/dom/beforeload/frame-before-load.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/objc/DOMEvents.mm:
+        (kitClass):
+        * dom/BeforeLoadEvent.h:
+        (WebCore::BeforeLoadEvent::isBeforeLoadEvent):
+        * dom/Event.cpp:
+        (WebCore::Event::isBeforeLoadEvent):
+        * dom/Event.h:
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+
+2009-10-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix <rdar://problem/7094146> Reproducible crash at
+        RenderObject::localToAbsolute()
+
+        Test: fast/dynamic/position-absolute-to-fixed-crash.html
+
+        The crash was caused by stale positioned objects lists following an
+        object transitioning from being absolutely position to being fixed
+        positioned.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange): In case of a transition between
+        absolute and fixed position, mark the parent as having a child needing
+        layout, so that this object will get inserted into its new container's
+        positioned objects list.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange): Changed a condition to cover
+        this transition, so that this object gets removed from its current
+        container's positioned objects list.
+
+2009-10-12  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add a palette() method that is needed by our RenderTheme.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Gradients can't handle percentage values in userSpaceOnUse mode
+        [https://bugs.webkit.org/show_bug.cgi?id=30286]
+
+        Fixed *GradientAttributes to take SVGLength instead of double. This casues
+        the problem, that we can't calculate the correct size of a gradient on
+        userSpaceOnUse mode with percentage values.
+
+        Test: svg/custom/gradient-userSpaceOnUse-with-percentage.svg
+
+        * svg/LinearGradientAttributes.h:
+        (WebCore::LinearGradientAttributes::LinearGradientAttributes):
+        (WebCore::LinearGradientAttributes::x1):
+        (WebCore::LinearGradientAttributes::y1):
+        (WebCore::LinearGradientAttributes::x2):
+        (WebCore::LinearGradientAttributes::y2):
+        (WebCore::LinearGradientAttributes::setX1):
+        (WebCore::LinearGradientAttributes::setY1):
+        (WebCore::LinearGradientAttributes::setX2):
+        (WebCore::LinearGradientAttributes::setY2):
+        * svg/RadialGradientAttributes.h:
+        (WebCore::RadialGradientAttributes::RadialGradientAttributes):
+        (WebCore::RadialGradientAttributes::cx):
+        (WebCore::RadialGradientAttributes::cy):
+        (WebCore::RadialGradientAttributes::r):
+        (WebCore::RadialGradientAttributes::fx):
+        (WebCore::RadialGradientAttributes::fy):
+        (WebCore::RadialGradientAttributes::setCx):
+        (WebCore::RadialGradientAttributes::setCy):
+        (WebCore::RadialGradientAttributes::setR):
+        (WebCore::RadialGradientAttributes::setFx):
+        (WebCore::RadialGradientAttributes::setFy):
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::buildGradient):
+        (WebCore::SVGLinearGradientElement::collectGradientProperties):
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+        (WebCore::SVGRadialGradientElement::collectGradientProperties):
+
+2009-10-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30315>.
+        Web Inspector: DOM Content and Load lines in Resources are unclear what they mean.
+        
+        Add tooltip text to the Load event and DOM Content event lines through
+        a new layer that allows these lines to be on top of the view.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
+        * inspector/front-end/inspector.css:
+
+2009-10-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49429, because it broke layout tests.
+        http://trac.webkit.org/changeset/49429
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG - crash on feMerge when input not available
+        [https://bugs.webkit.org/show_bug.cgi?id=30297]
+
+        Make a early return in SVGFEMergeElement if the needed
+        filter effect doesn't exist.
+
+        Test: svg/filters/feMerge-wrong-input.svg
+
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::build):
+
+2009-10-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added automatic flush before compositing
+        https://bugs.webkit.org/show_bug.cgi?id=30236
+
+        This causes image to always render correctly. In writing a testcase
+        I needed to implement readPixels. This exposed a bug in reading back
+        values from a CanvasArray subclass, so I fixed that as well. Now when
+        you wrap a CanvasArray in a JSValue it actually wraps the specific
+        subclass. To do this I need to add virtual methods to each CanvasArray
+        subclass to determine the type and a custom toJS method for CanvasArray
+        to create the proper wrapper. 
+
+        Test: fast/canvas/webgl/triangle.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasArrayCustom.cpp:
+        (WebCore::toJS):
+        * html/canvas/CanvasArray.h:
+        (WebCore::CanvasArray::isByteArray):
+        (WebCore::CanvasArray::isUnsignedByteArray):
+        (WebCore::CanvasArray::isShortArray):
+        (WebCore::CanvasArray::isUnsignedShortArray):
+        (WebCore::CanvasArray::isIntArray):
+        (WebCore::CanvasArray::isUnsignedIntArray):
+        (WebCore::CanvasArray::isFloatArray):
+        * html/canvas/CanvasArray.idl:
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::isByteArray):
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::isFloatArray):
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::isIntArray):
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::readPixels):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::isShortArray):
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::isUnsignedByteArray):
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::isUnsignedIntArray):
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::isUnsignedShortArray):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer drawInCGLContext:pixelFormat:forLayerTime:displayTime:]):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::readPixels):
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30307
+        
+        Fix 0 sentinel for g_object_set() function call.
+
+        * platform/graphics/gtk/DataSourceGStreamer.cpp:
+        (webkit_data_src_uri_set_uri):
+        0 is passed as 32 bit value on x86-64 in vararg functions, but
+        g_object_set() expects a 64 bit 0. This will cause crashes.
+
+2009-10-12  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Drop in="" from <feFlood>
+        https://bugs.webkit.org/show_bug.cgi?id=29001
+
+        This makes <feFlood in="bogus"> have an effect, too.
+
+        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#feflood-attribute
+
+        Test: svg/dom/feFlood-no-in1.html
+
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::SVGFEFloodElement):
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFloodElement.idl:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::FEFlood):
+        (WebCore::FEFlood::create):
+        * svg/graphics/filters/SVGFEFlood.h:
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29998
+        
+        Scale video to completely fill the target surface while
+        keeping the aspect ratio. This fixes displaying of the
+        YouTube HTML5 sample website.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        Scale video to completely fill the target surface, keep
+        the aspect ratio and center it.
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29997
+        
+        Fixes double memcpy of all rendered video frames.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateRepaintCallback):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::duration):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_dispose):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (marshal_VOID__MINIOBJECT):
+        (webkit_video_sink_class_init):
+        (webkit_video_sink_new):
+        * platform/graphics/gtk/VideoSinkGStreamer.h:
+        Directly pass the buffers up to the MediaPlayerPrivate::paint()
+        method instead of rendering them first to an intermediate cairo
+        surface. This should increase performance and peak memory usage.
+
+2009-10-11  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30242
+        
+        Fixes an issue where JavaScript URLs that are URL-encoded twice can 
+        bypass the XSSAuditor.
+        
+        JavaScript URLs that are completed by method Document::completeURL have added
+        URL-encoded characters such that a direct comparison with the URL-decoded 
+        outgoing HTTP parameters is not sufficient. Instead, the URL-decoded outgoing 
+        HTTP parameters must be URL-decoded before comparison.
+
+        Tests: http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode.html
+               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2.html
+               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3.html
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL): Modified to pass XSSAuditor
+        the URL-decoded source code for the JavaScript URL.
+        * page/XSSAuditor.cpp:
+        (WebCore::isIllegalURICharacter): Minor syntactical change to the comment.
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::canonicalizeURL): Added 
+        parameter decodeURLEscapeSequencesTwice.
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::decodeURL): Ditto.
+        (WebCore::XSSAuditor::findInRequest): Ditto.
+        * page/XSSAuditor.h:
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer): Ditto.
+
+2009-10-11  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Adam Barth.
+
+        Fixes a build break in the V8 bindings caused by revision 49420.
+        https://bugs.webkit.org/show_bug.cgi?id=30294
+
+        Revision 49420 introduces an IDL-defined CanvasActiveInfo
+        type. This causes a build break in the V8 bindings where
+        CanvasGraphicsContext3D naively refers to CanvasActiveInfo as a
+        non-ref type.
+
+        * WebCore.gypi: Include CanvasActiveInfo.idl in build.
+        * bindings/scripts/CodeGeneratorV8.pm: CanvasActiveInfo is a ref
+          ptr type.
+        * bindings/v8/DOMObjectsInclude.h: Include generated
+          CanvasActiveInfo files.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-10-11  Collin Jackson  <collinj@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Log mixed content warnings to console
+
+        https://bugs.webkit.org/show_bug.cgi?id=30290
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
+        (WebCore::FrameLoader::checkIfRunInsecureContent):
+
+2009-10-11  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Add a context scope in JS listener destructor. The destructor code uses the cotext. See http://crbug.com/24200.
+        https://bugs.webkit.org/show_bug.cgi?id=30250
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-11  Lyon Chen  <lyon.chen@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Correct the position of #endif sentence inside WebCore::Document::finishedParsing().
+
+        https://bugs.webkit.org/show_bug.cgi?id=30244
+
+        This change requires no test case as it fix a compiling error.
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+
+2009-10-11  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Adam Barth.
+
+        Sets a 500K stack limit for JavaScript workers in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=29797
+
+        Runaway recursion in JavaScript workers crashes the Chromium
+        worker process on OS X. This is because V8's default stack limit
+        is 512K on ia32 or 1M on x64, but the worker process runs workers
+        on a thread with the OS X default stack size--512K. Because there
+        are already some C+frames on the stack when V8 establishes its
+        512K default stack limit, and V8 doesn't precisely enforce the
+        stack limit, runaway recursion in V8 workers overflows the OS
+        stack and segfaults, killing the worker process. This is described
+        in Chromium bug 21653 <http://crbug.com/21653>.
+
+        This patch sets the V8 stack limit for worker JavaScript in
+        Chromium to a more conservative 500K on all platforms. This allows
+        some "headroom" for the C+stack in use when the limit is set up,
+        and some "legroom" for the V8 helper functions which in practice
+        briefly flout the V8 stack limit.
+
+        Test: LayoutTests/fast/workers/use-machine-stack.html
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+
+2009-10-11  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for wxMac 2.9, use wxGC API for measuring text.
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (GetTextExtent):
+
+2009-10-10  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Sam Weinig.
+
+        Allow [Reflect] on SVG elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28936
+
+        Update the JS binding generators to reference SVGNames instead of
+        HTMLNames, if [Reflect]ing an attribute on an SVG element.  Make
+        SVGElement::id use [Reflect].
+
+        Also make [Reflect] on an attribute with a setter exception work in ObjC
+        bindings.
+
+        Test: svg/dom/id-reflect.html
+
+        * bindings/scripts/CodeGenerator.pm: Add a function to determine the
+        appropriate C+namespace for attribute name constants.
+        * bindings/scripts/CodeGeneratorObjC.pm: Generate ExceptionCode handling
+        code for [Reflect] on an attribute with a setter exception.
+        * bindings/scripts/CodeGeneratorCOM.pm: Generate "SVGNames" instead of
+        "HTMLNames" when appropriate.
+        * bindings/scripts/CodeGeneratorJS.pm: Ditto.
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        * svg/SVGElement.cpp: Remove getter and setter methods for id.
+        * svg/SVGElement.h: Ditto.
+        * svg/SVGElement.idl: Add [Reflect] to id.
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Fix paths in xcode.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Implement getActiveAttrib and getActiveUniform
+        https://bugs.webkit.org/show_bug.cgi?id=30276
+
+        Implements the getActiveAttrib and getActiveUniform APIs.
+        Rather simple patch, adds CanvasActiveInfo definition and implementation
+        and adds forwarding to the GraphicsContext3D.
+
+        Test: fast/canvas/webgl/getActiveTest.html
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/canvas/CanvasActiveInfo.h: Added.
+        (WebCore::CanvasActiveInfo::create):
+        (WebCore::CanvasActiveInfo::name):
+        (WebCore::CanvasActiveInfo::type):
+        (WebCore::CanvasActiveInfo::size):
+        (WebCore::CanvasActiveInfo::CanvasActiveInfo):
+        * html/canvas/CanvasActiveInfo.idl: Added.
+        * html/canvas/CanvasObject.h:
+        (WebCore::CanvasObject::context):
+          Need to make the context public as it is needed to ensure we don't
+          provide a program from one context as an argument to another.
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::getActiveAttrib):
+        (WebCore::CanvasRenderingContext3D::getActiveUniform):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+
+2009-10-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Adding new attributes in Element Panel is
+        counterintuitive.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30057
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmousemove):
+        (WebInspector.ElementsTreeElement.prototype.set hovered):
+        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton):
+
+2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Build fix if Netscape plugin support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=30275
+
+        In addition to fixing the build break with guards
+        remove notImplemented() from PluginViewNone.cpp and
+        make them just just be empty functions.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::handlePostReadFile):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+        (WebCore::PluginView::setParentVisible):
+        (WebCore::PluginView::updatePluginWidget):
+
+2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r49415.
+
+        Add HistoryController.cpp to the build.
+
+        * WebCore.pro:
+
+2009-10-09  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] KURLGoogle's protocolIs barfs on input containing hyphens
+        https://bugs.webkit.org/show_bug.cgi?id=30262
+
+        This is not testable from WebKit since WebKit never uses the member
+        function form of protocolIs with input that can be controlled from a
+        web page.  It always passes string literals lacking hyphens.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::lowerCaseEqualsASCII): Only assert if toASCIILower would
+        transform the input character.
+
+2009-10-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Move HistoryController to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=30272
+
+        Purely mechanical.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/HistoryController.cpp: Added.
+        * loader/HistoryController.h: Added.
+
+2009-10-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        ApplyStyleCommand removes presentational tags even when not necessary
+        https://bugs.webkit.org/show_bug.cgi?id=28091
+
+        This patch updates implicitlyStyledElementShouldBeRemovedWhenApplyingStyle to return true
+        (triggering removal of tag) only if the style implicitly added by the element is not present in
+        the new style to apply. It also changes surroundNodeRangeWithElement so that it merges the
+        surrounding element when possible. applyTextDecorationStyle is modified so that it does not add
+        style span when the style attribute is empty.
+
+        Test: editing/execCommand/toggle-style-3.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::shouldRemoveTextDecorationTag): Returns true if specified text
+        decoration is not present in the style to apply
+        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle): No longer
+        returns true if the tag is used in new style
+        (WebCore::ApplyStyleCommand::applyTextDecorationStyle): Does not add style-span when redundant
+        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement): Merges the newly created element
+        with the surrounding identical elements
+        * editing/ApplyStyleCommand.h:
+
+2009-10-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor HistoryController out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30246
+
+        HistoryController is in charge of managing the current / previous /
+        provisional HistoryItems.  The split isn't perfect, but it's a place to
+        start.  I'll move HistoryController into its own file in another patch.
+
+        * WebCore.base.exp:
+        * loader/FrameLoader.cpp:
+        (WebCore::HistoryController::HistoryController):
+        (WebCore::HistoryController::~HistoryController):
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::closeURL):
+        (WebCore::FrameLoader::begin):
+        (WebCore::HistoryController::restoreDocumentState):
+        (WebCore::HistoryController::setCurrentItem):
+        (WebCore::HistoryController::setProvisionalItem):
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::FrameLoader::scrollToAnchor):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+        (WebCore::FrameLoader::didFirstLayout):
+        (WebCore::HistoryController::updateForFrameLoadCompleted):
+        (WebCore::FrameLoader::frameLoadCompleted):
+        (WebCore::FrameLoader::detachFromParent):
+        (WebCore::FrameLoader::receivedMainResourceError):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        (WebCore::HistoryController::addHistoryItemForFragmentScroll):
+        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
+        (WebCore::FrameLoader::shouldTreatURLAsSameAsCurrent):
+        (WebCore::HistoryController::createHistoryItem):
+        (WebCore::FrameLoader::checkDidPerformFirstNavigation):
+        (WebCore::HistoryController::addBackForwardItemClippedAtTarget):
+        (WebCore::HistoryController::createHistoryItemTree):
+        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem):
+        (WebCore::HistoryController::restoreScrollPositionAndViewState):
+        (WebCore::HistoryController::invalidateCurrentItemCachedPage):
+        (WebCore::HistoryController::saveDocumentState):
+        (WebCore::FrameLoader::loadItem):
+        (WebCore::HistoryController::urlsMatchItem):
+        (WebCore::HistoryController::goToItem):
+        (WebCore::HistoryController::recursiveGoToItem):
+        (WebCore::HistoryController::childFramesMatchItem):
+        (WebCore::HistoryController::updateForStandardLoad):
+        (WebCore::HistoryController::updateForClientRedirect):
+        (WebCore::HistoryController::updateForBackForwardNavigation):
+        (WebCore::HistoryController::updateForReload):
+        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
+        (WebCore::HistoryController::updateForCommit):
+        (WebCore::HistoryController::updateForAnchorScroll):
+        (WebCore::HistoryController::saveDocumentAndScrollState):
+        (WebCore::HistoryController::setCurrentItemTitle):
+        (WebCore::FrameLoader::didChangeTitle):
+        * loader/FrameLoader.h:
+        (WebCore::HistoryController::current):
+        (WebCore::HistoryController::provisional):
+        (WebCore::FrameLoader::policyChecker):
+        (WebCore::FrameLoader::history):
+        (WebCore::FrameLoader::creatingInitialEmptyDocument):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Unreviewed - fixing an obvious typo in my previous check-in.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30260
+        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
+
+        Fixes existing tests (which I thought I had run the previous time).
+
+        * platform/network/CredentialStorage.cpp: (WebCore::originsWithCredentials): Return the
+        set by reference.
+
+2009-10-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [v8] Need change to V8WorkerContextEventListener::reportError signature to match the base class.
+        https://bugs.webkit.org/show_bug.cgi?id=30264
+
+        The base class method changed in r48884.
+
+        Test: fast/worker/worker-script-error.html
+
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        * bindings/v8/V8WorkerContextEventListener.h:
+
+2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30260
+        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
+
+        Tests: http/tests/xmlhttprequest/logout.html
+               http/tests/xmlhttprequest/re-login-async.html
+               http/tests/xmlhttprequest/re-login.html
+
+        Fix several issues with existing credential handling code.
+
+        * platform/network/CredentialStorage.cpp:
+        (WebCore::pathToDefaultProtectionSpaceMap): Changed the data structure to a simpler one.
+        (WebCore::originsWithCredentials): The reason for two-stage lookup above was that we didn't
+        want to iterate paths for origins that never had credentials associated with them. Changed
+        to use a separate HashSet for this.
+        (WebCore::pathToDefaultProtectionSpaceMap): The concept of default per-path credentials didn't
+        match the spec very well. UAs are supposed to deduce protection space from an URL, and then
+        use whichever credentials are known for this protection space. So, OriginToDefaultBasicCredentialMap
+        is now PathToDefaultProtectionSpaceMap.
+        (WebCore::protectionSpaceMapKeyFromURL): Factored out a helper that extracts a directory
+        URL from a given URL. These directory URLs are what we use as keys in PathToDefaultProtectionSpaceMap.
+        (WebCore::CredentialStorage::set): Updated for above changes.
+        (WebCore::findDefaultProtectionSpaceForURL): Factored out code iterating path length to find
+        a prefix in OriginToDefaultBasicCredentialMap.
+        (WebCore::CredentialStorage::set): Another version of set() can update credentials for a
+        URL default protection space. It does nothing if the given URL doesn't correspond to a known
+        protection space.
+        (WebCore::CredentialStorage::get): Renamed from getDefaultAuthenticationCredential.
+
+        * platform/network/CredentialStorage.h: Made the distinction between methods that use a known
+        protection space and those that deduce one from URL more clear.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start): Update credentials before starting the request for real.
+        This makes the following pattern work:
+          var req = new XMLHttpRequest("GET", "logout.html", "logout", "logout"); // wrong credentials
+          req.send("");
+          req.abort();
+        Abort() is used here to avoid having UA present an auth dialog after getting a 401 response.
+        Note that one cannot log in using the same method, because there isn't a known protection
+        space for the URL yet in that case, so the added code has no effect.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Use a correct persistence for
+        calling receivedCredential(). This fixes logging in using an async XHR (withut abort(), of
+        course), and matches sync case.
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+        Renamed getDefaultAuthenticationCredential() to get().
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::WebCoreSynchronousLoader::load):
+        Same changes as in Mac code.
+
+2009-10-09  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Undoing a indent removes text instead of it's formatting.
+        <rdar://problem/7169206>
+        https://bugs.webkit.org/show_bug.cgi?id=28722
+        Restored the behavior prior to http://trac.webkit.org/changeset/46143. This change implemented the
+        indent command making simple DOM operation, without using moveParagraph which cause undo to be broken.
+        
+        Added editing/undo/undo-indent.html test.
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion): Restored. 
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Merged changes.
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Restored.
+        (WebCore::IndentOutdentCommand::indentRegion): Restored and added call to updateLayout to
+        ensure TextIterator could correctly calculate the position starting from the index.
+        * editing/IndentOutdentCommand.h: Restored.
+
+2009-10-09  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+        
+        Optimization: Many StringImpl transformations are no-ops and should just return 'this'
+        https://bugs.webkit.org/show_bug.cgi?id=30186
+
+        Optimized StringImpl methods lower(), stripWhiteSpace() and simplifyWhiteSpace() to
+        detect no-ops and return this instead of creating a new instance.
+        Empirical testing shows that the majority of calls to these methods are no-ops, making
+        this worthwhile even if (in the case of lower()) the non-no-op case is slightly slowed.
+        Upper() is very rarely a no-op, so it wasn't worthwhile to optimize it.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::lower):
+        (WebCore::StringImpl::upper): Just add a comment explaining why this wasn't optimized
+        (WebCore::StringImpl::stripWhiteSpace):
+        (WebCore::StringImpl::simplifyWhiteSpace):
+
+2009-10-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter feGaussianBlur implementation is missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28141]
+
+        This is the implementation of GaussianBlur filter for SVG.
+
+        There is already a test for feGaussianBlur
+        Test: svg/W3C-SVG-1.1/filters-gauss-01-b-w3c.svg 
+
+        Test: svg/filters/feGaussianBlur.svg
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::isAlphaImage):
+        (WebCore::FilterEffect::setIsAlphaImage):
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::apply):
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
+        (WebCore::boxBlur):
+        (WebCore::FEGaussianBlur::apply):
+
+2009-10-09  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] QoS support in the video sink
+        https://bugs.webkit.org/show_bug.cgi?id=29959
+
+        Removed the async buffer queue from the sink. Synchronize the
+        render method of the sink using a g_timeout_add() combined with a
+        gcond triggered when the buffer has been rendered.
+        Also fixed the video sink reference handling in the player, now
+        that the idle is not there anymore to mess up things.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_init):
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        (webkit_video_sink_dispose):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (webkit_video_sink_stop):
+        (webkit_video_sink_class_init):
+
+2009-10-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        feMorphology filter is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=5863]
+
+        Adds SVGFEMorphologyElement, for the SVG filter. It also fixes a bug
+        with the attribute "operator". It was only accessible via "_operator" 
+        on JavaScript.
+
+        Test: svg/dom/operatorAttribute.xhtml
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.SVG.Filters.exp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        * bindings/objc/DOMSVG.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * page/DOMWindow.idl:
+        * svg/SVGAllInOne.cpp:
+        * svg/SVGFECompositeElement.idl:
+        * svg/SVGFEMorphologyElement.cpp: Added.
+        (WebCore::SVGFEMorphologyElement::SVGFEMorphologyElement):
+        (WebCore::SVGFEMorphologyElement::~SVGFEMorphologyElement):
+        (WebCore::SVGFEMorphologyElement::setRadius):
+        (WebCore::SVGFEMorphologyElement::parseMappedAttribute):
+        (WebCore::SVGFEMorphologyElement::build):
+        * svg/SVGFEMorphologyElement.h: Added.
+        * svg/SVGFEMorphologyElement.idl: Added.
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::operator<<):
+        * svg/graphics/filters/SVGFEMorphology.h:
+        (WebCore::):
+        * svg/svgtags.in:
+
+2009-10-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix Chromium breakage.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30104
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.addCookieDomain): check that Storage panel is present before calling its methods.
+
 2009-10-09  Joe Ligman  <joseph.ligman@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -8,6 +4129,1156 @@
 
         * platform/qt/QWebPageClient.h:
 
+2009-10-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implement beforeload for images.  ImageLoadEventSender has been refactored into a more generic
+        ImageEventSender that can be used by both load and beforeload events.  If the document has any
+        beforeload listeners, then the installation of images onto the renderer becomes asynchronous
+        and will be held up until the beforeload event can fire at a later date.
+
+        Both beforeload and load events now fire at the end of the tokenizer write() methods, so that
+        in the typical parsing case we don't have to put off the beforeload/load events until after
+        a layout or paint might already have happened.  This lets beforeload/load not cause extra
+        layouts and repaints.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::addListenerTypeIfNeeded):
+        * dom/Document.h:
+        (WebCore::Document::):
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::write):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::attach):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageBeforeLoadEventSender::ImageBeforeLoadEventSender):
+        (WebCore::ImageLoadEventSender::ImageLoadEventSender):
+        (WebCore::beforeLoadEventSender):
+        (WebCore::ImageLoader::ImageLoader):
+        (WebCore::ImageLoader::~ImageLoader):
+        (WebCore::ImageLoader::setImage):
+        (WebCore::ImageLoader::setLoadingImage):
+        (WebCore::ImageLoader::updateFromElement):
+        (WebCore::ImageLoader::notifyFinished):
+        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):
+        (WebCore::ImageLoader::dispatchPendingEvents):
+        (WebCore::ImageEventSender::ImageEventSender):
+        (WebCore::ImageEventSender::dispatchEventSoon):
+        (WebCore::ImageEventSender::cancelEvent):
+        (WebCore::ImageEventSender::dispatchPendingEvents):
+        (WebCore::ImageEventSender::timerFired):
+        * loader/ImageLoader.h:
+        (WebCore::ImageLoader::haveFiredBeforeLoadEvent):
+        * wml/WMLImageElement.cpp:
+        (WebCore::WMLImageElement::attach):
+
+2009-10-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Web Inspector: Wrap Database into ScriptObject in v8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30174
+
+        No tests due to no Script* test infrastructure.
+
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins : Fix crash when using QWebPage without QWebView.
+        
+        'client' is 0 when we have no view.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30251
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins : Add missing setCurrentPlugin(0)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30248
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+
+2009-10-09  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] beforeload event does not fire on script elements in XML
+        https://bugs.webkit.org/show_bug.cgi?id=30235
+
+        r49194 was lacking a change to XMLTokenizerQt.cpp, equivalent to the one
+        made in XMLTokenizerLibxml2.cpp.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement):
+
+2009-10-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSParserValueList
+        https://bugs.webkit.org/show_bug.cgi?id=30249
+
+        Inherits CSSParserValueList class from FastAllocBase because it has 
+        been instantiated by 'new' in WebCore/css/CSSGrammar.y:1271.
+
+        * css/CSSParserValues.h:
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins : Create Pixmap only when size changes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30214
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+
+2009-10-08  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove the WebKitPluginHalterEnabledPreferenceKey in favor of checking
+        for the existence of a PluginHalterDelegate.
+
+        This fixes a leak of WebPluginHalterClients:
+        https://bugs.webkit.org/show_bug.cgi?id=30119.
+
+        Reviewed by Dan Bernstein.
+
+        * WebCore.base.exp:
+        Removed the export of WebCore::Settings::setPluginHalterEnabled().
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyPluginHalterClient::enabled):
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Remove initialization of m_pluginHalterClient, which was removed. If a
+        non-null PluginHalterClient was passed, create the PluginHalter, and
+        set its allowed run time.
+
+        * page/Page.h:
+        Removed pluginHalterEnabledStateChanged() and m_pluginHalterClient.
+
+        * page/PluginHalter.cpp:
+        (WebCore::PluginHalter::didStartPlugin):
+        Check whether the PluginHalterClient is enabled.
+        (WebCore::PluginHalter::didStopPlugin):
+        Ditto.
+
+        * page/PluginHalter.h:
+        Made m_client an OwnPtr.
+
+        * page/PluginHalterClient.h:
+        Added a function to return the enabled state.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        Remove initialization of removed member.
+
+        * page/Settings.h:
+        Removed settings for the enabled state of the PluginHalter; we now use
+        the existence of a WebPluginHalterDelegate to determine whether the
+        PluginHalter is enabled.
+
+2009-10-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move executeScript from FrameLoader to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=30200
+
+        These methods have virtually no interaction with FrameLoader.  They
+        really seem like they ought to belong to ScriptController.
+
+        * WebCore.base.exp:
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::executeScript):
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptController.h:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::executeScript):
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/v8/ScriptController.h:
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::notifyFinished):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected):
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::replaceDocument):
+        * loader/FrameLoader.h:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::performRequest):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: added missing #include.
+
+        * ForwardingHeaders/runtime/StructureChain.h: Copied from WebCore/ForwardingHeaders/runtime/PropertyNameArray.h.
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30237>.
+        DOM Content and Load lines aren't shown if a page is loaded when the inspector is up.
+        
+        Make sure to call update script object if we have an InspectorFrontend to
+        call it on when we get one of the new events.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
+        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: updated for removal of Structure::markAggregate().
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+
+2009-10-08  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make AtomicString create its StringImpl via create(), not the constructor,
+        so it gets allocated in a single heap block, saving memory and CPU cycles.
+        This eliminates two StringImpl constructors, making the remaining ones
+        unambiguous, so the "AdoptBuffer" parameter is no longer needed.
+        Added const attribute to UChar* in StringImpl constructor, eliminating the
+        need for several const_casts in calls to it.
+        StringImpl also unfriends AtomicString (OMG drama!!!)
+        https://bugs.webkit.org/show_bug.cgi?id=30141
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::CStringTranslator::translate): Call StringImpl::create().
+        (WebCore::UCharBufferTranslator::translate): Ditto.
+        (WebCore::HashAndCharactersTranslator::translate): Ditto.
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Remove unnecessary AdoptBuffer param.
+        (WebCore::StringImpl::adopt): Ditto.
+        (WebCore::StringImpl::createUninitialized): Ditto.
+        (WebCore::StringImpl::create): Ditto.
+        (WebCore::StringImpl::crossThreadString): Ditto.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::setHash): Used by AtomicString when creating StringImpls.
+
+2009-10-08  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the shouldLoadMediaElementURL frame loader client function.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+
+2009-10-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        SVGURIReference Build problem for V8.  An additional stale reference to SVGURIReference bindings
+        which wasn't exposed until a clean build.
+        https://bugs.webkit.org/show_bug.cgi?id=30217
+
+        No new tests, just a build fix.
+
+        * bindings/v8/V8Index.cpp:
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sort XCode project file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-08  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        unselectable resources in resource panel
+        https://bugs.webkit.org/show_bug.cgi?id=30079
+
+        manual test added
+        
+        Also changed the way DnD for resources in the Resources panel is 
+        handled.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondragstart):
+        * manual-tests/inspector/duplicate-resource-urls.html: Added.
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30233>
+        Local Storage and Cookies show Blank Titles on Local Files.
+
+        If a local storage or cookies sidebar item has no domain, set the 
+        title to "Local Files", because that is what it represents.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.get mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
+
+2009-10-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix failing media layout tests.  Don't make beforeload block loads of objects that aren't in the
+        document, since video/audio (and images eventually too) can load when not in the document yet.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Move SVGFitToViewBox ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30230
+
+        This patch also devirtualizes viewBoxToViewTransform(), is it's superflous.
+        viewBoxToViewTransform() is now a simple static heper function in SVGFitToViewBox.
+        As a result, the SVGSVGElement::viewBoxToViewTransform() function now resuses the same logic.
+
+        As side-effect this patch fixes svg/custom/linking-a-03-b-transform.svg, the return
+        statement in SVGSVGElement::viewBoxToViewTransform() was clearly wrong.
+
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::SVGFitToViewBox):
+        (WebCore::SVGFitToViewBox::viewBoxToViewTransform):
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        (WebCore::SVGMarkerElement::viewBoxToViewTransform):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/SVGPatternElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        (WebCore::SVGSVGElement::viewBoxToViewTransform):
+        * svg/SVGSVGElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        * svg/SVGViewElement.h:
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        * svg/SVGViewSpec.h:
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Correct a typo that fixes the resizing of columns in Cookie view when you
+        resize the Inspector window.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.resize):
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=29811>
+        Text in Inspector's Styles gear menu is invisible.
+        
+        Adds a style rule for the option text and hr's in the gear menu,
+        to prevent them from being transparent.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Fix build problem with SVGURIReference in V8.
+        https://bugs.webkit.org/show_bug.cgi?id=30217
+
+        No new tests, just a build fix.
+
+        * WebCore.gypi:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+
+2009-10-07  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Make beforeload work on <video>/<audio> elements.
+
+        Added fast/dom/beforeload/video-before-load.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+        (WebCore::HTMLMediaElement::selectMediaResource):
+        (WebCore::HTMLMediaElement::selectNextSourceChild):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Move SVGExternalResourcesRequired ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30218
+
+        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
+        No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        * svg/SVGAElement.h:
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::SVGAnimationElement):
+        * svg/SVGAnimationElement.h:
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::SVGCircleElement):
+        * svg/SVGCircleElement.h:
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::SVGClipPathElement):
+        * svg/SVGClipPathElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        * svg/SVGCursorElement.h:
+        * svg/SVGDefsElement.cpp:
+        (WebCore::SVGDefsElement::SVGDefsElement):
+        * svg/SVGDefsElement.h:
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::SVGEllipseElement):
+        * svg/SVGEllipseElement.h:
+        * svg/SVGExternalResourcesRequired.cpp:
+        (WebCore::SVGExternalResourcesRequired::SVGExternalResourcesRequired):
+        * svg/SVGExternalResourcesRequired.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFontElement.cpp:
+        (WebCore::SVGFontElement::SVGFontElement):
+        * svg/SVGFontElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGElement.cpp:
+        (WebCore::SVGGElement::SVGGElement):
+        * svg/SVGGElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        * svg/SVGImageElement.h:
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::SVGLineElement):
+        * svg/SVGLineElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::SVGPathElement):
+        * svg/SVGPathElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPatternElement.h:
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::SVGPolyElement):
+        * svg/SVGPolyElement.h:
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::SVGRectElement):
+        * svg/SVGRectElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        * svg/SVGSVGElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        * svg/SVGScriptElement.h:
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::SVGSwitchElement):
+        * svg/SVGSwitchElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::SVGTextContentElement):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        * svg/SVGUseElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        * svg/SVGViewElement.h:
+
+2009-10-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        SVG feComposite: operator over mixes up inputs
+        [https://bugs.webkit.org/show_bug.cgi?id=30205]
+
+        SVG feComposite operator over mixed up the inputs.
+        The pixel-test svg/filters/feComposite.svg can already test this.
+        No new test result is needed as long as filters are disabled.
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Move SVGURIReference ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30184
+
+        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
+        No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        * svg/SVGAElement.h:
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::SVGAltGlyphElement):
+        * svg/SVGAltGlyphElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        * svg/SVGCursorElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        * svg/SVGFilterElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        * svg/SVGImageElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        (WebCore::SVGMPathElement::pathElement):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPatternElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        * svg/SVGScriptElement.h:
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::SVGTRefElement):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::SVGTextPathElement):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGURIReference.cpp:
+        (WebCore::SVGURIReference::SVGURIReference):
+        * svg/SVGURIReference.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        * svg/SVGUseElement.h:
+
+2009-10-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Re-add the QApplication::syncX() line for plugin windows removed
+        by r49169. Also changed the location of the sync just after the
+        creation instead of just before sending it to the plugin.
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::platformStart):
+
+2009-10-08  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: NodeLists Don't Display Well in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=28061
+
+        * inspector/front-end/InjectedScript.js:
+        (Object.type):
+
+2009-10-08  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Remove unnecessary XSync for opaque mode.
+        
+        The reason for the XSync was that the plugin would not know about the
+        Drawable. It turns out that the real reason behind this is that even
+        though XCreatePixmap returns a handle, this id is unknown to the server
+        until we flush the connection.
+        
+        So, move the XSync to right after we create the Pixmap.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30207
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+
+2009-10-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30188
+        
+        Fixes an issue where performing a non DHTML drag-and-drop operation 
+        does not work as expected. For instance, dragging some selected text 
+        to an external application, such as TextEdit.
+        
+        This issue was a regression that arose from patching bug #30107.
+        
+        This change is covered by the manual test: 
+        drag-out-of-background-window.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::startDrag): When performing a non-DHTML drag 
+        operation then default to drag operations DragOperationGeneric and 
+        DragOperationCopy according to similar functionality removed when fixing
+        bug #30107, see: 
+        http://trac.webkit.org/browser/trunk/WebKit/mac/WebView/WebHTMLView.mm?rev=48526#L3430 
+
+2009-10-07  Xan Lopez  <xlopez@igalia.com>
+
+        Fix more breakage in the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move PolicyChecker to it's own file
+        https://bugs.webkit.org/show_bug.cgi?id=30193
+
+        This is just moving code around and re-naming things.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/PolicyCallback.cpp: Added.
+        (WebCore::PolicyCallback::PolicyCallback):
+        (WebCore::PolicyCallback::~PolicyCallback):
+        (WebCore::PolicyCallback::clear):
+        (WebCore::PolicyCallback::set):
+        (WebCore::PolicyCallback::call):
+        (WebCore::PolicyCallback::clearRequest):
+        (WebCore::PolicyCallback::cancel):
+        * loader/PolicyCallback.h: Added.
+        (WebCore::PolicyCallback::request):
+        * loader/PolicyCheck.cpp: Removed.
+        * loader/PolicyCheck.h: Removed.
+
+2009-10-07  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by Mark Rowe.
+
+        Include <limits> for std::numeric_limits.  Required by gcc-4.4
+        https://bugs.webkit.org/show_bug.cgi?id=30197
+
+        * html/canvas/CanvasByteArray.h:
+        * html/canvas/CanvasIntArray.h:
+        * html/canvas/CanvasShortArray.h:
+        * html/canvas/CanvasUnsignedByteArray.h:
+        * html/canvas/CanvasUnsignedIntArray.h:
+        * html/canvas/CanvasUnsignedShortArray.h:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor PolicyChecker out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30155
+
+        This patch separates PolicyChecker from FrameLoader.  Loader policy is
+        in change of managing the FrameLoaderClient callbacks.  Ideally, it
+        shouldn't know anything about FrameLoader, but I couldn't quite remove
+        all knowledge (although we might be able to do more later).  In a
+        future patch, I'll move PolicyChecker into a separate file.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::load):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+        (WebCore::PolicyChecker::handleUnimplementablePolicy):
+        (WebCore::PolicyChecker::cannotShowMIMEType):
+        (WebCore::PolicyChecker::PolicyChecker):
+        (WebCore::PolicyChecker::checkNavigationPolicy):
+        (WebCore::PolicyChecker::checkContentPolicy):
+        (WebCore::FrameLoader::shouldReloadToHandleUnreachableURL):
+        (WebCore::FrameLoader::stopAllLoaders):
+        (WebCore::PolicyChecker::cancelCheck):
+        (WebCore::PolicyChecker::stopCheck):
+        (WebCore::PolicyChecker::continueAfterContentPolicy):
+        (WebCore::PolicyChecker::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::loadPostRequest):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::PolicyChecker::checkNewWindowPolicy):
+        (WebCore::PolicyChecker::continueAfterNewWindowPolicy):
+        (WebCore::PolicyChecker::continueAfterNavigationPolicy):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        * loader/FrameLoader.h:
+        (WebCore::PolicyChecker::loadType):
+        (WebCore::PolicyChecker::setLoadType):
+        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
+        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
+        (WebCore::FrameLoader::policy):
+        * loader/FrameLoaderClient.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didCancel):
+        (WebCore::MainResourceLoader::willSendRequest):
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/5751979> Database code takes JSLock on secondary
+        thread, permanently slowing down JavaScript
+
+        Changed callback objects to use a standard helper object. The helper
+        object ASSERTs that it is deleted on the main thread, so no lock is
+        required when unprotecting its members. It also centralizes some previously
+        duplicated code.
+        
+        Callback objects that might be deleted on a secondary thread use
+        callOnMainThread to delete their helper objects on the main thread.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCallbackData.cpp: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
+        (WebCore::JSCallbackData::deleteData):
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
+        (WebCore::JSCallbackData::JSCallbackData):
+        (WebCore::JSCallbackData::~JSCallbackData):
+        (WebCore::JSCallbackData::callback):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionCallback.h:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::~JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::~JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::~JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::~JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.h:
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+
+2009-10-07  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        Fix StringImpl::m_buffer
+        https://bugs.webkit.org/show_bug.cgi?id=30189
+
+        Fix my previous StringImpl patch to avoid using an indefinite-length array member,
+        since MSVC doesn't like it. Instead, go back to offsetting by sizeof(StringImpl).
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::createUninitialized):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::bufferIsInternal):
+
+2009-10-07  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Update isolated worlds under v8 to support world reuse.
+        https://bugs.webkit.org/show_bug.cgi?id=30145
+
+        * bindings/v8/ScriptController.cpp:
+        Replace evaluateInNewIsolatedWorld() withe evaluateInIsolatedWorld(id).
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/v8/ScriptController.h: Ditto.
+        * bindings/v8/V8Proxy.cpp: Ditto.
+        (WebCore::V8Proxy::~V8Proxy): Dittio.
+        (WebCore::V8Proxy::evaluateInIsolatedWorld): Ditto.
+        * bindings/v8/V8Proxy.h: Ditto.
+        * bindings/v8/V8IsolatedWorld.cpp:
+        Add support for controlling lifetime of a world, rather than relying on GC.
+        (WebCore::V8IsolatedWorld::contextWeakReferenceCallback): Ditto.
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld): Ditto.
+        (WebCore::V8IsolatedWorld::destroy): Ditto.
+        * bindings/v8/V8IsolatedWorld.h: Ditto.
+
+2009-10-07  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix for http://trac.webkit.org/changeset/49272 on Windows
+
+        * platform/text/StringImpl.h:
+
+2009-10-07  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Optimization of StringImpl:
+        - Remove unnecessary m_bufferIsInternal member (saves 4 bytes). Instead, check whether
+          m_data points to just past the end of the object's members.
+        - copy() and createWithTerminatingNullCharacter() create the string in a single malloc
+          block instead of 2 (saves ~20 bytes and considerable CPU cycles, increases locality).
+        - Move m_length next to m_hash to save 4 bytes of padding in 64-bit builds.
+          
+        https://bugs.webkit.org/show_bug.cgi?id=29500
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Re-ordered members.
+        (WebCore::StringImpl::~StringImpl): Change to is-buffer-internal check.
+        (WebCore::StringImpl::createUninitialized): Use new m_buffer member instead of sizeof()
+            to ensure chars are copied to correct location.
+        (WebCore::StringImpl::createWithTerminatingNullCharacter): Make sure copy is created
+            in a single malloc block.
+        (WebCore::StringImpl::threadsafeCopy): Make sure copy is created in a single malloc block.
+        (WebCore::StringImpl::crossThreadString): Make sure copy is created in a single malloc block.
+        (WebCore::StringImpl::sharedBuffer): Change to is-buffer-internal check.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::startsWith): Just fixed a confusing param name.
+        (WebCore::StringImpl::bufferIsInternal): Changed member var into accessor method.
+        (WebCore::StringImpl::m_data): Repositioned for optimal member packing in 64-bit.
+        (WebCore::StringImpl::m_buffer): Added to provide an explicit location for where internal buffer goes.
+
+2009-10-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30102
+        And
+        <rdar://problem/5015957>
+        
+        Manual test to confirm that the not-allowed cursor is shown for an
+        invalid drag-and-drop operation.
+        
+        We cannot test this using DRT because of a discrepancy between the Windows
+        API-based drop effect and the WebKit drop effect. See bug #24731 for more
+        details.
+
+        * manual-tests/drag-cursor-notallowed.html: Added.
+
+2009-10-07  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-07  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30104>.
+        Inspector should show cookies of sub-resources on the page.
+        
+        This function implements showing cookies for all sub-resources of a page.
+        When the page is loaded, it populates the Storage Panel with a list of all
+        domains that were loaded as part of the full page load (iframes, ads, etc).
+        When the user selects one of the domains, the inspector calls back into the
+        controller, and the controller combines all of the cookies from that domain
+        into a list, and sends that list is sent back to the controller to render.
+        
+        A domain now needs to be passed into CookieItemsView, and CookieSidebarTreeElement.
+        
+        As a result of a previous patch, we now have detailed cookie information for
+        both Windows on CFNetwork and Mac. Additionally, this patch provides deleteCookie
+        support on Windows.
+
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/js/ScriptObject.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::getCookies):
+        (WebCore::InspectorController::buildArrayForCookies):
+        (WebCore::InspectorController::buildObjectForCookie):
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addCookieDomainForDocument):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.addCookieDomain):
+        (WebInspector.StoragePanel.prototype.showCookies):
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addCookieDomain):
+        * platform/Cookie.h:
+        (WebCore::CookieHash::hash):
+        (WebCore::CookieHash::equal):
+        (WTF::):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::deleteCookie):
+
+2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add ScriptObject::set(const char*, unsigned).
+
+        https://bugs.webkit.org/show_bug.cgi?id=30104
+
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/v8/ScriptObject.h:
+
+2009-10-07  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows (Cairo).
+
+        Provide implementation of new BitmapImage::create that was
+        added in @r49060.
+
+        * platform/graphics/win/ImageCairoWin.cpp:
+
+2009-10-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Refactor RenderThemeChromiumMac and RenderThemeChromiumSkia to render media controls using GraphicsContext.
+
+        Design was based on existing RenderMediaControls.cpp used by RenderThemeSafari/Win.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29987
+
+        Covered by existing layout tests as no new functionality was introduced.
+
+        * WebCore.gypi: Added RenderMediaControlsChromium.cpp/h.
+        * css/mediaControlsChromium.css: Tweaked media slider position and border style.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::toParentMediaElement): Taken from RenderMediaControls.
+        (WebCore::MediaControlElement::rendererIsNeeded): Don't call shouldRenderMediaControlPart() if element has no appearance.
+        (WebCore::MediaControlInputElement::rendererIsNeeded): Ditto.
+        * rendering/RenderMediaControls.cpp: Moved parentMediaElement() to MediaControlElements.
+        * rendering/RenderMediaControlsChromium.cpp: Added.
+        (WebCore::platformResource): Helper to load and cache media control image resources.
+        (WebCore::mediaSliderThumbImage): Implementation refactored from RenderThemeChromiumMac/Skia.
+        (WebCore::mediaVolumeSliderThumbImage): Ditto.
+        (WebCore::paintMediaButton): Ditto.
+        (WebCore::paintMediaMuteButton): Ditto.
+        (WebCore::paintMediaPlayButton): Ditto.
+        (WebCore::paintMediaSlider): Ditto.
+        (WebCore::paintMediaSliderThumb): Ditto.
+        (WebCore::paintMediaVolumeSlider): Ditto.
+        (WebCore::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::paintMediaTimelineContainer): Ditto.
+        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart): Ditto.
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart): Same
+        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
+        * rendering/RenderMediaControlsChromium.h: Added.
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize): Implementation delegated to RenderMediaControlsChromium.
+        (WebCore::RenderThemeChromiumMac::shouldRenderMediaControlPart): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground): Ditto.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaControlsBackground): Implementation delegated to RenderMediaControlsChromium.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Ditto.
+
+2009-10-07  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make plugins work with beforeload.
+
+        Added fast/dom/beforeload/flash-before-load.html
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-10-07  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Protect JS listener object from GC while clearing a property on it.
+        See http://crbug.com/23780.
+        https://bugs.webkit.org/show_bug.cgi?id=30137
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Rubber-stamped by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CachedResourceClient class
+        https://bugs.webkit.org/show_bug.cgi?id=30165
+
+        Inherits CachedResourceClient class from FastAllocBase because (its
+        child class) CSSFontFaceSource has been instantiated by 'new' in WebCore/css/CSSFontFaceSource.h:46.
+
+        * loader/CachedResourceClient.h:
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's IdentifierRep 
+        https://bugs.webkit.org/show_bug.cgi?id=30159                                                        
+
+        Inherits IdentifierRep class from FastAllocBase because it has been                                 
+        instantiated by 'new' in WebCore/bridge/IdentifierRep.cpp:61.  
+
+        * bridge/IdentifierRep.h:
+
+2009-10-07  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fetch pointers to C+DOM window immediately from holder
+        object (do not search prototype chain for proper JS wrapper).
+        https://bugs.webkit.org/show_bug.cgi?id=29031
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::installDOMWindow):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+2009-10-07  Adam Roben  <aroben@apple.com>
+
+        Fix typo in PluginView::load that was causing cross-origin loads to
+        be allowed
+
+        This typo was introduced in the build fix in r49213.
+
+        Fixes <http://webkit.org/b/30168> REGRESSION (r49213):
+        http/tests/plugins/local-geturl-from-remote.html is failing on Windows
+
+        Reviewed by Sam Weinig.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load): Removed a comma operator that was making
+        a condition always evaluate to true.
+
+2009-10-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Do not create valid QColor's for invalid WebCore::Color's.
+
+        * platform/graphics/qt/ColorQt.cpp:
+        (WebCore::Color::operator QColor):
+
 2009-10-07  Janne Koskinen  <janne.p.koskinen@digia.com>
 
         Reviewed by Simon Hausmann.
@@ -20,6 +5291,3817 @@
 
         * WebCore.pro:
 
+2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Migrate database inspection to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29788
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::databaseForId):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::databaseForId):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::getDatabaseTableNames):
+        (WebCore::InspectorBackend::reportDidDispatchOnInjectedScript):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::selectDatabase):
+        (WebCore::InspectorController::databaseForId):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::selectDOMStorage):
+        (WebCore::InspectorController::getDOMStorageResourceForId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorDatabaseResource.h:
+        (WebCore::InspectorDatabaseResource::database):
+        (WebCore::InspectorDatabaseResource::id):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/Database.js:
+        (WebInspector.Database):
+        (WebInspector.Database.prototype.get id):
+        (WebInspector.Database.prototype.set name):
+        (WebInspector.Database.prototype.set version):
+        (WebInspector.Database.prototype.set domain):
+        (WebInspector.Database.prototype.getTableNames):
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.selectDatabase):
+        (WebInspector.StoragePanel.prototype.dataGridForResult):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDatabase):
+
+2009-10-07  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins: Disable content propagation for QGraphicsView items
+        
+        We cannot support content propagation for items in QGraphicsView because
+        the contents of the backing store might be transformed. So turn it off
+        if we are not painting on QWidget.
+        
+        Note that this check will not work for a QWebView in a
+        QGraphicsProxyWidget, but I guess it's fine. Alternative is to do an
+        even uglier cast: static_cast painter's paintDevice() to QWidget and
+        check if it is the viewport() of QGraphicsView.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30149
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build by adding the missing files to the build.
+
+        * WebCore.pro:
+
+2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Fix incorrect convertion of double into int while assigning it to
+        a float.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Fix rounding error issues in height calculation in 64 bits.
+
+        Already covered by existing tests.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-10-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Dual lines in css2.1 layout tests do not match:
+        https://bugs.webkit.org/show_bug.cgi?id=23262
+
+        Now we can put a counter node as the next sibling of a reset node.
+        Re-layout the counter content when the count is updated.
+
+        Tests: fast/css/counters/t1204-increment-00-c-o.html
+               fast/css/counters/t1204-increment-01-c-o.html
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::recount):
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+
+2009-10-06  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Removed unused member variable from FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30146
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        * loader/FrameLoader.h:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        A few small/trivial tweaks to the last build fix.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Need to adjust MessagePort, etc. code for the post clone work done.
+        https://bugs.webkit.org/show_bug.cgi?id=30147
+
+        No change in functionality so no new tests.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/SerializedScriptValue.h: Added.
+         A very simple implementation of SerializedScriptValue
+         that only works for strings.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Fix for <rdar://problem/7271202>
+        Dispatch resource load delegate functions for the media element.
+        Since we don't get the required callbacks from the media engine,
+        just fake the parameters to the delegate functions as best as possible.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource):
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+        * loader/FrameLoader.h:
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        More build fixes.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::DeserializingTreeWalker::getProperty):
+        (WebCore::TeardownTreeWalker::getProperty):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Build and formatting fix.
+
+        * ForwardingHeaders/runtime/ExceptionHelpers.h: Added.
+        * bindings/js/SerializedScriptValue.cpp:
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::operator bool):
+        (WebCore::SerializedScriptValueData::release):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+
+2009-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        It should be possible to post (clone) built-in JS objects to Workers
+        https://bugs.webkit.org/show_bug.cgi?id=22878
+
+        Implement object cloning semantics for postMessage.  Currently only
+        a partial implementation of the spec -- cloning of File, FileList,
+        ImageData, and RegExp were left out as they would have significantly
+        increased patch size.
+
+        Cloning requires multiple tree walks so we use a templated tree
+        walk function, allowing us to share a single implementation for
+        serialization, deserialization, and eventual destruction of the
+        serialized object tree.
+
+        Test: fast/dom/Window/window-postmessage-clone.html
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        * bindings/js/JSMessageEventCustom.cpp:
+        (WebCore::JSMessageEvent::initMessageEvent):
+        * bindings/js/JSMessagePortCustom.h:
+        (WebCore::handlePostMessage):
+        * bindings/js/SerializedScriptValue.cpp: Added.
+        (WebCore::SerializedObject::set):
+        (WebCore::SerializedObject::names):
+        (WebCore::SerializedObject::values):
+        (WebCore::SerializedObject::create):
+        (WebCore::SerializedObject::clear):
+        (WebCore::SerializedObject::SerializedObject):
+        (WebCore::SerializedArray::setIndex):
+        (WebCore::SerializedArray::canDoFastRead):
+        (WebCore::SerializedArray::getIndex):
+        (WebCore::SerializedArray::getSparseIndex):
+        (WebCore::SerializedArray::length):
+        (WebCore::SerializedArray::create):
+        (WebCore::SerializedArray::clear):
+        (WebCore::SerializedArray::SerializedArray):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SharedSerializedData::asArray):
+        (WebCore::SharedSerializedData::asObject):
+        (WebCore::):
+        (WebCore::walk):
+        (WebCore::BaseWalker::BaseWalker):
+        (WebCore::BaseWalker::shouldTerminate):
+        (WebCore::BaseWalker::ticksUntilNextCheck):
+        (WebCore::BaseWalker::didTimeOut):
+        (WebCore::BaseWalker::throwStackOverflow):
+        (WebCore::BaseWalker::throwInterruptedException):
+        (WebCore::SerializingTreeWalker::SerializingTreeWalker):
+        (WebCore::SerializingTreeWalker::null):
+        (WebCore::SerializingTreeWalker::isArray):
+        (WebCore::SerializingTreeWalker::isObject):
+        (WebCore::SerializingTreeWalker::asInputArray):
+        (WebCore::SerializingTreeWalker::asInputObject):
+        (WebCore::SerializingTreeWalker::createOutputArray):
+        (WebCore::SerializingTreeWalker::createOutputObject):
+        (WebCore::SerializingTreeWalker::length):
+        (WebCore::SerializingTreeWalker::canDoFastRead):
+        (WebCore::SerializingTreeWalker::getIndex):
+        (WebCore::SerializingTreeWalker::getSparseIndex):
+        (WebCore::SerializingTreeWalker::getProperty):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::SerializingTreeWalker::getPropertyNames):
+        (WebCore::SerializingTreeWalker::putIndex):
+        (WebCore::SerializingTreeWalker::putProperty):
+        (WebCore::SerializingTreeWalker::startArray):
+        (WebCore::SerializingTreeWalker::endArray):
+        (WebCore::SerializingTreeWalker::startObject):
+        (WebCore::SerializingTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::serialize):
+        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
+        (WebCore::DeserializingTreeWalker::null):
+        (WebCore::DeserializingTreeWalker::isArray):
+        (WebCore::DeserializingTreeWalker::isObject):
+        (WebCore::DeserializingTreeWalker::asInputArray):
+        (WebCore::DeserializingTreeWalker::asInputObject):
+        (WebCore::DeserializingTreeWalker::createOutputArray):
+        (WebCore::DeserializingTreeWalker::createOutputObject):
+        (WebCore::DeserializingTreeWalker::length):
+        (WebCore::DeserializingTreeWalker::canDoFastRead):
+        (WebCore::DeserializingTreeWalker::getIndex):
+        (WebCore::DeserializingTreeWalker::getSparseIndex):
+        (WebCore::DeserializingTreeWalker::getProperty):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::getPropertyNames):
+        (WebCore::DeserializingTreeWalker::putIndex):
+        (WebCore::DeserializingTreeWalker::putProperty):
+        (WebCore::DeserializingTreeWalker::startArray):
+        (WebCore::DeserializingTreeWalker::endArray):
+        (WebCore::DeserializingTreeWalker::startObject):
+        (WebCore::DeserializingTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::deserialize):
+        (WebCore::TeardownTreeWalker::shouldTerminate):
+        (WebCore::TeardownTreeWalker::ticksUntilNextCheck):
+        (WebCore::TeardownTreeWalker::didTimeOut):
+        (WebCore::TeardownTreeWalker::throwStackOverflow):
+        (WebCore::TeardownTreeWalker::throwInterruptedException):
+        (WebCore::TeardownTreeWalker::null):
+        (WebCore::TeardownTreeWalker::isArray):
+        (WebCore::TeardownTreeWalker::isObject):
+        (WebCore::TeardownTreeWalker::asInputArray):
+        (WebCore::TeardownTreeWalker::asInputObject):
+        (WebCore::TeardownTreeWalker::createOutputArray):
+        (WebCore::TeardownTreeWalker::createOutputObject):
+        (WebCore::TeardownTreeWalker::length):
+        (WebCore::TeardownTreeWalker::canDoFastRead):
+        (WebCore::TeardownTreeWalker::getIndex):
+        (WebCore::TeardownTreeWalker::getSparseIndex):
+        (WebCore::TeardownTreeWalker::getProperty):
+        (WebCore::TeardownTreeWalker::convertIfTerminal):
+        (WebCore::TeardownTreeWalker::getPropertyNames):
+        (WebCore::TeardownTreeWalker::putIndex):
+        (WebCore::TeardownTreeWalker::putProperty):
+        (WebCore::TeardownTreeWalker::startArray):
+        (WebCore::TeardownTreeWalker::endArray):
+        (WebCore::TeardownTreeWalker::startObject):
+        (WebCore::TeardownTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::tearDownSerializedData):
+        * bindings/js/SerializedScriptValue.h: Added.
+        (WebCore::SharedSerializedData::~SharedSerializedData):
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::type):
+        (WebCore::SerializedScriptValueData::~SerializedScriptValueData):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SerializedScriptValueData::asImmediate):
+        (WebCore::SerializedScriptValueData::asDouble):
+        (WebCore::SerializedScriptValueData::asString):
+        (WebCore::SerializedScriptValueData::asObject):
+        (WebCore::SerializedScriptValueData::asArray):
+        (WebCore::SerializedScriptValueData::operator bool ):
+        (WebCore::SerializedScriptValueData::release):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::deserialize):
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create):
+        (WebCore::MessageEvent::data):
+        * dom/MessageEvent.idl:
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        * dom/MessagePort.h:
+        * dom/MessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::EventData::message):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+        (WebCore::DOMWindow::postMessage):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/EventSource.cpp:
+        (WebCore::EventSource::createMessageEvent):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didReceiveMessage):
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::postMessage):
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix for Windows.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move FrameLoader::canLoad to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30111
+
+        * WebCore.base.exp:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+        (WebCore::FrameLoader::loadPlugin):
+        (WebCore::FrameLoader::loadFrameRequest):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::createJavaAppletWidget):
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::canLoad):
+        (WebCore::SecurityOrigin::shouldHideReferrer):
+        * page/SecurityOrigin.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move setLocalLoadPolicy and friends to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30110
+
+        These have more to do with security policies than with loading frames.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::setLocalLoadPolicy):
+        (WebCore::SecurityOrigin::restrictAccessToLocal):
+        (WebCore::SecurityOrigin::allowSubstituteDataAccessToLocal):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::):
+
+2009-10-06  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Preparation for <http://webkit.org/b/30104>.
+        Inspector should show cookies of sub-resources on the page.
+        
+        Implement getRawCookies for CFNetwork for Windows, so we can see more
+        than just a key/value pair for Cookies when we are on Windows.
+
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+
+2009-10-06  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30132, make beforeload work with <link> elements and
+        XML processing instructions.
+
+        Fix up ProcessingInstruction's setData call so that it actually updates a stylesheet when the
+        data gets changed.
+
+        Move dispatchBeforeLoadedEvent to ContainerNode so all Elements (and ProcessingInstruction) can
+        access it.
+
+        Added fast/dom/beforeload/link-before-load.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+        * dom/ContainerNode.h:
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+        (WebCore::ProcessingInstruction::setData):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::requestScript):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseMappedAttribute):
+        (WebCore::HTMLLinkElement::process):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::forAttributeValue):
+        * html/HTMLScriptElement.h:
+        * svg/SVGScriptElement.cpp:
+        * svg/SVGScriptElement.h:
+
+2009-10-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        accessibility/media-element.html crashes (and has incorrect result)
+        https://bugs.webkit.org/show_bug.cgi?id=30108
+
+        Fix up the accessibilty label for the newly added fullscreen button,
+        and update the test result accordingly.
+
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaControl::controlTypeName):
+
+2009-10-06  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30028>
+        Multiple calls to SetFrontendProxyObject can leave an InspectorTimelineAgent with an invalid
+        InspectorFrontend.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject): Adds a check for an existing timeline agent.
+
+2009-10-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        Move textRects to the right category in DOM.mm. Include DOMPrivate.h to ensure that the interfaces match.
+
+        * bindings/objc/DOM.mm:
+        (-[DOMNode textRects]):
+
+2009-10-06  Benjamin C Meyer  <bmeyer@rim.com>
+
+        Reviewed by Ariya Hidayat.
+        
+        Match the behavior of other WebKit browser and have the first url of the drag data be the url passed in declareAndWriteDragImage and set the text of the drag data to be the title argument.
+        
+        Manual test: Drag the readability js link from http://lab.arc90.com/experiments/readability/
+        
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::declareAndWriteDragImage):
+
+2009-10-06  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+        
+        HTMLInputElement::max and min are not defined for COM because they
+        conflict with the standard min() and max() macros.
+
+        Tests: fast/forms/ValidityState-rangeOverflow-number.html
+               fast/forms/ValidityState-rangeOverflow-range.html
+               fast/forms/ValidityState-rangeUnderflow-number.html
+               fast/forms/ValidityState-rangeUnderflow-range.html
+               fast/forms/input-minmax.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::rangeMinimum):
+        (WebCore::HTMLInputElement::rangeMaximum):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move m_openedByDOM to Page
+        https://bugs.webkit.org/show_bug.cgi?id=30109
+
+        We only need one instance of m_openedByDOM per page, we should move it
+        to a page-scoped object.  Notice that it's only ever touched for the
+        main frame.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::openedByDOM):
+        (WebCore::Page::setOpenedByDOM):
+        * page/Page.h:
+
+2009-10-06  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Some functions in GraphicsContext do not work
+        as expected if the associated painter has no clipping.
+        https://bugs.webkit.org/show_bug.cgi?id=29691
+
+        No new tests are associated with this because DumpRenderTree
+        always sets clipping on the painter, thus it would never hit 
+        the test case, but fast/box-shadow/basic-shadows.html is a
+        good example of what happens if the clipping is not set by
+        the user of QtWebKit.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        Fixed to handle the case that there is no clipping
+        before the call.
+
+2009-10-06  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30131, make beforeload fire on script elements.
+
+        Added tests in fast/dom/beforeload/.
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::requestScript):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * html/HTMLAttributeNames.in:
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        (WebCore::HTMLScriptElement::dispatchBeforeLoadEvent):
+        * html/HTMLScriptElement.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchBeforeLoadEvent):
+        * svg/SVGScriptElement.h:
+
+2009-10-06  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25526
+        [Gtk] Additional support is needed for caret browsing
+
+        Enable caret movement commands also when caret browsing setting is
+        enabled.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::caretBrowsingEnabled):
+        (WebCore::enabledVisibleSelectionOrCaretBrowsing):
+        (WebCore::enabledInEditableTextOrCaretBrowsing):
+        (WebCore::CommandEntry::):
+        * manual-tests/gtk/caret-browsing.html: Added.
+
+2009-10-06  Anton Muhin  <antonm@chromium>
+
+        Reviewed by Dimitri Glazkov.
+
+        Non standard, but popular exetension allows automagically
+        turn a function into a namespace resolver.  Support that in
+        Chromium as well.
+
+        Adjust CodeGeneratorV8 to treat XPathNSResolver in a special way.
+        https://bugs.webkit.org/show_bug.cgi?id=30128
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getXPathNSResolver):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: close inspector client view on
+        InspectorController::close API call.
+
+        In order to run batch web inspector layout tests (and not affect
+        subsequent tests) we should close inspector client's view upon
+        InspectorController::close API call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30009
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::close):
+
+2009-10-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the Qt/Windows build by stubbing out the still image
+        support for halted plugins for the Qt build.
+
+        Bugzilla entry https://bugs.webkit.org/show_bug.cgi?id=30130
+        tracks removing this by implementing Frame::nodeImage().
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Change QImageReader usage in ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Replace the ReadContext with another appoach to
+        reading the image. Attempt to only read meta information
+        like the image size and number of frames (for animations)
+        first and then when the page is getting drawn decode
+        the image with the QImageReader.
+
+        This is a huge benefit on pages with many images and saves
+        ~2GB of memory on the szeged image test page.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::repetitionCount):
+        (WebCore::ImageDecoderQt::filenameExtension):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        (WebCore::ImageDecoderQt::internalDecodeSize):
+        (WebCore::ImageDecoderQt::internalReadImage):
+        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
+        (WebCore::ImageDecoderQt::forceLoadEverything):
+        (WebCore::ImageDecoderQt::failRead):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make use of RGBA32Buffer in ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Use the RGBA32Buffer instead of the internal ImageData
+        to be able to use support of the base class, optionally
+        support WebCore decoders for Qt and most importantly
+        separate metadata and image data for better cache control.
+
+        Remove ImageSourceQt as everything is now shared with
+        the normal ImageSource.
+
+        Change the ownership of the NativeImagePtr/QPixmap in
+        ImageQt.cpp to delete the m_frame to be subject to cache
+        control.
+
+        * WebCore.pro:
+        * platform/graphics/ImageSource.cpp:
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp: Removed.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::decodedImage):
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp: Added.
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::setDecodedImage):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] ImageDecoderQt avoid QString creation.
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Avoid going from CString to QString to String
+        and go directly from CString to String. Also
+        avoid going to lower case to avoid an extra
+        memory allocation.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Cleanup the ImageDecoder of Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Remove the various enums for partial load. The fact is
+        that this image decoder will decode everything that is
+        in the file at once. Make it look like it behaves to
+        ease fixing this core problem.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageData::ImageData):
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::hasFirstImageHeader):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Reimplement instead of overload frameCount in ImageDecoderQt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Reimplement frameCount instead of overloading it.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameCount):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QImageReader does not support progressive reading
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Change the ImageDecoderQt::setData to store the encoded
+        data in ImageDecoder.
+
+        Only call ReadContext when the whole Resource has been
+        loaded to avoid needless calls to reset and the
+        ReadContext as progressive loading is not supported.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove dead code from ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Remove unused variables and debugging code. The debug
+        code has never been used and does not provide anything
+        useful.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::repetitionCount):
+        (WebCore::ImageDecoderQt::filenameExtension):
+        (WebCore::ImageDecoderQt::imageAtIndex):
+
+2009-10-06  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] segfault when calling gst_video_format_parse_caps in the video sink
+        https://bugs.webkit.org/show_bug.cgi?id=30120
+
+        Fix use of gst_video_format_parse_caps()
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Update mediaControls CSS
+
+        * css/mediaControlsQt.css:
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Get rid of Preferences.ignoreWhitespace.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30092
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent):
+        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.update):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.onpopulate):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.isCaretAtEndOfPrompt):
+        * inspector/front-end/inspector.js:
+        * inspector/front-end/utilities.js:
+        (Node.prototype.rangeOfWord):
+        (traverseNextNode):
+        (traversePreviousNode):
+        (onlyTextChild):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not call nodeTitleInfo twice +
+        followup fixes for r49101.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30087
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Enable painting on printer.
+
+        The print preview dialog crashed because the depth of the drawable
+        changed owing to a bug in Qt - if you draw onto a 32-bit pixmap,
+        and set a 24-bit pixmap as source, it will convert the source to
+        32-bit.
+
+        1210fa5b2d65895ad2be1f9ca7cae586e3b29dc1 is the bug fix in Qt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Make painting and events work when page is zoomed.
+
+        The element gets resized when zoomed. So, we have to make sure that we resize
+        the drawable and do a setwindow call. Multiple calls to setwindow do not
+        crash plugin in windowless mode (unlike in windowed mode).
+
+        For mouse events we have to convert the pos to post-zoom position.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Add PluginQuirkRequiresDefaultScreenDepth quirk for Flash.
+
+        Flash does not use the visual provided by us to draw into the drawable.
+        It instead uses the system default visual (as returned by XDefaultVisual).
+        This means that if the screen default visual is 24-bit, Flash won't be
+        able to draw on 32-bit drawable created by us. This is a bug in Flash
+        and for the moment, the above quirk is only set for Flash.
+
+        Our strategy to create the drawable:
+        1. Create a 32-bit drawable if the default screen depth is 32 or the
+        quirk is not set (i.e not flash)
+        2. If we didn't create a 32-bit drawable (maybe the Display has no such
+        visual), we create a drawable with default screen depth.
+
+        As a result of the above changes, content propagation behavior changes as:
+        1. Content propagation is possible only if the drawable we create and
+        Qt's backing store are of the same depth.
+        2. If we created a 32-bit drawable, there is no need for content
+        propagation (Qt will take care of it).
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        * plugins/PluginQuirkSet.h:
+        (WebCore::):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::getVisualAndColormap):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Qt build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=29362.
+
+        In Qt 4.5, a new function QPainter::fillRect(QRect, QColor) is
+        introduced to avoid the expensive construction of QBrush.
+        By casting WebCore::Color to QColor, we can compile on Qt 4.4
+        and use optimization for solid color fill in Qt 4.5.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::drawBorderlessRectShadow):
+
+2009-10-05  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Eric Carlson.
+
+        Allow the platform media player to know the <video> poster URL.
+        Add MediaPlayerPrivate::prepareToPlay() to support media engines
+        that do not buffer video data automatically. This method allows
+        such media engines to start the buffering just before starting
+        playback.
+        https://bugs.webkit.org/show_bug.cgi?id=29133
+
+        All platforms that currently implement <video> return false
+        in MediaPlayerPrivate::canLoadPoster() and do nothing in
+        MediaPlayerPrivate::prepareToPlay() their behavior is
+        unchanged. The current set of media test should then be
+        sufficient to guarantee that this patch does not break anything.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource):
+        After the MediaPlayer is created, inform it what the poster URL is.
+        (WebCore::HTMLMediaElement::updatePlayState):
+        Add another case where prepareToPlay is called for the platforms
+        that do not buffer video content automatically.
+        (WebCore::HTMLMediaElement::couldPlayIfEnoughData)
+        Same as potentiallyPlaying, except that we don't check for
+        the readyState being at least HAVE_FUTURE_DATA.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::canLoadPoster):
+        Empty implementation for the NullMediaPlayerPrivate.
+        (WebCore::NullMediaPlayerPrivate::setPoster):
+        Empty implementation for the NullMediaPlayerPrivate.
+        (WebCore::MediaPlayer::canLoadPoster):
+        Proxy to the m_private.
+        (WebCore::MediaPlayer::setPoster):
+        Proxy to m_private.
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::canLoadPoster):
+        (WebCore::MediaPlayerPrivateInterface::setPoster):
+        Add new methods that allow the platform player to receive the poster URL.
+        (WebCore::MediaPlayerPrivateInterface::prepareToPlay):
+        Notifies the media engine that playback should start. The media engine
+        should start preparing (e.g. by initializing the player and starting to buffer)
+        and call back when the state is changed to HAVE_FUTURE_DATA.
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        StringImpl needs a method to get an instance for another thread which doesn't copy the underlying buffer.
+        https://bugs.webkit.org/show_bug.cgi?id=30095
+
+        All String::copy methods were changed to call either threadsafeCopy or crossThreadString. The method
+        call was made threadsafeCopy unless I could show that threadsafety wasn't needed.
+
+        No visible change in functionality so no new tests.
+
+        * dom/MessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        (WebCore::IconDatabase::iconForPageURL):
+        (WebCore::IconDatabase::iconURLForPageURL):
+        (WebCore::IconDatabase::retainIconForPageURL):
+        (WebCore::IconDatabase::releaseIconForPageURL):
+        (WebCore::IconDatabase::setIconDataForIconURL):
+        (WebCore::IconDatabase::setIconURLForPageURL):
+        (WebCore::IconDatabase::databasePath):
+        (WebCore::IconDatabase::defaultDatabaseFilename):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin): Since this is used by SecurityOrigin::threadsafeCopy,
+        it makes threadsafe calls.
+        (WebCore::SecurityOrigin::threadsafeCopy): The only place that called this
+        needed a threadsafe method.
+        * page/SecurityOrigin.h:
+        * platform/CrossThreadCopier.cpp:
+        (WebCore::::copy):
+        * platform/KURL.cpp:
+        (WebCore::KURL::copy):
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::copyData):
+        * platform/network/ResourceErrorBase.cpp:
+        (WebCore::ResourceErrorBase::copy):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::copyData):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::copyData):
+        * platform/sql/SQLValue.cpp:
+        (WebCore::SQLValue::SQLValue):
+        (WebCore::SQLValue::string):
+        * platform/sql/SQLValue.h:
+        (WebCore::SQLValue::SQLValue):
+        All constructors now initialize the m_number which is a double. Failure to
+        do so can result in unexpected crashes when it is copied in the copy constructor.
+        See http://blogs.msdn.com/oldnewthing/archive/2008/07/02/8679191.aspx, I was that colleague.
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::threadsafeCopy):
+        (WebCore::String::crossThreadString):
+        * platform/text/StringImpl.cpp:
+        Removed StringImpl::substringCopy which was no longer being used anywhere.
+        (WebCore::StringImpl::threadsafeCopy): Changed the name to indicate that
+        it is threadsafe.
+        (WebCore::StringImpl::crossThreadString): The way to get strings for
+        another thread which is not threadsafe. This shares the underlying buffer
+        with both strings and gives them a way to do threadsafe refcounting for it.
+        * platform/text/StringImpl.h:
+        * storage/ChangeVersionWrapper.cpp:
+        (WebCore::ChangeVersionWrapper::ChangeVersionWrapper):
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap):
+        (WebCore::Database::Database):
+        (WebCore::Database::getVersionFromDatabase):
+        (WebCore::Database::setVersionInDatabase):
+        (WebCore::Database::version):
+        (WebCore::Database::setExpectedVersion):
+        (WebCore::Database::securityOriginCopy):
+        (WebCore::Database::stringIdentifier):
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::scheduleNotifyDatabaseChanged):
+        * storage/OriginQuotaManager.cpp:
+        (WebCore::OriginQuotaManager::addDatabase):
+        * storage/SQLError.h:
+        (WebCore::SQLError::message):
+        (WebCore::SQLError::SQLError):
+        * storage/SQLStatement.cpp:
+        (WebCore::SQLStatement::SQLStatement):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::syncTimerFired):
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::importItem):
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::url): Do the copy of the url in a way that is threadsafe.
+        (WebCore::SharedWorkerProxy::name):
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::DefaultSharedWorkerRepository::getProxy): Do the copy of the url in a way that is threadsafe.
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::Task::Task):
+        (WebCore::WorkerRunLoop::postTaskForMode):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Use X Pixmap instead of QPixmap.
+
+        This has the following advantages:
+        1. Allows more sharing of code between gtk and Qt ports in the future
+        2. QPixmap creates 24-bit by default. We have to later 'upgrade' it to 32-bit.
+        3. QPixmap may sometime change depth behind our back! This will require us to
+        update the plugin about the new visual and colormap.
+        4. We cannot ensure that QPixmap is backed by a X Drawable. For example, with
+        -graphicssystem raster, QPixmap uses the raster (image) backend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add support for windowless NPAPI plugins
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect):
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::setSharedXEventFields):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::setXKeyEventSpecificFields):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::inputEventState):
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::handleFocusInEvent):
+        (WebCore::PluginView::handleFocusOutEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::getPluginDisplay):
+        (WebCore::PluginView::platformStart):
+
+2009-10-05  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Filters do not support source images besides "sourceGraphic"
+        [https://bugs.webkit.org/show_bug.cgi?id=6022]
+
+        Add support for SourceAlpha to SVG filters.
+
+        Test: svg/filters/sourceAlpha.svg
+
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::calculateEffectRect):
+        (WebCore::SourceAlpha::apply):
+        * platform/graphics/filters/SourceAlpha.h:
+
+2009-10-05  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix reliablity bot crash in DateExtension.
+        https://bugs.webkit.org/show_bug.cgi?id=30033
+
+        There were a few problems using the weak persistent pointers because no one else had a
+        handle to them.  The new approach stores them as a hidden value on the Date constructor.
+
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep):
+        (WebCore::DateExtension::GetNativeFunction):
+        (WebCore::DateExtension::Setup):
+        (WebCore::DateExtension::OnSleepDetected):
+        * bindings/v8/DateExtension.h:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore::V8HiddenPropertyName::sleepFunction):
+        * bindings/v8/V8HiddenPropertyName.h:
+
+2009-10-05  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash when trying to load a null stylesheet for a site specific hack. 
+        https://bugs.webkit.org/show_bug.cgi?id=30105
+
+        Created a testcase and tested in browser.  DRT doesn't test
+        site specific hacks.
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+
+2009-10-05  James Robinson  <jamesr@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix forward declaration (struct vs class mismatch)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30094
+
+        * loader/RedirectScheduler.h:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, last Chromium build fix corresponding to revision 49113.
+        Add include for BeforeLoadEvent to DOMObjectsInclude.h.
+
+        * bindings/v8/DOMObjectsInclude.h:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Windows build.
+
+        * html/HTMLMediaElement.cpp:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the build: MediaControllerThemeQT was renamed to MediaControllerThemeQuickTime.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+
+2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
+
+        Reviewed by Simon Fraser
+        
+        Support fullscreen in MediaPlayer (Mac)
+        https://bugs.webkit.org/show_bug.cgi?id=26742
+
+        Add a fullscreen button to the <video> controller if the media engine,
+        and the theme have support for fullscreen, and can show appropriate controls.
+        Clicking the button calls through the ChromeClient to the WebVideoFullscreenController
+        in WebKit to do a nice animation to fullscreen, with a custom controller.
+
+        * DerivedSources.make:
+        * WebCore.Video.exp: Added.
+        New export file for when VIDEO is enabled.
+        
+        * WebCore.base.exp: Export WebCore::HTMLNames::videoTag
+        * WebCore.xcodeproj/project.pbxproj: New files
+        
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement):
+        (WebCore::HTMLMediaElement::willRemove):
+        (WebCore::HTMLMediaElement::screenRect):
+        (WebCore::HTMLMediaElement::enterFullscreen):
+        (WebCore::HTMLMediaElement::exitFullscreen):
+        (WebCore::HTMLMediaElement::platformMedia):
+        Add fullscreen logic. platformMedia returns a pointer to platform-specific playback data
+        used for fullscreen.
+        
+        * html/HTMLVideoElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::supportsFullscreen): Check with both the player and the ChromeClient
+        to see if it's possile to enter fullscreen for this element.
+        
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::supportsFullscreenForNode):
+        (WebCore::ChromeClient::enterFullscreenForNode):
+        (WebCore::ChromeClient::exitFullscreenForNode):
+        New methods
+        
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayer::platformMedia):
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::platformMedia):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        New methods to return platform-specific playback data for fullscreen.
+        
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlFullscreenButtonElement::defaultEventHandler):
+        Hook up the fullscreen button.
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+        Allow the RenderThemeMac to make a decision about the availability of fullscreen based
+        on the QuickTime version, since this affects what controls are availabl.e
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Export a few more methods from Settings.h
+        
+        Rubberstamped by Jon Honeycutt.
+        
+        * WebCore.base.exp:
+
+2009-10-05  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        1-char fix for obviously reverse condition.
+        https://bugs.webkit.org/show_bug.cgi?id=30100
+        No test since the only difference is a timing of GC.
+
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::clear): Revert condition. Almost a typo.
+
+2009-09-30  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Update platform-specific #ifdefs in GraphicsContext3D.h for the
+        Chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=29936
+
+        * platform/graphics/GraphicsContext3D.h:
+        Changed #if PLATFORM(SKIA) to #if PLATFORM(CHROMIUM).
+
+2009-10-05  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r47440): Inserting text in the middle of content in a scrolled textfield results in painting bugs
+        <rdar://problem/7269108>
+        https://bugs.webkit.org/show_bug.cgi?id=29982
+
+        Test: fast/repaint/line-in-scrolled-clipped-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock): Use the unclipped overflow rect
+        (including layout overflow) for the repaint rect calculation.
+
+2009-10-05  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Chromium wants to turn off SharedWorkers at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=29757
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::sharedWorker):
+        Now returns jsUndefined if isAvailable() returns false, to allow SharedWorkers to be disabled at runtime.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerRepository::isAvailable):
+        Made SharedWorkers available by default.
+        * workers/SharedWorkerRepository.h:
+        Added definition for SharedWorkerRepository::isAvailable().
+
+2009-10-05  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        A super quick fix for Bug 28710.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28710
+
+        This change just resets the style sent to addStyleMarkup() to avoid an assertion error
+        and creates an empty style when computedStyleAtPosition is 0 to avoid a crash.
+        (This change is nothing but a better-than-crash change.)
+
+        Tests: editing/selection/select-crash-001.html
+               editing/selection/select-crash-002.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::editingStyleAtPosition): Resets the style sent to addStyleMarkup() if it is not valid.
+        * editing/markup.cpp:
+        (WebCore::createMarkup): Creates an empty style if computedStyleAtPosition is 0.
+
+2009-10-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Silence duplicate errors logged for missing getComputedStyle
+        implementations. Improves the error message as well.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::logUnimplementedPropertyID):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix #3.  Add V8BeforeLoadEvent.[cc|h] to derived sources.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+
+2009-10-05  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the GTK build.
+
+        * GNUmakefile.am:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix #2.  Add new BEFORELOADEVENT to V8ClassIndex.
+
+        * bindings/v8/V8Index.h:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix.  Missing "," after entry for BeforeLoadEvent.idl. 
+
+        * WebCore.gypi:
+
+2009-10-05  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a beforeload event that will be fired before subresources load. (It isn't fired yet.)  The event
+        has one field, the URL that is going to be requested.  Setting preventDefault will stop the load
+        from occurring.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/BeforeLoadEvent.h: Added.
+        (WebCore::BeforeLoadEvent::create):
+        (WebCore::BeforeLoadEvent::initBeforeLoadEvent):
+        (WebCore::BeforeLoadEvent::url):
+        (WebCore::BeforeLoadEvent::BeforeLoadEvent):
+        * dom/BeforeLoadEvent.idl: Added.
+        * dom/EventNames.h:
+        * page/DOMWindow.idl:
+
+2009-10-05  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Add Gentoo-specific paths for searching browser plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=30088
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::defaultPluginDirectories):
+
+2009-10-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Add functionality to pause/throttle CSS transitions/animations in a WebView
+        https://bugs.webkit.org/show_bug.cgi?id=29942
+
+        Exporting call from AnimationController
+
+        * WebCore.base.exp:
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Rubberstamped by Anders Carlsson.
+        
+        * WebCore.base.exp: Update export of HaltablePlugin/PluginHalterClient.
+        * WebCore.xcodeproj/project.pbxproj: Likewise.
+
+2009-10-05  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r49104.
+        http://trac.webkit.org/changeset/49104
+
+        * html/HTMLInputElement.cpp:
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Update style immediately when validation-related values are updated.
+        https://bugs.webkit.org/show_bug.cgi?id=28868
+
+        In order to apply :valid, :invalid, :optional or :required lively,
+          - call setNeedsStyleRecalc() when properties which can change
+            willValidate state are updated, and
+             (Parent form element, name, disabled, readonly)
+          - call updateValidity() when properties which can change validity
+            state are updated. (value, pattern, required)
+
+        Tests: fast/forms/input-live-pseudo-selectors.html
+               fast/forms/textarea-live-pseudo-selectors.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        (WebCore::HTMLFormControlElement::required):
+        (WebCore::HTMLFormControlElement::updateValidity):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setValue):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+
+        Tests: fast/forms/ValidityState-rangeOverflow-number.html
+               fast/forms/ValidityState-rangeOverflow-range.html
+               fast/forms/ValidityState-rangeUnderflow-number.html
+               fast/forms/ValidityState-rangeUnderflow-range.html
+               fast/forms/input-minmax.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::rangeMinimum):
+        (WebCore::HTMLInputElement::rangeMaximum):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduces
+         - new CSS pseudo selector: "-webkit-input-list-button"
+         - new CSS apperance type: "list-button"
+         - new ControlPart value: "ListButtonPart"
+        for the UI of the list attribute of the input element, and adds
+        implementation to draw ListButtonPart on Mac.
+        The code is guarded by ENABLE(DATALIST).
+
+        https://bugs.webkit.org/show_bug.cgi?id=27794
+
+        Test: platform/mac/fast/forms/input-list-button-size.html
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * css/CSSValueKeywords.in:
+        * css/html.css:
+        * html/HTMLInputElement.cpp:
+        * platform/ThemeTypes.h:
+        (WebCore::):
+        * platform/mac/ThemeMac.mm:
+        (WebCore::listButtonSizes):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeMac::controlSize):
+        (WebCore::ThemeMac::minimumControlSize):
+        (WebCore::ThemeMac::controlBorder):
+        (WebCore::ThemeMac::paint):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::paintBorderOnly):
+        (WebCore::RenderTheme::paintDecorations):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustRepaintRect):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-10-05  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30065>
+        nodeTitleInfo should be placed in ElementsTreeOutline.
+        
+        Move nodeTitleInfo into ElementsTreeOutline.js from utilities.js.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
+        * inspector/front-end/utilities.js:
+
+2009-10-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Inform the application when a new request is created
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        Emit a signal each time a request is created, with the request and the frame
+        that created it.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-10-05  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        Add an ASSERT in updateGuidVersionMap.
+        https://bugs.webkit.org/show_bug.cgi?id=30077
+
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap): ASSERT that the guidMutex() is locked.
+
+2009-10-05  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow V8 to throw an exception in _NPN_SetException without worrying about context
+        if we don't have enough information to find the correct context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30026
+
+        Part of the fix for Chromium's failure of LayouTests/plugins/netscape-throw-exception.html.
+
+        * bindings/v8/NPV8Object.cpp: 
+        (_NPN_SetException): Don't suppress the exception if we can't find the relevant context.
+
+2009-10-05  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Place "Close" button in docked mode on the same side as the window "Close" button in detached mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29961
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-10-05  J-P Nurmi  <jpnurmi@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Added pure virtual QWebPageClient::pluginParent()
+
+        https://bugs.webkit.org/show_bug.cgi?id=29710
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-05  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] windowsKeyCodeForKeyEvent() returns a wrong value for the F10 key.
+        https://bugs.webkit.org/show_bug.cgi?id=30042
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-10-05  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix for ENABLE(WEB_SOCKETS) and v8.
+
+        V8ObjectEventListener.h has been removed at r48978
+
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+
+2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector console stops working while JS in IFRAME is paused.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29958
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce inspected object groups for console
+        and watch evaluation results so that they could be released
+        explicitly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29891
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::wrapObject):
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::wrapObject):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        (WebCore::InspectorController::releaseWrapperObjectGroup):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.evaluateInCallFrame):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSection.prototype.update):
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Move mediaControls extras for the Qt port into WebCore/css like other ports
+
+        https://bugs.webkit.org/show_bug.cgi?id=30013
+
+        * WebCore.pro:
+        * WebCore.qrc:
+        * css/mediaControlsQt.css: Renamed from WebCore/css/qt/mediaControls-extras.css.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::extraMediaControlsStyleSheet):
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Rename WebCore/css/mediaControlsQT.css and MediaControllerThemeQT
+
+        https://bugs.webkit.org/show_bug.cgi?id=30013
+
+        The QT suffix has been expanded to QuickTime, to not cause confusion
+        and name-crashes with similar files in the Qt port.
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/mediaControlsQuickTime.css: Renamed from WebCore/css/mediaControlsQT.css.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::):
+        (WebCore::mediaControllerTheme):
+        (WebCore::RenderThemeMac::adjustSliderThumbSize):
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeMac::extraMediaControlsStyleSheet):
+
+2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30064>
+        Syntax Highlighting CSS shouldn't be duplicated.
+
+        Refactor syntax highlighting CSS into a new file, add it to the
+        projects, and have SourceFrame.js and inspector.html include the
+        new CSS file.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspectorSyntaxHighlight.css: Added.
+        * inspector/front-end/WebKit.qrc:
+
+2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30062>
+        Inspector should syntax highlight JS/CSS in elements view.
+
+        Add syntax highlighting of CSS and JavaScript tags to the elements panel.
+        Copied CSS rules from SourceFrame.js to inspector.css, and have the text nodes
+        in utilities.js call the CSS or JS Syntax highlighters if their parent is a script
+        or style tag.
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/utilities.js:
+
+2009-10-04  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Enable Web Sockets in chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=29917
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustova Noronha.
+
+        [GTK] performs a POST when refreshing a view that was obtained with a GET
+        https://bugs.webkit.org/show_bug.cgi?id=29761
+
+        Update the HTTP method in the request stored by willSendRequest
+        after a redirect, since it could have changed.
+
+        Test: http/tests/navigation/postredirect-reload.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Revert previous patch, as the newly added test breaks other tests.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustova Noronha.
+
+        [GTK] performs a POST when refreshing a view that was obtained with a GET
+        https://bugs.webkit.org/show_bug.cgi?id=29761
+
+        Update the HTTP method in the request stored by willSendRequest
+        after a redirect, since it could have changed.
+
+        Test: http/tests/navigation/postredirect-reload.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Fixed Function leak in V8LazyEventListener.
+        (Should fix the remaning leak in
+        https://bugs.webkit.org/show_bug.cgi?id=29093).
+        V8LazyEventListeners used to create FunctionTemplates for each
+        wrapped listener which in turn created Functions that were cached
+        forever in V8 Context. Now there is at most one such Function per
+        Context.
+        https://bugs.webkit.org/show_bug.cgi?id=30060
+
+        Added new hidden property name to store toString result:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        * bindings/v8/V8HiddenPropertyName.h:
+
+        Switched to static FunctionTemplate:
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListenerToString):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        CSS Source View Should be Syntax Highlighted
+        https://bugs.webkit.org/show_bug.cgi?id=14359
+
+          Support for WebKit's CSS Variables @variables and var()
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.CSSSourceSyntaxHighligher):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector should remember preferences for docked/undocked etc
+        https://bugs.webkit.org/show_bug.cgi?id=29089
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources): toggle the preference
+        * inspector/front-end/inspector.js:
+        (WebInspector._loadPreferences): factored out loading preferences
+        (WebInspector.loaded):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        CSS Source View Should be Syntax Highlighted
+        https://bugs.webkit.org/show_bug.cgi?id=14359
+
+          Trigger the Syntax Highlighter for CSS files.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.syntaxHighlightJavascript):
+        (WebInspector.SourceFrame.prototype.syntaxHighlightCSS):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._contentLoaded):
+
+          Factored out the Syntax Highlighting procedure into a "Class"
+          Added CSSSourceSyntaxHighlighter and JavaScriptSourceSyntaxHighlighter
+
+        (WebInspector.SourceSyntaxHighligher):
+        (WebInspector.SourceSyntaxHighligher.prototype.createSpan):
+        (WebInspector.SourceSyntaxHighligher.prototype.process.processChunk):
+        (WebInspector.SourceSyntaxHighligher.prototype.process):
+        (WebInspector.CSSSourceSyntaxHighligher): the CSS Highlighter
+        (WebInspector.JavaScriptSourceSyntaxHighligher): the JS Highlighter
+
+2009-10-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Factor back-forward list methods out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30037
+
+        This change moves these back-forward related methods from FrameLoader
+        to Page.  It's possible we should move these methods into some kind of
+        "page controller" object, but we can figure that out in a future patch.
+
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close):
+        * page/History.cpp:
+        (WebCore::History::length):
+        * page/Page.cpp:
+        (WebCore::Page::canGoBackOrForward):
+        (WebCore::Page::goBackOrForward):
+        (WebCore::Page::getHistoryLength):
+        * page/Page.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: prepare InspectorController for being used from layout tests.
+        This change adds evaluateForTestInFrontend method with the callback that
+        allows evaluating arbitrary code in the frontend context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30008
+
+        * WebCore.Inspector.exp:
+        * WebCore.order:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::didEvaluateForTestInFrontend):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+        (WebCore::InspectorController::didEvaluateForTestInFrontend):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Node search mode is not getting reset on element selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30016
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30036>
+        Should be able to resize Cookie Columns.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.resize):
+
+2009-09-25  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Make WebCore::PluginView participate in plug-in halting.
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/BitmapImage.h:
+        Declare a create() function that takes an HBITMAP.
+
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::create):
+        Use GetObject() to fill out a DIBSECTION structure for the given
+        HBITMAP. Call CGBitmapContextCreate() to create a CG context from the
+        bits of the bitmap. Create a CG image from the context, and pass this
+        when creating a new BitmapImage.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        If we successfully started, tell our parent frame's Page.
+        (WebCore::PluginView::stop):
+        Tell our parent frame's Page that we stopped.
+        (WebCore::PluginView::node):
+
+        * plugins/PluginView.h:
+        Inherit from HaltablePlugin.
+        (WebCore::PluginView::setPlatformPluginWidget):
+        On platforms where the platform plug-in widget is the WebCore::Widget's
+        platform widget, have setPlatformPluginWidget() call
+        setPlatformWidget().
+
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::platformDestroy):
+        After destroying the window, set the platform plug-in widget to 0 to
+        ensure that Widget isn't holding a stale handle.
+        (WebCore::PluginView::halt):
+        Have our element's RenderWidget display a screenshot of the plug-in,
+        then stop the plug-in and destroy it.
+        (WebCore::PluginView::restart):
+        Clear the RenderWidget's substitute image, then start the plug-in.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::showSubstituteImage):
+        Set m_substituteImage to the passed image, and repaint.
+        (WebCore::RenderWidget::paint):
+        If we have a substitute image, paint that instead of allowing the
+        widget to paint itself.
+
+        * rendering/RenderWidget.h:
+        Declare showSubstituteImage(). Added a member to store the substitute
+        image.
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move PolicyCheck out of FrameLoader.{h,cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=30035
+
+        Purely code motion (and adding a destructor).
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/PolicyCheck.cpp:
+        * loader/PolicyCheck.h:
+
+2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Add NPNVToolkit value quirk in plugins for nspluginwrapper.
+        Plugin error message was:
+        ERROR: failed to initialize brower-side RPC events listener
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        (WebCore::staticPluginQuirkRequiresGtkToolKit_NPN_GetValue):
+        (WebCore::PluginPackage::load):
+
+2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] X sync our XEmbed container window creation before sending the
+        xid to plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Setting zero size on a container of a video element doesn't hide the controller
+        https://bugs.webkit.org/show_bug.cgi?id=30031
+        
+        Fix a logic error in enclosingCompositingLayer() when mixing normal flow and 
+        positioned layers. This resulted in enclosingCompositingLayer() giving back a different
+        answer to the logic used to actually parent compositing layers, so layer positions
+        and layer hierarchy would be out of agreement.
+        
+        Test: compositing/geometry/clipped-video-controller.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::compositingContainer):
+        (WebCore::RenderLayer::enclosingCompositingLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::setCompositingParent):
+
+2009-10-02  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Move the following methods of HTMLInputElement and HTMLTextAreaElement
+          to HTMLTextFormControlElement.
+           setSelectionStart()
+           setSelectionEnd()
+           select()
+           setSelectionRange()
+           selectionStart()
+           selectionEnd()
+           selection()
+
+        - Introduce cachedSelectionStart() and cachedSelectionEnd().
+
+        - Unify HTMLInputElement::isTextFieldWithRenderer() and
+         HTMLTextAreaElement::rendererAfterUpdateLayout() into textRendererAfterUpdateLayout().
+        
+        - Unify a part of parseMappedAttribute() of HTMLInputElement and HTMLTextAreaElement.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29782
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::textRendererAfterUpdateLayout):
+        (WebCore::HTMLTextFormControlElement::setSelectionStart):
+        (WebCore::HTMLTextFormControlElement::setSelectionEnd):
+        (WebCore::HTMLTextFormControlElement::select):
+        (WebCore::HTMLTextFormControlElement::setSelectionRange):
+        (WebCore::HTMLTextFormControlElement::selectionStart):
+        (WebCore::HTMLTextFormControlElement::selectionEnd):
+        (WebCore::HTMLTextFormControlElement::selection):
+        (WebCore::HTMLTextFormControlElement::parseMappedAttribute):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::select):
+        (WebCore::HTMLInputElement::cachedSelectionStart):
+        (WebCore::HTMLInputElement::cachedSelectionEnd):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::cachedSelectionStart):
+        (WebCore::HTMLTextAreaElement::cachedSelectionEnd):
+
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Disconnect event listeners on navigation.
+        Fixes http://crbug.com/23597.
+        https://bugs.webkit.org/show_bug.cgi?id=30027
+
+        Added V8ListenerGuard that is shared by listeners and proxy. On
+        navigation proxy sets a flag in the guard turning off listeners.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8ListenerGuard::create):
+        (WebCore::V8ListenerGuard::isDisconnected):
+        (WebCore::V8ListenerGuard::disconnectListeners):
+        (WebCore::V8ListenerGuard::V8ListenerGuard):
+        (WebCore::V8AbstractEventListener::disconnected):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::disconnectEventListeners):
+        (WebCore::V8Proxy::clearForNavigation):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::listenerGuard):
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create):
+
+2009-10-02  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [chromium] Fix WebGL build after CustomGetter constructor changes
+        https://bugs.webkit.org/show_bug.cgi?id=30020
+
+        * page/DOMWindow.idl:
+        Changed CustomGetter to JSCCustomGetter for CanvasArray constructors.
+
+2009-10-02  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: text in a "Request Payload" section disappears on selection
+        https://bugs.webkit.org/show_bug.cgi?id=29967
+
+        No new tests.
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshRequestPayload):
+
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Recursion guard for V8Proxy::callFunction.
+        Fixes http://crbug.com/23278.
+        https://bugs.webkit.org/show_bug.cgi?id=29974
+
+        Test: fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::callFunction):
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix test breakages by adding null checks, and putting inspector code in
+        ENABLE(INSPECTOR).
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent):
+
+2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Clean up the QNetworkReplyHandler to only apply HTTP headers
+        for protocols in the HTTP family.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Move error check into sendResponseIfNeeded() as suggested
+        by Eric Seidel. Also, remove some dead code.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-10-02  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Assertion failure in CompositeEditCommand::moveParagraphs() and crash in Node::nodeIndex() when pasting.
+        <rdar://problem/7148712>
+        https://bugs.webkit.org/show_bug.cgi?id=28992
+
+        Test: editing/selection/replace-selection-crash.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded): Handle properly the case of
+        the destination position matching the end of the paragraph to move.
+
+2009-10-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement per-storage-area quotas for LocalStorage
+        https://bugs.webkit.org/show_bug.cgi?id=29991
+
+        I put 90% of the code in StorageMap since the decision to allow an update is
+        closely tied to quota tracking.  The quota is set via a page's Settings class.
+        Like with the local storage path and whether it's enabled, it's assumed that
+        all pages in the same group will have the same settings.  The setting defaults
+        to 5mb which is what the spec suggests, but it can easily be changed to
+        anything else--including StorageMap::noQuota.  Any values in LocalStorage are
+        grandfathered in regarudless of quota, so importItem only tracks (and will
+        never block) imports.
+
+        I believe this change is a good transition to more complex quota management.
+        For example, if we wanted to track quotas in the SQLite DB, then we'd just add
+        a function to the StorageMap that sets the quota.  This would be fine since all
+        use of LocalStorage is blocked on the import completing, so you'd never hit a
+        quota error in the mean time.  Also, if embedders wanted to ask the user
+        whether to expand the quota whenever it's hit (before deciding whether or not
+        to raise an exception), a callback via the chrome client should be fairly easy.
+        That said, I think it's best to add these features in steps rather than one
+        huge patch.  (Both of these are on my TODO list, btw.)
+
+        Included is a layout test that verifies the behavior.  It assumes the default
+        quota is 5mb (since that's what Settings defaults to).
+
+        Test: storage/domstorage/localstorage/quota.html
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::localStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setLocalStorageQuota):
+        * page/Settings.h:
+        (WebCore::Settings::localStorageQuota):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::create):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::create):
+        (WebCore::StorageMap::StorageMap):
+        (WebCore::StorageMap::copy):
+        (WebCore::StorageMap::setItem):
+        (WebCore::StorageMap::removeItem):
+        (WebCore::StorageMap::importItem):
+        * storage/StorageMap.h:
+        (WebCore::StorageMap::quota):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::localStorageNamespace):
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::localStorageNamespace):
+        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-10-02  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Database Inspector crashes Safari when table has more than 21 columns
+        https://bugs.webkit.org/show_bug.cgi?id=29924
+
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.dataGridForResult): adjust the minimum column width percentage to be flexible for many columns.
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/14370>.
+        Inspector's timeline should record when certain DOM events fired.
+        
+        This patch adds calls into the Web Inspector when the main frame
+        fires an load event, and when the document fires its DOMContent
+        event. Once these values are passed in, they are sent to the Web Inspector
+        as a timing change, and these are denoted by vertical lines in the resources
+        panel (blue for DOM Content, red for load event).
+
+        * English.lproj/localizedStrings.js: Added tooltip text.
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing): Added an Inspector callback for DOM Content.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent): Tell the main resource it got the event.
+        (WebCore::InspectorController::mainResourceFiredLoadEvent): Ditto.
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource): Added new variables.
+        (WebCore::InspectorResource::updateScriptObject): Send new variables to inspector.js.
+        (WebCore::InspectorResource::markDOMContentEventTime): Send a TimingChange event.
+        (WebCore::InspectorResource::markLoadEventTime): Ditto.
+        * inspector/InspectorResource.h:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.get mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded): Draw dividers for event timings.
+        (WebInspector.ResourceTimeCalculator.prototype.computePercentageFromEventTime):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent): Add an Inspector callback for the Load event.
+
+2009-10-02  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add support for blacklist patterns to user stylesheets and scripts in addition to whitelist patterns.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::pageGroupUserSheets):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScript):
+        (WebCore::PageGroup::addUserStyleSheet):
+        (WebCore::PageGroup::removeUserContentWithURLForWorld):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        * page/PageGroup.h:
+        * page/UserContentURLPattern.cpp:
+        (WebCore::UserContentURLPattern::matchesPatterns):
+        * page/UserContentURLPattern.h:
+        * page/UserScript.h:
+        (WebCore::UserScript::UserScript):
+        (WebCore::UserScript::whitelist):
+        (WebCore::UserScript::blacklist):
+        * page/UserStyleSheet.h:
+        (WebCore::UserStyleSheet::UserStyleSheet):
+        (WebCore::UserStyleSheet::whitelist):
+        (WebCore::UserStyleSheet::blacklist):
+
+2009-10-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Build fix when SVG is not enabled
+        https://bugs.webkit.org/show_bug.cgi?id=30011
+
+        Move TextRenderingMode related functions out from
+        the ENABLE(SVG) guard.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
+
+2009-10-02  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        WebGL crashes with recent CanvasArray change
+        https://bugs.webkit.org/show_bug.cgi?id=30018
+
+        Test: fast/canvas/webgl/array-unit-tests.html
+
+        * html/canvas/CanvasArray.cpp:
+        (WebCore::CanvasArray::CanvasArray):
+        Fix bug where PassRefPtr was tested after transferring value to RefPtr.
+
+2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=29989>
+        Safari version number shouldn't be exposed in WebKit code
+        
+        For a WebKit version of 532.3.4:
+        Product version is: 5.32.3.4 (was 4.0.3.0)
+        File version is: 5.32.3.4 (was 4.532.3.4)
+
+        * WebCore.vcproj/QTMovieWin.rc:
+
+2009-10-02  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Enable two point radial gradients in Chromium/Skia.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30017
+
+        Covered by the following tests:
+
+        LayoutTests/svg/W3C-SVG-1.1/pservers-grad-13-b.svg
+        LayoutTests/fast/backgrounds/svg-as-background-3.html
+        LayoutTests/fast/gradients/generated-gradients.html
+        LayoutTests/fast/gradients/simple-gradients.html
+
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::platformGradient):
+
+2009-10-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Conditionally guard cursor code (cursor and updateCursor functions) with !QT_NO_CURSOR.
+        Otherwise, it is inconsistent with class declaration of QCursor.
+
+        No new tests.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] missing support for anamorphic PAR video size
+        https://bugs.webkit.org/show_bug.cgi?id=29717
+
+        cleanup of caps handling in the video sink
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_set_caps):
+
+2009-10-02  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compiler warnings about unused function arguments.
+
+        * bridge/qt/qt_class.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::initializeParserContext):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::setPlatformFont):
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setURLForRect):
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::setEndTime):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
+        * platform/graphics/qt/StillImageQt.h:
+        (WebCore::StillImage::destroyDecodedData):
+        * platform/network/qt/DnsPrefetchHelper.h:
+        (WebCore::DnsPrefetchHelper::lookedUp):
+        * platform/qt/ContextMenuQt.cpp:
+        (WebCore::ContextMenu::setPlatformDescription):
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::populate):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::supportsFocusRing):
+        (WebCore::RenderThemeQt::systemFont):
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeQt::paintMediaSeekBackButton):
+        (WebCore::RenderThemeQt::paintMediaSeekForwardButton):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::platformAddChild):
+        * platform/qt/SearchPopupMenuQt.cpp:
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        * platform/qt/TemporaryLinkStubs.cpp:
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::paint):
+        * xml/XSLStyleSheetQt.cpp:
+        (WebCore::XSLStyleSheet::loadChildSheet):
+        (WebCore::XSLStyleSheet::setParentStyleSheet):
+        * xml/XSLTProcessorQt.cpp:
+        (WebCore::XSLTMessageHandler::handleMessage):
+        (WebCore::XSLTProcessor::transformToString):
+
+2009-10-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] missing support for anamorphic PAR video size
+        https://bugs.webkit.org/show_bug.cgi?id=29717
+
+        Scale the cairo surface of the video sink depending on the
+        pixel-aspect-ratio of the video buffer to paint. Also
+        destruct/re-create the surface when setSize() is called with a new
+        size.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::setSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-02  Ben Murdoch  <benm@google.com>
+
+        Reviewed by David Kilzer.
+
+        Stale database version persists through browser refresh (changeVersion doesn't work)
+        https://bugs.webkit.org/show_bug.cgi?id=27836
+
+        Tests: storage/change-version-handle-reuse.html
+               storage/change-version.html
+
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Implement the V8 binding for database.changeVersion().
+        (WebCore::createTransaction): Fix a bug that was checking the wrong argument index to save the success callback.
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap): Safely update the Guid/version hash map.
+        (WebCore::Database::~Database): Remove code that removes the database from the guid->database and guid->version maps.
+        (WebCore::Database::setVersionInDatabase): Add a comment to explain some behaviour.
+        (WebCore::Database::close): Move the code that updates the maps from the destructor to here.
+        (WebCore::Database::performOpenAndVerify): Call updateGuidVersionMap instead of setting the hash map directly.
+        (WebCore::Database::setExpectedVersion): Update the in memory guid->version map when we want to update the database version.
+
+2009-10-02  Janne Koskinen <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Partial WINSCW build fix.
+
+        Add parentheses around the function pointer declaration, similar to the
+        second hunk in r48825.
+
+        * loader/CachedResourceHandle.h:
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempted build fix by Xcode magic.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.  Actually add the new files.
+
+        * loader/RedirectScheduler.cpp: Added.
+        (WebCore::ScheduledRedirection::):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        * loader/RedirectScheduler.h: Added.
+
+2009-10-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move RedirectScheduler to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=29952
+
+        This change is purely code motion.
+
+        No behavior change.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/RedirectScheduler.cpp: Added.
+        (WebCore::ScheduledRedirection::):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        * loader/RedirectScheduler.h: Added.
+
+2009-10-02  Dave MacLachlan  <dmaclach@gmail.com>
+
+        Reviewed by David Levin.
+
+        Clean up warnings in WebCore/bindings/v8/npruntime.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=29971
+
+        Gets rid of warnings on gcc about using anonymous namespaces 
+          warning: 'StringKeyHashTraits' has a base
+          'WTF::GenericHashTraits<<unnamed>::StringKey>' 
+          whose type uses the anonymous namespace
+        and
+          warning: 'WTF::PairHashTraits<StringKeyHashTraits,
+          WTF::HashTraits<PrivateIdentifier*> >' has a base
+          'WTF::GenericHashTraits<std::pair<<unnamed>::StringKey,
+          PrivateIdentifier*> >' whose type uses the anonymous namespace
+
+        No tests required.
+
+        * bindings/v8/npruntime.cpp:
+
+2009-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Turn on ENABLE_3D_CANVAS in TOT
+        https://bugs.webkit.org/show_bug.cgi?id=29906
+
+        Fixed a bug found when running tests with flag on
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.base.exp:
+        * bindings/js/JSCanvasArrayBufferConstructor.h:
+        (WebCore::construct):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * html/canvas/CanvasArray.cpp:
+        (WebCore::CanvasArray::CanvasArray):
+        * html/canvas/CanvasByteArray.cpp:
+        (WebCore::CanvasByteArray::create):
+        * html/canvas/CanvasFloatArray.cpp:
+        (WebCore::CanvasFloatArray::create):
+        * html/canvas/CanvasIntArray.cpp:
+        (WebCore::CanvasIntArray::create):
+        * html/canvas/CanvasShortArray.cpp:
+        (WebCore::CanvasShortArray::create):
+        * html/canvas/CanvasUnsignedByteArray.cpp:
+        (WebCore::CanvasUnsignedByteArray::create):
+        * html/canvas/CanvasUnsignedIntArray.cpp:
+        (WebCore::CanvasUnsignedIntArray::create):
+        * html/canvas/CanvasUnsignedShortArray.cpp:
+        (WebCore::CanvasUnsignedShortArray::create):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setWebGLEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::webGLEnabled):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/7264725> Re-add a vendor prefix to box-
+        shadow (29927)
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29927
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::ShadowParseContext::ShadowParseContext):
+        (WebCore::ShadowParseContext::commitValue):
+        (WebCore::ShadowParseContext::commitLength):
+        (WebCore::ShadowParseContext::commitColor):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        At bad merge at some point in the development of my patch must have 
+        put TextRenderMode.h in a weird spot in the xcodeproj. Moving it 
+        back where it belongs!
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove FrameLoader::schedule* APIs
+        https://bugs.webkit.org/show_bug.cgi?id=29950
+
+        Change clients of FrameLoader::schedule* to call redirectScheduler
+        directly.
+
+        No behavior change.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::navigateIfAllowed):
+        (WebCore::JSLocation::reload):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::navigateIfAllowed):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::processHttpEquiv):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::receivedFirstData):
+        * loader/FrameLoader.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        * page/History.cpp:
+        (WebCore::History::back):
+        (WebCore::History::forward):
+        (WebCore::History::go):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Just removing a comment I accidentally committed earlier. 
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+
+2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Clean up use of const and mutable in StorageMap
+        https://bugs.webkit.org/show_bug.cgi?id=29933
+
+        What's the point of having every single member variable be mutable and nearly
+        every method be const?  Let's clean it up.
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::setIteratorToIndex):
+        (WebCore::StorageMap::key):
+        (WebCore::StorageMap::importItem):
+        * storage/StorageMap.h:
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6934421> Support CSS for Text Kerning and 
+        ligature
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=6136
+
+        This patch makes the SVG CSS property text-rendering work with any 
+        HTML, much like it does in Firefox. It accepts four possible input 
+        values: auto, optimizeSpeed, optimizeLegibility, and 
+        geometricPrecision. Right now, in this implementation, here is what 
+        those values correspond to:
+
+        auto = optimizeSpeed = what we normally when the value's not set
+        optimizeLegibility = geometricPrecision = ligatures kerning
+
+        Add new file TextRenderingMode.h to the project files.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        CSS support for the new CSSPropertyTextRendering
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+
+        All the old SVG CSS support for this property can go away. When 
+        it's used in SVG, it will just fall into the normal HTML case.
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/SVGCSSPropertyNames.in:
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+        * css/SVGCSSValueKeywords.in:
+
+        FontDescription stores the m_textRendering bit.
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::textRenderingMode):
+        (WebCore::FontDescription::setTextRenderingMode):
+        (WebCore::FontDescription::operator==):
+
+        We want to fall into the complex text rendering code path if 
+        kerning and ligatures have been enabled with this property.
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::canUseGlyphCache):
+
+        Now takes a TextRenderingMode as a parameter.
+        * platform/graphics/SimpleFontData.h:
+
+        New header for the enum.
+        * platform/graphics/TextRenderingMode.h: Added.
+        (WebCore::):
+
+        getCFStringAttributes() now takes a TextRenderingMode as an 
+        attribute.
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::collectCoreTextRunsForCharacters):
+
+        Enable kerning and ligatures whenever the TextRenderingMode is 
+        OptimizeLegibility or GeometricPrecision
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::disableLigatures):
+        (WebCore::initializeATSUStyle):
+        (WebCore::ATSULayoutParameters::initialize):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+
+        More SVG CSS stuff that isn't needed anymore since SVG will use the 
+        new HTML CSS implementation.
+        * rendering/style/SVGRenderStyle.h:
+        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
+        (WebCore::SVGRenderStyle::setBitDefaults):
+        * rendering/style/SVGRenderStyleDefs.h:
+
+2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Use isClosure property of scope proxy to decide whether the
+        scope is a closure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29965
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-10-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Odd color transitions on anchors with transition-property: all
+        https://bugs.webkit.org/show_bug.cgi?id=29911
+
+        When transitioning maybe-invalid colors, if the source and destination
+        color are both invalid, then don't animate.
+        
+        This fixes an issue where a child element of an element running a color
+        transition, with -webkit-transition-property:all, would show a color change.
+        This happened because the "maybe invalid color" logic copied the color style
+        into -webkit-text-fill-color for both endpoints, causing -webkit-text-fill-color
+        to animate while the transition ran, and to then to disappear when the transition
+        finished.
+        
+        Test: transitions/color-transition-all.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperMaybeInvalidColor::equals):
+        (WebCore::PropertyWrapperMaybeInvalidColor::blend):
+
+2009-10-01  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Allow dragging a node who has child nodes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28632
+
+        Test: fast/events/drag-parent-node.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldDragAutoNode):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] media player: better mute support
+        https://bugs.webkit.org/show_bug.cgi?id=29960
+
+        Handle volume and mute state with the two corresponding properties
+        of playbin2.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::setVolume):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] video sink pad template colorspace is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=29953
+
+        Set sink pad template colorspace depending on byte order.
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-01  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Refactored V8 event listeners:
+        (This change should fix http://crbug.com/21079 and
+        https://bugs.webkit.org/show_bug.cgi?id=29093.)
+         o All listeners use weak handles to JS objects to avoid creating
+           cycles and leaking memory.
+         o "Object" variants of listeners removed.
+         o All event accessor callbacks are generated.
+         o Custom event accessors removed.
+         o All wrappers have hidden dependencies on their listeners to
+           prevent listeners from being collected.
+         o All variats of getEventListener function grouped in V8DOMWrapper.
+         o Pointers to C+EventListener wrappers are stored in JS objects
+           instead of event listener lists.
+        https://bugs.webkit.org/show_bug.cgi?id=29825
+
+        * WebCore.gypi: Removed "Object" listeners.
+        * bindings/scripts/CodeGeneratorV8.pm: Now handles event accessors.
+        * bindings/v8/DOMObjectsInclude.h:
+
+        V8AbstractEventListener manages weak JS handle:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::weakEventListenerCallback):
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        (WebCore::V8AbstractEventListener::setListenerObject):
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::cast):
+        (WebCore::V8AbstractEventListener::isLazy):
+        (WebCore::V8AbstractEventListener::getListenerObject):
+        (WebCore::V8AbstractEventListener::getExistingListenerObject):
+        (WebCore::V8AbstractEventListener::hasExistingListenerObject):
+        (WebCore::V8AbstractEventListener::disconnectFrame):
+        (WebCore::V8AbstractEventListener::disconnected):
+        (WebCore::V8AbstractEventListener::prepareListenerObject):
+        (WebCore::V8AbstractEventListener::lineNumber):
+        (WebCore::V8AbstractEventListener::virtualisAttribute):
+
+        Grouped getEventListener functions:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8DOMWrapper.h:
+
+        Removed most event listener objects bookkeeping:
+        * bindings/v8/V8EventListenerList.cpp:
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findWrapper):
+        (WebCore::V8EventListenerList::clearWrapper):
+        (WebCore::V8EventListenerList::doFindWrapper):
+        (WebCore::V8EventListenerList::getHiddenProperty):
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+
+        Added hidden properties for storing EventListener wrappers:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore::V8HiddenPropertyName::listener):
+        (WebCore::V8HiddenPropertyName::attributeListener):
+        * bindings/v8/V8HiddenPropertyName.h:
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::isLazy):
+        * bindings/v8/V8ObjectEventListener.cpp: Removed.
+        * bindings/v8/V8ObjectEventListener.h: Removed.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::disconnectEventListeners):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        * bindings/v8/V8WorkerContextObjectEventListener.cpp: Removed.
+        * bindings/v8/V8WorkerContextObjectEventListener.h: Removed.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        (WebCore::V8EventListener::getListenerFunction):
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+
+2009-10-01  Alexis Menard  <alexis.menard@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Rename QWebGraphicsItem to QGraphicsWebView
+
+        * WebCore.pro:
+
+2009-10-01  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Read-only transactions do not change file sizes and therefore
+        should not trigger quota updates.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29945
+
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::openTransactionAndPreflight):
+        (WebCore::SQLTransaction::runStatements):
+
+2009-09-30  Timothy Hatcher  <timothy@apple.com>
+
+        Fix list box scrolling by correctly overriding the scroll()
+        function on RenderBox.
+
+        <rdar://problem/7255440> REGRESSION (r48683): Mousewheel scrolling
+        of listboxes is broken (29756)
+
+        Reviewed by Dan Bernstein.
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scroll):
+        * rendering/RenderListBox.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::scroll):
+        * rendering/RenderTextControlSingleLine.h:
+
+2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Make a copy of listeners array before dispatching an event in
+        WebInspector.Object.prototype.dispatchEventToListeners. Otherwise if current
+        listener removes itself from the array next listener will be skipped.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29920
+
+        * inspector/front-end/Object.js:
+        (WebInspector.Object.prototype.dispatchEventToListeners): make a copy of listeners array before dispatching an event
+
+2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GtkIMContext filtering interferes with DOM key events
+        https://bugs.webkit.org/show_bug.cgi?id=28733
+
+        Ensure that keyboard events filtered by the GtkIMContext still create
+        the proper DOM events.
+
+        No tests added. Instead previously skipped tests have been enabled.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] data: uri support in media player
+        https://bugs.webkit.org/show_bug.cgi?id=29842
+
+        New GStreamer element to handle data: uris. For now only base64
+        encoded data is supported. Decoded data is handed over to
+        giostreamsrc.
+
+        * GNUmakefile.am:
+        * platform/graphics/gtk/DataSourceGStreamer.cpp: Added.
+        (_do_init):
+        (webkit_data_src_base_init):
+        (webkit_data_src_class_init):
+        (webkit_data_src_reset):
+        (webkit_data_src_init):
+        (webkit_data_src_finalize):
+        (webkit_data_src_uri_get_type):
+        (webkit_data_src_uri_get_protocols):
+        (webkit_data_src_uri_get_uri):
+        (webkit_data_src_uri_set_uri):
+        (webkit_data_src_uri_handler_init):
+        * platform/graphics/gtk/DataSourceGStreamer.h: Added.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::mimeTypeCache):
+
+2009-09-30  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29944
+        
+        Reduces false positives in the XSSAuditor by explicitly allowing requests
+        that do not contain illegal URI characters.
+        
+        As a side effect of this change, the tests property-inject.html, 
+        property-escape-noquotes.html, and property-escape-noquotes-tab-slash-chars.html 
+        fail because these attacks do not contain any illegal URI characters and 
+        thus are now allowed by the XSSAuditor, where previously they weren't. A future
+        change may reinstate this functionality.
+
+        Tests: http/tests/security/xssAuditor/script-tag-safe2.html
+               http/tests/security/xssAuditor/script-tag-safe3.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isIllegalURICharacter): Added method.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::findInRequest): Added parameter 
+        allowRequestIfNoIllegalURICharacters.
+        * page/XSSAuditor.h:
+
+2009-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        reproducible freeze and crash on closing form popup at bosch-home.nl
+        https://bugs.webkit.org/show_bug.cgi?id=28948
+
+        showModalDialog calls getDirect on what is actually a window shell,
+        so ends up not getting a value (since no value can ever be placed
+        directly on the shell), which leads to incorrect behaviour.
+
+        We use a manual test rather than automatic as it was not
+        possible to get a modal run loop to work inside DRT.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::showModalDialog):
+        * manual-tests/showModalDialog-returnValue.html: manual testcase.
+
+2009-09-30  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Adds ValidityState.tooLong support for <input> and <textarea>.
+
+        Introduces tooLong() in HTMLFormControlElement and it always returns false.
+        HTMLInputElement and HTMLTextAreaElement overrides it and checks the text
+        length and maxLength.  tooLong() should work only for `dirty' values.
+        So, introduces m_isDirty flag for HTMLTextAreaElement, and
+        !m_data.value().isNull() works as a dirty flag for HTMLInputElement.
+
+        Renames parameter names of setMaxLength().
+
+        https://bugs.webkit.org/show_bug.cgi?id=27454
+
+        Tests: fast/forms/ValidityState-tooLong-input.html
+               fast/forms/ValidityState-tooLong-textarea.html
+
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::tooLong):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::tooLong):
+        (WebCore::HTMLInputElement::setMaxLength):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::reset):
+        (WebCore::HTMLTextAreaElement::updateValue):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        (WebCore::HTMLTextAreaElement::tooLong):
+        * html/HTMLTextAreaElement.h:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::tooLong):
+
+2009-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Factor RedirectScheduler out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=29948
+
+        This change introduces a new sub-object of Frame, redirectScheduler.
+        The redirectScheduler is responsible for scheduling redirects.
+
+        This change leaves the code for the redirectScheduler in
+        FrameLoader.cpp.  A future change will move the class into its own
+        file.
+
+        No behavior change (hopefully!).
+
+        * loader/FrameLoader.cpp:
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::setDefersLoading):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::didOpenURL):
+        (WebCore::FrameLoader::didExplicitOpen):
+        (WebCore::FrameLoader::cancelAndClear):
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::checkCompleted):
+        (WebCore::FrameLoader::isScheduledLocationChangePending):
+        (WebCore::FrameLoader::scheduleHTTPRedirection):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::FrameLoader::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::FrameLoader::scheduleRefresh):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::FrameLoader::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::FrameLoader::provisionalLoadStarted):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        (WebCore::FrameLoader::completed):
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::redirectScheduler):
+        * page/Frame.h:
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix, not reviewed.
+
+        More Windows build fixes for https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix, not reviewed.
+
+        Fix windows build for fix for https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+2009-09-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] HTMLAudioElement, HTMLImageElement, and HTMLOptionElement are constructable, but they shouldn't be.
+        Only Audio, Image, and Option should be constructable.
+        https://bugs.webkit.org/show_bug.cgi?id=29940
+
+        Test: fast/dom/dom-constructor.html
+
+        * WebCore.gypi: Added new files to project.
+        * bindings/scripts/CodeGeneratorV8.pm: Modified to generate custom constructors.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed handling of HTMLImageElement, HTMLOptionElement
+          and HTMLAudioElement construction.
+        * bindings/v8/V8HTMLAudioElementConstructor.h: Added.
+        * bindings/v8/V8HTMLImageElementConstructor.h: Added.
+        * bindings/v8/V8HTMLOptionElementConstructor.h: Added.
+        * bindings/v8/V8Index.cpp: Added new headers.
+        * bindings/v8/V8Index.h: Added Audio, Image and Option decls.
+        * bindings/v8/custom/V8CustomBinding.h: Ditto.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): Added custom constructors.
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Added custom template creator.
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::V8HTMLOptionElementConstructor::GetTemplate): Ditto.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Ditto.
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        307 redirects should pass along http body and Content-Type header
+        https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        Follow-up fix for:
+        <rdar://problem/3802660> SAP: 307 (Temporary Redirect) responses should use POST, not GET
+        
+        Test: http/tests/loading/resources/redirect-methods-result.php
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest): Pass along http body and Content-Type header.
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): ditto
+
+2009-09-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=29941
+        REGRESSION (r48882-r48888): Many memory leaks on SnowLeopard leaks bot
+
+        Forgot to implement a destructor for JSDOMWindowBaseData, so it was
+        leaking its RefPtr data member.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::destroyJSDOMWindowBaseData):
+        * bindings/js/JSDOMWindowBase.h:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData::JSDOMWindowBaseData):
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Make sure the removal of user stylesheets results in all of the WebViews being updated to
+        reflect the changes.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::removeUserContentWithURLForWorld):
+        (WebCore::PageGroup::removeUserContentForWorld):
+
+2009-09-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION(r47440): drop down menus at americanexpress.com disappear on mouse out
+        https://bugs.webkit.org/show_bug.cgi?id=29209
+
+        Test: fast/inline/relative-positioned-overflow.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow): Add self-painting
+        inlines to overflow to ensure that they are included in hit-testing.
+
+2009-09-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        transforms/3d tests are not run in Release builds
+        https://bugs.webkit.org/show_bug.cgi?id=29827
+
+        Make sure we export the WebCoreHas3DRendering symbol in Release builds,
+        because this symbols is used by run-webkit-tests (via 'nm') to detect whether
+        WebCore was built with ENABLE_3D_RENDERING turned on.
+
+        * DerivedSources.make:
+        * WebCore.3DRendering.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix for QT.  Didn't know WebCore.pro existed.
+
+        * WebCore.pro:
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a method for removal of user scripts and stylesheets by URL from a specific world.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::removeUserContentURLForWorld):
+        * page/PageGroup.h:
+
+2009-09-30  Chris Hawk  <hawk@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for conditionals in the WebCore gyp file, which contained two separate
+        'conditions' values for the webcore target. The first entry was ignored,
+        resulting in some missine defines.
+        https://bugs.webkit.org/show_bug.cgi?id=29907
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-09-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage needs to be more careful about where "ThreadSafe" objects are destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=29265
+
+        DOM Storage needs to be more careful about where "ThreadSafe" objects are
+        destroyed.  With the current code, there actually isn't a race condition, but
+        it sure would be easy for someone to introduce one.  A bunch of
+        ThreadSafeShared objects have RefPtrs to objects that are NOT ThreadSafeShared
+        objects.  If it were possible any of these objects' destructors to be fired off
+        the main thread, then the you'd have a race condition.  The code should be more
+        clear and self-documenting about how things related to each other.
+
+        Since the lifetime of a LocalStorageTask is bounded by the LocalStorageThread
+        which is bounded by the StorageSyncManager, StorageAreaImpl, and
+        StorageAreaSync, there's no reason for LocalStorageTask to store anything other
+        than pointers.  By breaking this dependency, we can eliminate the risk.
+
+        Note that we _could_ have LocalStorageThread's task queue just store
+        LocalStorageTask*'s rather than RefPtr<LocalStorageTask>s but then we'd need to
+        manually take care of deleting.  It'd probably also be possible to change
+        LocalStorageThread around so that it needn't hold onto a reference of itself
+        and have a more deterministic shutdown, but my initial attempts to do so
+        failed, and I decided it wasn't worth changing.  The queue is killed before
+        hand, so the thread is 100% impotent before the main thread continues anyway.
+
+        The constructors and destructors of StorageSyncManager, StorageAreaImpl, and
+        StorageAreaSync now have ASSERTs to verify they're running on the main thread. 
+        I'm fairly positive that it'd be impossible to hit these asserts and the fact
+        that these classes are no longer ThreadSafeShared should make it clear how
+        they're meant to be used, but I think it's worth it to be extra sure.  Of
+        course, ideally, we'd have such an assert every time a ref is incremented or
+        decremented.
+
+        Behavior should be unchanged and this is just an internal code cleanup, so no
+        new tests.
+
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::LocalStorageTask):
+        (WebCore::LocalStorageTask::performTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        (WebCore::LocalStorageTask::createTerminate):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        * storage/LocalStorageThread.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::~StorageAreaImpl):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-09-28  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium needs to be able to override the way storage events are delivered
+        https://bugs.webkit.org/show_bug.cgi?id=29655
+
+        Chromium needs to be able to override the way storage events are delivered.
+        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
+        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
+        injection).  This is necessary because Chromium needs to transport events across
+        a process barrier and then dispatch them without use of a Frame*.
+
+        Behavior should not change with this, so no updates to tests.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageEventDispatcher.cpp: Copied from WebCore/storage/StorageAreaImpl.cpp.
+        (WebCore::StorageEventDispatcher::dispatch):
+        * storage/StorageEventDispatcher.h: Added.  (Well, technically in the other half of this patch.)
+
+2009-09-30  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Need to check NULL frame in EventHandler::updateDragAndDrop.
+        https://bugs.webkit.org/show_bug.cgi?id=29929
+
+        Test: http/tests/misc/drag-over-iframe-invalid-source-crash.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+
+2009-09-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        ASSERTION FAILED: !repaintContainer || repaintContainer == this
+        https://bugs.webkit.org/show_bug.cgi?id=29755
+        
+        Generalize the fix for this bug to account for cases where there may be multiple
+        containing blocks between the repaint container, and the container of the element
+        being repainted.
+
+        Test: compositing/repaint/opacity-between-absolute2.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        Call offsetFromAncestorContainer() to get the correct offset.
+        
+        (WebCore::RenderBox::computeRectForRepaint): Ditto
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::computeRectForRepaint): Ditto.
+        
+        * rendering/RenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::offsetFromAncestorContainer):
+        New method that computes an offset from some object in the ancestor container() chain.
+
+2009-09-30  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix TextCodecQt::decode method after r48752 to return a non-null string if the length of the input is 0.
+        This fixes https://bugs.webkit.org/show_bug.cgi?id=29736.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+
 2009-09-29  Dave Hyatt  <hyatt@apple.com>
 
         Reviewed by Jon Honeycutt.
@@ -582,7 +9664,7 @@
         * platform/network/qt/QNetworkReplyHandler.cpp:
         (WebCore::QNetworkReplyHandler::finish):
 
-009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
@@ -1655,7 +10737,7 @@
         can't happen when working with JavaScript since the Element will be kept
         alive due to the change above.
         (WebCore::NamedNodeMap::addAttribute): Fix function name in comment.
-        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "+ 1" and added
+        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "1" and added
         missing braces.
 
         * dom/NamedAttrMap.h: Made the element function public so it can be used by
@@ -1778,7 +10860,7 @@
         1. if the insertion node has a non opaque background color and one of the parent element did have
         a solid background color the new paragraph did not have the element with the solid color in the tree.
         2. in some circumstances it generated more markup than the original paragraph had (a span with bold, italic,
-        background color and some font attribute was being reproduced as span + bold + italic + font as separate tags.
+        background color and some font attribute was being reproduced as span bold italic font as separate tags.
         The new approach is to recreate in the new paragraph the same hierarchy of nodes found in the
         paragraph where the insertion point is.
 
@@ -2114,7 +11196,7 @@
 
         Reviewed by Oliver Hunt.
 
-        Implement correct horizontal scrollbar behavior for GTK+ also on
+        Implement correct horizontal scrollbar behavior for GTKalso on
         styled scrollbars.
 
         https://bugs.webkit.org/show_bug.cgi?id=29348
@@ -3988,7 +13070,7 @@
 
 2009-09-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Unreviewed build fix for GTK+ and a blind one for Qt after r48566.
+        Unreviewed build fix for GTKand a blind one for Qt after r48566.
 
         * GNUmakefile.am:
         * WebCore.pro:
@@ -4742,7 +13824,7 @@
         Reviewed by Oliver Hunt.
 
         <rdar://problem/7007541> 
-        CrashTracer: 4800+ crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
+        CrashTracer: 4800crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
         
         Make RuntimeObjectImp more robust against m_instance being a null (which can happen if an OOP plug-in
         crashes while we're calling into it).
@@ -6024,7 +15106,7 @@
 
         Reviewed by Dan Bernstein.
 
-        <rdar://problem/7047282> Safari crashes at WebCore::RenderMenuList::adjustInnerStyle() + 436
+        <rdar://problem/7047282> Safari crashes at WebCore::RenderMenuList::adjustInnerStyle() 436
         
         Avoid a crash when a mouse event handler on a <select> changes the select from a popup
         to a list (by setting the 'size' property) inside the event handler.
@@ -7040,7 +16122,7 @@
 
         Reviewed by Gustavo Noronha.
 
-        Build fix for GTK+ after r48267.
+        Build fix for GTKafter r48267.
 
         * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
         (WebCore::MediaPlayerPrivate::buffered):
@@ -8081,7 +17163,7 @@
 
 2009-09-08  Xan Lopez  <xlopez@igalia.com>
 
-        Unreviewed attempt to fix the GTK+ build.
+        Unreviewed attempt to fix the GTKbuild.
 
         * GNUmakefile.am:
 
@@ -13747,7 +22829,7 @@
         do not set playbin's audio sink.
         * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
         * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_idle_func): Use C++ casts, decrease reference count of async
+        (webkit_video_sink_idle_func): Use C+casts, decrease reference count of async
         queue at the end of the idle function.
         (webkit_video_sink_render): Increase reference count of async queue.
         (webkit_video_sink_stop): Remove any idle functions with the sink as data.
@@ -15508,7 +24590,7 @@
 
         Reviewed by Eric Seidel.
 
-        Add 'icu::' qualifier when refering to ICU C++ names to the other
+        Add 'icu::' qualifier when refering to ICU C+names to the other
         file with this issue missed in the previous check-in.
 
         https://bugs.webkit.org/show_bug.cgi?id=28410
@@ -15791,7 +24873,7 @@
 
         Reviewed by Eric Seidel
 
-        Add 'icu::' qualifier when refering to ICU C++ names.
+        Add 'icu::' qualifier when refering to ICU C+names.
 
         https://bugs.webkit.org/show_bug.cgi?id=28410
 
@@ -19969,7 +29051,7 @@ form controls that have different validity states.
         Reviewed by Sam Weinig.
 
         <rdar://problem/6952336>
-        CrashTracer: [USER] 3 crashes in Safari at com.apple.WebCore • WebCore::SecurityOrigin::canAccess const + 27
+        CrashTracer: [USER] 3 crashes in Safari at com.apple.WebCore • WebCore::SecurityOrigin::canAccess const 27
 
         Make sure to set the security origin before calling dispatchWindowObjectAvailable.
         
@@ -20293,11 +29375,11 @@ form controls that have different validity states.
         Reviewed by Darin Adler.
 
         https://bugs.webkit.org/show_bug.cgi?id=28204
-        Allow C++ exceptions to be disabled in WebCore's V8 Mac build.
+        Allow C+exceptions to be disabled in WebCore's V8 Mac build.
 
         * WebCorePrefix.h:
         Only undefine |try| and |catch| when building Objective-C[++],
-        leaving the C++ library definitions intact for C++.
+        leaving the C+library definitions intact for C++.
 
 2009-08-12  Nate Chapin  <japhet@chromium.org>
 
@@ -21347,7 +30429,7 @@ form controls that have different validity states.
 
         Reviewed by Darin Fisher.
 
-        Cleanup DOM Storage namespace shutdown code + usage of security origin.
+        Cleanup DOM Storage namespace shutdown code usage of security origin.
         https://bugs.webkit.org/show_bug.cgi?id=28094
 
         If a storage namespace is not explicitly closed, be sure to do so on
@@ -21454,7 +30536,7 @@ form controls that have different validity states.
 
 2009-08-10  Xan Lopez  <xlopez@igalia.com>
 
-        Fix GTK+ build.
+        Fix GTKbuild.
 
         * platform/network/soup/ResourceHandleSoup.cpp:
         (WebCore::):
@@ -21468,7 +30550,7 @@ form controls that have different validity states.
         * platform/graphics/GlyphBuffer.h: Removed advanceData().
         * platform/graphics/wince/GraphicsContextWince.cpp:
         (WebCore::GraphicsContext::drawText): Changed to use advances(from)
-            instead of advanceData() + from.
+            instead of advanceData() from.
 
 2009-08-10  Xan Lopez  <xlopez@igalia.com>
 
@@ -21781,7 +30863,7 @@ form controls that have different validity states.
 
         Modify FrameLoadType enum to match the order of WebFrameLoadType in WebFramePrivate.h / IWebFramePrivate.idl.
         The mac/win public API exposes the old 'FrameLoadTypeReloadAllowingStaleData' value, which resides between
-        'FrameLoadTypeReload' and 'FrameLoadTypeSame'. Work around this problem, by assigning 'FrameLoadTypeSame = FrameLoadTypeReload + 2'.
+        'FrameLoadTypeReload' and 'FrameLoadTypeSame'. Work around this problem, by assigning 'FrameLoadTypeSame = FrameLoadTypeReload 2'.
 
         Add a note to the FrameLoadType enum to keep it in sync with WebFramePrivate.h & IWebFramePrivate.idl.
 
@@ -29091,7 +38173,7 @@ form controls that have different validity states.
 
         I decided to change these to Base:: instead of DOMObjectWithGlobal::
         for future-proofing.  All autogenerated classes use a typedef Base
-        to avoid bugs like these.  Sadly C++ does not have a built-in super:: we could use.
+        to avoid bugs like these.  Sadly C+does not have a built-in super:: we could use.
 
         * WebCore.xcodeproj/project.pbxproj:
         * bindings/js/JSAbstractWorkerCustom.cpp:
@@ -29959,7 +39041,7 @@ form controls that have different validity states.
 
 2009-07-22  Xan Lopez  <xlopez@igalia.com>
 
-        Attempt to fix the GTK+ build.
+        Attempt to fix the GTKbuild.
 
         * GNUmakefile.am:
 
@@ -36020,7 +45102,7 @@ form controls that have different validity states.
 
         Crash in RenderMedia::styleDidChange.
         <rdar://problem/7044313> CrashTracer: quicklook crashed generating thumbnail for page with 
-        media element (RenderMedia::styleDidChange + 115)
+        media element (RenderMedia::styleDidChange 115)
 
         Speculative fix for crash in styleDidChange. Null check controller elements before tell
         them to update style.
@@ -37138,7 +46220,7 @@ form controls that have different validity states.
 
         Not reviewed, Chromium build fix.
 
-        Add in missing header + fix syntax issue that crept into last patch.
+        Add in missing header fix syntax issue that crept into last patch.
         https://bugs.webkit.org/show_bug.cgi?id=27027
 
         * rendering/RenderThemeChromiumMac.mm:
@@ -37969,7 +47051,7 @@ form controls that have different validity states.
 
         Report the caret offset from the end of the selection, otherwise
         we'll report the same offset when moving the caret while
-        modififying the selection (eg, with Shift + Right).
+        modififying the selection (eg, with Shift Right).
 
         * editing/gtk/SelectionControllerGtk.cpp:
         (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
@@ -39238,7 +48320,7 @@ form controls that have different validity states.
 
         Reviewed by Geoff Garen.
 
-        <rdar://problem/6960286> CrashTracer: [REGRESSION] 1120 crashes in Safari at com.apple.WebCore WebCore::JSLazyEventListener::parseCode const + 62
+        <rdar://problem/6960286> CrashTracer: [REGRESSION] 1120 crashes in Safari at com.apple.WebCore WebCore::JSLazyEventListener::parseCode const 62
 
         <select> elements and other elements the produce popups can keep their popups
         live across a page load.  If this occurs and the <select> element has an
@@ -39894,7 +48976,7 @@ form controls that have different validity states.
 
         Reviewed by Jan Alonzo.
 
-        [GTK] Don't use deprecated GTK+ symbols.
+        [GTK] Don't use deprecated GTKsymbols.
         https://bugs.webkit.org/show_bug.cgi?id=26583
 
         * plugins/gtk/gtk2xtbin.c:
@@ -45387,7 +54469,7 @@ form controls that have different validity states.
 
         Reviewed by Brady Eidson.
 
-        <rdar://problem/6660037> CrashTracer: [USER] 46 crashes in Safari at com.apple.WebCore • WebCore::CachedCSSStyleSheet::addClient + 53
+        <rdar://problem/6660037> CrashTracer: [USER] 46 crashes in Safari at com.apple.WebCore • WebCore::CachedCSSStyleSheet::addClient 53
         
         When revalidating a resource, calling addClient() on one client might cause another to get removed.
         
@@ -45449,7 +54531,7 @@ form controls that have different validity states.
         Update of https://bugs.webkit.org/show_bug.cgi?id=26353.
         Provide an assignment operator to avoid improper reference
         counts on the Cairo font objects.  This brings the Windows
-        Cairo port in line with the GTK+ port.
+        Cairo port in line with the GTKport.
 
         * platform/graphics/win/FontPlatformData.h:
         * platform/graphics/win/FontPlatformDataCairoWin.cpp:
diff --git a/src/3rdparty/webkit/WebCore/DerivedSources.cpp b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
index 2131793568..be83136a47 100644
--- a/src/3rdparty/webkit/WebCore/DerivedSources.cpp
+++ b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
@@ -28,6 +28,7 @@
 #include "JSAbstractWorker.cpp"
 #include "JSAttr.cpp"
 #include "JSBarInfo.cpp"
+#include "JSBeforeLoadEvent.cpp"
 #include "JSCanvasGradient.cpp"
 #include "JSCanvasPattern.cpp"
 #include "JSCanvasRenderingContext.cpp"
@@ -243,6 +244,7 @@
 #include "JSSVGFEImageElement.cpp"
 #include "JSSVGFEMergeElement.cpp"
 #include "JSSVGFEMergeNodeElement.cpp"
+#include "JSSVGFEMorphologyElement.cpp"
 #include "JSSVGFEOffsetElement.cpp"
 #include "JSSVGFEPointLightElement.cpp"
 #include "JSSVGFESpecularLightingElement.cpp"
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ExceptionHelpers.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ExceptionHelpers.h
new file mode 100644
index 0000000000..661c61a791
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ExceptionHelpers.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_ExceptionHelpers_h
+#define WebCore_FWD_ExceptionHelpers_h
+#include <JavaScriptCore/ExceptionHelpers.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSCell.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSCell.h
new file mode 100644
index 0000000000..83a1575b43
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSCell.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_JSCell_h
+#define WebCore_FWD_JSCell_h
+#include <JavaScriptCore/JSCell.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StructureChain.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StructureChain.h
new file mode 100644
index 0000000000..7c60fa7ab1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StructureChain.h
@@ -0,0 +1,5 @@
+#ifndef WebCore_FWD_StructureChain_h
+#define WebCore_FWD_StructureChain_h
+#include <JavaScriptCore/StructureChain.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/WebCore.3DRendering.exp b/src/3rdparty/webkit/WebCore/WebCore.3DRendering.exp
new file mode 100644
index 0000000000..4a84c63951
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/WebCore.3DRendering.exp
@@ -0,0 +1 @@
+_WebCoreHas3DRendering
diff --git a/src/3rdparty/webkit/WebCore/WebCore.SVG.Filters.exp b/src/3rdparty/webkit/WebCore/WebCore.SVG.Filters.exp
index b0244dbd86..5698258251 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.SVG.Filters.exp
+++ b/src/3rdparty/webkit/WebCore/WebCore.SVG.Filters.exp
@@ -15,6 +15,7 @@
 .objc_class_name_DOMSVGFEImageElement
 .objc_class_name_DOMSVGFEMergeElement
 .objc_class_name_DOMSVGFEMergeNodeElement
+.objc_class_name_DOMSVGFEMorphologyElement
 .objc_class_name_DOMSVGFEOffsetElement
 .objc_class_name_DOMSVGFEPointLightElement
 .objc_class_name_DOMSVGFESpecularLightingElement
diff --git a/src/3rdparty/webkit/WebCore/WebCore.Video.exp b/src/3rdparty/webkit/WebCore/WebCore.Video.exp
new file mode 100644
index 0000000000..5d356983d4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/WebCore.Video.exp
@@ -0,0 +1,14 @@
+__ZN7WebCore16HTMLMediaElement4playEv
+__ZN7WebCore16HTMLMediaElement5pauseEv
+__ZNK7WebCore16HTMLMediaElement6volumeEv
+__ZNK7WebCore16HTMLMediaElement7canPlayEv
+__ZNK7WebCore16HTMLMediaElement8durationEv
+__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZN7WebCore16HTMLMediaElement8setMutedEb
+__ZN7WebCore16HTMLMediaElement9setVolumeEfRi
+__ZN7WebCore16HTMLMediaElement6rewindEf
+__ZN7WebCore16HTMLMediaElement10screenRectEv
+__ZNK7WebCore16HTMLMediaElement11currentTimeEv
+__ZNK7WebCore16HTMLMediaElement13platformMediaEv
+__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
+__ZN7WebCore16HTMLMediaElement14exitFullscreenEv
diff --git a/src/3rdparty/webkit/WebCore/WebCore.gypi b/src/3rdparty/webkit/WebCore/WebCore.gypi
index 43e739c3d2..c0da0ec831 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.gypi
+++ b/src/3rdparty/webkit/WebCore/WebCore.gypi
@@ -31,6 +31,7 @@
             'css/WebKitCSSMatrix.idl',
             'css/WebKitCSSTransformValue.idl',
             'dom/Attr.idl',
+            'dom/BeforeLoadEvent.idl',
             'dom/CDATASection.idl',
             'dom/CharacterData.idl',
             'dom/ClientRect.idl',
@@ -76,6 +77,7 @@
             'dom/WebKitAnimationEvent.idl',
             'dom/WebKitTransitionEvent.idl',
             'dom/WheelEvent.idl',
+            'html/canvas/CanvasActiveInfo.idl',
             'html/canvas/CanvasArray.idl',
             'html/canvas/CanvasArrayBuffer.idl',
             'html/canvas/CanvasBuffer.idl',
@@ -258,6 +260,7 @@
             'svg/SVGFEImageElement.idl',
             'svg/SVGFEMergeElement.idl',
             'svg/SVGFEMergeNodeElement.idl',
+            'svg/SVGFEMorphologyElement.idl',
             'svg/SVGFEOffsetElement.idl',
             'svg/SVGFEPointLightElement.idl',
             'svg/SVGFESpecularLightingElement.idl',
@@ -345,7 +348,6 @@
             'svg/SVGTransform.idl',
             'svg/SVGTransformList.idl',
             'svg/SVGTransformable.idl',
-            'svg/SVGURIReference.idl',
             'svg/SVGUnitTypes.idl',
             'svg/SVGUseElement.idl',
             'svg/SVGViewElement.idl',
@@ -428,6 +430,8 @@
             'bindings/js/DOMObjectWithSVGContext.h',
             'bindings/js/GCController.cpp',
             'bindings/js/GCController.h',
+            'bindings/js/JSCallbackData.cpp',
+            'bindings/js/JSCallbackData.h',
             'bindings/js/JSAttrCustom.cpp',
             'bindings/js/JSAudioConstructor.cpp',
             'bindings/js/JSAudioConstructor.h',
@@ -482,6 +486,8 @@
             'bindings/js/JSEventListener.h',
             'bindings/js/JSEventTarget.cpp',
             'bindings/js/JSEventTarget.h',
+            'bindings/js/JSExceptionBase.cpp',
+            'bindings/js/JSExceptionBase.h',
             'bindings/js/JSGeolocationCustom.cpp',
             'bindings/js/JSHistoryCustom.cpp',
             'bindings/js/JSHistoryCustom.h',
@@ -622,6 +628,7 @@
             'bindings/js/StringSourceProvider.h',
             'bindings/js/WorkerScriptController.cpp',
             'bindings/js/WorkerScriptController.h',
+            'bindings/ScriptControllerBase.cpp',
             'bindings/v8/ChildThreadDOMData.cpp',
             'bindings/v8/ChildThreadDOMData.h',
             'bindings/v8/custom/V8AbstractWorkerCustom.cpp',
@@ -669,6 +676,7 @@
             'bindings/v8/custom/V8EventCustom.cpp',
             'bindings/v8/custom/V8FileListCustom.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.cpp',
+            'bindings/v8/custom/V8HTMLAudioElementConstructor.h',
             'bindings/v8/custom/V8HTMLCanvasElementCustom.cpp',
             'bindings/v8/custom/V8HTMLCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLDataGridElementCustom.cpp',
@@ -678,8 +686,10 @@
             'bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp',
             'bindings/v8/custom/V8HTMLIFrameElementCustom.cpp',
             'bindings/v8/custom/V8HTMLImageElementConstructor.cpp',
+            'bindings/v8/custom/V8HTMLImageElementConstructor.h',
             'bindings/v8/custom/V8HTMLInputElementCustom.cpp',
             'bindings/v8/custom/V8HTMLOptionElementConstructor.cpp',
+            'bindings/v8/custom/V8HTMLOptionElementConstructor.h',
             'bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLPlugInElementCustom.cpp',
             'bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp',
@@ -761,8 +771,11 @@
             'bindings/v8/ScriptState.h',
             'bindings/v8/ScriptState.cpp',
             'bindings/v8/ScriptString.h',
+            'bindings/v8/ScriptStringImpl.cpp',
+            'bindings/v8/ScriptStringImpl.h',
             'bindings/v8/ScriptValue.cpp',
             'bindings/v8/ScriptValue.h',
+            'bindings/v8/SerializedScriptValue.h',
             'bindings/v8/StaticDOMDataStore.cpp',
             'bindings/v8/StaticDOMDataStore.h',
             'bindings/v8/V8AbstractEventListener.cpp',
@@ -799,8 +812,6 @@
             'bindings/v8/V8NPUtils.h',
             'bindings/v8/V8NodeFilterCondition.cpp',
             'bindings/v8/V8NodeFilterCondition.h',
-            'bindings/v8/V8ObjectEventListener.cpp',
-            'bindings/v8/V8ObjectEventListener.h',
             'bindings/v8/V8Proxy.cpp',
             'bindings/v8/V8Proxy.h',
             'bindings/v8/V8SVGPODTypeWrapper.h',
@@ -808,8 +819,6 @@
             'bindings/v8/V8Utilities.h',
             'bindings/v8/V8WorkerContextEventListener.cpp',
             'bindings/v8/V8WorkerContextEventListener.h',
-            'bindings/v8/V8WorkerContextObjectEventListener.cpp',
-            'bindings/v8/V8WorkerContextObjectEventListener.h',
             'bindings/v8/WorkerContextExecutionProxy.h',
             'bindings/v8/WorkerContextExecutionProxy.cpp',
             'bindings/v8/WorkerScriptController.h',
@@ -961,6 +970,7 @@
             'dom/Attribute.h',
             'dom/BeforeTextInsertedEvent.cpp',
             'dom/BeforeTextInsertedEvent.h',
+            'dom/BeforeLoadEvent.h',
             'dom/BeforeUnloadEvent.cpp',
             'dom/BeforeUnloadEvent.h',
             'dom/CDATASection.cpp',
@@ -1611,6 +1621,8 @@
             'loader/FrameLoader.h',
             'loader/FrameLoaderClient.h',
             'loader/FrameLoaderTypes.h',
+            'loader/HistoryController.cpp',
+            'loader/HistoryController.h',
             'loader/ImageDocument.cpp',
             'loader/ImageDocument.h',
             'loader/ImageLoader.cpp',
@@ -1627,12 +1639,20 @@
             'loader/PlaceholderDocument.h',
             'loader/PluginDocument.cpp',
             'loader/PluginDocument.h',
+            'loader/PolicyCallback.cpp',
+            'loader/PolicyCallback.h',
+            'loader/PolicyChecker.cpp',
+            'loader/PolicyChecker.h',
             'loader/ProgressTracker.cpp',
             'loader/ProgressTracker.h',
+            'loader/RedirectScheduler.cpp',
+            'loader/RedirectScheduler.h',
             'loader/Request.cpp',
             'loader/Request.h',
             'loader/ResourceLoader.cpp',
             'loader/ResourceLoader.h',
+            'loader/ResourceLoadNotifier.cpp',
+            'loader/ResourceLoadNotifier.h',
             'loader/SubresourceLoader.cpp',
             'loader/SubresourceLoader.h',
             'loader/SubresourceLoaderClient.h',
@@ -1823,7 +1843,7 @@
             'platform/chromium/KeyboardCodesWin.h',
             'platform/chromium/Language.cpp',
             'platform/chromium/LinkHashChromium.cpp',
-            'platform/chromium/MimeTypeRegistryChromium.cpp',
+            'platform/chromium/MIMETypeRegistryChromium.cpp',
             'platform/chromium/PasteboardChromium.cpp',
             'platform/chromium/PasteboardPrivate.h',
             'platform/chromium/PlatformCursor.h',
@@ -1921,6 +1941,8 @@
             'platform/graphics/filters/FEComponentTransfer.h',
             'platform/graphics/filters/FEComposite.cpp',
             'platform/graphics/filters/FEComposite.h',
+            'platform/graphics/filters/FEGaussianBlur.cpp',
+            'platform/graphics/filters/FEGaussianBlur.h',
             'platform/graphics/filters/SourceAlpha.cpp',
             'platform/graphics/filters/SourceAlpha.h',
             'platform/graphics/filters/SourceGraphic.cpp',
@@ -2935,6 +2957,8 @@
             'rendering/RenderMarquee.h',
             'rendering/RenderMedia.cpp',
             'rendering/RenderMedia.h',
+            'rendering/RenderMediaControlsChromium.cpp',
+            'rendering/RenderMediaControlsChromium.h',
             'rendering/RenderMenuList.cpp',
             'rendering/RenderMenuList.h',
             'rendering/RenderObject.cpp',
@@ -3105,6 +3129,7 @@
             'storage/StorageAreaSync.h',
             'storage/StorageEvent.cpp',
             'storage/StorageEvent.h',
+            'storage/StorageEventDispatcher.cpp',
             'storage/StorageEventDispatcher.h',
             'storage/StorageMap.cpp',
             'storage/StorageMap.h',
@@ -3129,8 +3154,6 @@
             'svg/graphics/filters/SVGFEDisplacementMap.h',
             'svg/graphics/filters/SVGFEFlood.cpp',
             'svg/graphics/filters/SVGFEFlood.h',
-            'svg/graphics/filters/SVGFEGaussianBlur.cpp',
-            'svg/graphics/filters/SVGFEGaussianBlur.h',
             'svg/graphics/filters/SVGFEImage.cpp',
             'svg/graphics/filters/SVGFEImage.h',
             'svg/graphics/filters/SVGFEMerge.cpp',
@@ -3275,6 +3298,8 @@
             'svg/SVGFEMergeElement.h',
             'svg/SVGFEMergeNodeElement.cpp',
             'svg/SVGFEMergeNodeElement.h',
+            'svg/SVGFEMorphologyElement.cpp',
+            'svg/SVGFEMorphologyElement.h',
             'svg/SVGFEOffsetElement.cpp',
             'svg/SVGFEOffsetElement.h',
             'svg/SVGFEPointLightElement.cpp',
@@ -3456,6 +3481,8 @@
             'svg/SVGZoomAndPan.h',
             'svg/SVGZoomEvent.cpp',
             'svg/SVGZoomEvent.h',
+            'svg/SynchronizablePropertyController.cpp',
+            'svg/SynchronizablePropertyController.h',
             'svg/SynchronizableTypeWrapper.h',
             'websockets/WebSocket.cpp',
             'websockets/WebSocket.h',
@@ -3470,8 +3497,6 @@
             'workers/DedicatedWorkerContext.h',
             'workers/DedicatedWorkerThread.cpp',
             'workers/DedicatedWorkerThread.h',
-            'workers/DefaultSharedWorkerRepository.cpp',
-            'workers/DefaultSharedWorkerRepository.h',
             'workers/GenericWorkerTask.h',
             'workers/SharedWorker.cpp',
             'workers/SharedWorker.h',
@@ -3613,6 +3638,7 @@
             'inspector/front-end/StoragePanel.js',
             'inspector/front-end/StylesSidebarPane.js',
             'inspector/front-end/SummaryBar.js',
+            'inspector/front-end/TestController.js',
             'inspector/front-end/TextPrompt.js',
             'inspector/front-end/TimelineAgent.js',
             'inspector/front-end/TopDownProfileDataGridTree.js',
@@ -3621,6 +3647,7 @@
             'inspector/front-end/View.js',
             'inspector/front-end/WatchExpressionsSidebarPane.js',
             'inspector/front-end/inspector.css',
+            'inspector/front-end/inspectorSyntaxHighlight.css',
         ],
         'webinspector_image_files': [
 
diff --git a/src/3rdparty/webkit/WebCore/WebCore.order b/src/3rdparty/webkit/WebCore/WebCore.order
index ff42e26dd2..c1040e23c6 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.order
+++ b/src/3rdparty/webkit/WebCore/WebCore.order
@@ -7851,6 +7851,7 @@ __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalida
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
 __ZN7WebCore19InspectorController22inspectedPageDestroyedEv
+__ZN7WebCore19InspectorController25evaluateForTestInFrontendElRKNS_6StringE
 __ZN7WebCore19InspectorController5closeEv
 __ZN7WebCore15BackForwardList5closeEv
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14shrinkCapacityEm
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index a0a072d1b4..f321aadb7c 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -177,7 +177,7 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 
 # Nescape plugins support (NPAPI)
 !contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=.) {
-    unix|win32-*:!embedded:!wince*:!symbian {
+    unix|win32-*:!embedded:!wince*: {
         DEFINES += ENABLE_NETSCAPE_PLUGIN_API=1
     } else {
         DEFINES += ENABLE_NETSCAPE_PLUGIN_API=0
@@ -309,7 +309,8 @@ STYLESHEETS_EMBED = \
     $$PWD/css/svg.css \
     $$PWD/css/view-source.css \
     $$PWD/css/wml.css \
-    $$PWD/css/mediaControls.css
+    $$PWD/css/mediaControls.css \
+    $$PWD/css/mediaControlsQt.css
 
 DOMLUT_FILES += \
     bindings/js/JSDOMWindowBase.cpp \
@@ -343,6 +344,7 @@ IDL_BINDINGS += \
     css/WebKitCSSMatrix.idl \
     css/WebKitCSSTransformValue.idl \
     dom/Attr.idl \
+    dom/BeforeLoadEvent.idl \
     dom/CharacterData.idl \
     dom/ClientRect.idl \
     dom/ClientRectList.idl \
@@ -558,6 +560,7 @@ IDL_BINDINGS += \
     svg/SVGFEImageElement.idl \
     svg/SVGFEMergeElement.idl \
     svg/SVGFEMergeNodeElement.idl \
+    svg/SVGFEMorphologyElement.idl \
     svg/SVGFEOffsetElement.idl \
     svg/SVGFEPointLightElement.idl \
     svg/SVGFESpecularLightingElement.idl \
@@ -682,6 +685,7 @@ SOURCES += \
     accessibility/AccessibilityTableRow.cpp \    
     accessibility/AXObjectCache.cpp \
     bindings/js/GCController.cpp \
+    bindings/js/JSCallbackData.cpp \
     bindings/js/JSAttrCustom.cpp \
     bindings/js/JSCDATASectionCustom.cpp \
     bindings/js/JSCanvasRenderingContextCustom.cpp \
@@ -710,6 +714,7 @@ SOURCES += \
     bindings/js/JSEventSourceConstructor.cpp \
     bindings/js/JSEventSourceCustom.cpp \
     bindings/js/JSEventTarget.cpp \
+    bindings/js/JSExceptionBase.cpp \
     bindings/js/JSGeolocationCustom.cpp \
     bindings/js/JSHTMLAllCollection.cpp \
     bindings/js/JSHistoryCustom.cpp \
@@ -776,6 +781,8 @@ SOURCES += \
     bindings/js/ScriptState.cpp \
     bindings/js/ScriptValue.cpp \
     bindings/js/ScheduledAction.cpp \
+    bindings/js/SerializedScriptValue.cpp \
+    bindings/ScriptControllerBase.cpp \
     bridge/IdentifierRep.cpp \
     bridge/NP_jsobject.cpp \
     bridge/npruntime.cpp \
@@ -1110,6 +1117,7 @@ SOURCES += \
     loader/DocumentThreadableLoader.cpp \
     loader/FormState.cpp \
     loader/FrameLoader.cpp \
+    loader/HistoryController.cpp \
     loader/FTPDirectoryDocument.cpp \
     loader/FTPDirectoryParser.cpp \
     loader/icon/IconLoader.cpp \
@@ -1122,9 +1130,13 @@ SOURCES += \
     loader/NetscapePlugInStreamLoader.cpp \
     loader/PlaceholderDocument.cpp \
     loader/PluginDocument.cpp \
+    loader/PolicyCallback.cpp \
+    loader/PolicyChecker.cpp \
     loader/ProgressTracker.cpp \
+    loader/RedirectScheduler.cpp \
     loader/Request.cpp \
     loader/ResourceLoader.cpp \
+    loader/ResourceLoadNotifier.cpp \
     loader/SubresourceLoader.cpp \
     loader/TextDocument.cpp \
     loader/TextResourceDecoder.cpp \
@@ -1187,6 +1199,7 @@ SOURCES += \
     platform/DragImage.cpp \
     platform/FileChooser.cpp \
     platform/GeolocationService.cpp \
+    platform/image-decoders/qt/RGBA32BufferQt.cpp \
     platform/graphics/FontDescription.cpp \
     platform/graphics/FontFamily.cpp \
     platform/graphics/BitmapImage.cpp \
@@ -1380,6 +1393,7 @@ HEADERS += \
     bindings/js/CachedScriptSourceProvider.h \
     bindings/js/DOMObjectWithSVGContext.h \
     bindings/js/GCController.h \
+    bindings/js/JSCallbackData.h \
     bindings/js/JSAudioConstructor.h \
     bindings/js/JSCSSStyleDeclarationCustom.h \
     bindings/js/JSCustomPositionCallback.h \
@@ -1440,6 +1454,7 @@ HEADERS += \
     bindings/js/ScriptSourceProvider.h \
     bindings/js/ScriptState.h \
     bindings/js/ScriptValue.h \
+    bindings/js/SerializedScriptValue.h \
     bindings/js/StringSourceProvider.h \
     bindings/js/WorkerScriptController.h \
     bridge/c/c_class.h \
@@ -1863,6 +1878,7 @@ HEADERS += \
     platform/DragImage.h \
     platform/FileChooser.h \
     platform/GeolocationService.h \
+    platform/image-decoders/ImageDecoder.h \
     platform/mock/GeolocationServiceMock.h \
     platform/graphics/BitmapImage.h \
     platform/graphics/Color.h \
@@ -2098,7 +2114,6 @@ HEADERS += \
     svg/graphics/filters/SVGFEDiffuseLighting.h \
     svg/graphics/filters/SVGFEDisplacementMap.h \
     svg/graphics/filters/SVGFEFlood.h \
-    svg/graphics/filters/SVGFEGaussianBlur.h \
     svg/graphics/filters/SVGFEImage.h \
     svg/graphics/filters/SVGFEMerge.h \
     svg/graphics/filters/SVGFEMorphology.h \
@@ -2162,6 +2177,7 @@ HEADERS += \
     svg/SVGFELightElement.h \
     svg/SVGFEMergeElement.h \
     svg/SVGFEMergeNodeElement.h \
+    svg/SVGFEMorphologyElement.h \
     svg/SVGFEOffsetElement.h \
     svg/SVGFEPointLightElement.h \
     svg/SVGFESpecularLightingElement.h \
@@ -2249,6 +2265,7 @@ HEADERS += \
     svg/SVGViewSpec.h \
     svg/SVGZoomAndPan.h \
     svg/SVGZoomEvent.h \
+    svg/SynchronizablePropertyController.h \
     wml/WMLAccessElement.h \
     wml/WMLAElement.h \
     wml/WMLAnchorElement.h \
@@ -2346,7 +2363,6 @@ SOURCES += \
     platform/graphics/qt/ImageBufferQt.cpp \
     platform/graphics/qt/ImageDecoderQt.cpp \
     platform/graphics/qt/ImageQt.cpp \
-    platform/graphics/qt/ImageSourceQt.cpp \
     platform/graphics/qt/IntPointQt.cpp \
     platform/graphics/qt/IntRectQt.cpp \
     platform/graphics/qt/IntSizeQt.cpp \
@@ -2456,46 +2472,61 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
 
     SOURCES += plugins/npapi.cpp
 
-    unix {
-        DEFINES += ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH=1
+    symbian {
+        SOURCES += \
+        plugins/symbian/PluginPackageSymbian.cpp \
+        plugins/symbian/PluginDatabaseSymbian.cpp \
+        plugins/symbian/PluginViewSymbian.cpp \
+        plugins/symbian/PluginContainerSymbian.cpp
 
-        mac {
-            SOURCES += \
-                plugins/mac/PluginPackageMac.cpp \
-                plugins/mac/PluginViewMac.cpp
-            OBJECTIVE_SOURCES += \
-                platform/text/mac/StringImplMac.mm \
-                platform/mac/WebCoreNSStringExtras.mm
-            INCLUDEPATH += platform/mac
-            # Note: XP_MACOSX is defined in npapi.h
-        } else {
-            !embedded: CONFIG += x11
-            SOURCES += \
-                plugins/qt/PluginContainerQt.cpp \
-                plugins/qt/PluginPackageQt.cpp \
-                plugins/qt/PluginViewQt.cpp
-            HEADERS += \
-                plugins/qt/PluginContainerQt.h
-            DEFINES += XP_UNIX
-        }
-    }
+        HEADERS += \
+        plugins/symbian/PluginContainerSymbian.h \
+        plugins/symbian/npinterface.h
 
-    win32-* {
-        INCLUDEPATH += $$PWD/plugins/win
-
-        SOURCES += page/win/PageWin.cpp \
-                   plugins/win/PluginDatabaseWin.cpp \
-                   plugins/win/PluginPackageWin.cpp \
-                   plugins/win/PluginMessageThrottlerWin.cpp \
-                   plugins/win/PluginViewWin.cpp
-
-        LIBS += \
-            -ladvapi32 \
-            -lgdi32 \
-            -lshell32 \
-            -lshlwapi \
-            -luser32 \
-            -lversion
+        LIBS += -lefsrv
+
+    } else {
+
+        unix {
+    
+            mac {
+                SOURCES += \
+                    plugins/mac/PluginPackageMac.cpp \
+                    plugins/mac/PluginViewMac.cpp
+                OBJECTIVE_SOURCES += \
+                    platform/text/mac/StringImplMac.mm \
+                    platform/mac/WebCoreNSStringExtras.mm
+                INCLUDEPATH += platform/mac
+                # Note: XP_MACOSX is defined in npapi.h
+            } else {
+                !embedded: CONFIG += x11
+                SOURCES += \
+                    plugins/qt/PluginContainerQt.cpp \
+                    plugins/qt/PluginPackageQt.cpp \
+                    plugins/qt/PluginViewQt.cpp
+                HEADERS += \
+                    plugins/qt/PluginContainerQt.h
+                DEFINES += XP_UNIX
+            }
+        }
+    
+        win32-* {
+            INCLUDEPATH += $$PWD/plugins/win
+    
+            SOURCES += page/win/PageWin.cpp \
+                       plugins/win/PluginDatabaseWin.cpp \
+                       plugins/win/PluginPackageWin.cpp \
+                       plugins/win/PluginMessageThrottlerWin.cpp \
+                       plugins/win/PluginViewWin.cpp
+    
+            LIBS += \
+                -ladvapi32 \
+                -lgdi32 \
+                -lshell32 \
+                -lshlwapi \
+                -luser32 \
+                -lversion
+        }
     }
 
 } else {
@@ -2605,6 +2636,7 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/StorageAreaImpl.h \
         storage/StorageAreaSync.h \
         storage/StorageEvent.h \
+        storage/StorageEventDispatcher.h \
         storage/Storage.h \
         storage/StorageMap.h \
         storage/StorageNamespace.h \
@@ -2619,6 +2651,7 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/StorageAreaImpl.cpp \
         storage/StorageAreaSync.cpp \
         storage/StorageEvent.cpp \
+        storage/StorageEventDispatcher.cpp \
         storage/StorageMap.cpp \
         storage/StorageNamespace.cpp \
         storage/StorageNamespaceImpl.cpp \
@@ -2756,6 +2789,7 @@ contains(DEFINES, ENABLE_FILTERS=1) {
         platform/graphics/filters/FEColorMatrix.cpp \
         platform/graphics/filters/FEComponentTransfer.cpp \
         platform/graphics/filters/FEComposite.cpp \
+        platform/graphics/filters/FEGaussianBlur.cpp \
         platform/graphics/filters/FilterEffect.cpp \
         platform/graphics/filters/SourceAlpha.cpp \
         platform/graphics/filters/SourceGraphic.cpp
@@ -2900,6 +2934,7 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/SVGFELightElement.cpp \
         svg/SVGFEMergeElement.cpp \
         svg/SVGFEMergeNodeElement.cpp \
+        svg/SVGFEMorphologyElement.cpp \
         svg/SVGFEOffsetElement.cpp \
         svg/SVGFEPointLightElement.cpp \
         svg/SVGFESpecularLightingElement.cpp \
@@ -2986,6 +3021,7 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/SVGViewElement.cpp \
         svg/SVGViewSpec.cpp \
         svg/SVGZoomAndPan.cpp \
+        svg/SynchronizablePropertyController.cpp \
         svg/animation/SMILTime.cpp \
         svg/animation/SMILTimeContainer.cpp \
         svg/animation/SVGSMILElement.cpp \
@@ -2993,7 +3029,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/graphics/filters/SVGFEDiffuseLighting.cpp \
         svg/graphics/filters/SVGFEDisplacementMap.cpp \
         svg/graphics/filters/SVGFEFlood.cpp \
-        svg/graphics/filters/SVGFEGaussianBlur.cpp \
         svg/graphics/filters/SVGFEImage.cpp \
         svg/graphics/filters/SVGFEMerge.cpp \
         svg/graphics/filters/SVGFEMorphology.cpp \
diff --git a/src/3rdparty/webkit/WebCore/WebCore.qrc b/src/3rdparty/webkit/WebCore/WebCore.qrc
index b3fe43a3cc..69f860a0c9 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.qrc
+++ b/src/3rdparty/webkit/WebCore/WebCore.qrc
@@ -1,7 +1,4 @@
 <!DOCTYPE RCC><RCC version="1.0">
-<qresource prefix="/webcore/css">
-    <file alias="mediaControls-extras.css">css/qt/mediaControls-extras.css</file>
-</qresource>
 <qresource prefix="/webkit/resources">
     <file alias="missingImage.png">Resources/missingImage.png</file>
     <file alias="nullPlugin.png">Resources/nullPlugin.png</file>
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
index a807ab993c..7200de9ba4 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
@@ -101,6 +101,7 @@ MediaControlElementType AccessibilityMediaControl::controlType() const
 
 String AccessibilityMediaControl::controlTypeName() const
 {
+    DEFINE_STATIC_LOCAL(const String, mediaFullscreenButtonName, ("FullscreenButton"));
     DEFINE_STATIC_LOCAL(const String, mediaMuteButtonName, ("MuteButton"));
     DEFINE_STATIC_LOCAL(const String, mediaPlayButtonName, ("PlayButton"));
     DEFINE_STATIC_LOCAL(const String, mediaSeekBackButtonName, ("SeekBackButton"));
@@ -114,6 +115,8 @@ String AccessibilityMediaControl::controlTypeName() const
     DEFINE_STATIC_LOCAL(const String, mediaTimeRemainingDisplay, ("TimeRemainingDisplay"));
 
     switch (controlType()) {
+    case MediaFullscreenButton:
+        return mediaFullscreenButtonName;
     case MediaMuteButton:
         return mediaMuteButtonName;
     case MediaPlayButton:
diff --git a/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp b/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
new file mode 100644
index 0000000000..4d73d837a0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
@@ -0,0 +1,84 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "ScriptController.h"
+
+#include "Frame.h"
+#include "Page.h"
+#include "ScriptSourceCode.h"
+#include "ScriptValue.h"
+#include "Settings.h"
+#include "XSSAuditor.h"
+
+namespace WebCore {
+
+ScriptValue ScriptController::executeScript(const String& script, bool forceUserGesture)
+{
+    return executeScript(ScriptSourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url()));
+}
+
+ScriptValue ScriptController::executeScript(const ScriptSourceCode& sourceCode)
+{
+    if (!isEnabled() || isPaused())
+        return ScriptValue();
+
+    bool wasInExecuteScript = m_inExecuteScript;
+    m_inExecuteScript = true;
+
+    ScriptValue result = evaluate(sourceCode);
+
+    if (!wasInExecuteScript) {
+        m_inExecuteScript = false;
+        Document::updateStyleForAllDocuments();
+    }
+
+    return result;
+}
+
+bool ScriptController::executeIfJavaScriptURL(const KURL& url, bool userGesture, bool replaceDocument)
+{
+    if (!protocolIsJavaScript(url))
+        return false;
+
+    if (m_frame->page() && !m_frame->page()->javaScriptURLsAreAllowed())
+        return true;
+
+    const int javascriptSchemeLength = sizeof("javascript:") - 1;
+
+    String script = decodeURLEscapeSequences(url.string().substring(javascriptSchemeLength));
+    ScriptValue result;
+    if (xssAuditor()->canEvaluateJavaScriptURL(script))
+        result = executeScript(script, userGesture);
+
+    String scriptResult;
+    if (!result.getString(scriptResult))
+        return true;
+
+    // FIXME: We should always replace the document, but doing so
+    //        synchronously can cause crashes:
+    //        http://bugs.webkit.org/show_bug.cgi?id=16782
+    if (replaceDocument) 
+        m_frame->loader()->replaceDocument(scriptResult);
+
+    return true;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
index 9411ad80f7..a6cbd91f9b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
@@ -46,10 +46,6 @@ namespace WebCore {
 
 JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -60,10 +56,6 @@ JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
 
 JSValue JSAbstractWorker::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
new file mode 100644
index 0000000000..d08f7601d9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCallbackData.h"
+
+#include "Document.h"
+#include "JSDOMBinding.h"
+
+using namespace JSC;
+    
+namespace WebCore {
+
+void JSCallbackData::deleteData(void* context)
+{
+    delete static_cast<JSCallbackData*>(context);
+}
+
+JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedException)
+{
+    ASSERT(callback());
+    ASSERT(globalObject());
+
+    ExecState* exec = globalObject()->globalExec();
+    
+    JSValue function = callback()->get(exec, Identifier(exec, "handleEvent"));
+    CallData callData;
+    CallType callType = function.getCallData(callData);
+    if (callType == CallTypeNone) {
+        callType = callback()->getCallData(callData);
+        if (callType == CallTypeNone)
+            return JSValue();
+        function = callback();
+    }
+    
+    globalObject()->globalData()->timeoutChecker.start();
+    JSValue result = call(exec, function, callType, callData, callback(), args);
+    globalObject()->globalData()->timeoutChecker.stop();
+
+    Document::updateStyleForAllDocuments();
+
+    if (exec->hadException()) {
+        reportCurrentException(exec);
+        if (raisedException)
+            *raisedException = true;
+        return result;
+    }
+    
+    return result;
+}
+    
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
new file mode 100644
index 0000000000..4fc9f8494c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSCallbackData_h
+#define JSCallbackData_h
+
+#include "JSDOMGlobalObject.h"
+#include <runtime/JSObject.h>
+#include <runtime/Protect.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+// We have to clean up this data on the main thread because unprotecting a
+// JSObject on a non-main thread without synchronization would corrupt the heap
+// (and synchronization would be slow).
+
+class JSCallbackData {
+public:
+    static void deleteData(void*);
+
+    JSCallbackData(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+        : m_callback(callback)
+        , m_globalObject(globalObject)
+    {
+    }
+    
+    ~JSCallbackData()
+    {
+        ASSERT(isMainThread());
+    }
+
+    JSC::JSObject* callback() { return m_callback.get(); }
+    JSDOMGlobalObject* globalObject() { return m_globalObject.get(); }
+    
+    JSC::JSValue invokeCallback(JSC::MarkedArgumentBuffer&, bool* raisedException = 0);
+
+private:
+    JSC::ProtectedPtr<JSC::JSObject> m_callback;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+};
+
+} // namespace WebCore
+
+#endif // JSCallbackData_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
index 44c9000c42..5f1254ed96 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
@@ -47,8 +47,9 @@ namespace WebCore {
         //
         RefPtr<C> arrayObject;
         
+        // For the 0 args case, just create an object without a buffer 
         if (args.size() < 1)
-            return 0;
+            return C::create(0, 0, 0);
         
         if (args.at(0).isObject()) {
             RefPtr<CanvasArrayBuffer> buffer = toCanvasArrayBuffer(args.at(0));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
index 4aa15475b1..14548d7e39 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
@@ -29,6 +29,13 @@
 
 #include "config.h"
 #include "JSCanvasArray.h"
+#include "JSCanvasByteArray.h"
+#include "JSCanvasUnsignedByteArray.h"
+#include "JSCanvasShortArray.h"
+#include "JSCanvasUnsignedShortArray.h"
+#include "JSCanvasIntArray.h"
+#include "JSCanvasUnsignedIntArray.h"
+#include "JSCanvasFloatArray.h"
 
 #include "CanvasArray.h"
 
@@ -38,17 +45,21 @@ namespace WebCore {
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArray* object)
 {
-    if (!object)
-        return jsUndefined();
-        
-    
-
-#if ENABLE(3D_CANVAS)
-    if (object->is3d())
-        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
-#endif
-    ASSERT(object->is2d());
-    return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
+    if (object->isFloatArray())
+        return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, static_cast<CanvasFloatArray*>(object));
+    if (object->isUnsignedByteArray())
+        return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, static_cast<CanvasUnsignedByteArray*>(object));
+    if (object->isByteArray())
+        return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, static_cast<CanvasByteArray*>(object));
+    if (object->isIntArray())
+        return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, static_cast<CanvasIntArray*>(object));
+    if (object->isUnsignedIntArray())
+        return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, static_cast<CanvasUnsignedIntArray*>(object));
+    if (object->isShortArray())
+        return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, static_cast<CanvasShortArray*>(object));
+    if (object->isUnsignedShortArray())
+        return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, static_cast<CanvasUnsignedShortArray*>(object));
+    return jsUndefined();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
index 707442362c..e5f83aa10d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
@@ -36,45 +36,19 @@ namespace WebCore {
 using namespace JSC;
 
 JSCustomPositionCallback::JSCustomPositionCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
-    : m_callback(callback)
-    , m_globalObject(globalObject)
+    : m_data(callback, globalObject)
 {
 }
 
 void JSCustomPositionCallback::handleEvent(Geoposition* geoposition)
 {
-    ASSERT(m_callback);
-    ASSERT(m_globalObject);
-
-    ExecState* exec = m_globalObject->globalExec();
-    
-    JSC::JSLock lock(SilenceAssertionsOnly);
-    
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
-    
     RefPtr<JSCustomPositionCallback> protect(this);
 
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data.globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), geoposition));
-
-    m_globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    m_globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException())
-        reportCurrentException(exec);
-    
-    Document::updateStyleForAllDocuments();
+    m_data.invokeCallback(args);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h
index 15a166af1a..ad5528dc23 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h
@@ -26,14 +26,14 @@
 #ifndef JSCustomPositionCallback_h
 #define JSCustomPositionCallback_h
 
+#include "JSCallbackData.h"
 #include "PositionCallback.h"
-#include "JSDOMGlobalObject.h"
-#include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
 
 class Geoposition;
+class JSDOMGlobalObject;
 
 class JSCustomPositionCallback : public PositionCallback {
 public:
@@ -46,9 +46,8 @@ private:
     JSCustomPositionCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
     virtual void handleEvent(Geoposition*);
-
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+    
+    JSCallbackData m_data;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
index 9109cd1e2c..bd64deb48d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
@@ -36,45 +36,20 @@ namespace WebCore {
 using namespace JSC;
 
 JSCustomPositionErrorCallback::JSCustomPositionErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
-    : m_callback(callback)
-    , m_globalObject(globalObject)
+    : m_data(callback, globalObject)
 {
 }
 
 void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
 {
-    ASSERT(m_callback);
-    ASSERT(m_globalObject);
+    RefPtr<JSCustomPositionErrorCallback> protect(this);
 
-    ExecState* exec = m_globalObject->globalExec();
-    
     JSC::JSLock lock(SilenceAssertionsOnly);
-    
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
-    
-    RefPtr<JSCustomPositionErrorCallback> protect(this);
-    
+    ExecState* exec = m_data.globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), positionError));
     
-    m_globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    m_globalObject->globalData()->timeoutChecker.stop();
-    
-    if (exec->hadException())
-        reportCurrentException(exec);
-
-    Document::updateStyleForAllDocuments();
+    m_data.invokeCallback(args);
 }
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h
index d97e967e06..59328ca9eb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h
@@ -26,9 +26,8 @@
 #ifndef JSCustomPositionErrorCallback_h
 #define JSCustomPositionErrorCallback_h
 
+#include "JSCallbackData.h"
 #include "PositionErrorCallback.h"
-#include "JSDOMGlobalObject.h"
-#include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
@@ -45,9 +44,8 @@ public:
 private:
     JSCustomPositionErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject* globalObject);
     virtual void handleEvent(PositionError*);
-
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+    
+    JSCallbackData m_data;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
index cdeda8fe42..1f6bd95e9a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
@@ -36,55 +36,38 @@
 #include "JSSQLResultSet.h"
 #include "JSSQLTransaction.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
 JSCustomSQLStatementCallback::JSCustomSQLStatementCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
-    : m_callback(callback)
-    , m_globalObject(globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
     
-void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLResultSet* resultSet, bool& raisedException)
+JSCustomSQLStatementCallback::~JSCustomSQLStatementCallback()
 {
-    ASSERT(m_callback);
-    ASSERT(m_globalObject);
-        
-    ExecState* exec = m_globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
 
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
+void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLResultSet* resultSet, bool& raisedException)
+{
+    ASSERT(m_data);
 
     RefPtr<JSCustomSQLStatementCallback> protect(this);
 
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), resultSet));
-        
-    m_globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    m_globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException()) {
-        reportCurrentException(exec);
-
-        raisedException = true;
-    }
 
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args, &raisedException);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
index e6600c5cf9..259aecf130 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
@@ -31,9 +31,8 @@
 
 #if ENABLE(DATABASE)
 
-#include "JSDOMGlobalObject.h"
+#include "JSCallbackData.h"
 #include "SQLStatementCallback.h"
-#include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
@@ -46,14 +45,15 @@ public:
     {
         return adoptRef(new JSCustomSQLStatementCallback(callback, globalObject));
     }
+    
+    virtual ~JSCustomSQLStatementCallback();
 
     virtual void handleEvent(SQLTransaction*, SQLResultSet*, bool& raisedException);
 
 private:
     JSCustomSQLStatementCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+    JSCallbackData* m_data;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index ea47c647f7..61785092bf 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -32,70 +32,51 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
-#include "ScriptController.h"
+#include "JSCallbackData.h"
 #include "JSSQLError.h"
 #include "JSSQLTransaction.h"
+#include "ScriptController.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
 JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
-    : m_callback(callback)
-    , m_globalObject(globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
-    
-bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLError* error)
+
+JSCustomSQLStatementErrorCallback::~JSCustomSQLStatementErrorCallback()
 {
-    ASSERT(m_callback);
-    ASSERT(m_globalObject);
-        
-    ExecState* exec = m_globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
-        
-    JSValue handleEventFunction = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
-    CallData callbackCallData;
-    CallType callbackCallType = CallTypeNone;
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
 
-    if (handleEventCallType == CallTypeNone) {
-        callbackCallType = m_callback->getCallData(callbackCallData);
-        if (callbackCallType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return true;
-        }
-    }
+bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLError* error)
+{
+    ASSERT(m_data);
         
     RefPtr<JSCustomSQLStatementErrorCallback> protect(this);
         
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), error));
-        
-    JSValue result;
-    m_globalObject->globalData()->timeoutChecker.start();
-    if (handleEventCallType != CallTypeNone)
-        result = call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_callback, args);
-    else
-        result = call(exec, m_callback, callbackCallType, callbackCallData, m_callback, args);
-    m_globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException()) {
-        reportCurrentException(exec);
-            
+    
+    bool raisedException = false;
+    JSValue result = m_data->invokeCallback(args, &raisedException);
+    if (raisedException) {
         // The spec says:
         // "If the error callback returns false, then move on to the next statement..."
         // "Otherwise, the error callback did not return false, or there was no error callback"
         // Therefore an exception and returning true are the same thing - so, return true on an exception
         return true;
     }
-        
-    Document::updateStyleForAllDocuments();
-
     return result.toBoolean(exec);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
index e03ac35bd6..ac4e45f9f7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
@@ -37,7 +37,8 @@
 #include <wtf/Forward.h>
 
 namespace WebCore {
-    
+
+class JSCallbackData;    
 class SQLError;
     
 class JSCustomSQLStatementErrorCallback : public SQLStatementErrorCallback {
@@ -46,14 +47,15 @@ public:
     {
         return adoptRef(new JSCustomSQLStatementErrorCallback(callback, globalObject));
     }
-        
+
+    virtual ~JSCustomSQLStatementErrorCallback();
+
     virtual bool handleEvent(SQLTransaction*, SQLError*);
 
 private:
     JSCustomSQLStatementErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+    JSCallbackData* m_data;
 };
     
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
index 18863455ac..456022f9f7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
@@ -32,6 +32,7 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
+#include "JSCallbackData.h"
 #include "JSDOMGlobalObject.h"
 #include "JSSQLTransaction.h"
 #include "Page.h"
@@ -48,42 +49,17 @@ using namespace JSC;
 static WTF::RefCountedLeakCounter counter("JSCustomSQLTransactionCallback");
 #endif
 
-// We have to clean up the data on the main thread because unprotecting the 
-// JSObject on a non-main thread would register that thread for JavaScript
-// garbage collection, which could unnecessarily slow things down.
-
-class JSCustomSQLTransactionCallback::Data {
-public:
-    Data(JSObject* callback, JSDOMGlobalObject* globalObject)
-        : m_callback(callback)
-        , m_globalObject(globalObject)
-    {
-    }
-
-    JSObject* callback() { return m_callback; }
-    JSDOMGlobalObject* globalObject() { return m_globalObject.get(); }
-
-private:
-    ProtectedPtr<JSObject> m_callback;
-    ProtectedPtr<JSDOMGlobalObject> m_globalObject;
-};
-
 JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
-    : m_data(new Data(callback, globalObject))
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 #ifndef NDEBUG
     counter.increment();
 #endif
 }
 
-void JSCustomSQLTransactionCallback::deleteData(void* context)
-{
-    delete static_cast<Data*>(context);
-}
-
 JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback()
 {
-    callOnMainThread(deleteData, m_data);
+    callOnMainThread(JSCallbackData::deleteData, m_data);
 #ifndef NDEBUG
     m_data = 0;
     counter.decrement();
@@ -93,47 +69,14 @@ JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback()
 void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bool& raisedException)
 {
     ASSERT(m_data);
-    ASSERT(m_data->callback());
-    ASSERT(m_data->globalObject());
 
-    JSDOMGlobalObject* globalObject = m_data->globalObject();
-    ExecState* exec = globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
-        
-    JSValue handleEventFunction = m_data->callback()->get(exec, Identifier(exec, "handleEvent"));
-    CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
-    CallData callbackCallData;
-    CallType callbackCallType = CallTypeNone;
-
-    if (handleEventCallType == CallTypeNone) {
-        callbackCallType = m_data->callback()->getCallData(callbackCallData);
-        if (callbackCallType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-    }
-        
     RefPtr<JSCustomSQLTransactionCallback> protect(this);
         
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
-
-    globalObject->globalData()->timeoutChecker.start();
-    if (handleEventCallType != CallTypeNone)
-        call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_data->callback(), args);
-    else
-        call(exec, m_data->callback(), callbackCallType, callbackCallData, m_data->callback(), args);
-    globalObject->globalData()->timeoutChecker.stop();
-        
-    if (exec->hadException()) {
-        reportCurrentException(exec);
-        
-        raisedException = true;
-    }
-        
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args, &raisedException);
 }
     
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
index f7f78f244e..f142e59b81 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
@@ -41,6 +41,7 @@ namespace JSC {
 namespace WebCore {
 
 class Frame;
+class JSCallbackData;
 class JSDOMGlobalObject;
 
 class JSCustomSQLTransactionCallback : public SQLTransactionCallback {
@@ -57,10 +58,7 @@ public:
 private:
     JSCustomSQLTransactionCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    static void deleteData(void*);
-
-    class Data;
-    Data* m_data;
+    JSCallbackData* m_data;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
index b2f828018d..331e014c79 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
@@ -32,54 +32,40 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
-#include "ScriptController.h"
+#include "JSCallbackData.h"
 #include "JSSQLError.h"
+#include "ScriptController.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
 JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
-    : m_callback(callback)
-    , m_globalObject(globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
-    
-void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
-{
-    ASSERT(m_callback);
-    ASSERT(m_globalObject);
-
-    ExecState* exec = m_globalObject->globalExec();
 
-    JSC::JSLock lock(SilenceAssertionsOnly);
+JSCustomSQLTransactionErrorCallback::~JSCustomSQLTransactionErrorCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
 
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
+void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
+{
+    ASSERT(m_data);
 
     RefPtr<JSCustomSQLTransactionErrorCallback> protect(this);
 
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), error));
-
-    m_globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    m_globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException())
-        reportCurrentException(exec);
-
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
index 42fcbce667..54bf33b8c5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
@@ -38,6 +38,7 @@
 
 namespace WebCore {
 
+class JSCallbackData;
 class SQLError;
 
 class JSCustomSQLTransactionErrorCallback : public SQLTransactionErrorCallback {
@@ -47,13 +48,14 @@ public:
         return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, globalObject));
     }
     
+    virtual ~JSCustomSQLTransactionErrorCallback();
+    
     virtual void handleEvent(SQLError*);
 
 private:
     JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject* globalObject);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+    JSCallbackData* m_data;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
index 5300c42b5d..0edd66fdde 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
@@ -30,53 +30,38 @@
 #include "JSCustomVoidCallback.h"
 
 #include "Frame.h"
+#include "JSCallbackData.h"
 #include "JSDOMWindowCustom.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
 JSCustomVoidCallback::JSCustomVoidCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
-    : m_callback(callback)
-    , m_globalObject(globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
+
+JSCustomVoidCallback::~JSCustomVoidCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
     
 void JSCustomVoidCallback::handleEvent()
 {
-    ASSERT(m_callback);
-    ASSERT(m_globalObject);
+    ASSERT(m_data);
 
-    ExecState* exec = m_globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
-        
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
-        
     RefPtr<JSCustomVoidCallback> protect(this);
         
+    JSC::JSLock lock(SilenceAssertionsOnly);
     MarkedArgumentBuffer args;
-    
-    m_globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    m_globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException())
-        reportCurrentException(exec);
-        
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
index f3db49f0de..4b8d7ea394 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
@@ -36,6 +36,8 @@
 
 namespace WebCore {
 
+class JSCallbackData;
+
 class JSCustomVoidCallback : public VoidCallback {
 public: 
     static PassRefPtr<JSCustomVoidCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
@@ -43,13 +45,14 @@ public:
         return adoptRef(new JSCustomVoidCallback(callback, globalObject));
     }
     
+    virtual ~JSCustomVoidCallback();
+    
     virtual void handleEvent();
     
 private:
     JSCustomVoidCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+    JSCallbackData* m_data;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index 49ef5e3aca..8634589ed2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -87,10 +87,6 @@ JSValue JSDOMApplicationCache::remove(ExecState* exec, const ArgList& args)
 
 JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -101,10 +97,6 @@ JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList&
 
 JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index 515c0883f6..8168323c5f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -25,6 +25,7 @@
 #include "DOMCoreException.h"
 #include "Document.h"
 #include "EventException.h"
+#include "ExceptionBase.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLAudioElement.h"
@@ -35,6 +36,7 @@
 #include "JSDOMCoreException.h"
 #include "JSDOMWindowCustom.h"
 #include "JSEventException.h"
+#include "JSExceptionBase.h"
 #include "JSNode.h"
 #include "JSRangeException.h"
 #include "JSXMLHttpRequestException.h"
@@ -468,6 +470,9 @@ void reportException(ExecState* exec, JSValue exception)
     UString exceptionSourceURL = exceptionObject->get(exec, Identifier(exec, "sourceURL")).toString(exec);
     exec->clearException();
 
+    if (ExceptionBase* exceptionBase = toExceptionBase(exception))
+        errorMessage = exceptionBase->message() + ": "  + exceptionBase->description();
+
     ScriptExecutionContext* scriptExecutionContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
     ASSERT(scriptExecutionContext);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
index 9c0ad7ec13..9af45d7648 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
@@ -76,10 +76,12 @@ namespace WebCore {
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasStandardGetOwnPropertySlot));
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
         }
 
     protected:
+        static const unsigned StructureFlags = JSC::OverridesMarkChildren | DOMObject::StructureFlags;
+
         DOMObjectWithGlobalPointer(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObject(structure)
             , m_globalObject(globalObject)
@@ -106,10 +108,11 @@ namespace WebCore {
     public:
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasStandardGetOwnPropertySlot | JSC::ImplementsHasInstance));
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
         }
 
     protected:
+        static const unsigned StructureFlags = JSC::ImplementsHasInstance | JSC::OverridesMarkChildren | DOMObjectWithGlobalPointer::StructureFlags;
         DOMConstructorObject(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObjectWithGlobalPointer(structure, globalObject)
         {
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
index 372684c01e..53bb26b84c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -51,7 +51,7 @@ void JSDOMGlobalObject::markChildren(MarkStack& markStack)
 
     JSDOMStructureMap::iterator end = structures().end();
     for (JSDOMStructureMap::iterator it = structures().begin(); it != end; ++it)
-        it->second->markAggregate(markStack);
+        markStack.append(it->second->storedPrototype());
 
     JSDOMConstructorMap::iterator end2 = constructors().end();
     for (JSDOMConstructorMap::iterator it2 = constructors().begin(); it2 != end2; ++it2)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
index 00c3bbf1bc..ce26857062 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -73,6 +73,12 @@ namespace WebCore {
             {
             }
 
+            JSDOMGlobalObjectData(Destructor destructor)
+                : JSGlobalObjectData(destructor)
+                , evt(0)
+            {
+            }
+
             JSDOMStructureMap structures;
             JSDOMConstructorMap constructors;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
index fe4d59c012..a04ef89e00 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -42,12 +42,6 @@ namespace WebCore {
 
 const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, 0, 0 };
 
-JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
-    : impl(window)
-    , shell(shell)
-{
-}
-
 JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
 {
@@ -175,6 +169,11 @@ JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
     return globalData;
 }
 
+void JSDOMWindowBase::destroyJSDOMWindowBaseData(void* jsDOMWindowBaseData)
+{
+    delete static_cast<JSDOMWindowBaseData*>(jsDOMWindowBaseData);
+}
+
 // JSDOMGlobalObject* is ignored, accesing a window in any context will
 // use that DOMWindow's prototype chain.
 JSValue toJS(ExecState* exec, JSDOMGlobalObject*, DOMWindow* domWindow)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
index 09fe4bc4a8..52c3c1d8e9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
@@ -76,7 +76,12 @@ namespace WebCore {
 
     private:
         struct JSDOMWindowBaseData : public JSDOMGlobalObjectData {
-            JSDOMWindowBaseData(PassRefPtr<DOMWindow>, JSDOMWindowShell*);
+            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+                : JSDOMGlobalObjectData(destroyJSDOMWindowBaseData)
+                , impl(window)
+                , shell(shell)
+            {
+            }
 
             RefPtr<DOMWindow> impl;
             JSDOMWindowShell* shell;
@@ -85,6 +90,8 @@ namespace WebCore {
         bool allowsAccessFromPrivate(const JSC::JSGlobalObject*) const;
         String crossDomainAccessErrorMessage(const JSC::JSGlobalObject*) const;
         
+        static void destroyJSDOMWindowBaseData(void*);
+
         JSDOMWindowBaseData* d() const { return static_cast<JSDOMWindowBaseData*>(JSC::JSVariableObject::d); }
     };
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 7410107560..deb92cb1b3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -79,7 +79,9 @@
 #include "RegisteredEventListener.h"
 #include "ScheduledAction.h"
 #include "ScriptController.h"
+#include "SerializedScriptValue.h"
 #include "Settings.h"
+#include "SharedWorkerRepository.h"
 #include "WindowFeatures.h"
 #include <runtime/Error.h>
 #include <runtime/JSFunction.h>
@@ -589,7 +591,7 @@ void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
 
     if (!protocolIsJavaScript(url) || allowsAccessFrom(exec)) {
         // We want a new history item if this JS was called via a user gesture
-        frame->loader()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture(exec));
+        frame->redirectScheduler()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture(exec));
     }
 }
 
@@ -713,7 +715,9 @@ JSValue JSDOMWindow::worker(ExecState* exec) const
 #if ENABLE(SHARED_WORKERS)
 JSValue JSDOMWindow::sharedWorker(ExecState* exec) const
 {
-    return getDOMConstructor<JSSharedWorkerConstructor>(exec, this);
+    if (SharedWorkerRepository::isAvailable())
+        return getDOMConstructor<JSSharedWorkerConstructor>(exec, this);
+    return jsUndefined();
 }
 #endif
 
@@ -726,8 +730,6 @@ JSValue JSDOMWindow::webSocket(ExecState* exec) const
     Settings* settings = frame->settings();
     if (!settings)
         return jsUndefined();
-    if (!settings->experimentalWebSocketsEnabled())
-        return jsUndefined();
     return getDOMConstructor<JSWebSocketConstructor>(exec, this);
 }
 #endif
@@ -767,7 +769,7 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
         return 0;
 
     newFrame->loader()->setOpener(openerFrame);
-    newFrame->loader()->setOpenedByDOM();
+    newFrame->page()->setOpenedByDOM();
 
     JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
 
@@ -781,7 +783,7 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
         if (created)
             newFrame->loader()->changeLocation(completedURL, referrer, false, false, userGesture);
         else if (!url.isEmpty())
-            newFrame->loader()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+            newFrame->redirectScheduler()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
     }
 
     return newFrame;
@@ -838,7 +840,7 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
             // here.
             String referrer = dynamicFrame->loader()->outgoingReferrer();
 
-            frame->loader()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+            frame->redirectScheduler()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
         }
         return toJS(exec, frame->domWindow());
     }
@@ -933,7 +935,15 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
     JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
     dialogFrame->page()->chrome()->runModal();
 
-    return dialogWindow->getDirect(Identifier(exec, "returnValue"));
+    Identifier returnValue(exec, "returnValue");
+    if (dialogWindow->allowsAccessFromNoErrorMessage(exec)) {
+        PropertySlot slot;
+        // This is safe, we have already performed the origin security check and we are
+        // not interested in any of the DOM properties of the window.
+        if (dialogWindow->JSGlobalObject::getOwnPropertySlot(exec, returnValue, slot))
+            return slot.getValue(exec, returnValue);
+    }
+    return jsUndefined();
 }
 
 JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
@@ -941,7 +951,7 @@ JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
     DOMWindow* window = impl();
 
     DOMWindow* source = asJSDOMWindow(exec->lexicalGlobalObject())->impl();
-    String message = args.at(0).toString(exec);
+    PassRefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, args.at(0));
 
     if (exec->hadException())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
index 23af3407dc..1bb0938ba6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
@@ -60,10 +60,12 @@ namespace WebCore {
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype) 
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType)); 
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
         }
 
     private:
+        static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | DOMObject::StructureFlags;
+
         virtual void markChildren(JSC::MarkStack&);
         virtual JSC::UString className() const;
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
index 493d7bd7f4..9bff637d09 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
@@ -63,29 +63,21 @@ JSValue JSNotificationCenter::requestPermission(ExecState* exec, const ArgList&
 
 JSValue JSNotification::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener)), globalObject, false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener)), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSNotification::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
index e48b59399f..d7f8725426 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -88,7 +88,7 @@ void JSDocument::setLocation(ExecState* exec, JSValue value)
         str = activeFrame->document()->completeURL(str).string();
 
     bool userGesture = activeFrame->script()->processingUserGesture();
-    frame->loader()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+    frame->redirectScheduler()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
 }
 
 JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Document* document)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
index 162543d617..edf9151a75 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
@@ -31,6 +31,7 @@
 
 #include "Clipboard.h"
 #include "Event.h"
+#include "JSBeforeLoadEvent.h"
 #include "JSClipboard.h"
 #include "JSErrorEvent.h"
 #include "JSKeyboardEvent.h"
@@ -46,6 +47,7 @@
 #include "JSWebKitTransitionEvent.h"
 #include "JSWheelEvent.h"
 #include "JSXMLHttpRequestProgressEvent.h"
+#include "BeforeLoadEvent.h"
 #include "ErrorEvent.h"
 #include "KeyboardEvent.h"
 #include "MessageEvent.h"
@@ -120,7 +122,8 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, XMLHttpRequestProgressEvent, event);
         else
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, ProgressEvent, event);
-    }
+    } else if (event->isBeforeLoadEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, BeforeLoadEvent, event);
 #if ENABLE(DOM_STORAGE)
     else if (event->isStorageEvent())
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, StorageEvent, event);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
index 404bf11c64..00dfe12ff7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
@@ -45,10 +45,6 @@ namespace WebCore {
 
 JSValue JSEventSource::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -59,10 +55,6 @@ JSValue JSEventSource::addEventListener(ExecState* exec, const ArgList& args)
 
 JSValue JSEventSource::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.cpp
new file mode 100644
index 0000000000..3749eed98d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.cpp
@@ -0,0 +1,64 @@
+/*

+ * Copyright (C) 2009 Apple Inc. All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#include "config.h"

+#include "JSExceptionBase.h"

+

+#include "JSDOMCoreException.h"

+#include "JSEventException.h"

+#include "JSRangeException.h"

+#include "JSXMLHttpRequestException.h"

+#if ENABLE(SVG)

+#include "JSSVGException.h"

+#endif

+#if ENABLE(XPATH)

+#include "JSXPathException.h"

+#endif

+ 

+namespace WebCore {

+ 

+ExceptionBase* toExceptionBase(JSC::JSValue value)

+{

+    if (DOMCoreException* domException = toDOMCoreException(value))

+        return reinterpret_cast<ExceptionBase*>(domException);

+    if (RangeException* rangeException = toRangeException(value))

+        return reinterpret_cast<ExceptionBase*>(rangeException);

+    if (EventException* eventException = toEventException(value))

+        return reinterpret_cast<ExceptionBase*>(eventException);

+    if (XMLHttpRequestException* xmlHttpException = toXMLHttpRequestException(value))

+        return reinterpret_cast<ExceptionBase*>(xmlHttpException);

+#if ENABLE(SVG)

+    if (SVGException* svgException = toSVGException(value))

+        return reinterpret_cast<ExceptionBase*>(svgException);

+#endif

+#if ENABLE(XPATH)

+    if (XPathException* pathException = toXPathException(value))

+        return reinterpret_cast<ExceptionBase*>(pathException);

+#endif

+    

+    return 0;

+}

+

+} // namespace WebCore

diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.h
new file mode 100644
index 0000000000..01c6ac24e2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.h
@@ -0,0 +1,43 @@
+/*

+ * Copyright (C) 2009 Apple Inc. All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#ifndef JSExceptionBase_h

+#define JSExceptionBase_h

+

+namespace JSC {

+    

+class JSValue;

+

+}   // namespace JSC

+

+namespace WebCore {

+

+class ExceptionBase;

+

+ExceptionBase* toExceptionBase(JSC::JSValue);

+

+} // namespace WebCore

+

+#endif // JSExceptionBase_h

diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
index e6fe7f563d..da3a758b26 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
@@ -42,10 +42,12 @@ namespace WebCore {
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
         { 
-            return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::MasqueradesAsUndefined)); 
+            return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
         }
 
         static const JSC::ClassInfo s_info;
+    protected:
+        static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::MasqueradesAsUndefined | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSHTMLCollection::StructureFlags;
 
     private:
         virtual bool toBoolean(JSC::ExecState*) const { return false; }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
index 583d97133a..391caccf10 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
@@ -66,10 +66,7 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 #include "JavaScriptCallFrame.h"
 #include "JavaScriptDebugServer.h"
-#include "JavaScriptProfile.h"
 #include "JSJavaScriptCallFrame.h"
-#include <profiler/Profile.h>
-#include <profiler/Profiler.h>
 #endif
 
 using namespace JSC;
@@ -122,27 +119,20 @@ JSValue JSInspectorBackend::search(ExecState* exec, const ArgList& args)
 }
 
 #if ENABLE(DATABASE)
-JSValue JSInspectorBackend::databaseTableNames(ExecState* exec, const ArgList& args)
+JSValue JSInspectorBackend::databaseForId(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
 
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
         return jsUndefined();
 
-    Database* database = toDatabase(wrapper->unwrappedObject());
+    Database* database = impl()->databaseForId(args.at(0).toInt32(exec));
     if (!database)
         return jsUndefined();
-
-    MarkedArgumentBuffer result;
-
-    Vector<String> tableNames = database->tableNames();
-    unsigned length = tableNames.size();
-    for (unsigned i = 0; i < length; ++i)
-        result.append(jsString(exec, tableNames[i]));
-
-    return constructArray(exec, result);
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, database));
 }
 #endif
 
@@ -260,21 +250,6 @@ JSValue JSInspectorBackend::currentCallFrame(ExecState* exec, const ArgList&)
     return JSInspectedObjectWrapper::wrap(globalExec, toJS(exec, callFrame));
 }
 
-JSValue JSInspectorBackend::profiles(JSC::ExecState* exec, const JSC::ArgList&)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    MarkedArgumentBuffer result;
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-    const Vector<RefPtr<Profile> >& profiles = ic->profiles();
-
-    for (size_t i = 0; i < profiles.size(); ++i)
-        result.append(toJS(exec, profiles[i].get()));
-
-    return constructArray(exec, result);
-}
-
 #endif
 
 JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
@@ -295,12 +270,12 @@ JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
     return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, deprecatedGlobalObjectForPrototype(inspectedWindow->globalExec()), node));
 }
 
-JSValue JSInspectorBackend::wrapObject(ExecState*, const ArgList& args)
+JSValue JSInspectorBackend::wrapObject(ExecState* exec, const ArgList& args)
 {
-    if (args.size() < 1)
+    if (args.size() < 2)
         return jsUndefined();
 
-    return impl()->wrapObject(ScriptValue(args.at(0))).jsValue();
+    return impl()->wrapObject(ScriptValue(args.at(0)), args.at(1).toString(exec)).jsValue();
 }
 
 JSValue JSInspectorBackend::unwrapObject(ExecState* exec, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
index aecec5ea56..c76a2b18c9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
@@ -196,7 +196,7 @@ static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bo
         return;
 
     if (!protocolIsJavaScript(url) || allowsAccessFromFrame(exec, frame))
-        frame->loader()->scheduleLocationChange(url.string(), lexicalFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture(exec));
+        frame->redirectScheduler()->scheduleLocationChange(url.string(), lexicalFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture(exec));
 }
 
 void JSLocation::setHref(ExecState* exec, JSValue value)
@@ -326,7 +326,7 @@ JSValue JSLocation::reload(ExecState* exec, const ArgList&)
         return jsUndefined();
 
     if (!protocolIsJavaScript(frame->loader()->url()))
-        frame->loader()->scheduleRefresh(processingUserGesture(exec));
+        frame->redirectScheduler()->scheduleRefresh(processingUserGesture(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageEventCustom.cpp
index 4c61c0409f..2e7b2d0626 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageEventCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageEventCustom.cpp
@@ -59,7 +59,7 @@ JSC::JSValue JSMessageEvent::initMessageEvent(JSC::ExecState* exec, const JSC::A
     const UString& typeArg = args.at(0).toString(exec);
     bool canBubbleArg = args.at(1).toBoolean(exec);
     bool cancelableArg = args.at(2).toBoolean(exec);
-    const UString& dataArg = args.at(3).toString(exec);
+    PassRefPtr<SerializedScriptValue> dataArg = SerializedScriptValue::create(exec, args.at(3));
     const UString& originArg = args.at(4).toString(exec);
     const UString& lastEventIdArg = args.at(5).toString(exec);
     DOMWindow* sourceArg = toDOMWindow(args.at(6));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
index 210c93e283..a0a92beedd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -57,10 +57,6 @@ void JSMessagePort::markChildren(MarkStack& markStack)
 
 JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -71,10 +67,6 @@ JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
 
 JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.h
index 7e9094392e..17b1eae80c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.h
@@ -49,7 +49,7 @@ namespace WebCore {
     template <typename T>
     inline JSC::JSValue handlePostMessage(JSC::ExecState* exec, const JSC::ArgList& args, T* impl)
     {
-        String message = args.at(0).toString(exec);
+        PassRefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, args.at(0));
         MessagePortArray portArray;
         fillMessagePortArray(exec, args.at(1), portArray);
         if (exec->hadException())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
index 52f21e779c..4e7d6229c2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
@@ -110,14 +110,6 @@ JSValue JSNode::appendChild(ExecState* exec, const ArgList& args)
 
 JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
 {
-    Document* document = impl()->document();
-    if (!document)
-        return jsUndefined();
-        
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -128,14 +120,6 @@ JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
 
 JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    Document* document = impl()->document();
-    if (!document)
-        return jsUndefined();
-
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
index 94a92bdd0a..9f624951c0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
@@ -47,10 +47,12 @@ namespace WebCore {
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
         { 
-            return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::OverridesHasInstance)); 
+            return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
         }
 
     protected:
+        static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::ImplementsHasInstance | JSC::OverridesHasInstance | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::JSObject::StructureFlags;
+
         JSQuarantinedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
 
         virtual void markChildren(JSC::MarkStack&);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index 571e3021ac..fd3742d12a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -50,10 +50,6 @@ void JSSVGElementInstance::markChildren(MarkStack& markStack)
 
 JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -64,10 +60,6 @@ JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& a
 
 JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
index d305502f87..bea3563900 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -36,6 +36,7 @@
 #include "JSWebSocket.h"
 
 #include "KURL.h"
+#include "JSEventListener.h"
 #include "WebSocket.h"
 #include "NotImplemented.h"
 #include <runtime/Error.h>
@@ -59,7 +60,25 @@ JSValue JSWebSocket::send(ExecState* exec, const ArgList& args)
     return ret;
 }
 
-// FIXME: implement addEventListener/removeEventListener.
+JSValue JSWebSocket::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue JSWebSocket::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
 
 }  // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 4b44db26eb..7d3f8af14e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -152,10 +152,6 @@ JSValue JSXMLHttpRequest::overrideMimeType(ExecState* exec, const ArgList& args)
 
 JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -166,10 +162,6 @@ JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
 
 JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index dab0a3e3ba..275d1fbbc5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -56,10 +56,6 @@ void JSXMLHttpRequestUpload::markChildren(MarkStack& markStack)
 
 JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -70,10 +66,6 @@ JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList&
 
 JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
index 9e64bceb9a..93155e1f61 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
@@ -125,7 +125,7 @@ void ScheduledAction::execute(Document* document)
         executeFunctionInContext(window, window->shell());
         Document::updateStyleForAllDocuments();
     } else
-        frame->loader()->executeScript(m_code);
+        frame->script()->executeScript(m_code);
 
     frame->script()->setProcessingTimerCallback(false);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
index e7d0b750b3..2cd36ed541 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
@@ -21,6 +21,7 @@
 #define ScheduledAction_h
 
 #include "PlatformString.h"
+#include <runtime/JSCell.h>
 #include <runtime/Protect.h>
 #include <wtf/Vector.h>
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
index 8852611247..77b8ca48fe 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -86,7 +86,7 @@ void ScriptCachedFrameData::clear()
 {
     JSLock lock(SilenceAssertionsOnly);
 
-    if (!m_window) {
+    if (m_window) {
         m_window = 0;
         gcController().garbageCollectSoon();
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
index dfa16026ed..54acc90b06 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
@@ -48,6 +48,7 @@ ScriptController::ScriptController(Frame* frame)
     : m_frame(frame)
     , m_handlerLineNumber(0)
     , m_sourceURL(0)
+    , m_inExecuteScript(false)
     , m_processingTimerCallback(false)
     , m_paused(false)
     , m_allowPopupsFromPlugin(false)
@@ -84,7 +85,7 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
 {
     const SourceCode& jsSourceCode = sourceCode.jsSourceCode();
     String sourceURL = jsSourceCode.provider()->url();
-    
+
     if (!m_XSSAuditor->canEvaluate(sourceCode.source())) {
         // This script is not safe to be evaluated.
         return JSValue();
@@ -185,6 +186,9 @@ bool ScriptController::processingUserGestureEvent() const
         return false;
 
     if (Event* event = m_windowShell->window()->currentEvent()) {
+        if (event->createdByDOM())
+            return false;
+
         const AtomicString& type = event->type();
         if ( // mouse events
             type == eventNames().clickEvent || type == eventNames().mousedownEvent ||
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
index 56e8f0c927..bd4b65ef52 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
@@ -80,6 +80,12 @@ public:
         return m_windowShell->window();
     }
 
+    ScriptValue executeScript(const ScriptSourceCode&);
+    ScriptValue executeScript(const String& script, bool forceUserGesture = false);
+
+    // Returns true if argument is a JavaScript URL.
+    bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
+
     ScriptValue evaluate(const ScriptSourceCode&);
     void evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>&);
 
@@ -155,6 +161,8 @@ private:
     int m_handlerLineNumber;
     const String* m_sourceURL;
 
+    bool m_inExecuteScript;
+
     bool m_processingTimerCallback;
     bool m_paused;
     bool m_allowPopupsFromPlugin;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
index b527a96a13..1172e8e81f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
@@ -103,6 +103,14 @@ bool ScriptObject::set(const char* name, int value)
     return handleException(m_scriptState);
 }
 
+bool ScriptObject::set(const char* name, unsigned value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    PutPropertySlot slot;
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
+}
+
 bool ScriptObject::set(const char* name, bool value)
 {
     JSLock lock(SilenceAssertionsOnly);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
index a8b11e076f..31381f39df 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
@@ -52,6 +52,7 @@ namespace WebCore {
         bool set(const char* name, double);
         bool set(const char* name, long long);
         bool set(const char* name, int);
+        bool set(const char* name, unsigned);
         bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp
new file mode 100644
index 0000000000..48cd92d7c4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -0,0 +1,839 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "config.h"
+#include "SerializedScriptValue.h"
+
+#include <runtime/DateInstance.h>
+#include <runtime/ExceptionHelpers.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/HashTraits.h>
+#include <wtf/Vector.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+class SerializedObject : public SharedSerializedData
+{
+public:
+    typedef Vector<RefPtr<StringImpl> > PropertyNameList;
+    typedef Vector<SerializedScriptValueData> ValueList;
+
+    void set(const Identifier& propertyName, const SerializedScriptValueData& value)
+    {
+        ASSERT(m_names.size() == m_values.size());
+        m_names.append(String(propertyName.ustring()).crossThreadString().impl());
+        m_values.append(value);
+    }
+
+    PropertyNameList& names() { return m_names; }
+
+    ValueList& values() { return m_values; }
+
+    static PassRefPtr<SerializedObject> create()
+    {
+        return adoptRef(new SerializedObject);
+    }
+
+    void clear()
+    {
+        m_names.clear();
+        m_values.clear();
+    }
+
+private:
+    SerializedObject() { }
+    PropertyNameList m_names;
+    ValueList m_values;
+};
+
+class SerializedArray : public SharedSerializedData
+{
+    typedef HashMap<unsigned, SerializedScriptValueData, DefaultHash<unsigned>::Hash, WTF::UnsignedWithZeroKeyHashTraits<unsigned> > SparseMap;
+public:
+    void setIndex(unsigned index, const SerializedScriptValueData& value)
+    {
+        ASSERT(index < m_length);
+        if (index == m_compactStorage.size())
+            m_compactStorage.append(value);
+        else
+            m_sparseStorage.set(index, value);
+    }
+
+    bool canDoFastRead(unsigned index) const
+    {
+        ASSERT(index < m_length);
+        return index < m_compactStorage.size();
+    }
+
+    const SerializedScriptValueData& getIndex(unsigned index)
+    {
+        ASSERT(index < m_compactStorage.size());
+        return m_compactStorage[index];
+    }
+
+    SerializedScriptValueData getSparseIndex(unsigned index, bool& hasIndex)
+    {
+        ASSERT(index >= m_compactStorage.size());
+        ASSERT(index < m_length);
+        SparseMap::iterator iter = m_sparseStorage.find(index);
+        if (iter == m_sparseStorage.end()) {
+            hasIndex = false;
+            return SerializedScriptValueData();
+        }
+        hasIndex = true;
+        return iter->second;
+    }
+
+    unsigned length() const
+    {
+        return m_length;
+    }
+
+    static PassRefPtr<SerializedArray> create(unsigned length)
+    {
+        return adoptRef(new SerializedArray(length));
+    }
+
+    void clear()
+    {
+        m_compactStorage.clear();
+        m_sparseStorage.clear();
+        m_length = 0;
+    }
+private:
+    SerializedArray(unsigned length)
+        : m_length(length)
+    {
+    }
+
+    Vector<SerializedScriptValueData> m_compactStorage;
+    SparseMap m_sparseStorage;
+    unsigned m_length;
+};
+
+SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedObject> data)
+    : m_type(ObjectType)
+    , m_sharedData(data)
+{
+}
+
+SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedArray> data)
+    : m_type(ArrayType)
+    , m_sharedData(data)
+{
+}
+
+SerializedArray* SharedSerializedData::asArray()
+{
+    return static_cast<SerializedArray*>(this);
+}
+
+SerializedObject* SharedSerializedData::asObject()
+{
+    return static_cast<SerializedObject*>(this);
+}
+
+static const unsigned maximumFilterRecursion = 40000;
+enum WalkerState { StateUnknown, ArrayStartState, ArrayStartVisitMember, ArrayEndVisitMember,
+    ObjectStartState, ObjectStartVisitMember, ObjectEndVisitMember };
+template <typename TreeWalker> typename TreeWalker::OutputType walk(TreeWalker& context, typename TreeWalker::InputType in)
+{
+    typedef typename TreeWalker::InputObject InputObject;
+    typedef typename TreeWalker::InputArray InputArray;
+    typedef typename TreeWalker::OutputObject OutputObject;
+    typedef typename TreeWalker::OutputArray OutputArray;
+    typedef typename TreeWalker::InputType InputType;
+    typedef typename TreeWalker::OutputType OutputType;
+    typedef typename TreeWalker::PropertyList PropertyList;
+
+    Vector<uint32_t, 16> indexStack;
+    Vector<uint32_t, 16> lengthStack;
+    Vector<PropertyList, 16> propertyStack;
+    Vector<InputObject, 16> inputObjectStack;
+    Vector<InputArray, 16> inputArrayStack;
+    Vector<OutputObject, 16> outputObjectStack;
+    Vector<OutputArray, 16> outputArrayStack;
+    Vector<WalkerState, 16> stateStack;
+    WalkerState state = StateUnknown;
+    InputType inValue = in;
+    OutputType outValue = context.null();
+
+    unsigned tickCount = context.ticksUntilNextCheck();
+    while (1) {
+        switch (state) {
+            arrayStartState:
+            case ArrayStartState: {
+                ASSERT(context.isArray(inValue));
+                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion) {
+                    context.throwStackOverflow();
+                    return context.null();
+                }
+
+                InputArray inArray = context.asInputArray(inValue);
+                unsigned length = context.length(inArray);
+                OutputArray outArray = context.createOutputArray(length);
+                if (!context.startArray(inArray, outArray))
+                    return context.null();
+                inputArrayStack.append(inArray);
+                outputArrayStack.append(outArray);
+                indexStack.append(0);
+                lengthStack.append(length);
+                // fallthrough
+            }
+            arrayStartVisitMember:
+            case ArrayStartVisitMember: {
+                if (!--tickCount) {
+                    if (context.didTimeOut()) {
+                        context.throwInterruptedException();
+                        return context.null();
+                    }
+                    tickCount = context.ticksUntilNextCheck();
+                }
+
+                InputArray array = inputArrayStack.last();
+                uint32_t index = indexStack.last();
+                if (index == lengthStack.last()) {
+                    InputArray inArray = inputArrayStack.last();
+                    OutputArray outArray = outputArrayStack.last();
+                    context.endArray(inArray, outArray);
+                    outValue = outArray;
+                    inputArrayStack.removeLast();
+                    outputArrayStack.removeLast();
+                    indexStack.removeLast();
+                    lengthStack.removeLast();
+                    break;
+                }
+                if (context.canDoFastRead(array, index))
+                    inValue = context.getIndex(array, index);
+                else {
+                    bool hasIndex = false;
+                    inValue = context.getSparseIndex(array, index, hasIndex);
+                    if (!hasIndex) {
+                        indexStack.last()++;
+                        goto arrayStartVisitMember;
+                    }
+                }
+
+                if (OutputType transformed = context.convertIfTerminal(inValue))
+                    outValue = transformed;
+                else {
+                    stateStack.append(ArrayEndVisitMember);
+                    goto stateUnknown;
+                }
+                // fallthrough
+            }
+            case ArrayEndVisitMember: {
+                OutputArray outArray = outputArrayStack.last();
+                context.putProperty(outArray, indexStack.last(), outValue);
+                indexStack.last()++;
+                goto arrayStartVisitMember;
+            }
+            objectStartState:
+            case ObjectStartState: {
+                ASSERT(context.isObject(inValue));
+                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion) {
+                    context.throwStackOverflow();
+                    return context.null();
+                }
+                InputObject inObject = context.asInputObject(inValue);
+                OutputObject outObject = context.createOutputObject();
+                if (!context.startObject(inObject, outObject))
+                    return context.null();
+                inputObjectStack.append(inObject);
+                outputObjectStack.append(outObject);
+                indexStack.append(0);
+                context.getPropertyNames(inObject, propertyStack);
+                // fallthrough
+            }
+            objectStartVisitMember:
+            case ObjectStartVisitMember: {
+                if (!--tickCount) {
+                    if (context.didTimeOut()) {
+                        context.throwInterruptedException();
+                        return context.null();
+                    }
+                    tickCount = context.ticksUntilNextCheck();
+                }
+
+                InputObject object = inputObjectStack.last();
+                uint32_t index = indexStack.last();
+                PropertyList& properties = propertyStack.last();
+                if (index == properties.size()) {
+                    InputObject inObject = inputObjectStack.last();
+                    OutputObject outObject = outputObjectStack.last();
+                    context.endObject(inObject, outObject);
+                    outValue = outObject;
+                    inputObjectStack.removeLast();
+                    outputObjectStack.removeLast();
+                    indexStack.removeLast();
+                    propertyStack.removeLast();
+                    break;
+                }
+                inValue = context.getProperty(object, properties[index], index);
+
+                if (context.shouldTerminate())
+                    return context.null();
+
+                if (OutputType transformed = context.convertIfTerminal(inValue))
+                    outValue = transformed;
+                else {
+                    stateStack.append(ObjectEndVisitMember);
+                    goto stateUnknown;
+                }
+                // fallthrough
+            }
+            case ObjectEndVisitMember: {
+                context.putProperty(outputObjectStack.last(), propertyStack.last()[indexStack.last()], outValue);
+                if (context.shouldTerminate())
+                    return context.null();
+
+                indexStack.last()++;
+                goto objectStartVisitMember;
+            }
+            stateUnknown:
+            case StateUnknown:
+                if (OutputType transformed = context.convertIfTerminal(inValue)) {
+                    outValue = transformed;
+                    break;
+                }
+                if (context.isArray(inValue))
+                    goto arrayStartState;
+                goto objectStartState;
+        }
+        if (stateStack.isEmpty())
+            break;
+
+        state = stateStack.last();
+        stateStack.removeLast();
+
+        if (!--tickCount) {
+            if (context.didTimeOut()) {
+                context.throwInterruptedException();
+                return context.null();
+            }
+            tickCount = context.ticksUntilNextCheck();
+        }
+    }
+    return outValue;
+}
+
+struct BaseWalker {
+    BaseWalker(ExecState* exec)
+        : m_exec(exec)
+        , m_timeoutChecker(exec->globalData().timeoutChecker)
+    {
+        m_timeoutChecker.reset();
+    }
+    ExecState* m_exec;
+    TimeoutChecker m_timeoutChecker;
+    MarkedArgumentBuffer m_gcBuffer;
+
+    bool shouldTerminate()
+    {
+        return m_exec->hadException();
+    }
+
+    unsigned ticksUntilNextCheck()
+    {
+        return m_timeoutChecker.ticksUntilNextCheck();
+    }
+
+    bool didTimeOut()
+    {
+        return m_timeoutChecker.didTimeOut(m_exec);
+    }
+
+    void throwStackOverflow()
+    {
+        m_exec->setException(createStackOverflowError(m_exec));
+    }
+
+    void throwInterruptedException()
+    {
+        m_exec->setException(createInterruptedExecutionException(&m_exec->globalData()));
+    }
+};
+
+struct SerializingTreeWalker : public BaseWalker {
+    typedef JSValue InputType;
+    typedef JSArray* InputArray;
+    typedef JSObject* InputObject;
+    typedef SerializedScriptValueData OutputType;
+    typedef RefPtr<SerializedArray> OutputArray;
+    typedef RefPtr<SerializedObject> OutputObject;
+    typedef PropertyNameArray PropertyList;
+
+    SerializingTreeWalker(ExecState* exec)
+        : BaseWalker(exec)
+    {
+    }
+
+    OutputType null() { return SerializedScriptValueData(); }
+
+    bool isArray(JSValue value)
+    {
+        if (!value.isObject())
+            return false;
+        JSObject* object = asObject(value);
+        return isJSArray(&m_exec->globalData(), object) || object->inherits(&JSArray::info);
+    }
+
+    bool isObject(JSValue value)
+    {
+        return value.isObject();
+    }
+
+    JSArray* asInputArray(JSValue value)
+    {
+        return asArray(value);
+    }
+
+    JSObject* asInputObject(JSValue value)
+    {
+        return asObject(value);
+    }
+
+    PassRefPtr<SerializedArray> createOutputArray(unsigned length)
+    {
+        return SerializedArray::create(length);
+    }
+
+    PassRefPtr<SerializedObject> createOutputObject()
+    {
+        return SerializedObject::create();
+    }
+
+    uint32_t length(JSValue array)
+    {
+        ASSERT(array.isObject());
+        JSObject* object = asObject(array);
+        return object->get(m_exec, m_exec->propertyNames().length).toUInt32(m_exec);
+    }
+
+    bool canDoFastRead(JSArray* array, unsigned index)
+    {
+        return isJSArray(&m_exec->globalData(), array) && array->canGetIndex(index);
+    }
+
+    JSValue getIndex(JSArray* array, unsigned index)
+    {
+        return array->getIndex(index);
+    }
+
+    JSValue getSparseIndex(JSObject* object, unsigned propertyName, bool& hasIndex)
+    {
+        PropertySlot slot(object);
+        if (object->getOwnPropertySlot(m_exec, propertyName, slot)) {
+            hasIndex = true;
+            return slot.getValue(m_exec, propertyName);
+        }
+        hasIndex = false;
+        return jsNull();
+    }
+
+    JSValue getProperty(JSObject* object, const Identifier& propertyName, unsigned)
+    {
+        PropertySlot slot(object);
+        if (object->getOwnPropertySlot(m_exec, propertyName, slot))
+            return slot.getValue(m_exec, propertyName);
+        return jsNull();
+    }
+
+    SerializedScriptValueData convertIfTerminal(JSValue value)
+    {
+        if (!value.isCell())
+            return SerializedScriptValueData(value);
+
+        if (value.isString())
+            return SerializedScriptValueData(asString(value)->value());
+
+        if (value.isNumber())
+            return SerializedScriptValueData(SerializedScriptValueData::NumberType, value.uncheckedGetNumber());
+
+        if (value.isObject() && asObject(value)->inherits(&DateInstance::info))
+            return SerializedScriptValueData(SerializedScriptValueData::DateType, asDateInstance(value)->internalNumber());
+
+        if (isArray(value))
+            return SerializedScriptValueData();
+
+        CallData unusedData;
+        if (value.isObject() && value.getCallData(unusedData) == CallTypeNone)
+            return SerializedScriptValueData();
+
+        // Any other types are expected to serialize as null.
+        return SerializedScriptValueData(jsNull());
+    }
+
+    void getPropertyNames(JSObject* object, Vector<PropertyNameArray, 16>& propertyStack)
+    {
+        propertyStack.append(PropertyNameArray(m_exec));
+        object->getOwnPropertyNames(m_exec, propertyStack.last());
+    }
+
+    void putProperty(RefPtr<SerializedArray> array, unsigned propertyName, const SerializedScriptValueData& value)
+    {
+        array->setIndex(propertyName, value);
+    }
+
+    void putProperty(RefPtr<SerializedObject> object, const Identifier& propertyName, const SerializedScriptValueData& value)
+    {
+        object->set(propertyName, value);
+    }
+
+    bool startArray(JSArray* inArray, RefPtr<SerializedArray>)
+    {
+        // Cycle detection
+        if (!m_cycleDetector.add(inArray).second) {
+            m_exec->setException(createTypeError(m_exec, "Cannot post cyclic structures."));
+            return false;
+        }
+        m_gcBuffer.append(inArray);
+        return true;
+    }
+
+    void endArray(JSArray* inArray, RefPtr<SerializedArray>)
+    {
+        m_cycleDetector.remove(inArray);
+        m_gcBuffer.removeLast();
+    }
+
+    bool startObject(JSObject* inObject, RefPtr<SerializedObject>)
+    {
+        // Cycle detection
+        if (!m_cycleDetector.add(inObject).second) {
+            m_exec->setException(createTypeError(m_exec, "Cannot post cyclic structures."));
+            return false;
+        }
+        m_gcBuffer.append(inObject);
+        return true;
+    }
+
+    void endObject(JSObject* inObject, RefPtr<SerializedObject>)
+    {
+        m_cycleDetector.remove(inObject);
+        m_gcBuffer.removeLast();
+    }
+
+private:
+    HashSet<JSObject*> m_cycleDetector;
+};
+
+SerializedScriptValueData SerializedScriptValueData::serialize(ExecState* exec, JSValue inValue)
+{
+    SerializingTreeWalker context(exec);
+    return walk<SerializingTreeWalker>(context, inValue);
+}
+
+
+struct DeserializingTreeWalker : public BaseWalker {
+    typedef SerializedScriptValueData InputType;
+    typedef RefPtr<SerializedArray> InputArray;
+    typedef RefPtr<SerializedObject> InputObject;
+    typedef JSValue OutputType;
+    typedef JSArray* OutputArray;
+    typedef JSObject* OutputObject;
+    typedef SerializedObject::PropertyNameList PropertyList;
+
+    DeserializingTreeWalker(ExecState* exec, bool mustCopy)
+        : BaseWalker(exec)
+        , m_mustCopy(mustCopy)
+    {
+    }
+
+    OutputType null() { return jsNull(); }
+
+    bool isArray(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ArrayType;
+    }
+
+    bool isObject(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ObjectType;
+    }
+
+    SerializedArray* asInputArray(const SerializedScriptValueData& value)
+    {
+        return value.asArray();
+    }
+
+    SerializedObject* asInputObject(const SerializedScriptValueData& value)
+    {
+        return value.asObject();
+    }
+
+    JSArray* createOutputArray(unsigned length)
+    {
+        JSArray* array = constructEmptyArray(m_exec);
+        array->setLength(length);
+        return array;
+    }
+
+    JSObject* createOutputObject()
+    {
+        return constructEmptyObject(m_exec);
+    }
+
+    uint32_t length(RefPtr<SerializedArray> array)
+    {
+        return array->length();
+    }
+
+    bool canDoFastRead(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->canDoFastRead(index);
+    }
+
+    SerializedScriptValueData getIndex(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->getIndex(index);
+    }
+
+    SerializedScriptValueData getSparseIndex(RefPtr<SerializedArray> array, unsigned propertyName, bool& hasIndex)
+    {
+        return array->getSparseIndex(propertyName, hasIndex);
+    }
+
+    SerializedScriptValueData getProperty(RefPtr<SerializedObject> object, const RefPtr<StringImpl>& propertyName, unsigned propertyIndex)
+    {
+        ASSERT(object->names()[propertyIndex] == propertyName);
+        UNUSED_PARAM(propertyName);
+        return object->values()[propertyIndex];
+    }
+
+    JSValue convertIfTerminal(SerializedScriptValueData& value)
+    {
+        switch (value.type()) {
+            case SerializedScriptValueData::ArrayType:
+            case SerializedScriptValueData::ObjectType:
+                return JSValue();
+            case SerializedScriptValueData::StringType:
+                return jsString(m_exec, value.asString().crossThreadString());
+            case SerializedScriptValueData::ImmediateType:
+                return value.asImmediate();
+            case SerializedScriptValueData::NumberType:
+                return jsNumber(m_exec, value.asDouble());
+            case SerializedScriptValueData::DateType:
+                return new (m_exec) DateInstance(m_exec, value.asDouble());
+            default:
+                ASSERT_NOT_REACHED();
+                return JSValue();
+        }
+    }
+
+    void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
+    {
+        properties.append(object->names());
+    }
+
+    void putProperty(JSArray* array, unsigned propertyName, JSValue value)
+    {
+        array->put(m_exec, propertyName, value);
+    }
+
+    void putProperty(JSObject* object, const RefPtr<StringImpl> propertyName, JSValue value)
+    {
+        object->putDirect(Identifier(m_exec, String(propertyName)), value);
+    }
+
+    bool startArray(RefPtr<SerializedArray>, JSArray* outArray)
+    {
+        m_gcBuffer.append(outArray);
+        return true;
+    }
+    void endArray(RefPtr<SerializedArray>, JSArray*)
+    {
+        m_gcBuffer.removeLast();
+    }
+    bool startObject(RefPtr<SerializedObject>, JSObject* outObject)
+    {
+        m_gcBuffer.append(outObject);
+        return true;
+    }
+    void endObject(RefPtr<SerializedObject>, JSObject*)
+    {
+        m_gcBuffer.removeLast();
+    }
+
+private:
+    bool m_mustCopy;
+};
+
+JSValue SerializedScriptValueData::deserialize(ExecState* exec, bool mustCopy) const
+{
+    DeserializingTreeWalker context(exec, mustCopy);
+    return walk<DeserializingTreeWalker>(context, *this);
+}
+
+struct TeardownTreeWalker {
+    typedef SerializedScriptValueData InputType;
+    typedef RefPtr<SerializedArray> InputArray;
+    typedef RefPtr<SerializedObject> InputObject;
+    typedef bool OutputType;
+    typedef bool OutputArray;
+    typedef bool OutputObject;
+    typedef SerializedObject::PropertyNameList PropertyList;
+
+    bool shouldTerminate()
+    {
+        return false;
+    }
+
+    unsigned ticksUntilNextCheck()
+    {
+        return 0xFFFFFFFF;
+    }
+
+    bool didTimeOut()
+    {
+        return false;
+    }
+
+    void throwStackOverflow()
+    {
+    }
+
+    void throwInterruptedException()
+    {
+    }
+
+    bool null() { return false; }
+
+    bool isArray(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ArrayType;
+    }
+
+    bool isObject(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ObjectType;
+    }
+
+    SerializedArray* asInputArray(const SerializedScriptValueData& value)
+    {
+        return value.asArray();
+    }
+
+    SerializedObject* asInputObject(const SerializedScriptValueData& value)
+    {
+        return value.asObject();
+    }
+
+    bool createOutputArray(unsigned)
+    {
+        return false;
+    }
+
+    bool createOutputObject()
+    {
+        return false;
+    }
+
+    uint32_t length(RefPtr<SerializedArray> array)
+    {
+        return array->length();
+    }
+
+    bool canDoFastRead(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->canDoFastRead(index);
+    }
+
+    SerializedScriptValueData getIndex(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->getIndex(index);
+    }
+
+    SerializedScriptValueData getSparseIndex(RefPtr<SerializedArray> array, unsigned propertyName, bool& hasIndex)
+    {
+        return array->getSparseIndex(propertyName, hasIndex);
+    }
+
+    SerializedScriptValueData getProperty(RefPtr<SerializedObject> object, const RefPtr<StringImpl>& propertyName, unsigned propertyIndex)
+    {
+        ASSERT(object->names()[propertyIndex] == propertyName);
+        UNUSED_PARAM(propertyName);
+        return object->values()[propertyIndex];
+    }
+
+    bool convertIfTerminal(SerializedScriptValueData& value)
+    {
+        switch (value.type()) {
+            case SerializedScriptValueData::ArrayType:
+            case SerializedScriptValueData::ObjectType:
+                return false;
+            case SerializedScriptValueData::StringType:
+            case SerializedScriptValueData::ImmediateType:
+            case SerializedScriptValueData::NumberType:
+                return true;
+            default:
+                ASSERT_NOT_REACHED();
+                return JSValue();
+        }
+    }
+
+    void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
+    {
+        properties.append(object->names());
+    }
+
+    void putProperty(bool, unsigned, bool)
+    {
+    }
+
+    void putProperty(bool, const RefPtr<StringImpl>&, bool)
+    {
+    }
+
+    bool startArray(RefPtr<SerializedArray>, bool)
+    {
+        return true;
+    }
+    void endArray(RefPtr<SerializedArray> array, bool)
+    {
+        array->clear();
+    }
+    bool startObject(RefPtr<SerializedObject>, bool)
+    {
+        return true;
+    }
+    void endObject(RefPtr<SerializedObject> object, bool)
+    {
+        object->clear();
+    }
+};
+
+void SerializedScriptValueData::tearDownSerializedData()
+{
+    if (m_sharedData && m_sharedData->refCount() > 1)
+        return;
+    TeardownTreeWalker context;
+    walk<TeardownTreeWalker>(context, *this);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h
new file mode 100644
index 0000000000..f8a126ff7b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef SerializedScriptValue_h
+#define SerializedScriptValue_h
+
+#include "ScriptValue.h"
+
+namespace WebCore {
+    class SerializedObject;
+    class SerializedArray;
+
+    class SharedSerializedData : public RefCounted<SharedSerializedData> {
+    public:
+        virtual ~SharedSerializedData() { }
+        SerializedArray* asArray();
+        SerializedObject* asObject();
+    };
+
+    class SerializedScriptValue;
+
+    class SerializedScriptValueData {
+    public:
+        enum SerializedType {
+            EmptyType,
+            DateType,
+            NumberType,
+            ImmediateType,
+            ObjectType,
+            ArrayType,
+            StringType
+        };
+
+        SerializedType type() const { return m_type; }
+        static SerializedScriptValueData serialize(JSC::ExecState*, JSC::JSValue);
+        JSC::JSValue deserialize(JSC::ExecState*, bool mustCopy) const;
+
+        ~SerializedScriptValueData()
+        {
+            if (m_sharedData)
+                tearDownSerializedData();
+        }
+
+        SerializedScriptValueData()
+            : m_type(EmptyType)
+        {
+        }
+
+        explicit SerializedScriptValueData(const String& string)
+            : m_type(StringType)
+            , m_string(string.crossThreadString()) // FIXME: Should be able to just share the Rep
+        {
+        }
+
+        explicit SerializedScriptValueData(JSC::JSValue value)
+            : m_type(ImmediateType)
+        {
+            ASSERT(!value.isCell());
+            m_data.m_immediate = JSC::JSValue::encode(value);
+        }
+
+        SerializedScriptValueData(SerializedType type, double value)
+            : m_type(type)
+        {
+            m_data.m_double = value;
+        }
+
+        SerializedScriptValueData(RefPtr<SerializedObject>);
+        SerializedScriptValueData(RefPtr<SerializedArray>);
+
+        JSC::JSValue asImmediate() const
+        {
+            ASSERT(m_type == ImmediateType);
+            return JSC::JSValue::decode(m_data.m_immediate);
+        }
+
+        double asDouble() const
+        {
+            ASSERT(m_type == NumberType || m_type == DateType);
+            return m_data.m_double;
+        }
+
+        String asString() const
+        {
+            ASSERT(m_type == StringType);
+            return m_string;
+        }
+
+        SerializedObject* asObject() const
+        {
+            ASSERT(m_type == ObjectType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asObject();
+        }
+
+        SerializedArray* asArray() const
+        {
+            ASSERT(m_type == ArrayType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asArray();
+        }
+
+        operator bool() const { return m_type != EmptyType; }
+
+        SerializedScriptValueData release()
+        {
+            SerializedScriptValueData result = *this;
+            *this = SerializedScriptValueData();
+            return result;
+        }
+
+    private:
+        void tearDownSerializedData();
+        SerializedType m_type;
+        RefPtr<SharedSerializedData> m_sharedData;
+        String m_string;
+        union {
+            double m_double;
+            JSC::EncodedJSValue m_immediate;
+        } m_data;
+    };
+
+    class SerializedScriptValue : public RefCounted<SerializedScriptValue> {
+    public:
+        static PassRefPtr<SerializedScriptValue> create(JSC::ExecState* exec, JSC::JSValue value)
+        {
+            return adoptRef(new SerializedScriptValue(SerializedScriptValueData::serialize(exec, value)));
+        }
+
+        static PassRefPtr<SerializedScriptValue> create(String string)
+        {
+            return adoptRef(new SerializedScriptValue(SerializedScriptValueData(string)));
+        }
+
+        static PassRefPtr<SerializedScriptValue> create()
+        {
+            return adoptRef(new SerializedScriptValue(SerializedScriptValueData()));
+        }
+
+        PassRefPtr<SerializedScriptValue> release()
+        {
+            PassRefPtr<SerializedScriptValue> result = adoptRef(new SerializedScriptValue(m_value));
+            m_value = SerializedScriptValueData();
+            result->m_mustCopy = true;
+            return result;
+        }
+
+        String toString()
+        {
+            if (m_value.type() != SerializedScriptValueData::StringType)
+                return "";
+            return m_value.asString();
+        }
+
+        JSC::JSValue deserialize(JSC::ExecState* exec)
+        {
+            if (!m_value)
+                return JSC::jsNull();
+            return m_value.deserialize(exec, m_mustCopy);
+        }
+
+        ~SerializedScriptValue() {}
+
+    private:
+        SerializedScriptValue(SerializedScriptValueData value)
+            : m_value(value)
+            , m_mustCopy(false)
+        {
+        }
+
+        SerializedScriptValueData m_value;
+        bool m_mustCopy;
+    };
+}
+
+#endif // SerializedScriptValue_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
index 92bd39097d..c1cb0a0347 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
@@ -59,6 +59,12 @@ my %svgAnimatedTypeHash = ("SVGAnimatedAngle" => 1, "SVGAnimatedBoolean" => 1,
                            "SVGAnimatedRect" => 1, "SVGAnimatedString" => 1,
                            "SVGAnimatedTransformList" => 1);
 
+my %svgAttributesInHTMLHash = ("class" => 1, "id" => 1, "onabort" => 1, "onclick" => 1,
+                               "onerror" => 1, "onload" => 1, "onmousedown" => 1,
+                               "onmousemove" => 1, "onmouseout" => 1, "onmouseover" => 1,
+                               "onmouseup" => 1, "onresize" => 1, "onscroll" => 1,
+                               "onunload" => 1);
+
 # Cache of IDL file pathnames.
 my $idlFiles;
 
@@ -347,4 +353,12 @@ sub WK_lcfirst
     return $ret;
 }
 
+# Return the C++ namespace that a given attribute name string is defined in.
+sub NamespaceForAttributeName
+{
+    my ($object, $interfaceName, $attributeName) = @_;
+    return "SVGNames" if $interfaceName =~ /^SVG/ && !$svgAttributesInHTMLHash{$attributeName};
+    return "HTMLNames";
+}
+
 1;
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
index 4d5cb96ef1..4ca441b525 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
@@ -524,7 +524,7 @@ sub GenerateCPPAttributeSignature
 
 sub GenerateCPPAttribute
 {
-    my ($attribute, $className, $implementationClass) = @_;
+    my ($attribute, $className, $implementationClass, $IDLType) = @_;
 
     my $implementationClassWithoutNamespace = StripNamespace($implementationClass);
 
@@ -598,9 +598,10 @@ sub GenerateCPPAttribute
         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
         my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
         if ($reflect || $reflectURL) {
-            $CPPImplementationWebCoreIncludes{"HTMLNames.h"} = 1;
             my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
-            push(@setterImplementation, "    impl${implementationClassWithoutNamespace}()->setAttribute(WebCore::HTMLNames::${contentAttributeName}Attr, " . join(", ", @setterParams) . ");\n");
+            my $namespace = $codeGenerator->NamespaceForAttributeName($IDLType, $contentAttributeName);
+            $CPPImplementationWebCoreIncludes{"${namespace}.h"} = 1;
+            push(@setterImplementation, "    impl${implementationClassWithoutNamespace}()->setAttribute(WebCore::${namespace}::${contentAttributeName}Attr, " . join(", ", @setterParams) . ");\n");
         } else {
             push(@setterImplementation, "    impl${implementationClassWithoutNamespace}()->${setterName}(" . join(", ", @setterParams) . ");\n");
         }
@@ -620,10 +621,11 @@ sub GenerateCPPAttribute
     my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
     my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
     if ($reflect || $reflectURL) {
-        $implIncludes{"HTMLNames.h"} = 1;
         my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
+        my $namespace = $codeGenerator->NamespaceForAttributeName($IDLType, $contentAttributeName);
+        $implIncludes{"${namespace}.h"} = 1;
         my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
-        $implementationGetter = "impl${implementationClassWithoutNamespace}()->${getAttributeFunctionName}(WebCore::HTMLNames::${contentAttributeName}Attr)";
+        $implementationGetter = "impl${implementationClassWithoutNamespace}()->${getAttributeFunctionName}(WebCore::${namespace}::${contentAttributeName}Attr)";
     } else {
         $implementationGetter = "impl${implementationClassWithoutNamespace}()->" . $codeGenerator->WK_lcfirst($attributeName) . "(" . ($hasGetterException ? "ec" : ""). ")";
     }
@@ -1154,7 +1156,7 @@ sub GenerateCPPImplementation
 
                 AddIncludesForTypeInCPPImplementation($attribute->signature->type);
 
-                my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass);
+                my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass, $IDLType);
                 push(@CPPImplementationContent, values(%attributes));
             }
         }
@@ -1182,7 +1184,7 @@ sub GenerateCPPImplementation
 
             AddIncludesForTypeInCPPImplementation($attribute->signature->type);
 
-            my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass);
+            my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass, $IDLType);
             push(@CPPImplementationContent, values(%attributes));
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
index d552aa0743..ff7b52f9fe 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -463,6 +463,7 @@ sub GenerateHeader
     my $className = "JS$interfaceName";
     my $implClassName = $interfaceName;
     my @ancestorInterfaceNames = ();
+    my %structureFlags = ();
 
     # We only support multiple parents with SVG (for now).
     if (@{$dataNode->parents} > 1) {
@@ -574,6 +575,7 @@ sub GenerateHeader
         push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);\n") if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) && !$dataNode->extendedAttributes->{"HasOverridingNameGetter"};
         push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"};
         push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"};
+        $structureFlags{"JSC::OverridesGetOwnPropertySlot"} = 1;
     }
 
     # Check if we have any writable properties
@@ -602,21 +604,20 @@ sub GenerateHeader
 
     # Structure ID
     if ($interfaceName eq "DOMWindow") {
-        push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
-            "    {\n" .
-            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::NeedsThisConversion));\n" .
-            "    }\n\n");
-    } elsif ($hasGetter) {
-        push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
-            "    {\n" .
-            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));\n" .
-            "    }\n\n");
+        $structureFlags{"JSC::ImplementsHasInstance"} = 1;
+        $structureFlags{"JSC::NeedsThisConversion"} = 1;
     }
+    push(@headerContent,
+        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
+        "    {\n" .
+        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));\n" .
+        "    }\n\n");
 
     # markChildren function
-    push(@headerContent, "    virtual void markChildren(JSC::MarkStack&);\n\n") if $needsMarkChildren;
+    if ($needsMarkChildren) {
+        push(@headerContent, "    virtual void markChildren(JSC::MarkStack&);\n\n");
+        $structureFlags{"JSC::OverridesMarkChildren"} = 1;
+    }
 
     # Custom pushEventHandlerScope function
     push(@headerContent, "    virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;\n\n") if $dataNode->extendedAttributes->{"CustomPushEventHandlerScope"};
@@ -628,13 +629,19 @@ sub GenerateHeader
     push(@headerContent, "    virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);\n") if $dataNode->extendedAttributes->{"CustomDeleteProperty"};
 
     # Custom getPropertyNames function exists on DOMWindow
-    push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if $interfaceName eq "DOMWindow";
+    if ($interfaceName eq "DOMWindow") {
+        push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n");
+        $structureFlags{"JSC::OverridesGetPropertyNames"} = 1;
+    }
 
     # Custom defineProperty function exists on DOMWindow
     push(@headerContent, "    virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);\n") if $interfaceName eq "DOMWindow";
 
     # Custom getOwnPropertyNames function
-    push(@headerContent, "    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"});    
+    if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
+        push(@headerContent, "    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n");
+        $structureFlags{"JSC::OverridesGetPropertyNames"} = 1;       
+    }
 
     # Custom getPropertyAttributes function
     push(@headerContent, "    virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;\n") if $dataNode->extendedAttributes->{"CustomGetPropertyAttributes"};
@@ -712,6 +719,14 @@ sub GenerateHeader
         push(@headerContent, "        return static_cast<$implClassName*>(Base::impl());\n");
         push(@headerContent, "    }\n");
     }
+    
+    # structure flags
+    push(@headerContent, "protected:\n");
+    push(@headerContent, "    static const unsigned StructureFlags = ");
+    foreach my $structureFlag (keys %structureFlags) {
+        push(@headerContent, $structureFlag . " | ");
+    }
+    push(@headerContent, "Base::StructureFlags;\n");
 
     # Index getter
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
@@ -719,6 +734,7 @@ sub GenerateHeader
     }
     if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
         push(@headerContent, "    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);\n");
+        
     }
     
     # Index setter
@@ -770,6 +786,7 @@ sub GenerateHeader
     push(@headerContent, "\n");
 
     # Add prototype declaration.
+    %structureFlags = ();
     push(@headerContent, "class ${className}Prototype : public JSC::JSObject {\n");
     push(@headerContent, "    typedef JSC::JSObject Base;\n");
     push(@headerContent, "public:\n");
@@ -787,19 +804,16 @@ sub GenerateHeader
         push(@headerContent, "    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n");
         push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"};
         push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"};
-
-        push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
-            "    {\n" .
-            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType" . ($needsMarkChildren ? "" : ", JSC::HasDefaultMark") . "));\n" .
-            "    }\n");
-    } elsif ($dataNode->extendedAttributes->{"CustomMarkFunction"}) {
-        push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
-            "    {\n" .
-            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));\n" .
-            "    }\n");
+        $structureFlags{"JSC::OverridesGetOwnPropertySlot"} = 1;
     }
+    if ($dataNode->extendedAttributes->{"CustomMarkFunction"} or $needsMarkChildren) {
+        $structureFlags{"JSC::OverridesMarkChildren"} = 1;
+    }
+    push(@headerContent,
+        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
+        "    {\n" .
+        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));\n" .
+        "    }\n");
     if ($dataNode->extendedAttributes->{"DelegatingPrototypePutFunction"}) {
         push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
         push(@headerContent, "    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);\n");
@@ -810,6 +824,14 @@ sub GenerateHeader
 
     push(@headerContent, "    ${className}Prototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }\n");
 
+    # structure flags
+    push(@headerContent, "protected:\n");
+    push(@headerContent, "    static const unsigned StructureFlags = ");
+    foreach my $structureFlag (keys %structureFlags) {
+        push(@headerContent, $structureFlag . " | ");
+    }
+    push(@headerContent, "Base::StructureFlags;\n");
+
     push(@headerContent, "};\n\n");
 
     if ($numFunctions > 0) {
@@ -1323,10 +1345,11 @@ sub GenerateImplementation
                         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
                         my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
                         if ($reflect || $reflectURL) {
-                            $implIncludes{"HTMLNames.h"} = 1;
                             my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $name : ($reflect || $reflectURL);
+                            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+                            $implIncludes{"${namespace}.h"} = 1;
                             my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
-                            $value = "imp->$getAttributeFunctionName(HTMLNames::${contentAttributeName}Attr)"
+                            $value = "imp->$getAttributeFunctionName(${namespace}::${contentAttributeName}Attr)"
                         } else {
                             $value = "imp->$implGetterFunctionName()";
                         }
@@ -1483,9 +1506,10 @@ sub GenerateImplementation
                                 my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
                                 my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
                                 if ($reflect || $reflectURL) {
-                                    $implIncludes{"HTMLNames.h"} = 1;
                                     my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $name : ($reflect || $reflectURL);
-                                    push(@implContent, "    imp->setAttribute(HTMLNames::${contentAttributeName}Attr, $nativeValue");
+                                    my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+                                    $implIncludes{"${namespace}.h"} = 1;
+                                    push(@implContent, "    imp->setAttribute(${namespace}::${contentAttributeName}Attr, $nativeValue");
                                 } else {
                                     push(@implContent, "    imp->set$implSetterFunctionName($nativeValue");
                                 }
@@ -1842,6 +1866,11 @@ sub JSValueToNative
         return "$value.toString(exec)";
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return "SerializedScriptValue::create(exec, $value)";
+    }
+
     $implIncludes{"FloatPoint.h"} = 1 if $type eq "SVGPoint";
     $implIncludes{"FloatRect.h"} = 1 if $type eq "SVGRect";
     $implIncludes{"HTMLOptionElement.h"} = 1 if $type eq "HTMLOptionElement";
@@ -1928,6 +1957,8 @@ sub NativeToJSValue
     }
 
     if ($codeGenerator->IsSVGAnimatedType($type)) {
+        # Some SVGFE*Element.idl use 'operator' as attribute name, rewrite as '_operator' to avoid clashes with C/C++
+        $value =~ s/operator\(\)/_operator\(\)/ if ($value =~ /operator/);
         $value =~ s/\(\)//;
         $value .= "Animated()";
     }
@@ -1947,6 +1978,9 @@ sub NativeToJSValue
         $joinedName = $type;
         $joinedName =~ s/Abs|Rel//;
         $implIncludes{"$joinedName.h"} = 1;
+    } elsif ($type eq "SerializedScriptValue") {
+        $implIncludes{"$type.h"} = 1;
+        return "$value->deserialize(exec)";
     } else {
         # Default, include header with same name.
         $implIncludes{"JS$type.h"} = 1;
@@ -2241,8 +2275,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 EOF
 
     if ($canConstruct) {
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index 0026ba1ee6..91248c5500 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -311,7 +311,7 @@ sub GetClassName
     my $name = $codeGenerator->StripModule(shift);
 
     # special cases
-    return "NSString" if $codeGenerator->IsStringType($name);
+    return "NSString" if $codeGenerator->IsStringType($name) or $name eq "SerializedScriptValue";
     return "NS$name" if IsNativeObjCType($name);
     return "BOOL" if $name eq "boolean";
     return "unsigned" if $name eq "unsigned long";
@@ -492,6 +492,11 @@ sub GetObjCTypeGetter
     return "WTF::getPtr(nativeEventListener)" if $type eq "EventListener";
     return "WTF::getPtr(nativeNodeFilter)" if $type eq "NodeFilter";
     return "WTF::getPtr(nativeResolver)" if $type eq "XPathNSResolver";
+    
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return "WebCore::SerializedScriptValue::create(WebCore::String($argName))";
+    }
     return "core($argName)";
 }
 
@@ -607,6 +612,11 @@ sub AddIncludesForType
         return;
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return;
+    }
+
     # FIXME: won't compile without these
     $implIncludes{"CSSMutableStyleDeclaration.h"} = 1 if $type eq "CSSStyleDeclaration";
     $implIncludes{"NameNodeList.h"} = 1 if $type eq "NodeList";
@@ -715,6 +725,8 @@ sub GenerateHeader
             my $attributeIsReadonly = ($attribute->type =~ /^readonly/);
 
             my $property = "\@property" . GetPropertyAttributes($attribute->signature->type, $attributeIsReadonly);
+            # Some SVGFE*Element.idl use 'operator' as attribute name, rewrite as '_operator' to avoid clashes with C/C++
+            $attributeName =~ s/operator/_operator/ if ($attributeName =~ /operator/);
             $property .= " " . $attributeType . ($attributeType =~ /\*$/ ? "" : " ") . $attributeName;
 
             my $publicInterfaceKey = $property . ";";
@@ -1139,15 +1151,21 @@ sub GenerateImplementation
 
             # - GETTER
             my $getterSig = "- ($attributeType)$attributeInterfaceName\n";
+
+            # Some SVGFE*Element.idl use 'operator' as attribute name, rewrite as '_operator' to avoid clashes with C/C++
+            $attributeName =~ s/operatorAnimated/_operatorAnimated/ if ($attributeName =~ /operatorAnimated/);
+            $getterSig =~ s/operator/_operator/ if ($getterSig =~ /operator/);
+
             my $hasGetterException = @{$attribute->getterExceptions};
             my $getterContentHead;
             my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
             my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
             if ($reflect || $reflectURL) {
-                $implIncludes{"HTMLNames.h"} = 1;
                 my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
+                my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+                $implIncludes{"${namespace}.h"} = 1;
                 my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
-                $getterContentHead = "IMPL->${getAttributeFunctionName}(WebCore::HTMLNames::${contentAttributeName}Attr";
+                $getterContentHead = "IMPL->${getAttributeFunctionName}(WebCore::${namespace}::${contentAttributeName}Attr";
             } else {
                 $getterContentHead = "IMPL->" . $codeGenerator->WK_lcfirst($attributeName) . "(";
             }
@@ -1212,6 +1230,9 @@ sub GenerateImplementation
             } elsif ($idlType eq "Color") {
                 $getterContentHead = "WebCore::nsColor($getterContentHead";
                 $getterContentTail .= ")";
+            } elsif ($attribute->signature->type eq "SerializedScriptValue") {
+                $getterContentHead = "$getterContentHead";
+                $getterContentTail .= "->toString()";                
             } elsif (ConversionNeeded($attribute->signature->type)) {
                 $getterContentHead = "kit(WTF::getPtr($getterContentHead";
                 $getterContentTail .= "))";
@@ -1278,20 +1299,20 @@ sub GenerateImplementation
                     } else {
                         push(@implContent, "    IMPL->$coreSetterName($arg);\n");
                     }
-                } elsif ($hasSetterException) {
-                    push(@implContent, "    $exceptionInit\n");
-                    push(@implContent, "    IMPL->$coreSetterName($arg, ec);\n");
-                    push(@implContent, "    $exceptionRaiseOnError\n");
                 } else {
                     my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
                     my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
+                    push(@implContent, "    $exceptionInit\n") if $hasSetterException;
+                    my $ec = $hasSetterException ? ", ec" : "";
                     if ($reflect || $reflectURL) {
-                        $implIncludes{"HTMLNames.h"} = 1;
                         my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
-                        push(@implContent, "    IMPL->setAttribute(WebCore::HTMLNames::${contentAttributeName}Attr, $arg);\n");
+                        my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+                        $implIncludes{"${namespace}.h"} = 1;
+                        push(@implContent, "    IMPL->setAttribute(WebCore::${namespace}::${contentAttributeName}Attr, $arg$ec);\n");
                     } else {
-                        push(@implContent, "    IMPL->$coreSetterName($arg);\n");
+                        push(@implContent, "    IMPL->$coreSetterName($arg$ec);\n");
                     }
+                    push(@implContent, "    $exceptionRaiseOnError\n") if $hasSetterException;
                 }
 
                 push(@implContent, "}\n\n");
@@ -1446,6 +1467,8 @@ sub GenerateImplementation
                     push(@functionContent, "        return $toReturn;\n");
                     push(@functionContent, "    return nil;\n");
                 }
+            } elsif ($returnType eq "SerializedScriptValue") {
+                $content = "foo";
             } else {
                 if (ConversionNeeded($function->signature->type)) {
                     if ($codeGenerator->IsPodType($function->signature->type)) {
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 7f1508ba5b..28562f1ab5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -326,10 +326,26 @@ sub IsNodeSubType
     return 0;
 }
 
-sub RequiresCustomEventListenerAccessors
+sub GetHiddenDependencyIndex
 {
     my $dataNode = shift;
-    return !IsNodeSubType($dataNode) && $dataNode->name ne "SVGElementInstance";
+    my $attribute = shift;
+    my $name = $dataNode->name;
+    return "V8Custom::kNodeEventListenerCacheIndex" if IsNodeSubType($dataNode);
+    return "V8Custom::kSVGElementInstanceEventListenerCacheIndex" if $name eq "SVGElementInstance";
+    return "V8Custom::kAbstractWorkerRequestCacheIndex" if $name eq "AbstractWorker";
+    return "V8Custom::kWorkerRequestCacheIndex" if $name eq "Worker";
+    return "V8Custom::kDedicatedWorkerContextRequestCacheIndex" if $name eq "DedicatedWorkerContext";
+    return "V8Custom::kWorkerContextRequestCacheIndex" if $name eq "WorkerContext";
+    return "V8Custom::kWorkerContextRequestCacheIndex" if $name eq "SharedWorkerContext";
+    return "V8Custom::kMessagePortRequestCacheIndex" if $name eq "MessagePort";
+    return "V8Custom::kWebSocketCacheIndex" if $name eq "WebSocket";
+    return "V8Custom::kXMLHttpRequestCacheIndex" if $name eq "XMLHttpRequest";
+    return "V8Custom::kXMLHttpRequestCacheIndex" if $name eq "XMLHttpRequestUpload";
+    return "V8Custom::kDOMApplicationCacheCacheIndex" if $name eq "DOMApplicationCache";
+    return "V8Custom::kNotificationRequestCacheIndex" if $name eq "Notification";
+    return "V8Custom::kDOMWindowEventListenerCacheIndex" if $name eq "DOMWindow";
+    die "Unexpected name " . $name . " when generating " . $attribute;
 }
 
 sub HolderToNative
@@ -444,6 +460,7 @@ sub GenerateNormalAttrGetter
     my $dataNode = shift;
     my $classIndex = shift;
     my $implClassName = shift;
+    my $interfaceName = shift;
 
     my $attrExt = $attribute->signature->extendedAttributes;
 
@@ -500,11 +517,17 @@ END
         }
 
     } elsif ($attrExt->{"v8OnProto"} || $attrExt->{"V8DisallowShadowing"}) {
+      if ($classIndex eq "DOMWINDOW") {
+        push(@implContentDecls, <<END);
+    v8::Handle<v8::Object> holder = info.Holder();
+END
+      } else {
         # perform lookup first
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
     if (holder.IsEmpty()) return v8::Undefined();
 END
+      }
         HolderToNative($dataNode, $implClassName, $classIndex);
     } else {
         push(@implContentDecls, <<END);
@@ -540,10 +563,11 @@ END
         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
         my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
         if ($reflect || $reflectURL) {
-            $implIncludes{"HTMLNames.h"} = 1;
             my $contentAttributeName = ($reflect || $reflectURL) eq "1" ? $attrName : ($reflect || $reflectURL);
+            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+            $implIncludes{"${namespace}.h"} = 1;
             my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
-            $getterString = "imp->$getAttributeFunctionName(HTMLNames::${contentAttributeName}Attr";
+            $getterString = "imp->$getAttributeFunctionName(${namespace}::${contentAttributeName}Attr";
         } else {
             $getterString = "imp->$getterFunc(";
         }
@@ -594,6 +618,10 @@ END
         }
 
     } else {
+        if ($attribute->signature->type eq "EventListener" && $dataNode->name eq "DOMWindow") {
+            push(@implContentDecls, "    if (!imp->document())\n");
+            push(@implContentDecls, "      return v8::Undefined();\n");
+        }
         push(@implContentDecls, "    $nativeType v = ");
 
         push(@implContentDecls, "$getterString;\n");
@@ -651,6 +679,7 @@ sub GenerateNormalAttrSetter
     my $dataNode = shift;
     my $classIndex = shift;
     my $implClassName = shift;
+    my $interfaceName = shift;
 
     my $attrExt = $attribute->signature->extendedAttributes;
 
@@ -672,11 +701,17 @@ sub GenerateNormalAttrSetter
         push(@implContentDecls, "    $implClassName* imp = &imp_instance;\n");
 
     } elsif ($attrExt->{"v8OnProto"}) {
+      if ($classIndex eq "DOMWINDOW") {
+        push(@implContentDecls, <<END);
+    v8::Handle<v8::Object> holder = info.Holder();
+END
+      } else {
         # perform lookup first
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
-    if (holder.IsEmpty()) return v8::Undefined();
+    if (holder.IsEmpty()) return;
 END
+      }
         HolderToNative($dataNode, $implClassName, $classIndex);
     } else {
         push(@implContentDecls, <<END);
@@ -687,7 +722,11 @@ END
 
     my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
     if ($attribute->signature->type eq "EventListener") {
-        push(@implContentDecls, "    $nativeType v = V8DOMWrapper::getEventListener(imp, value, true, false);\n");
+        if ($dataNode->name eq "DOMWindow") {
+            push(@implContentDecls, "    if (!imp->document())\n");
+            push(@implContentDecls, "      return;\n");
+        }
+        push(@implContentDecls, "    $nativeType v = V8DOMWrapper::getEventListener(imp, value, true, ListenerFindOrCreate);\n");
     } else {
         push(@implContentDecls, "    $nativeType v = " . JSValueToNative($attribute->signature, "value") . ";\n");
     }
@@ -719,20 +758,24 @@ END
         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
         my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
         if ($reflect || $reflectURL) {
-            $implIncludes{"HTMLNames.h"} = 1;
             my $contentAttributeName = ($reflect || $reflectURL) eq "1" ? $attrName : ($reflect || $reflectURL);
-            push(@implContentDecls, "    imp->setAttribute(HTMLNames::${contentAttributeName}Attr, $result");
+            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+            $implIncludes{"${namespace}.h"} = 1;
+            push(@implContentDecls, "    imp->setAttribute(${namespace}::${contentAttributeName}Attr, $result");
         } elsif ($attribute->signature->type eq "EventListener") {
             $implIncludes{"V8AbstractEventListener.h"} = 1;
             $implIncludes{"V8CustomBinding.h"} = 1;
+            $cacheIndex = GetHiddenDependencyIndex($dataNode, $attrName);
             push(@implContentDecls, "    $nativeType old = imp->$attrName();\n");
-            push(@implContentDecls, "    if (old && static_cast<V8AbstractEventListener*>(old.get())->isObjectListener()) {\n");
-            push(@implContentDecls, "      v8::Local<v8::Object> oldListener = static_cast<V8AbstractEventListener*>(old.get())->getListenerObject();\n");
-            push(@implContentDecls, "      removeHiddenDependency(holder, oldListener, V8Custom::kNodeEventListenerCacheIndex);\n");
+            push(@implContentDecls, "    V8AbstractEventListener* oldListener = old ? V8AbstractEventListener::cast(old.get()) : 0;\n");
+            push(@implContentDecls, "    if (oldListener) {\n");
+            push(@implContentDecls, "      v8::Local<v8::Object> oldListenerObject = oldListener->getExistingListenerObject();\n");
+            push(@implContentDecls, "      if (!oldListenerObject.IsEmpty())\n");
+            push(@implContentDecls, "        removeHiddenDependency(holder, oldListenerObject, $cacheIndex);\n");
             push(@implContentDecls, "    }\n");
             push(@implContentDecls, "    imp->set$implSetterFunctionName($result);\n");
             push(@implContentDecls, "    if ($result)\n");
-            push(@implContentDecls, "      createHiddenDependency(holder, value, V8Custom::kNodeEventListenerCacheIndex");
+            push(@implContentDecls, "      createHiddenDependency(holder, value, $cacheIndex");
         } else {
             push(@implContentDecls, "    imp->set$implSetterFunctionName(" . $result);
         }
@@ -905,142 +948,134 @@ sub GenerateBatchedAttributeData
     my $attributes = shift;
 
     foreach my $attribute (@$attributes) {
-        my $attrName = $attribute->signature->name;
-        my $attrExt = $attribute->signature->extendedAttributes;
-
-        my $accessControl = "v8::DEFAULT";
-        if ($attrExt->{"DoNotCheckDomainSecurityOnGet"}) {
-            $accessControl = "v8::ALL_CAN_READ";
-        } elsif ($attrExt->{"DoNotCheckDomainSecurityOnSet"}) {
-            $accessControl = "v8::ALL_CAN_WRITE";
-        } elsif ($attrExt->{"DoNotCheckDomainSecurity"}) {
-            $accessControl = "v8::ALL_CAN_READ";
-            if (!($attribute->type =~ /^readonly/) && !($attrExt->{"V8ReadOnly"})) {
-                $accessControl .= "|v8::ALL_CAN_WRITE";
-            }
-        }
-        if ($attrExt->{"V8DisallowShadowing"}) {
-            $accessControl .= "|v8::PROHIBITS_OVERWRITING";
-        }
-        $accessControl = "static_cast<v8::AccessControl>(" . $accessControl . ")";
-
-        my $customAccessor =
-            $attrExt->{"Custom"} ||
-            $attrExt->{"CustomSetter"} ||
-            $attrExt->{"CustomGetter"} ||
-            $attrExt->{"V8Custom"} ||
-            $attrExt->{"V8CustomSetter"} ||
-            $attrExt->{"V8CustomGetter"} ||
-            "";
-        if ($customAccessor eq 1) {
-            # use the naming convension, interface + (capitalize) attr name
-            $customAccessor = $interfaceName . $codeGenerator->WK_ucfirst($attrName);
-        }
+        my $conditionalString = GenerateConditionalString($attribute->signature);
+        push(@implContent, "\n#if ${conditionalString}\n") if $conditionalString;
+        GenerateSingleBatchedAttribute($interfaceName, $attribute, ",", "");
+        push(@implContent, "\n#endif // ${conditionalString}\n") if $conditionalString;
+    }
+}
 
-        my $getter;
-        my $setter;
-        my $propAttr = "v8::None";
-        my $hasCustomSetter = 0;
+sub GenerateSingleBatchedAttribute
+{
+    my $interfaceName = shift;
+    my $attribute = shift;
+    my $delimiter = shift;
+    my $indent = shift;
+    my $attrName = $attribute->signature->name;
+    my $attrExt = $attribute->signature->extendedAttributes;
 
-        # Check attributes.
-        if ($attrExt->{"DontEnum"}) {
-            $propAttr .= "|v8::DontEnum";
-        }
-        if ($attrExt->{"V8DisallowShadowing"}) {
-            $propAttr .= "|v8::DontDelete";
+    my $accessControl = "v8::DEFAULT";
+    if ($attrExt->{"DoNotCheckDomainSecurityOnGet"}) {
+        $accessControl = "v8::ALL_CAN_READ";
+    } elsif ($attrExt->{"DoNotCheckDomainSecurityOnSet"}) {
+        $accessControl = "v8::ALL_CAN_WRITE";
+    } elsif ($attrExt->{"DoNotCheckDomainSecurity"}) {
+        $accessControl = "v8::ALL_CAN_READ";
+        if (!($attribute->type =~ /^readonly/) && !($attrExt->{"V8ReadOnly"})) {
+            $accessControl .= "|v8::ALL_CAN_WRITE";
         }
+    }
+    if ($attrExt->{"V8DisallowShadowing"}) {
+        $accessControl .= "|v8::PROHIBITS_OVERWRITING";
+    }
+    $accessControl = "static_cast<v8::AccessControl>(" . $accessControl . ")";
+
+    my $customAccessor =
+        $attrExt->{"Custom"} ||
+        $attrExt->{"CustomSetter"} ||
+        $attrExt->{"CustomGetter"} ||
+        $attrExt->{"V8Custom"} ||
+        $attrExt->{"V8CustomSetter"} ||
+        $attrExt->{"V8CustomGetter"} ||
+        "";
+    if ($customAccessor eq 1) {
+        # use the naming convension, interface + (capitalize) attr name
+        $customAccessor = $interfaceName . $codeGenerator->WK_ucfirst($attrName);
+    }
 
-        my $on_proto = "0 /* on instance */";
-        my $data = "V8ClassIndex::INVALID_CLASS_INDEX /* no data */";
+    my $getter;
+    my $setter;
+    my $propAttr = "v8::None";
+    my $hasCustomSetter = 0;
 
-        # Constructor
-        if ($attribute->signature->type =~ /Constructor$/) {
-            my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
-            $constructorType =~ s/Constructor$//;
-            my $constructorIndex = uc($constructorType);
+    # Check attributes.
+    if ($attrExt->{"DontEnum"}) {
+        $propAttr .= "|v8::DontEnum";
+    }
+    if ($attrExt->{"V8DisallowShadowing"}) {
+        $propAttr .= "|v8::DontDelete";
+    }
+
+    my $on_proto = "0 /* on instance */";
+    my $data = "V8ClassIndex::INVALID_CLASS_INDEX /* no data */";
+
+    # Constructor
+    if ($attribute->signature->type =~ /Constructor$/) {
+        my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
+        $constructorType =~ s/Constructor$//;
+        my $constructorIndex = uc($constructorType);
+        if ($customAccessor) {
+            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
+        } else {
             $data = "V8ClassIndex::${constructorIndex}";
             $getter = "${interfaceName}Internal::${interfaceName}ConstructorGetter";
-            $setter = "0";
-            $propAttr = "v8::ReadOnly";
-
-        # EventListeners
-        } elsif ($attribute->signature->type eq "EventListener" && RequiresCustomEventListenerAccessors($dataNode)) {
-            if ($interfaceName eq "DOMWindow") {
-                $getter = "V8Custom::v8DOMWindowEventHandlerAccessorGetter";
-                $setter = "V8Custom::v8DOMWindowEventHandlerAccessorSetter";
-            } elsif ($interfaceName eq "DOMApplicationCache") {
-                $getter = "V8Custom::v8DOMApplicationCacheEventHandlerAccessorGetter";
-                $setter = "V8Custom::v8DOMApplicationCacheEventHandlerAccessorSetter";
-            } elsif ($interfaceName eq "Notification") {
-                $getter = "V8Custom::v8NotificationEventHandlerAccessorGetter";
-                $setter = "V8Custom::v8NotificationEventHandlerAccessorSetter";
-            } else {
-                $getter = "V8Custom::v8${customAccessor}AccessorGetter";
-                if ($interfaceName eq "WorkerContext" and $attrName eq "self") {
-                    $setter = "0";
-                    $propAttr = "v8::ReadOnly";
-                } else {
-                    $setter = "V8Custom::v8${customAccessor}AccessorSetter";
-                }
-            }
-        } else {
-            # Default Getter and Setter
-            $getter = "${interfaceName}Internal::${attrName}AttrGetter";
-            $setter = "${interfaceName}Internal::${attrName}AttrSetter";
-
-            # Custom Setter
-            if ($attrExt->{"CustomSetter"} || $attrExt->{"V8CustomSetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
-                $hasCustomSetter = 1;
-                $setter = "V8Custom::v8${customAccessor}AccessorSetter";
-            }
-
-            # Custom Getter
-            if ($attrExt->{"CustomGetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
-                $getter = "V8Custom::v8${customAccessor}AccessorGetter";
-            }
         }
+        $setter = "0";
+        $propAttr = "v8::ReadOnly";
 
-        # Replaceable
-        if ($attrExt->{"Replaceable"} && !$hasCustomSetter) {
-            $setter = "0";
-            # Handle the special case of window.top being marked as Replaceable.
-            # FIXME: Investigate whether we could treat window.top as replaceable 
-            # and allow shadowing without it being a security hole.
-            if (!($interfaceName eq "DOMWindow" and $attrName eq "top")) { 
-                $propAttr .= "|v8::ReadOnly";
-            }
+    } else {
+        # Default Getter and Setter
+        $getter = "${interfaceName}Internal::${attrName}AttrGetter";
+        $setter = "${interfaceName}Internal::${attrName}AttrSetter";
+
+        # Custom Setter
+        if ($attrExt->{"CustomSetter"} || $attrExt->{"V8CustomSetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+            $hasCustomSetter = 1;
+            $setter = "V8Custom::v8${customAccessor}AccessorSetter";
         }
 
-        # Read only attributes
-        if ($attribute->type =~ /^readonly/ || $attrExt->{"V8ReadOnly"}) {
-            $setter = "0";
+        # Custom Getter
+        if ($attrExt->{"CustomGetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
         }
+    }
 
-        # An accessor can be installed on the proto
-        if ($attrExt->{"v8OnProto"}) {
-            $on_proto = "1 /* on proto */";
+    # Replaceable
+    if ($attrExt->{"Replaceable"} && !$hasCustomSetter) {
+        $setter = "0";
+        # Handle the special case of window.top being marked as Replaceable.
+        # FIXME: Investigate whether we could treat window.top as replaceable
+        # and allow shadowing without it being a security hole.
+        if (!($interfaceName eq "DOMWindow" and $attrName eq "top")) {
+            $propAttr .= "|v8::ReadOnly";
         }
+    }
 
-        my $commentInfo = "Attribute '$attrName' (Type: '" . $attribute->type .
-                          "' ExtAttr: '" . join(' ', keys(%{$attrExt})) . "')";
-        
-        my $conditionalString = GenerateConditionalString($attribute->signature);
-        push(@implContent, "\n#if ${conditionalString}\n") if $conditionalString;
+    # Read only attributes
+    if ($attribute->type =~ /^readonly/ || $attrExt->{"V8ReadOnly"}) {
+        $setter = "0";
+    }
 
-        push(@implContent, <<END);
-  // $commentInfo
-  { "$attrName",
-    $getter,
-    $setter,
-    $data,
-    $accessControl,
-    static_cast<v8::PropertyAttribute>($propAttr),
-    $on_proto },
-END
-        push(@implContent, "\n#endif // ${conditionalString}\n") if $conditionalString;
+    # An accessor can be installed on the proto
+    if ($attrExt->{"v8OnProto"}) {
+        $on_proto = "1 /* on proto */";
     }
-}
 
+    my $commentInfo = "Attribute '$attrName' (Type: '" . $attribute->type .
+                      "' ExtAttr: '" . join(' ', keys(%{$attrExt})) . "')";
+
+    push(@implContent, $indent . "    {\n");
+    push(@implContent, $indent . "        \/\/ $commentInfo\n");
+    push(@implContent, $indent . "        \"$attrName\",\n");
+    push(@implContent, $indent . "        $getter,\n");
+    push(@implContent, $indent . "        $setter,\n");
+    push(@implContent, $indent . "        $data,\n");
+    push(@implContent, $indent . "        $accessControl,\n");
+    push(@implContent, $indent . "        static_cast<v8::PropertyAttribute>($propAttr),\n");
+    push(@implContent, $indent . "        $on_proto\n");
+    push(@implContent, $indent . "    }" . $delimiter . "\n");
+END
+}
 
 sub GenerateImplementation
 {
@@ -1088,20 +1123,16 @@ sub GenerateImplementation
 
         # Generate special code for the constructor attributes.
         if ($attrType =~ /Constructor$/) {
-            $hasConstructors = 1;
+            if ($attribute->signature->extendedAttributes->{"CustomGetter"}) {
+                $implIncludes{"V8CustomBinding.h"} = 1;
+            } else {
+                $hasConstructors = 1;
+            }
             next;
         }
 
-        # Make EventListeners custom for some types.
-        # FIXME: make the perl code capable of generating the
-        #   event setters/getters.  For now, WebKit has started removing the
-        #   [Custom] attribute, so just automatically insert it to avoid forking
-        #   other files.  This should be okay because we can't generate stubs
-        #   for any event getter/setters anyway.
-        if ($attrType eq "EventListener" && RequiresCustomEventListenerAccessors($dataNode)) {
-            $attribute->signature->extendedAttributes->{"Custom"} = 1;
-            $implIncludes{"V8CustomBinding.h"} = 1;
-            next;
+        if ($attrType eq "EventListener" && $interfaceName eq "DOMWindow") {
+            $attribute->signature->extendedAttributes->{"v8OnProto"} = 1;
         }
 
         # Do not generate accessor if this is a custom attribute.  The
@@ -1117,7 +1148,7 @@ sub GenerateImplementation
         if ($attribute->signature->extendedAttributes->{"CustomGetter"}) {
             $implIncludes{"V8CustomBinding.h"} = 1;
         } else {
-            GenerateNormalAttrGetter($attribute, $dataNode, $classIndex, $implClassName);
+            GenerateNormalAttrGetter($attribute, $dataNode, $classIndex, $implClassName, $interfaceName);
         }
         if ($attribute->signature->extendedAttributes->{"CustomSetter"} ||
             $attribute->signature->extendedAttributes->{"V8CustomSetter"}) {
@@ -1126,7 +1157,7 @@ sub GenerateImplementation
             $dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"} || die "Replaceable attribute can only be used in interface that defines ExtendsDOMGlobalObject attribute!";
             # GenerateReplaceableAttrSetter($implClassName);
         } elsif ($attribute->type !~ /^readonly/ && !$attribute->signature->extendedAttributes->{"V8ReadOnly"}) {
-            GenerateNormalAttrSetter($attribute, $dataNode, $classIndex, $implClassName);
+            GenerateNormalAttrSetter($attribute, $dataNode, $classIndex, $implClassName, $interfaceName);
         }
     }
 
@@ -1157,20 +1188,24 @@ sub GenerateImplementation
 
     # For the DOMWindow interface we partition the attributes into the
     # ones that disallows shadowing and the rest.
-    my @disallows_shadowing;
+    my @disallowsShadowing;
+    # Also separate out attributes that are enabled at runtime so we can process them specially.
+    my @enabledAtRuntime;
     my @normal;
-    if ($interfaceName eq "DOMWindow") {
-        foreach my $attribute (@$attributes) {
-            if ($attribute->signature->extendedAttributes->{"V8DisallowShadowing"}) {
-                push(@disallows_shadowing, $attribute);
-            } else {
-                push(@normal, $attribute);
-            }
+    foreach my $attribute (@$attributes) {
+        if ($interfaceName eq "DOMWindow" && $attribute->signature->extendedAttributes->{"V8DisallowShadowing"}) {
+            push(@disallowsShadowing, $attribute);
+        } elsif ($attribute->signature->extendedAttributes->{"EnabledAtRuntime"}) {
+            push(@enabledAtRuntime, $attribute);
+        } else {
+            push(@normal, $attribute);
         }
-        # Put the attributes that disallow shadowing on the shadow object.
-        $attributes = \@normal;
+    }
+    $attributes = \@normal;
+    # Put the attributes that disallow shadowing on the shadow object.
+    if (@disallowsShadowing) {
         push(@implContent, "static const BatchedAttribute shadow_attrs[] = {\n");
-        GenerateBatchedAttributeData($dataNode, \@disallows_shadowing);
+        GenerateBatchedAttributeData($dataNode, \@disallowsShadowing);
         push(@implContent, "};\n");
     }
 
@@ -1252,6 +1287,21 @@ END
 END
     }
 
+    # Setup the enable-at-runtime attrs if we have them
+    foreach my $runtime_attr (@enabledAtRuntime) {
+        $enable_function = $interfaceName . $codeGenerator->WK_ucfirst($runtime_attr->signature->name);
+        my $conditionalString = GenerateConditionalString($runtime_attr->signature);
+        push(@implContent, "\n#if ${conditionalString}\n") if $conditionalString;
+        push(@implContent, "    if (V8Custom::v8${enable_function}Enabled()) {\n");
+        push(@implContent, "        static const BatchedAttribute attrData =\\\n");
+        GenerateSingleBatchedAttribute($interfaceName, $runtime_attr, ";", "    ");
+        push(@implContent, <<END);
+        configureAttribute(instance, proto, attrData);
+    }
+END
+        push(@implContent, "\n#endif // ${conditionalString}\n") if $conditionalString;
+    }
+
     # Define our functions with Set() or SetAccessor()
     foreach my $function (@{$dataNode->functions}) {
         my $attrExt = $function->signature->extendedAttributes;
@@ -1456,7 +1506,7 @@ sub GenerateFunctionCallString()
             $paramName = "SVGPODListItem<" . GetNativeType($paramType, 1) . ">::copy($paramName)";
         }
 
-        if ($parameter->type eq "NodeFilter") {
+        if ($parameter->type eq "NodeFilter" || $parameter->type eq "XPathNSResolver") {
             $functionString .= "$paramName.get()";
         } else {
             $functionString .= $paramName;
@@ -1601,6 +1651,7 @@ sub IsRefPtrType
 {
     my $type = shift;
     return 1 if $type eq "Attr";
+    return 1 if $type eq "CanvasActiveInfo";
     return 1 if $type eq "CanvasArray";
     return 1 if $type eq "CanvasArrayBuffer";
     return 1 if $type eq "CanvasBooleanArray";
@@ -1738,6 +1789,9 @@ sub GetNativeType
     # temporary hack
     return "RefPtr<NodeFilter>" if $type eq "NodeFilter";
 
+    # necessary as resolvers could be constructed on fly.
+    return "RefPtr<XPathNSResolver>" if $type eq "XPathNSResolver";
+
     return "RefPtr<${type}>" if IsRefPtrType($type) and not $isParameter;
 
     # Default, assume native type is a pointer with same type name as idl type
@@ -1873,6 +1927,11 @@ sub JSValueToNative
         return "toWebCoreString($value)";
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return "SerializedScriptValue::create($value)";
+    }
+
     if ($type eq "NodeFilter") {
         return "V8DOMWrapper::wrapNativeNodeFilter($value)";
     }
@@ -1894,6 +1953,10 @@ sub JSValueToNative
         return "V8Node::HasInstance($value) ? V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast($value)) : 0";
     }
 
+    if ($type eq "XPathNSResolver") {
+        return "V8DOMWrapper::getXPathNSResolver($value)";
+    }
+
     AddIncludesForType($type);
     # $implIncludes{"$type.h"} = 1 unless AvoidInclusionOfType($type);
 
@@ -1945,10 +2008,16 @@ sub CreateCustomSignature
         if ($first) { $first = 0; }
         else { $result .= ", "; }
         if (IsWrapperType($parameter->type)) {
-            my $type = $parameter->type;
-            my $header = GetV8HeaderName($type);
-            $implIncludes{$header} = 1;
-            $result .= "V8${type}::GetRawTemplate()";
+            if ($parameter->type eq "XPathNSResolver") {
+                # Special case for XPathNSResolver.  All other browsers accepts a callable,
+                # so, even though it's against IDL, accept objects here.
+                $result .= "v8::Handle<v8::FunctionTemplate>()";
+            } else {
+                my $type = $parameter->type;
+                my $header = GetV8HeaderName($type);
+                $implIncludes{$header} = 1;
+                $result .= "V8${type}::GetRawTemplate()";
+            }
         } else {
             $result .= "v8::Handle<v8::FunctionTemplate>()";
         }
@@ -2053,7 +2122,9 @@ sub ReturnNativeToJSValue
 
     # For all the types where we use 'int' as the representation type,
     # we use Integer::New which has a fast Smi conversion check.
-    return "return v8::Integer::New($value)" if GetNativeType($type) eq "int";
+    my $nativeType = GetNativeType($type);
+    return "return v8::Integer::New($value)" if $nativeType eq "int";
+    return "return v8::Integer::NewFromUnsigned($value)" if $nativeType eq "unsigned";
 
     return "return v8::Number::New($value)" if $codeGenerator->IsPrimitiveType($type) or $type eq "SVGPaintType";
 
@@ -2091,6 +2162,11 @@ sub ReturnNativeToJSValue
         return "return V8DOMWrapper::convertEventListenerToV8Object($value)";
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"$type.h"} = 1;
+        return "return v8String($value->toString())";
+    }
+
     if ($type eq "DedicatedWorkerContext" or $type eq "WorkerContext" or $type eq "SharedWorkerContext") {
         $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
         return "return WorkerContextExecutionProxy::convertWorkerContextToV8Object($value)";
diff --git a/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
index 8e0e0d95da..8128bf8cb9 100644
--- a/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
+++ b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
@@ -27,11 +27,12 @@
 #define IdentifierRep_h
 
 #include <wtf/Assertions.h>
+#include <wtf/FastAllocBase.h>
 #include <string.h>
 
 namespace WebCore {
     
-class IdentifierRep {
+class IdentifierRep : public FastAllocBase {
 public:
     static IdentifierRep* get(int);
     static IdentifierRep* get(const char*);
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
index fcdd166231..77b5966271 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
@@ -121,15 +121,19 @@ JSValue CInstance::invokeMethod(ExecState* exec, const MethodList& methodList, c
         convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
+    bool retval = true;
     NPVariant resultVariant;
     VOID_TO_NPVARIANT(resultVariant);
 
     {
         JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
         ASSERT(globalExceptionString().isNull());
-        _object->_class->invoke(_object, ident, cArgs.data(), count, &resultVariant);
+        retval = _object->_class->invoke(_object, ident, cArgs.data(), count, &resultVariant);
         moveGlobalExceptionToExecState(exec);
     }
+    
+    if (!retval)
+        throwError(exec, GeneralError, "Error calling method on NPObject!");
 
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
@@ -153,14 +157,18 @@ JSValue CInstance::invokeDefaultMethod(ExecState* exec, const ArgList& args)
         convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
+    bool retval = true;
     NPVariant resultVariant;
     VOID_TO_NPVARIANT(resultVariant);
     {
         JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
         ASSERT(globalExceptionString().isNull());
-        _object->_class->invokeDefault(_object, cArgs.data(), count, &resultVariant);
+        retval = _object->_class->invokeDefault(_object, cArgs.data(), count, &resultVariant);
         moveGlobalExceptionToExecState(exec);
     }
+    
+    if (!retval)
+        throwError(exec, GeneralError, "Error calling method on NPObject!");
 
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
@@ -188,14 +196,18 @@ JSValue CInstance::invokeConstruct(ExecState* exec, const ArgList& args)
         convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
+    bool retval = true;
     NPVariant resultVariant;
     VOID_TO_NPVARIANT(resultVariant);
     {
         JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
         ASSERT(globalExceptionString().isNull());
-        _object->_class->construct(_object, cArgs.data(), count, &resultVariant);
+        retval = _object->_class->construct(_object, cArgs.data(), count, &resultVariant);
         moveGlobalExceptionToExecState(exec);
     }
+    
+    if (!retval)
+        throwError(exec, GeneralError, "Error calling method on NPObject!");
 
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
diff --git a/src/3rdparty/webkit/WebCore/bridge/npapi.h b/src/3rdparty/webkit/WebCore/bridge/npapi.h
index 07121b0fe4..5d48b0dc54 100644
--- a/src/3rdparty/webkit/WebCore/bridge/npapi.h
+++ b/src/3rdparty/webkit/WebCore/bridge/npapi.h
@@ -64,7 +64,9 @@
 #        endif /* XP_MAC */
 #    endif /* macintosh */
 #    ifdef __INTEL__
-#        undef NULL
+#       ifndef __SYMBIAN32__
+#           undef NULL
+#       endif
 #        ifndef XP_WIN
 #            define XP_WIN 1
 #        endif /* __INTEL__ */
@@ -106,6 +108,11 @@
     #include <stdio.h>
 #endif
 
+#if defined(XP_SYMBIAN)
+    #include <QEvent>
+    #include <QRegion>
+#endif
+
 #ifdef XP_WIN
     #include <windows.h>
 #endif
@@ -526,9 +533,9 @@ typedef struct _NPWindow
     uint32    height;
     NPRect    clipRect;    /* Clipping rectangle in port coordinates */
                         /* Used by MAC only.              */
-#ifdef XP_UNIX
+#if defined(XP_UNIX) || defined(XP_SYMBIAN)
     void *    ws_info;    /* Platform-dependent additonal data */
-#endif /* XP_UNIX */
+#endif /* XP_UNIX || XP_SYMBIAN */
     NPWindowType type;    /* Is this a window or a drawable? */
 } NPWindow;
 
@@ -578,6 +585,8 @@ typedef enum {
 typedef EventRecord    NPEvent;
 #endif
 
+#elif defined(XP_SYMBIAN)
+typedef QEvent NPEvent;
 #elif defined(XP_WIN)
 typedef struct _NPEvent
 {
@@ -608,6 +617,8 @@ typedef CGPathRef NPCGRegion;
 typedef HRGN NPRegion;
 #elif defined(XP_UNIX)
 typedef Region NPRegion;
+#elif defined(XP_SYMBIAN)
+typedef QRegion* NPRegion;
 #else
 typedef void *NPRegion;
 #endif /* XP_MAC */
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
index edb577cc15..f2ce95424a 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
@@ -151,7 +151,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType));
+        return Structure::create(prototype, TypeInfo(ObjectType,  OverridesGetOwnPropertySlot | OverridesMarkChildren));
     }
 
 protected:
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
index f614f7f18d..1218b8cbe9 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
@@ -59,10 +59,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType));
+        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
     }
 
 private:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
     static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     static JSValue indexGetter(ExecState*, const Identifier&, const PropertySlot&);
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
index 3233ffad47..967604846c 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
@@ -47,10 +47,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance));
+        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
     }
 
 private:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesMarkChildren | InternalFunction::StructureFlags;
     static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
index f16778e306..391e078d6a 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
@@ -62,10 +62,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType));
+        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
     }
 
 protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
     RuntimeObjectImp(ExecState*, NonNullPassRefPtr<Structure>, PassRefPtr<Bindings::Instance>);
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_root.h b/src/3rdparty/webkit/WebCore/bridge/runtime_root.h
index eacbb57ccd..fdd73c4883 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_root.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_root.h
@@ -31,8 +31,10 @@
 #endif
 #include <runtime/Protect.h>
 
+#include <wtf/Forward.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace JSC {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
index 2935c31727..4e067ce852 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -77,7 +77,6 @@ static const int computedProperties[] = {
     CSSPropertyBorderTopStyle,
     CSSPropertyBorderTopWidth,
     CSSPropertyBottom,
-    CSSPropertyBoxShadow,
     CSSPropertyCaptionSide,
     CSSPropertyClear,
     CSSPropertyClip,
@@ -129,6 +128,7 @@ static const int computedProperties[] = {
     CSSPropertyTextAlign,
     CSSPropertyTextDecoration,
     CSSPropertyTextIndent,
+    CSSPropertyTextRendering,
     CSSPropertyTextShadow,
     CSSPropertyTextOverflow,
     CSSPropertyTextTransform,
@@ -170,6 +170,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitBoxOrient,
     CSSPropertyWebkitBoxPack,
     CSSPropertyWebkitBoxReflect,
+    CSSPropertyWebkitBoxShadow,
     CSSPropertyWebkitBoxSizing,
     CSSPropertyWebkitColumnBreakAfter,
     CSSPropertyWebkitColumnBreakBefore,
@@ -252,7 +253,6 @@ static const int computedProperties[] = {
     CSSPropertyStrokeMiterlimit,
     CSSPropertyStrokeOpacity,
     CSSPropertyStrokeWidth,
-    CSSPropertyTextRendering,
     CSSPropertyAlignmentBaseline,
     CSSPropertyBaselineShift,
     CSSPropertyDominantBaseline,
@@ -637,6 +637,15 @@ static PassRefPtr<CSSValue> fillRepeatToCSSValue(EFillRepeat xRepeat, EFillRepea
     return list.release();
 }
 
+static void logUnimplementedPropertyID(int propertyID)
+{
+    DEFINE_STATIC_LOCAL(HashSet<int>, propertyIDSet, ());
+    if (!propertyIDSet.add(propertyID).second)
+        return;
+
+    LOG_ERROR("WebKit does not yet implement getComputedStyle for '%s'.", getPropertyName(static_cast<CSSPropertyID>(propertyID)));
+} 
+
 PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int propertyID, EUpdateLayout updateLayout) const
 {
     Node* node = m_node.get();
@@ -767,7 +776,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         }
         case CSSPropertyWebkitBoxReflect:
             return valueForReflection(style->boxReflect());
-        case CSSPropertyBoxShadow:
+        case CSSPropertyWebkitBoxShadow:
             return valueForShadow(style->boxShadow(), static_cast<CSSPropertyID>(propertyID));
         case CSSPropertyCaptionSide:
             return CSSPrimitiveValue::create(style->captionSide());
@@ -897,7 +906,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 // for how high to be in pixels does include things like minimum font size and the zoom factor.
                 // On the other hand, since font-size doesn't include the zoom factor, we really can't do
                 // that here either.
-                return CSSPrimitiveValue::create(static_cast<int>(length.percent() * style->fontDescription().specifiedSize()) / 100, CSSPrimitiveValue::CSS_PX);
+                // The line height returned is rounded to the nearest integer.
+                return CSSPrimitiveValue::create(length.calcMinValue(style->fontDescription().specifiedSize(), true), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(length.value(), CSSPrimitiveValue::CSS_PX);
         }
         case CSSPropertyListStyleImage:
@@ -1052,6 +1062,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->textIndent());
         case CSSPropertyTextShadow:
             return valueForShadow(style->textShadow(), static_cast<CSSPropertyID>(propertyID));
+        case CSSPropertyTextRendering:
+            return CSSPrimitiveValue::create(style->fontDescription().textRenderingMode());
         case CSSPropertyTextOverflow:
             if (style->textOverflow())
                 return CSSPrimitiveValue::createIdentifier(CSSValueEllipsis);
@@ -1413,7 +1425,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
 #endif
     }
 
-    LOG_ERROR("unimplemented propertyID: %d", propertyID);
+    logUnimplementedPropertyID(propertyID);
     return 0;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSGrammar.y b/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
index 1c1f7b4bb1..0530e913ed 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
+++ b/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
@@ -97,7 +97,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %}
 
-%expect 50
+%expect 51
 
 %nonassoc LOWEST_PREC
 
@@ -268,7 +268,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 %%
 
 stylesheet:
-    maybe_charset maybe_sgml import_list variables_list namespace_list rule_list
+    maybe_space maybe_charset maybe_sgml import_list variables_list namespace_list rule_list
   | webkit_rule maybe_space
   | webkit_decls maybe_space
   | webkit_value maybe_space
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
index c46bf366a6..10949dd400 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
@@ -405,9 +405,6 @@ Document* CSSParser::document() const
 
 bool CSSParser::validUnit(CSSParserValue* value, Units unitflags, bool strict)
 {
-    if (unitflags & FNonNeg && value->fValue < 0)
-        return false;
-
     bool b = false;
     switch (value->unit) {
     case CSSPrimitiveValue::CSS_NUMBER:
@@ -451,6 +448,8 @@ bool CSSParser::validUnit(CSSParserValue* value, Units unitflags, bool strict)
     default:
         break;
     }
+    if (b && unitflags & FNonNeg && value->fValue < 0)
+        b = false;
     return b;
 }
 
@@ -894,6 +893,13 @@ bool CSSParser::parseValue(int propId, bool important)
         int propId1, propId2;
         bool result = false;
         if (parseFillProperty(propId, propId1, propId2, val1, val2)) {
+            OwnPtr<ShorthandScope> shorthandScope;
+            if (propId == CSSPropertyBackgroundPosition ||
+                propId == CSSPropertyBackgroundRepeat ||
+                propId == CSSPropertyWebkitMaskPosition ||
+                propId == CSSPropertyWebkitMaskRepeat) {
+                shorthandScope.set(new ShorthandScope(this, propId));
+            }
             addProperty(propId1, val1.release(), important);
             if (val2)
                 addProperty(propId2, val2.release(), important);
@@ -1190,7 +1196,7 @@ bool CSSParser::parseValue(int propId, bool important)
         valid_primitive = validUnit(value, FLength, m_strict);
         break;
     case CSSPropertyTextShadow: // CSS2 property, dropped in CSS2.1, back in CSS3, so treat as CSS3
-    case CSSPropertyBoxShadow:
+    case CSSPropertyWebkitBoxShadow:
         if (id == CSSValueNone)
             valid_primitive = true;
         else
@@ -1433,6 +1439,11 @@ bool CSSParser::parseValue(int propId, bool important)
             id == CSSValueWave)
             valid_primitive = true;
         break;
+    case CSSPropertyTextRendering: // auto | optimizeSpeed | optimizeLegibility | geometricPrecision
+        if (id == CSSValueAuto || id == CSSValueOptimizespeed || id == CSSValueOptimizelegibility
+            || id == CSSValueGeometricprecision)
+            valid_primitive = true;
+        break;
     case CSSPropertyTextLineThroughWidth:
     case CSSPropertyTextOverlineWidth:
     case CSSPropertyTextUnderlineWidth:
@@ -3605,7 +3616,7 @@ struct ShadowParseContext {
         , allowBlur(false)
         , allowSpread(false)
         , allowColor(true)
-        , allowStyle(prop == CSSPropertyBoxShadow)
+        , allowStyle(prop == CSSPropertyWebkitBoxShadow)
         , allowBreak(true)
     {
     }
@@ -3637,7 +3648,7 @@ struct ShadowParseContext {
         allowY = false;
         allowBlur = false;
         allowSpread = false;
-        allowStyle = property == CSSPropertyBoxShadow;
+        allowStyle = property == CSSPropertyWebkitBoxShadow;
     }
 
     void commitLength(CSSParserValue* v)
@@ -3656,12 +3667,12 @@ struct ShadowParseContext {
             allowY = false;
             allowBlur = true;
             allowColor = true;
-            allowStyle = property == CSSPropertyBoxShadow;
+            allowStyle = property == CSSPropertyWebkitBoxShadow;
             allowBreak = true;
         } else if (allowBlur) {
             blur = val.release();
             allowBlur = false;
-            allowSpread = property == CSSPropertyBoxShadow;
+            allowSpread = property == CSSPropertyWebkitBoxShadow;
         } else if (allowSpread) {
             spread = val.release();
             allowSpread = false;
@@ -3678,7 +3689,7 @@ struct ShadowParseContext {
         } else {
             allowBlur = false;
             allowSpread = false;
-            allowStyle = property == CSSPropertyBoxShadow;
+            allowStyle = property == CSSPropertyWebkitBoxShadow;
         }
     }
 
@@ -5171,11 +5182,6 @@ static int cssPropertyID(const UChar* propertyName, unsigned length)
                 const char* const opacity = "opacity";
                 name = opacity;
                 length = strlen(opacity);
-            } else if (strcmp(buffer, "-webkit-box-shadow") == 0) {
-                // CSS Backgrounds/Borders.  -webkit-box-shadow worked in Safari 4 and earlier.
-                const char* const boxShadow = "box-shadow";
-                name = boxShadow;
-                length = strlen(boxShadow);
             } else if (strcmp(buffer, "-webkit-background-size") == 0) {
                 // CSS Backgrounds/Borders.  -webkit-background-size worked in Safari 4 and earlier.
                 const char* const backgroundSize = "background-size";
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParserValues.h b/src/3rdparty/webkit/WebCore/css/CSSParserValues.h
index 24bd9b7dc3..242cda87f7 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParserValues.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSParserValues.h
@@ -60,7 +60,7 @@ struct CSSParserValue {
     PassRefPtr<CSSValue> createCSSValue();
 };
 
-class CSSParserValueList {
+class CSSParserValueList : public FastAllocBase {
 public:
     CSSParserValueList()
         : m_current(0)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
index 1f2c9ca28a..d2286bb4c7 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
@@ -34,6 +34,8 @@
 #include "Rect.h"
 #include "RenderStyle.h"
 #include <wtf/ASCIICType.h>
+#include <wtf/MathExtras.h>
+#include <wtf/StringExtras.h>
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -684,6 +686,71 @@ int CSSPrimitiveValue::getIdent()
     return m_value.ident;
 }
 
+static void appendCSSDouble(Vector<UChar>& vector, double value)
+{
+    // From the CSS specification section titled "Integers and real numbers",
+    // real numbers are only formatted as [sign] [digits] "." [digits].
+    // This differs from printf-style formatting in that exponents (e.g. 1.3e06)
+    // are not allowed.  Since NaN/inf are also not valid CSS values this
+    // function doesn't handle them.
+
+    // For compatibility with what was returned by older versions of
+    // WebKit, we target 6 digits of precision.
+    const int digitsAfterDecimalPoint = 6;
+    long long rounded = llround(fabs(value) * 1000000.0);
+    if (rounded == 0) {
+        vector.append('0');
+        return;
+    }
+
+    char buf[24];
+    int length = snprintf(buf, sizeof(buf), "%lld", rounded);
+    int decimalPoint = length - digitsAfterDecimalPoint;
+
+    // We are matching printf("%g")'s behavior and must trim trailing zeros,
+    // regardless of whether they're significant.
+    while (length > 0 && length > decimalPoint && buf[length - 1] == '0')
+        length--;
+
+    // Reserve an estimate of space for the number of digits we anticipate
+    // along with a minus sign/initial zero/decimal point.
+    vector.reserveCapacity(vector.size() + 3 + length);
+
+    if (value < 0)
+        vector.append('-');
+
+    if (decimalPoint <= 0) {
+        // Only digits after the decimal point.
+        vector.append('0');
+        vector.append('.');
+        for (int i = decimalPoint; i < 0; i++)
+            vector.append('0');
+        for (int i = 0; i < length; i++)
+            vector.append(buf[i]);
+    } else if (length <= decimalPoint) {
+        // Only digits before the decimal point.
+        for (int i = 0; i < length; i++)
+            vector.append(buf[i]);
+    } else {
+        // Digits before and after the decimal point.
+        for (int i = 0; i < decimalPoint; i++)
+            vector.append(buf[i]);
+        vector.append('.');
+        for (int i = decimalPoint; i < length; i++)
+            vector.append(buf[i]);
+    }
+}
+
+static String formatWithUnits(double value, const char* units)
+{
+    Vector<UChar> result;
+    appendCSSDouble(result, value);
+    result.reserveCapacity(result.size() + strlen(units));
+    for (int i = 0; units[i]; i++)
+        result.append(units[i]);
+    return String::adopt(result);
+}
+
 String CSSPrimitiveValue::cssText() const
 {
     // FIXME: return the original value instead of a generated one (e.g. color
@@ -695,61 +762,61 @@ String CSSPrimitiveValue::cssText() const
             break;
         case CSS_NUMBER:
         case CSS_PARSER_INTEGER:
-            text = String::number(m_value.num);
+            text = formatWithUnits(m_value.num, "");
             break;
         case CSS_PERCENTAGE:
-            text = String::format("%.6lg%%", m_value.num);
+            text = formatWithUnits(m_value.num, "%");
             break;
         case CSS_EMS:
-            text = String::format("%.6lgem", m_value.num);
+            text = formatWithUnits(m_value.num, "em");
             break;
         case CSS_EXS:
-            text = String::format("%.6lgex", m_value.num);
+            text = formatWithUnits(m_value.num, "ex");
             break;
         case CSS_REMS:
-            text = String::format("%.6lgrem", m_value.num);
+            text = formatWithUnits(m_value.num, "rem");
             break;
         case CSS_PX:
-            text = String::format("%.6lgpx", m_value.num);
+            text = formatWithUnits(m_value.num, "px");
             break;
         case CSS_CM:
-            text = String::format("%.6lgcm", m_value.num);
+            text = formatWithUnits(m_value.num, "cm");
             break;
         case CSS_MM:
-            text = String::format("%.6lgmm", m_value.num);
+            text = formatWithUnits(m_value.num, "mm");
             break;
         case CSS_IN:
-            text = String::format("%.6lgin", m_value.num);
+            text = formatWithUnits(m_value.num, "in");
             break;
         case CSS_PT:
-            text = String::format("%.6lgpt", m_value.num);
+            text = formatWithUnits(m_value.num, "pt");
             break;
         case CSS_PC:
-            text = String::format("%.6lgpc", m_value.num);
+            text = formatWithUnits(m_value.num, "pc");
             break;
         case CSS_DEG:
-            text = String::format("%.6lgdeg", m_value.num);
+            text = formatWithUnits(m_value.num, "deg");
             break;
         case CSS_RAD:
-            text = String::format("%.6lgrad", m_value.num);
+            text = formatWithUnits(m_value.num, "rad");
             break;
         case CSS_GRAD:
-            text = String::format("%.6lggrad", m_value.num);
+            text = formatWithUnits(m_value.num, "grad");
             break;
         case CSS_MS:
-            text = String::format("%.6lgms", m_value.num);
+            text = formatWithUnits(m_value.num, "ms");
             break;
         case CSS_S:
-            text = String::format("%.6lgs", m_value.num);
+            text = formatWithUnits(m_value.num, "s");
             break;
         case CSS_HZ:
-            text = String::format("%.6lghz", m_value.num);
+            text = formatWithUnits(m_value.num, "hz");
             break;
         case CSS_KHZ:
-            text = String::format("%.6lgkhz", m_value.num);
+            text = formatWithUnits(m_value.num, "khz");
             break;
         case CSS_TURN:
-            text = String::format("%.6lgturn", m_value.num);
+            text = formatWithUnits(m_value.num, "turn");
             break;
         case CSS_DIMENSION:
             // FIXME
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
index b46322daaa..3616aa5d84 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
@@ -36,6 +36,7 @@
 #include "RenderStyleConstants.h"
 #include "SVGRenderStyleDefs.h"
 #include "TextDirection.h"
+#include "TextRenderingMode.h"
 #include "ThemeTypes.h"
 
 namespace WebCore {
@@ -199,6 +200,11 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case ListboxPart:
             m_value.ident = CSSValueListbox;
             break;
+#if ENABLE(DATALIST)
+        case ListButtonPart:
+            m_value.ident = CSSValueListButton;
+            break;
+#endif
         case ListItemPart:
             m_value.ident = CSSValueListitem;
             break;
@@ -1838,6 +1844,42 @@ template<> inline CSSPrimitiveValue::operator FontSmoothingMode() const
     return AutoSmoothing;
 }
 
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(TextRenderingMode e)
+    : m_type(CSS_IDENT)
+{
+    switch (e) {
+        case AutoTextRendering:
+            m_value.ident = CSSValueAuto;
+            break;
+        case OptimizeSpeed:
+            m_value.ident = CSSValueOptimizespeed;
+            break;
+        case OptimizeLegibility:
+            m_value.ident = CSSValueOptimizelegibility;
+            break;
+        case GeometricPrecision:
+            m_value.ident = CSSValueGeometricprecision;
+            break;
+    }
+}
+
+template<> inline CSSPrimitiveValue::operator TextRenderingMode() const
+{
+    switch (m_value.ident) {
+        case CSSValueAuto:
+            return AutoTextRendering;
+        case CSSValueOptimizespeed:
+            return OptimizeSpeed;
+        case CSSValueOptimizelegibility:
+            return OptimizeLegibility;
+        case CSSValueGeometricprecision:
+            return GeometricPrecision;
+        default:
+            ASSERT_NOT_REACHED();
+            return AutoTextRendering;
+    }
+}
+
 #if ENABLE(SVG)
 
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineCap e)
@@ -2241,42 +2283,6 @@ template<> inline CSSPrimitiveValue::operator ETextAnchor() const
     }
 }
 
-template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ETextRendering e)
-    : m_type(CSS_IDENT)
-{
-    switch (e) {
-        case TR_AUTO:
-            m_value.ident = CSSValueAuto;
-            break;
-        case TR_OPTIMIZESPEED:
-            m_value.ident = CSSValueOptimizespeed;
-            break;
-        case TR_OPTIMIZELEGIBILITY:
-            m_value.ident = CSSValueOptimizelegibility;
-            break;
-        case TR_GEOMETRICPRECISION:
-            m_value.ident = CSSValueGeometricprecision;
-            break;
-    }
-}
-
-template<> inline CSSPrimitiveValue::operator ETextRendering() const
-{
-    switch (m_value.ident) {
-        case CSSValueAuto:
-            return TR_AUTO;
-        case CSSValueOptimizespeed:
-            return TR_OPTIMIZESPEED;
-        case CSSValueOptimizelegibility:
-            return TR_OPTIMIZELEGIBILITY;
-        case CSSValueGeometricprecision:
-            return TR_GEOMETRICPRECISION;
-        default:
-            ASSERT_NOT_REACHED();
-            return TR_AUTO;
-    }
-}
-
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EWritingMode e)
     : m_type(CSS_IDENT)
 {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
index 1bf526b87b..5ef660509f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
+++ b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
@@ -49,7 +49,6 @@ border-top-style
 border-top-width
 border-width
 bottom
-box-shadow
 caption-side
 clear
 clip
@@ -127,6 +126,7 @@ text-overline-color
 text-overline-mode
 text-overline-style
 text-overline-width
+text-rendering
 text-shadow
 text-transform
 text-underline
@@ -179,6 +179,7 @@ zoom
 -webkit-box-orient
 -webkit-box-pack
 -webkit-box-reflect
+-webkit-box-shadow
 -webkit-box-sizing
 -webkit-column-break-after
 -webkit-column-break-before
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
index 9d9dd1b187..313528f821 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
@@ -99,6 +99,9 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, focus, ("focus"));
     DEFINE_STATIC_LOCAL(AtomicString, hover, ("hover"));
     DEFINE_STATIC_LOCAL(AtomicString, indeterminate, ("indeterminate"));
+#if ENABLE(DATALIST)
+    DEFINE_STATIC_LOCAL(AtomicString, inputListButton, ("-webkit-input-list-button"));
+#endif
     DEFINE_STATIC_LOCAL(AtomicString, inputPlaceholder, ("-webkit-input-placeholder"));
     DEFINE_STATIC_LOCAL(AtomicString, lastChild, ("last-child"));
     DEFINE_STATIC_LOCAL(AtomicString, lastOfType, ("last-of-type"));
@@ -197,7 +200,14 @@ void CSSSelector::extractPseudoType() const
         m_pseudoType = PseudoFirstChild;
     else if (m_value == fullPageMedia)
         m_pseudoType = PseudoFullPageMedia;
-    else if (m_value == inputPlaceholder) {
+    else
+#if ENABLE(DATALIST)
+    if (m_value == inputListButton) {
+        m_pseudoType = PseudoInputListButton;
+        element = true;
+    } else
+#endif
+    if (m_value == inputPlaceholder) {
         m_pseudoType = PseudoInputPlaceholder;
         element = true;
     } else if (m_value == lastChild)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelector.h b/src/3rdparty/webkit/WebCore/css/CSSSelector.h
index 7836136a62..0c3b677d6f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelector.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelector.h
@@ -183,7 +183,8 @@ namespace WebCore {
             PseudoMediaControlsRewindButton,
             PseudoMediaControlsReturnToRealtimeButton,
             PseudoMediaControlsStatusDisplay,
-            PseudoMediaControlsFullscreenButton
+            PseudoMediaControlsFullscreenButton,
+            PseudoInputListButton
         };
 
         PseudoType pseudoType() const
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
index dc9f2e5fda..181e48024a 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
@@ -2494,6 +2494,11 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoFileUploadButton:
                 dynamicPseudo = FILE_UPLOAD_BUTTON;
                 return true;
+#if ENABLE(DATALIST)
+            case CSSSelector::PseudoInputListButton:
+                dynamicPseudo = INPUT_LIST_BUTTON;
+                return true;
+#endif
             case CSSSelector::PseudoInputPlaceholder:
                 dynamicPseudo = INPUT_PLACEHOLDER;
                 return true;
@@ -4634,9 +4639,23 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         HANDLE_INHERIT_AND_INITIAL(outlineOffset, OutlineOffset)
         m_style->setOutlineOffset(primitiveValue->computeLengthInt(style(), m_rootElementStyle, zoomFactor));
         return;
-
+    case CSSPropertyTextRendering: {
+        FontDescription fontDescription = m_style->fontDescription();
+        if (isInherit) 
+            fontDescription.setTextRenderingMode(m_parentStyle->fontDescription().textRenderingMode());
+        else if (isInitial)
+            fontDescription.setTextRenderingMode(AutoTextRendering);
+        else {
+            if (!primitiveValue)
+                return;
+            fontDescription.setTextRenderingMode(*primitiveValue);
+        }
+        if (m_style->setFontDescription(fontDescription))
+            m_fontDirty = true;
+        return;
+    }
     case CSSPropertyTextShadow:
-    case CSSPropertyBoxShadow: {
+    case CSSPropertyWebkitBoxShadow: {
         if (isInherit) {
             if (id == CSSPropertyTextShadow)
                 return m_style->setTextShadow(m_parentStyle->textShadow() ? new ShadowData(*m_parentStyle->textShadow()) : 0);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in b/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
index 791f425150..1b7b1d82be 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
+++ b/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
@@ -501,6 +501,7 @@ square-button
 button
 button-bevel
 default-button
+list-button
 listbox
 listitem
 media-fullscreen-button
@@ -631,3 +632,9 @@ stroke
 # none
 antialiased
 subpixel-antialiased
+
+# text-rendering
+#auto
+optimizeSpeed
+optimizeLegibility
+geometricPrecision
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
index 2cd90a9d56..e8492d408e 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
@@ -93,8 +93,6 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getSVGPropertyCSSValue(int pro
             return CSSPrimitiveValue::create(svgStyle->strokeMiterLimit(), CSSPrimitiveValue::CSS_NUMBER);
         case CSSPropertyStrokeOpacity:
             return CSSPrimitiveValue::create(svgStyle->strokeOpacity(), CSSPrimitiveValue::CSS_NUMBER);
-        case CSSPropertyTextRendering:
-            return CSSPrimitiveValue::create(svgStyle->textRendering());
         case CSSPropertyAlignmentBaseline:
             return CSSPrimitiveValue::create(svgStyle->alignmentBaseline());
         case CSSPropertyDominantBaseline:
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
index 04ba185a5d..0ae9fbc496 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
@@ -132,12 +132,6 @@ bool CSSParser::parseSVGValue(int propId, bool important)
             valid_primitive = true;
         break;
 
-    case CSSPropertyTextRendering:   // auto | optimizeSpeed | optimizeLegibility | geometricPrecision | inherit
-        if (id == CSSValueAuto || id == CSSValueOptimizespeed || id == CSSValueOptimizelegibility ||
-       id == CSSValueGeometricprecision)
-            valid_primitive = true;
-        break;
-
     case CSSPropertyImageRendering:  // auto | optimizeSpeed |
     case CSSPropertyColorRendering:  // optimizeQuality | inherit
         if (id == CSSValueAuto || id == CSSValueOptimizespeed ||
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in b/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in
index 965fbbf126..e400ffe729 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in
@@ -37,7 +37,7 @@ stroke-linejoin
 stroke-miterlimit
 stroke-opacity
 stroke-width
-text-rendering
+# text-rendering
 alignment-baseline
 baseline-shift
 dominant-baseline
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
index d326dde434..b81b4f289a 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
@@ -229,13 +229,6 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
                 svgstyle->setShapeRendering(*primitiveValue);
             break;
         }
-        case CSSPropertyTextRendering:
-        {
-            HANDLE_INHERIT_AND_INITIAL(textRendering, TextRendering)
-            if (primitiveValue)
-                svgstyle->setTextRendering(*primitiveValue);
-            break;
-        }
         // end of ident only properties
         case CSSPropertyFill:
         {
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in b/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in
index c866a17039..152a68f246 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in
@@ -196,7 +196,7 @@ linearRGB
 
 # CSS_PROP_COLOR_RENDERING
 #auto
-optimizeSpeed
+#optimizeSpeed
 optimizeQuality
 
 ## CSS_PROP_FILL
@@ -220,7 +220,7 @@ optimizeQuality
 #auto
 #optimizeSpeed
 crispEdges
-geometricPrecision
+#geometricPrecision
 
 # CSS_PROP_STROKE
 # CSS_PROP_STROKE_DASHARRAY
@@ -238,11 +238,6 @@ bevel
 # CSS_PROP_STROKE_MITERLIMIT
 # CSS_PROP_STROKE_OPACITY
 # CSS_PROP_STROKE_WIDTH
-# CSS_PROP_TEXT_RENDERING
-#auto
-#optimizeSpeed
-optimizeLegibility
-#geometricPrecision
 
 # CSS_PROP_ALIGNMENT_BASELINE
 #auto
diff --git a/src/3rdparty/webkit/WebCore/css/html.css b/src/3rdparty/webkit/WebCore/css/html.css
index 30d5661bae..095fab3adf 100644
--- a/src/3rdparty/webkit/WebCore/css/html.css
+++ b/src/3rdparty/webkit/WebCore/css/html.css
@@ -354,6 +354,11 @@ input[type="search"]::-webkit-search-results-button {
     display: inline-block;
 }
 
+input::-webkit-input-list-button {
+    -webkit-appearance: list-button;
+    display: inline-block;
+}
+
 textarea {
     -webkit-appearance: textarea;
     background-color: white;
diff --git a/src/3rdparty/webkit/WebCore/css/makevalues.pl b/src/3rdparty/webkit/WebCore/css/makevalues.pl
index 3f52e64043..e49981df64 100644
--- a/src/3rdparty/webkit/WebCore/css/makevalues.pl
+++ b/src/3rdparty/webkit/WebCore/css/makevalues.pl
@@ -86,7 +86,7 @@ const char* getValueName(unsigned short id);
 EOF
 close HEADER;
 
-system("gperf -L ANSI-C -E -C -n -o -t --key-positions=\"*\" -NfindValue -Hhash_val -Wwordlist_value -D CSSValueKeywords.gperf > CSSValueKeywords.c");
+system("gperf -L ANSI-C -E -C -n -o -t --key-positions=\"*\" -NfindValue -Hhash_val -Wwordlist_value -D CSSValueKeywords.gperf > CSSValueKeywords.c") == 0 || die "calling gperf failed: $?";
 
 open C, ">>CSSValueKeywords.c" || die "Could not open CSSValueKeywords.c for writing";
 print C  "static const char * const valueList[] = {\n";
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css b/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
index 16ff0e44d8..0f667bde4e 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
@@ -83,8 +83,8 @@ audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-
     width: auto;
     height: 32px;
 
-    border-left-color: rgba(255, 255, 255, 0.2);
-    border-right-color: rgba(255, 255, 255, 0.2);
+    border-left: 1px solid rgba(255, 255, 255, 0.2);
+    border-right: 1px solid rgba(255, 255, 255, 0.2);
 }
 
 audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
@@ -141,7 +141,7 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     -webkit-appearance: media-slider;
     position: absolute;
     top: auto;
-    bottom: 8px;
+    bottom: 7px;
     left: 6px;
     right: 65px;
     height: 16px;
diff --git a/src/3rdparty/webkit/WebCore/css/qt/mediaControls-extras.css b/src/3rdparty/webkit/WebCore/css/mediaControlsQt.css
index d85deae207..a9c3609f07 100644
--- a/src/3rdparty/webkit/WebCore/css/qt/mediaControls-extras.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsQt.css
@@ -25,18 +25,38 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+ /* QtWebKit media controls. Extends mediaControls.css */
+
 audio {
     height: 34px;
     width: 400px;
 }
 
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    display: -webkit-box;
+    -webkit-box-orient: horizontal;
+    -webkit-box-align: end;
+    -webkit-user-select: none;
+    position: absolute;
+    bottom: 0;
+    width: 100%;
+    z-index: 0;
+    overflow: hidden;
+    height: 100%;
+    text-align: right;
+}
+
+video:-webkit-full-page-media::-webkit-media-controls-panel {
+	display: none;
+}
+
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
     left: auto;
     right: 5px;
     width: 12px;
     height: 12px;
     padding: 6px;
-    margin: 5px 0px;
+    margin: 5px 5px 5px 3px;
 }
 
 audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
@@ -44,17 +64,18 @@ audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-bu
     width: 9px;
     height: 12px;
     padding: 6px 12px 6px 11px;
-    margin: 5px 0px;
+    margin: 5px 3px 5px 5px;
 }
 
-audio::-webkit-media-controls-time-display, video::-webkit-media-controls-time-display {
-    /* Since MediaControlElements are always created with a renderer we have to hide
-       the controls we don't use, so they don't mess up activation and event handling */
-    left: 0px;
-    top: 0px;
-    width: 0px;
-    height: 0px;
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    height: 34px;
+}
 
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
+    display: none;
+}
+
+audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
     display: none;
 }
 
@@ -66,6 +87,14 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     margin: 5px 0px;
 }
 
+audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
+    display: none;
+}
+
+audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
+    display: none;
+}
+
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
     /* Since MediaControlElements are always created with a renderer we have to hide
        the controls we don't use, so they don't mess up activation and event handling */
@@ -99,3 +128,11 @@ audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-f
     display: none;
 }
 
+audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button {
+    display: none;
+}
+
+audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button {
+    display: none;
+}
+
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css b/src/3rdparty/webkit/WebCore/css/mediaControlsQuickTime.css
index 5cf48ae636..5cf48ae636 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsQuickTime.css
diff --git a/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.h b/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.h
new file mode 100644
index 0000000000..fc5814a987
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef BeforeLoadEvent_h
+#define BeforeLoadEvent_h
+
+#include "Event.h"
+#include "EventNames.h"
+
+namespace WebCore {
+
+class BeforeLoadEvent : public Event {
+public:
+    virtual bool isBeforeLoadEvent() const { return true; }
+
+    static PassRefPtr<BeforeLoadEvent> create(const String& url)
+    {
+        return adoptRef(new BeforeLoadEvent(url));
+    }
+
+    void initBeforeLoadEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& url)
+    {
+        if (dispatched())
+            return;
+        
+        initEvent(type, canBubble, cancelable);
+
+        m_url = url;
+    }
+
+    const String& url() const { return m_url; }
+
+private:
+    BeforeLoadEvent(const String& url)
+        : Event(eventNames().beforeloadEvent, false, true)
+        , m_url(url)
+    {}
+
+    String m_url;
+};
+
+} // namespace WebCore
+
+#endif // BeforeLoadEvent_h
diff --git a/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.idl b/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.idl
new file mode 100644
index 0000000000..d06a39d291
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.idl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module events {
+
+    interface [
+        GenerateConstructor
+    ] BeforeLoadEvent : Event {
+        void initBeforeLoadEvent(in DOMString type,
+                                 in boolean canBubble, 
+                                 in boolean cancelable,
+                                 in DOMString url);
+        readonly attribute DOMString url;
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
index 7274b5dc3c..5cd07819d9 100644
--- a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
@@ -23,6 +23,7 @@
 #include "config.h"
 #include "ContainerNode.h"
 
+#include "BeforeLoadEvent.h"
 #include "Cache.h"
 #include "ContainerNodeAlgorithms.h"
 #include "DeleteButtonController.h"
@@ -909,4 +910,15 @@ static void dispatchChildRemovalEvents(Node* child)
     }
 }
 
+bool ContainerNode::dispatchBeforeLoadEvent(const String& sourceURL)
+{
+    if (!document()->hasListenerType(Document::BEFORELOAD_LISTENER))
+        return true;
+
+    RefPtr<ContainerNode> protector(this);
+    RefPtr<BeforeLoadEvent> beforeLoadEvent = BeforeLoadEvent::create(sourceURL);
+    dispatchEvent(beforeLoadEvent.get());
+    return !beforeLoadEvent->defaultPrevented();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/ContainerNode.h b/src/3rdparty/webkit/WebCore/dom/ContainerNode.h
index aa480a7e5d..9789f1f22f 100644
--- a/src/3rdparty/webkit/WebCore/dom/ContainerNode.h
+++ b/src/3rdparty/webkit/WebCore/dom/ContainerNode.h
@@ -71,6 +71,8 @@ public:
     void removeAllChildren();
 
     void cloneChildNodes(ContainerNode* clone);
+    
+    bool dispatchBeforeLoadEvent(const String& sourceURL);
 
 protected:
     ContainerNode(Document*, ConstructionType = CreateContainer);
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index 6dba900646..475a8c1b92 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -943,7 +943,7 @@ Element* Document::elementFromPoint(int x, int y) const
         return 0;
 
     float zoomFactor = frame->pageZoomFactor();
-    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)) + view()->scrollOffset();
+    IntPoint point = roundedIntPoint(FloatPoint((x + view()->scrollX()) * zoomFactor, (y + view()->scrollY()) * zoomFactor));
 
     if (!frameView->visibleContentRect().contains(point))
         return 0;
@@ -973,7 +973,7 @@ PassRefPtr<Range> Document::caretRangeFromPoint(int x, int y)
         return 0;
 
     float zoomFactor = frame->pageZoomFactor();
-    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)) + view()->scrollOffset();
+    IntPoint point = roundedIntPoint(FloatPoint((x + view()->scrollX()) * zoomFactor, (y + view()->scrollY()) * zoomFactor));
 
     if (!frameView->visibleContentRect().contains(point))
         return 0;
@@ -1561,6 +1561,9 @@ void Document::open(Document* ownerDocument)
 
     implicitOpen();
 
+    if (DOMWindow* domWindow = this->domWindow())
+        domWindow->removeAllEventListeners();
+
     if (m_frame)
         m_frame->loader()->didExplicitOpen();
 }
@@ -1582,7 +1585,11 @@ void Document::implicitOpen()
 {
     cancelParsing();
 
-    clear();
+    delete m_tokenizer;
+    m_tokenizer = 0;
+
+    removeChildren();
+
     m_tokenizer = createTokenizer();
     setParsing(true);
 
@@ -1664,7 +1671,7 @@ void Document::implicitClose()
         return;
     }
 
-    bool wasLocationChangePending = frame() && frame()->loader()->isScheduledLocationChangePending();
+    bool wasLocationChangePending = frame() && frame()->redirectScheduler()->locationChangePending();
     bool doload = !parsing() && m_tokenizer && !m_processingLoadEvent && !wasLocationChangePending;
     
     if (!doload)
@@ -1711,7 +1718,7 @@ void Document::implicitClose()
     if (f)
         f->animation()->resumeAnimations(this);
 
-    ImageLoader::dispatchPendingLoadEvents();
+    ImageLoader::dispatchPendingEvents();
     dispatchWindowLoadEvent();
     dispatchWindowEvent(PageTransitionEvent::create(eventNames().pageshowEvent, false), this);
     if (f)
@@ -1731,7 +1738,7 @@ void Document::implicitClose()
     // fires. This will improve onload scores, and other browsers do it.
     // If they wanna cheat, we can too. -dwh
 
-    if (frame()->loader()->isScheduledLocationChangePending() && elapsedTime() < cLayoutScheduleThreshold) {
+    if (frame()->redirectScheduler()->locationChangePending() && elapsedTime() < cLayoutScheduleThreshold) {
         // Just bail out. Before or during the onload we were shifted to another page.
         // The old i-Bench suite does this. When this happens don't bother painting or laying out.        
         view()->unscheduleRelayout();
@@ -1860,16 +1867,6 @@ void Document::finishParsing()
         m_tokenizer->finish();
 }
 
-void Document::clear()
-{
-    delete m_tokenizer;
-    m_tokenizer = 0;
-
-    removeChildren();
-    if (DOMWindow* domWindow = this->domWindow())
-        domWindow->removeAllEventListeners();
-}
-
 const KURL& Document::virtualURL() const
 {
     return m_url;
@@ -1969,7 +1966,7 @@ const Vector<RefPtr<CSSStyleSheet> >* Document::pageGroupUserSheets() const
         const UserStyleSheetVector* sheets = it->second;
         for (unsigned i = 0; i < sheets->size(); ++i) {
             const UserStyleSheet* sheet = sheets->at(i).get();
-            if (!UserContentURLPattern::matchesPatterns(url(), sheet->patterns()))
+            if (!UserContentURLPattern::matchesPatterns(url(), sheet->whitelist(), sheet->blacklist()))
                 continue;
             RefPtr<CSSStyleSheet> parsedSheet = CSSStyleSheet::create(const_cast<Document*>(this), sheet->url());
             parsedSheet->setIsUserStyleSheet(true);
@@ -2160,7 +2157,7 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
                 url = frame->loader()->url().string();
             else
                 url = completeURL(url).string();
-            frame->loader()->scheduleHTTPRedirection(delay, url);
+            frame->redirectScheduler()->scheduleRedirect(delay, url);
         }
     } else if (equalIgnoringCase(equiv, "set-cookie")) {
         // FIXME: make setCookie work on XML documents too; e.g. in case of <html:meta .....>
@@ -2174,7 +2171,7 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
         FrameLoader* frameLoader = frame->loader();
         if (frameLoader->shouldInterruptLoadForXFrameOptions(content, url())) {
             frameLoader->stopAllLoaders();
-            frameLoader->scheduleLocationChange(blankURL(), String());
+            frame->redirectScheduler()->scheduleLocationChange(blankURL(), String());
         }
     }
 }
@@ -2357,8 +2354,8 @@ void Document::removePendingSheet()
     if (!m_pendingStylesheets && m_tokenizer)
         m_tokenizer->executeScriptsWaitingForStylesheets();
 
-    if (!m_pendingStylesheets && m_gotoAnchorNeededAfterStylesheetsLoad && m_frame)
-        m_frame->loader()->gotoAnchor();
+    if (!m_pendingStylesheets && m_gotoAnchorNeededAfterStylesheetsLoad && view())
+        view()->scrollToFragment(m_frame->loader()->url());
 }
 
 void Document::updateStyleSelector()
@@ -2894,42 +2891,47 @@ void Document::dispatchWindowLoadEvent()
 
 PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode& ec)
 {
+    RefPtr<Event> event;
     if (eventType == "Event" || eventType == "Events" || eventType == "HTMLEvents")
-        return Event::create();
-    if (eventType == "KeyboardEvent" || eventType == "KeyboardEvents")
-        return KeyboardEvent::create();
-    if (eventType == "MessageEvent")
-        return MessageEvent::create();
-    if (eventType == "MouseEvent" || eventType == "MouseEvents")
-        return MouseEvent::create();
-    if (eventType == "MutationEvent" || eventType == "MutationEvents")
-        return MutationEvent::create();
-    if (eventType == "OverflowEvent")
-        return OverflowEvent::create();
-    if (eventType == "PageTransitionEvent")
-        return PageTransitionEvent::create();
-    if (eventType == "ProgressEvent")
-        return ProgressEvent::create();
+        event = Event::create();
+    else if (eventType == "KeyboardEvent" || eventType == "KeyboardEvents")
+        event = KeyboardEvent::create();
+    else if (eventType == "MessageEvent")
+        event = MessageEvent::create();
+    else if (eventType == "MouseEvent" || eventType == "MouseEvents")
+        event = MouseEvent::create();
+    else if (eventType == "MutationEvent" || eventType == "MutationEvents")
+        event = MutationEvent::create();
+    else if (eventType == "OverflowEvent")
+        event = OverflowEvent::create();
+    else if (eventType == "PageTransitionEvent")
+        event = PageTransitionEvent::create();
+    else if (eventType == "ProgressEvent")
+        event = ProgressEvent::create();
 #if ENABLE(DOM_STORAGE)
-    if (eventType == "StorageEvent")
-        return StorageEvent::create();
+    else if (eventType == "StorageEvent")
+        event = StorageEvent::create();
 #endif
-    if (eventType == "TextEvent")
-        return TextEvent::create();
-    if (eventType == "UIEvent" || eventType == "UIEvents")
-        return UIEvent::create();
-    if (eventType == "WebKitAnimationEvent")
-        return WebKitAnimationEvent::create();
-    if (eventType == "WebKitTransitionEvent")
-        return WebKitTransitionEvent::create();
-    if (eventType == "WheelEvent")
-        return WheelEvent::create();
+    else if (eventType == "TextEvent")
+        event = TextEvent::create();
+    else if (eventType == "UIEvent" || eventType == "UIEvents")
+        event = UIEvent::create();
+    else if (eventType == "WebKitAnimationEvent")
+        event = WebKitAnimationEvent::create();
+    else if (eventType == "WebKitTransitionEvent")
+        event = WebKitTransitionEvent::create();
+    else if (eventType == "WheelEvent")
+        event = WheelEvent::create();
 #if ENABLE(SVG)
-    if (eventType == "SVGEvents")
-        return Event::create();
-    if (eventType == "SVGZoomEvents")
-        return SVGZoomEvent::create();
+    else if (eventType == "SVGEvents")
+        event = Event::create();
+    else if (eventType == "SVGZoomEvents")
+        event = SVGZoomEvent::create();
 #endif
+    if (event) {
+        event->setCreatedByDOM(true);
+        return event.release();
+    }
     ec = NOT_SUPPORTED_ERR;
     return 0;
 }
@@ -2960,6 +2962,8 @@ void Document::addListenerTypeIfNeeded(const AtomicString& eventType)
         addListenerType(ANIMATIONITERATION_LISTENER);
     else if (eventType == eventNames().webkitTransitionEndEvent)
         addListenerType(TRANSITIONEND_LISTENER);
+    else if (eventType == eventNames().beforeloadEvent)
+        addListenerType(BEFORELOAD_LISTENER);
 }
 
 CSSStyleDeclaration* Document::getOverrideStyle(Element*, const String&)
@@ -4016,8 +4020,17 @@ void Document::finishedParsing()
 {
     setParsing(false);
     dispatchEvent(Event::create(eventNames().DOMContentLoadedEvent, true, false));
-    if (Frame* f = frame())
+    if (Frame* f = frame()) {
         f->loader()->finishedParsing();
+
+#if ENABLE(INSPECTOR)
+        if (!page())
+            return;
+
+        if (InspectorController* controller = page()->inspectorController())
+            controller->mainResourceFiredDOMContentEvent(f->loader()->documentLoader(), url());
+#endif
+    }
 }
 
 Vector<String> Document::formElementsState() const
@@ -4230,7 +4243,7 @@ void Document::initSecurityContext()
     m_cookieURL = url;
     ScriptExecutionContext::setSecurityOrigin(SecurityOrigin::create(url));
 
-    if (FrameLoader::allowSubstituteDataAccessToLocal()) {
+    if (SecurityOrigin::allowSubstituteDataAccessToLocal()) {
         // If this document was loaded with substituteData, then the document can
         // load local resources.  See https://bugs.webkit.org/show_bug.cgi?id=16756
         // and https://bugs.webkit.org/show_bug.cgi?id=19760 for further
@@ -4494,7 +4507,7 @@ void Document::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const
     Frame* frame = this->frame();
     if (frame) {
         FrameLoader* frameLoader = frame->loader();
-        frameLoader->didLoadResourceByXMLHttpRequest(identifier, sourceString);
+        frameLoader->notifier()->didLoadResourceByXMLHttpRequest(identifier, sourceString);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.h b/src/3rdparty/webkit/WebCore/dom/Document.h
index f05c9f9702..09bba5879f 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.h
+++ b/src/3rdparty/webkit/WebCore/dom/Document.h
@@ -473,7 +473,6 @@ public:
     void write(const String& text, Document* ownerDocument = 0);
     void writeln(const String& text, Document* ownerDocument = 0);
     void finishParsing();
-    void clear();
 
     bool wellFormed() const { return m_wellFormed; }
 
@@ -615,7 +614,8 @@ public:
         ANIMATIONEND_LISTENER                = 0x100,
         ANIMATIONSTART_LISTENER              = 0x200,
         ANIMATIONITERATION_LISTENER          = 0x400,
-        TRANSITIONEND_LISTENER               = 0x800
+        TRANSITIONEND_LISTENER               = 0x800,
+        BEFORELOAD_LISTENER                  = 0x1000
     };
 
     bool hasListenerType(ListenerType listenerType) const { return (m_listenerTypes & listenerType); }
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.idl b/src/3rdparty/webkit/WebCore/dom/Document.idl
index 822f860330..e9b5480571 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Document.idl
@@ -172,6 +172,9 @@ module core {
                  attribute HTMLElement body
                      setter raises (DOMException);
 
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        readonly attribute HTMLHeadElement head;
+#endif
         readonly attribute HTMLCollection images;
         readonly attribute HTMLCollection applets;
         readonly attribute HTMLCollection links;
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.cpp b/src/3rdparty/webkit/WebCore/dom/Element.cpp
index 50ff033b7e..621c63abfd 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Element.cpp
@@ -123,6 +123,7 @@ PassRefPtr<Element> Element::cloneElementWithoutChildren()
 void Element::removeAttribute(const QualifiedName& name, ExceptionCode& ec)
 {
     if (namedAttrMap) {
+        ec = 0;
         namedAttrMap->removeNamedItem(name, ec);
         if (ec == NOT_FOUND_ERR)
             ec = 0;
@@ -515,7 +516,7 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
         return;
     }
 
-    const AtomicString& localName = (shouldIgnoreAttributeCase(this) && !name.string().impl()->isLower()) ? AtomicString(name.string().lower()) : name;
+    const AtomicString& localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
 
     // allocate attributemap if necessary
     Attribute* old = attributes(false)->getAttributeItem(localName, false);
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.cpp b/src/3rdparty/webkit/WebCore/dom/Event.cpp
index 4088e2c45b..ba310ef609 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Event.cpp
@@ -35,6 +35,7 @@ Event::Event()
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
+    , m_createdByDOM(false)
     , m_eventPhase(0)
     , m_currentTarget(0)
     , m_createTime(static_cast<DOMTimeStamp>(currentTime() * 1000.0))
@@ -49,6 +50,7 @@ Event::Event(const AtomicString& eventType, bool canBubbleArg, bool cancelableAr
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
+    , m_createdByDOM(false)
     , m_eventPhase(0)
     , m_currentTarget(0)
     , m_createTime(static_cast<DOMTimeStamp>(currentTime() * 1000.0))
@@ -149,6 +151,11 @@ bool Event::isXMLHttpRequestProgressEvent() const
     return false;
 }
 
+bool Event::isBeforeLoadEvent() const
+{
+    return false;
+}
+
 #if ENABLE(SVG)
 bool Event::isSVGZoomEvent() const
 {
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.h b/src/3rdparty/webkit/WebCore/dom/Event.h
index 7d06378bd6..74a2f10a8e 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.h
+++ b/src/3rdparty/webkit/WebCore/dom/Event.h
@@ -114,6 +114,7 @@ namespace WebCore {
         virtual bool isXMLHttpRequestProgressEvent() const;
         virtual bool isWebKitAnimationEvent() const;
         virtual bool isWebKitTransitionEvent() const;
+        virtual bool isBeforeLoadEvent() const;
 #if ENABLE(SVG)
         virtual bool isSVGZoomEvent() const;
 #endif
@@ -144,6 +145,9 @@ namespace WebCore {
 
         virtual Clipboard* clipboard() const { return 0; }
 
+        bool createdByDOM() const { return m_createdByDOM; }
+        void setCreatedByDOM(bool createdByDOM) { m_createdByDOM = createdByDOM; }
+
     protected:
         Event();
         Event(const AtomicString& type, bool canBubble, bool cancelable);
@@ -161,6 +165,9 @@ namespace WebCore {
         bool m_defaultHandled;
         bool m_cancelBubble;
 
+        // Whether this event was created by document.createEvent().
+        bool m_createdByDOM;
+
         unsigned short m_eventPhase;
         EventTarget* m_currentTarget;
         RefPtr<EventTarget> m_target;
diff --git a/src/3rdparty/webkit/WebCore/dom/EventNames.h b/src/3rdparty/webkit/WebCore/dom/EventNames.h
index 0eb98ec4e9..2c4cd32dbe 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventNames.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventNames.h
@@ -32,6 +32,7 @@ namespace WebCore {
     macro(abort) \
     macro(beforecopy) \
     macro(beforecut) \
+    macro(beforeload) \
     macro(beforepaste) \
     macro(beforeunload) \
     macro(blur) \
@@ -63,7 +64,6 @@ namespace WebCore {
     macro(keypress) \
     macro(keyup) \
     macro(load) \
-    macro(loadend) \
     macro(loadstart) \
     macro(message) \
     macro(mousedown) \
diff --git a/src/3rdparty/webkit/WebCore/dom/ExceptionBase.cpp b/src/3rdparty/webkit/WebCore/dom/ExceptionBase.cpp
index c73d5142ae..d175d8b1fb 100644
--- a/src/3rdparty/webkit/WebCore/dom/ExceptionBase.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ExceptionBase.cpp
@@ -34,6 +34,7 @@ namespace WebCore {
 ExceptionBase::ExceptionBase(const ExceptionCodeDescription& description)
     : m_code(description.code)
     , m_name(description.name)
+    , m_description(description.description)
 {
     if (description.name)
         m_message = String::format("%s: %s Exception %d", description.name, description.typeName, description.code);
diff --git a/src/3rdparty/webkit/WebCore/dom/ExceptionBase.h b/src/3rdparty/webkit/WebCore/dom/ExceptionBase.h
index 44fad7e205..81e2d7f9b9 100644
--- a/src/3rdparty/webkit/WebCore/dom/ExceptionBase.h
+++ b/src/3rdparty/webkit/WebCore/dom/ExceptionBase.h
@@ -40,6 +40,7 @@ namespace WebCore {
         unsigned short code() const { return m_code; }
         String name() const { return m_name; }
         String message() const { return m_message; }
+        String description() const { return m_description; }
 
         String toString() const;
 
@@ -50,6 +51,7 @@ namespace WebCore {
         unsigned short m_code;
         String m_name;
         String m_message;
+        String m_description;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp
index 0291a211ff..7bb8a50a06 100644
--- a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp
@@ -65,25 +65,70 @@ static const char* const exceptionNames[] = {
     "QUOTA_EXCEEDED_ERR"
 };
 
+static const char* const exceptionDescriptions[] = {
+    "Index or size was negative, or greater than the allowed value.",
+    "The specified range of text did not fit into a DOMString.",
+    "A Node was inserted somewhere it doesn't belong.",
+    "A Node was used in a different document than the one that created it (that doesn't support it).",
+    "An invalid or illegal character was specified, such as in an XML name.",
+    "Data was specified for a Node which does not support data.",
+    "An attempt was made to modify an object where modifications are not allowed.",
+    "An attempt was made to reference a Node in a context where it does not exist.",
+    "The implementation did not support the requested type of object or operation.",
+    "An attempt was made to add an attribute that is already in use elsewhere.",
+    "An attempt was made to use an object that is not, or is no longer, usable.",
+    "An invalid or illegal string was specified.",
+    "An attempt was made to modify the type of the underlying object.",
+    "An attempt was made to create or change an object in a way which is incorrect with regard to namespaces.",
+    "A parameter or an operation was not supported by the underlying object.",
+    "A call to a method such as insertBefore or removeChild would make the Node invalid with respect to \"partial validity\", this exception would be raised and the operation would not be done.",
+    "The type of an object was incompatible with the expected type of the parameter associated to the object.",
+    "An attempt was made to break through the security policy of the user agent.",
+    // FIXME: Couldn't find a description in the HTML/DOM specifications for NETWORK_ERR, ABORT_ERR, URL_MISMATCH_ERR, and QUOTA_EXCEEDED_ERR
+    "A network error occured.",
+    "The user aborted a request.",
+    "A worker global scope represented an absolute URL that is not equal to the resulting absolute URL.",
+    "An attempt was made to add something to storage that exceeded the quota."
+};
+
 static const char* const rangeExceptionNames[] = {
     "BAD_BOUNDARYPOINTS_ERR",
     "INVALID_NODE_TYPE_ERR"
 };
 
+static const char* const rangeExceptionDescriptions[] = {
+    "The boundary-points of a Range did not meet specific requirements.",
+    "The container of an boundary-point of a Range was being set to either a node of an invalid type or a node with an ancestor of an invalid type."
+};
+
 static const char* const eventExceptionNames[] = {
     "UNSPECIFIED_EVENT_TYPE_ERR"
 };
 
+static const char* const eventExceptionDescriptions[] = {
+    "The Event's type was not specified by initializing the event before the method was called."
+};
+
 static const char* const xmlHttpRequestExceptionNames[] = {
     "NETWORK_ERR",
     "ABORT_ERR"
 };
 
+static const char* const xmlHttpRequestExceptionDescriptions[] = {
+    "A network error occured in synchronous requests.",
+    "The user aborted a request in synchronous requests."
+};
+
 #if ENABLE(XPATH)
 static const char* const xpathExceptionNames[] = {
     "INVALID_EXPRESSION_ERR",
     "TYPE_ERR"
 };
+
+static const char* const xpathExceptionDescriptions[] = {
+    "The expression had a syntax error or otherwise is not a legal expression according to the rules of the specific XPathEvaluator.",
+    "The expression could not be converted to return the specified type."
+};
 #endif
 
 #if ENABLE(SVG)
@@ -92,6 +137,12 @@ static const char* const svgExceptionNames[] = {
     "SVG_INVALID_VALUE_ERR",
     "SVG_MATRIX_NOT_INVERTABLE"
 };
+
+static const char* const svgExceptionDescriptions[] = {
+    "An object of the wrong type was passed to an operation.",
+    "An invalid value was passed to an operation or assigned to an attribute.",
+    "An attempt was made to invert a matrix that is not invertible."
+};
 #endif
 
 void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& description)
@@ -101,6 +152,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
     const char* typeName;
     int code = ec;
     const char* const* nameTable;
+    const char* const* descriptionTable;
     int nameTableSize;
     int nameTableOffset;
     ExceptionType type;
@@ -110,6 +162,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         typeName = "DOM Range";
         code -= RangeException::RangeExceptionOffset;
         nameTable = rangeExceptionNames;
+        descriptionTable = rangeExceptionDescriptions;
         nameTableSize = sizeof(rangeExceptionNames) / sizeof(rangeExceptionNames[0]);
         nameTableOffset = RangeException::BAD_BOUNDARYPOINTS_ERR;
     } else if (code >= EventException::EventExceptionOffset && code <= EventException::EventExceptionMax) {
@@ -117,6 +170,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         typeName = "DOM Events";
         code -= EventException::EventExceptionOffset;
         nameTable = eventExceptionNames;
+        descriptionTable = eventExceptionDescriptions;
         nameTableSize = sizeof(eventExceptionNames) / sizeof(eventExceptionNames[0]);
         nameTableOffset = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
     } else if (code >= XMLHttpRequestException::XMLHttpRequestExceptionOffset && code <= XMLHttpRequestException::XMLHttpRequestExceptionMax) {
@@ -124,6 +178,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         typeName = "XMLHttpRequest";
         code -= XMLHttpRequestException::XMLHttpRequestExceptionOffset;
         nameTable = xmlHttpRequestExceptionNames;
+        descriptionTable = xmlHttpRequestExceptionDescriptions;
         nameTableSize = sizeof(xmlHttpRequestExceptionNames) / sizeof(xmlHttpRequestExceptionNames[0]);
         // XMLHttpRequest exception codes start with 101 and we don't want 100 empty elements in the name array
         nameTableOffset = XMLHttpRequestException::NETWORK_ERR;
@@ -133,6 +188,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         typeName = "DOM XPath";
         code -= XPathException::XPathExceptionOffset;
         nameTable = xpathExceptionNames;
+        descriptionTable = xpathExceptionDescriptions;
         nameTableSize = sizeof(xpathExceptionNames) / sizeof(xpathExceptionNames[0]);
         // XPath exception codes start with 51 and we don't want 51 empty elements in the name array
         nameTableOffset = XPathException::INVALID_EXPRESSION_ERR;
@@ -143,6 +199,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         typeName = "DOM SVG";
         code -= SVGException::SVGExceptionOffset;
         nameTable = svgExceptionNames;
+        descriptionTable = svgExceptionDescriptions;
         nameTableSize = sizeof(svgExceptionNames) / sizeof(svgExceptionNames[0]);
         nameTableOffset = SVGException::SVG_WRONG_TYPE_ERR;
 #endif
@@ -150,17 +207,20 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         type = DOMExceptionType;
         typeName = "DOM";
         nameTable = exceptionNames;
+        descriptionTable = exceptionDescriptions;
         nameTableSize = sizeof(exceptionNames) / sizeof(exceptionNames[0]);
         nameTableOffset = INDEX_SIZE_ERR;
     }
 
     description.typeName = typeName;
     description.name = (ec >= nameTableOffset && ec - nameTableOffset < nameTableSize) ? nameTable[ec - nameTableOffset] : 0;
+    description.description = (ec >= nameTableOffset && ec - nameTableOffset < nameTableSize) ? descriptionTable[ec - nameTableOffset] : 0;
     description.code = code;
     description.type = type;
 
     // All exceptions used in the DOM code should have names.
     ASSERT(description.name);
+    ASSERT(description.description);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h
index 58b18e2303..573fb365dc 100644
--- a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h
+++ b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h
@@ -77,6 +77,7 @@ namespace WebCore {
     struct ExceptionCodeDescription {
         const char* typeName; // has spaces and is suitable for use in exception description strings; maximum length is 10 characters
         const char* name; // exception name, also intended for use in exception description strings; 0 if name not known; maximum length is 27 characters
+        const char* description; // exception description, intended for use in exception strings; more readable explanation of error
         int code; // numeric value of the exception within a particular type
         ExceptionType type;
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/MessageEvent.cpp b/src/3rdparty/webkit/WebCore/dom/MessageEvent.cpp
index 2ef8bc29c0..3c8464281d 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MessageEvent.cpp
@@ -34,10 +34,11 @@
 namespace WebCore {
 
 MessageEvent::MessageEvent()
+    : m_data(SerializedScriptValue::create())
 {
 }
 
-MessageEvent::MessageEvent(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray> ports)
+MessageEvent::MessageEvent(PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray> ports)
     : Event(eventNames().messageEvent, false, false)
     , m_data(data)
     , m_origin(origin)
@@ -51,7 +52,7 @@ MessageEvent::~MessageEvent()
 {
 }
 
-void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, PassOwnPtr<MessagePortArray> ports)
+void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, PassOwnPtr<MessagePortArray> ports)
 {
     if (dispatched())
         return;
@@ -74,7 +75,7 @@ MessagePort* MessageEvent::messagePort()
     return (*m_ports)[0].get();
 }
 
-void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort* port)
+void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort* port)
 {
     MessagePortArray* ports = 0;
     if (port) {
diff --git a/src/3rdparty/webkit/WebCore/dom/MessageEvent.h b/src/3rdparty/webkit/WebCore/dom/MessageEvent.h
index 555ed471c0..b7f9b0292e 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessageEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessageEvent.h
@@ -31,6 +31,7 @@
 #include "DOMWindow.h"
 #include "Event.h"
 #include "MessagePort.h"
+#include "SerializedScriptValue.h"
 
 namespace WebCore {
 
@@ -42,15 +43,15 @@ namespace WebCore {
         {
             return adoptRef(new MessageEvent);
         }
-        static PassRefPtr<MessageEvent> create(PassOwnPtr<MessagePortArray> ports, const String& data = "", const String& origin = "", const String& lastEventId = "", PassRefPtr<DOMWindow> source = 0)
+        static PassRefPtr<MessageEvent> create(PassOwnPtr<MessagePortArray> ports, PassRefPtr<SerializedScriptValue> data = 0, const String& origin = "", const String& lastEventId = "", PassRefPtr<DOMWindow> source = 0)
         {
             return adoptRef(new MessageEvent(data, origin, lastEventId, source, ports));
         }
         virtual ~MessageEvent();
 
-        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, PassOwnPtr<MessagePortArray>);
+        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, PassOwnPtr<MessagePortArray>);
 
-        const String& data() const { return m_data; }
+        SerializedScriptValue* data() const { return m_data.get(); }
         const String& origin() const { return m_origin; }
         const String& lastEventId() const { return m_lastEventId; }
         DOMWindow* source() const { return m_source.get(); }
@@ -59,15 +60,15 @@ namespace WebCore {
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
         MessagePort* messagePort();
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
-        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort*);
+        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort*);
 
         virtual bool isMessageEvent() const;
 
     private:
         MessageEvent();
-        MessageEvent(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray>);
+        MessageEvent(PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray>);
 
-        String m_data;
+        RefPtr<SerializedScriptValue> m_data;
         String m_origin;
         String m_lastEventId;
         RefPtr<DOMWindow> m_source;
diff --git a/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl b/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl
index a32cc93ab0..7e497fcd05 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl
@@ -30,20 +30,20 @@ module events {
         GenerateConstructor,
         NoStaticTables
     ] MessageEvent : Event {
+        readonly attribute SerializedScriptValue data;
 
-        readonly attribute DOMString data;
         readonly attribute DOMString origin;
         readonly attribute DOMString lastEventId;
         readonly attribute DOMWindow source;
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         readonly attribute [CustomGetter] Array ports;
 
-        [Custom] void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in Array messagePorts);
+        [Custom] void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in SerializedScriptValue dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in Array messagePorts);
 #else
         // There's no good way to expose an array via the ObjC bindings, so for now just expose a single port.
         readonly attribute MessagePort messagePort;
 
-        void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in MessagePort messagePort);
+        void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in SerializedScriptValue dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in MessagePort messagePort);
 #endif
 
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
index 50a0106536..9f6e6499cc 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
@@ -56,7 +56,7 @@ MessagePort::~MessagePort()
 }
 
 // FIXME: remove this when we update the ObjC bindings (bug #28774).
-void MessagePort::postMessage(const String& message, MessagePort* port, ExceptionCode& ec)
+void MessagePort::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, ExceptionCode& ec)
 {
     MessagePortArray ports;
     if (port)
@@ -64,12 +64,12 @@ void MessagePort::postMessage(const String& message, MessagePort* port, Exceptio
     postMessage(message, &ports, ec);
 }
 
-void MessagePort::postMessage(const String& message, ExceptionCode& ec)
+void MessagePort::postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode& ec)
 {
     postMessage(message, static_cast<MessagePortArray*>(0), ec);
 }
 
-void MessagePort::postMessage(const String& message, const MessagePortArray* ports, ExceptionCode& ec)
+void MessagePort::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, ExceptionCode& ec)
 {
     if (!m_entangledChannel)
         return;
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.h b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
index e649d5d901..0ab0f505a4 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
@@ -56,10 +56,10 @@ namespace WebCore {
         static PassRefPtr<MessagePort> create(ScriptExecutionContext& scriptExecutionContext) { return adoptRef(new MessagePort(scriptExecutionContext)); }
         ~MessagePort();
 
-        void postMessage(const String& message, ExceptionCode&);
-        void postMessage(const String& message, const MessagePortArray*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray*, ExceptionCode&);
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
-        void postMessage(const String& message, MessagePort*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, ExceptionCode&);
 
         void start();
         void close();
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.cpp b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.cpp
index 34b2ce7c8f..e1a3ac6f31 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.cpp
@@ -33,13 +33,13 @@
 namespace WebCore {
 
 
-PassOwnPtr<MessagePortChannel::EventData> MessagePortChannel::EventData::create(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
+PassOwnPtr<MessagePortChannel::EventData> MessagePortChannel::EventData::create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
 {
     return new EventData(message, channels);
 }
 
-MessagePortChannel::EventData::EventData(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
-    : m_message(message.copy())
+MessagePortChannel::EventData::EventData(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
+    : m_message(message->release())
     , m_channels(channels)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
index 4acfe7feae..2321b1f50e 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
@@ -33,6 +33,8 @@
 
 #include "PlatformString.h"
 
+#include "SerializedScriptValue.h"
+
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
@@ -45,6 +47,7 @@ namespace WebCore {
     class MessagePortChannel;
     class PlatformMessagePortChannel;
     class ScriptExecutionContext;
+    class SerializedScriptValue;
     class String;
 
     // The overwhelmingly common case is sending a single port, so handle that efficiently with an inline buffer of size 1.
@@ -77,14 +80,14 @@ namespace WebCore {
 
         class EventData {
         public:
-            static PassOwnPtr<EventData> create(const String&, PassOwnPtr<MessagePortChannelArray>);
+            static PassOwnPtr<EventData> create(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
 
-            const String& message() { return m_message; }
+            SerializedScriptValue* message() { return m_message.get(); }
             PassOwnPtr<MessagePortChannelArray> channels() { return m_channels.release(); }
 
         private:
-            EventData(const String& message, PassOwnPtr<MessagePortChannelArray>);
-            String m_message;
+            EventData(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray>);
+            RefPtr<SerializedScriptValue> m_message;
             OwnPtr<MessagePortChannelArray> m_channels;
         };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
index 4ed85ce8bc..87815b1bad 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
@@ -57,7 +57,7 @@ static int contentsX(AbstractView* abstractView)
     FrameView* frameView = frame->view();
     if (!frameView)
         return 0;
-    return frameView->scrollX();
+    return frameView->scrollX() / frame->pageZoomFactor();
 }
 
 static int contentsY(AbstractView* abstractView)
@@ -70,7 +70,7 @@ static int contentsY(AbstractView* abstractView)
     FrameView* frameView = frame->view();
     if (!frameView)
         return 0;
-    return frameView->scrollY();
+    return frameView->scrollY() / frame->pageZoomFactor();
 }
 
 MouseRelatedEvent::MouseRelatedEvent(const AtomicString& eventType, bool canBubble, bool cancelable, PassRefPtr<AbstractView> viewArg,
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
index 84044810ac..72993dd271 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
@@ -64,6 +64,7 @@ void ProcessingInstruction::setData(const String& data, ExceptionCode&)
     int oldLength = m_data.length();
     m_data = data;
     document()->textRemoved(this, 0, oldLength);
+    checkStyleSheet();
 }
 
 String ProcessingInstruction::nodeName() const
@@ -142,13 +143,21 @@ void ProcessingInstruction::checkStyleSheet()
             }
 #endif
         } else {
+            if (m_cachedSheet) {
+                m_cachedSheet->removeClient(this);
+                m_cachedSheet = 0;
+            }
+            
+            String url = document()->completeURL(href).string();
+            if (!dispatchBeforeLoadEvent(url))
+                return;
+            
             m_loading = true;
             document()->addPendingSheet();
-            if (m_cachedSheet)
-                m_cachedSheet->removeClient(this);
+            
 #if ENABLE(XSLT)
             if (m_isXSL)
-                m_cachedSheet = document()->docLoader()->requestXSLStyleSheet(document()->completeURL(href).string());
+                m_cachedSheet = document()->docLoader()->requestXSLStyleSheet(url);
             else
 #endif
             {
@@ -156,10 +165,15 @@ void ProcessingInstruction::checkStyleSheet()
                 if (charset.isEmpty())
                     charset = document()->frame()->loader()->encoding();
 
-                m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(document()->completeURL(href).string(), charset);
+                m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(url, charset);
             }
             if (m_cachedSheet)
                 m_cachedSheet->addClient(this);
+            else {
+                // The request may have been denied if (for example) the stylesheet is local and the document is remote.
+                m_loading = false;
+                document()->removePendingSheet();
+            }
         }
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp b/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
index 607c846afc..2c5f39ae57 100644
--- a/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
@@ -97,4 +97,11 @@ void QualifiedName::init()
     }
 }
 
+const AtomicString& QualifiedName::localNameUpper() const
+{
+    if (!m_impl->m_localNameUpper)
+        m_impl->m_localNameUpper = m_impl->m_localName.upper();
+    return m_impl->m_localNameUpper;
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/QualifiedName.h b/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
index 939927bf11..3b9f5c44be 100644
--- a/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
+++ b/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
@@ -41,9 +41,10 @@ public:
             return adoptRef(new QualifiedNameImpl(prefix, localName, namespaceURI));
         }
 
-        AtomicString m_prefix;
-        AtomicString m_localName;
-        AtomicString m_namespace;
+        const AtomicString m_prefix;
+        const AtomicString m_localName;
+        const AtomicString m_namespace;
+        mutable AtomicString m_localNameUpper;
 
     private:
         QualifiedNameImpl(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI)
@@ -76,6 +77,9 @@ public:
     const AtomicString& localName() const { return m_impl->m_localName; }
     const AtomicString& namespaceURI() const { return m_impl->m_namespace; }
 
+    // Uppercased localName, cached for efficiency
+    const AtomicString& localNameUpper() const;
+
     String toString() const;
 
     QualifiedNameImpl* impl() const { return m_impl; }
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp b/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
index fe38b46a3d..827aff390e 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
@@ -151,6 +151,9 @@ void ScriptElementData::requestScript(const String& sourceUrl)
     if (!document->frame())
         return;
 
+    if (!m_element->dispatchBeforeLoadEvent(sourceUrl))
+        return;
+
     ASSERT(!m_cachedScript);
     m_cachedScript = document->docLoader()->requestScript(sourceUrl, scriptCharset());
     m_requested = true;
diff --git a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
index 5212380b93..46ce13780c 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
@@ -240,8 +240,8 @@ void StyledElement::parseMappedAttribute(MappedAttribute *attr)
         if (namedAttrMap) {
             if (attr->isNull())
                 namedAttrMap->setID(nullAtom);
-            else if (document()->inCompatMode() && !attr->value().impl()->isLower())
-                namedAttrMap->setID(AtomicString(attr->value().string().lower()));
+            else if (document()->inCompatMode())
+                namedAttrMap->setID(attr->value().lower());
             else
                 namedAttrMap->setID(attr->value());
         }
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
index 4d06343948..543927dc30 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
@@ -40,6 +40,7 @@
 #include "HTMLLinkElement.h"
 #include "HTMLNames.h"
 #include "HTMLStyleElement.h"
+#include "ImageLoader.h"
 #include "ProcessingInstruction.h"
 #include "ResourceError.h"
 #include "ResourceHandle.h"
@@ -105,6 +106,9 @@ void XMLTokenizer::write(const SegmentedString& s, bool /*appendData*/)
     }
     
     doWrite(s.toString());
+    
+    // After parsing, go ahead and dispatch image beforeload/load events.
+    ImageLoader::dispatchPendingEvents();
 }
 
 void XMLTokenizer::handleError(ErrorType type, const char* m, int lineNumber, int columnNumber)
@@ -296,7 +300,7 @@ void XMLTokenizer::notifyFinished(CachedResource* unusedResource)
     if (errorOccurred) 
         scriptElement->dispatchErrorEvent();
     else {
-        m_view->frame()->loader()->executeScript(sourceCode);
+        m_view->frame()->script()->executeScript(sourceCode);
         scriptElement->dispatchLoadEvent();
     }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
index d3c6546793..6cc0a0c76e 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -851,7 +851,8 @@ void XMLTokenizer::endElementNs()
         if (!scriptHref.isEmpty()) {
             // we have a src attribute 
             String scriptCharset = scriptElement->scriptCharset();
-            if ((m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
+            if (element->dispatchBeforeLoadEvent(scriptHref) &&
+                (m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
                 m_scriptElement = element;
                 m_pendingScript->addClient(this);
 
@@ -861,7 +862,7 @@ void XMLTokenizer::endElementNs()
             } else 
                 m_scriptElement = 0;
         } else
-            m_view->frame()->loader()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
+            m_view->frame()->script()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
     }
     m_requestingScript = false;
     setCurrentNode(parent.get());
@@ -886,7 +887,7 @@ void XMLTokenizer::error(ErrorType type, const char* message, va_list args)
     if (m_parserStopped)
         return;
 
-#if PLATFORM(WIN_OS)
+#if COMPILER(MSVC)
     char m[1024];
     vsnprintf(m, sizeof(m) - 1, message, args);
 #else
@@ -900,7 +901,7 @@ void XMLTokenizer::error(ErrorType type, const char* message, va_list args)
     else
         handleError(type, m, lineNumber(), columnNumber());
 
-#if !PLATFORM(WIN_OS)
+#if !COMPILER(MSVC)
     free(m);
 #endif
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
index 04405d605c..65cbc212bb 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
@@ -611,7 +611,8 @@ void XMLTokenizer::parseEndElement()
         if (!scriptHref.isEmpty()) {
             // we have a src attribute 
             String scriptCharset = scriptElement->scriptCharset();
-            if ((m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
+            if (element->dispatchBeforeLoadEvent(scriptHref) &&
+                (m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
                 m_scriptElement = element;
                 m_pendingScript->addClient(this);
 
@@ -621,7 +622,7 @@ void XMLTokenizer::parseEndElement()
             } else 
                 m_scriptElement = 0;
         } else
-            m_view->frame()->loader()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
+            m_view->frame()->script()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
     }
     m_requestingScript = false;
     setCurrentNode(parent.get());
diff --git a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
index 0c3aa42c23..89d862ffe6 100644
--- a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
@@ -383,7 +383,11 @@ size_t numEditingStyleProperties = sizeof(editingStyleProperties)/sizeof(editing
 PassRefPtr<CSSMutableStyleDeclaration> editingStyleAtPosition(Position pos, ShouldIncludeTypingStyle shouldIncludeTypingStyle)
 {
     RefPtr<CSSComputedStyleDeclaration> computedStyleAtPosition = pos.computedStyle();
-    RefPtr<CSSMutableStyleDeclaration> style = computedStyleAtPosition->copyPropertiesInSet(editingStyleProperties, numEditingStyleProperties);
+    RefPtr<CSSMutableStyleDeclaration> style;
+    if (!computedStyleAtPosition)
+        style = CSSMutableStyleDeclaration::create();
+    else
+        style = computedStyleAtPosition->copyPropertiesInSet(editingStyleProperties, numEditingStyleProperties);
 
     if (style && pos.node() && pos.node()->computedStyle()) {
         RenderStyle* renderStyle = pos.node()->computedStyle();
@@ -1075,6 +1079,23 @@ void ApplyStyleCommand::applyInlineStyleToRange(CSSMutableStyleDeclaration* styl
     }
 }
 
+bool ApplyStyleCommand::shouldRemoveTextDecorationTag(CSSStyleDeclaration* styleToApply, int textDecorationAddedByTag) const
+{
+    // Honor text-decorations-in-effect
+    RefPtr<CSSValue> textDecorationsToApply = styleToApply->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
+    if (!textDecorationsToApply || !textDecorationsToApply->isValueList())
+        textDecorationsToApply = styleToApply->getPropertyCSSValue(CSSPropertyTextDecoration);
+
+    // When there is no text decorations to apply, remove any one of u, s, & strike
+    if (!textDecorationsToApply || !textDecorationsToApply->isValueList())
+        return true;
+
+    // Remove node if it implicitly adds style not present in styleToApply
+    CSSValueList* valueList = static_cast<CSSValueList*>(textDecorationsToApply.get());
+    RefPtr<CSSPrimitiveValue> value = CSSPrimitiveValue::createIdentifier(textDecorationAddedByTag);
+    return !valueList->hasValue(value.get());
+}
+
 // This function maps from styling tags to CSS styles.  Used for knowing which
 // styling tags should be removed when toggling styles.
 bool ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(HTMLElement* elem, CSSMutableStyleDeclaration* style)
@@ -1088,36 +1109,25 @@ bool ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(
         case CSSPropertyFontWeight:
             // IE inserts "strong" tags for execCommand("bold"), so we remove them, even though they're not strictly presentational
             if (elem->hasLocalName(bTag) || elem->hasLocalName(strongTag))
-                return true;
+                return !equalIgnoringCase(property.value()->cssText(), "bold") || !elem->hasChildNodes();
             break;
         case CSSPropertyVerticalAlign:
-            if (elem->hasLocalName(subTag) || elem->hasLocalName(supTag))
-                return true;
+            if (elem->hasLocalName(subTag))
+                return !equalIgnoringCase(property.value()->cssText(), "sub") || !elem->hasChildNodes();
+            if (elem->hasLocalName(supTag))
+                return !equalIgnoringCase(property.value()->cssText(), "sup") || !elem->hasChildNodes();
             break;
         case CSSPropertyFontStyle:
             // IE inserts "em" tags for execCommand("italic"), so we remove them, even though they're not strictly presentational
             if (elem->hasLocalName(iTag) || elem->hasLocalName(emTag))
-                return true;
+                return !equalIgnoringCase(property.value()->cssText(), "italic") || !elem->hasChildNodes();
             break;
         case CSSPropertyTextDecoration:
         case CSSPropertyWebkitTextDecorationsInEffect:
-                ASSERT(property.value());
-                if (property.value()->isValueList()) {
-                    CSSValueList* valueList = static_cast<CSSValueList*>(property.value());
-                    DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, underline, (CSSPrimitiveValue::createIdentifier(CSSValueUnderline)));
-                    DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, lineThrough, (CSSPrimitiveValue::createIdentifier(CSSValueLineThrough)));
-                    // Because style is new style to be applied, we delete element only if the element is not used in style.
-                    if (!valueList->hasValue(underline.get()) && elem->hasLocalName(uTag))
-                        return true;
-                    if (!valueList->hasValue(lineThrough.get()) && (elem->hasLocalName(strikeTag) || elem->hasLocalName(sTag)))
-                        return true;
-                } else {
-                    // If the value is NOT a list, then it must be "none", in which case we should remove all text decorations.
-                    ASSERT(property.value()->cssText() == "none");
-                    if (elem->hasLocalName(uTag) || elem->hasLocalName(strikeTag) || elem->hasLocalName(sTag))
-                        return true;
-                }
-                break;
+                if (elem->hasLocalName(uTag))
+                    return shouldRemoveTextDecorationTag(style, CSSValueUnderline) || !elem->hasChildNodes();
+                else if (elem->hasLocalName(sTag) || elem->hasTagName(strikeTag))
+                    return shouldRemoveTextDecorationTag(style,CSSValueLineThrough) || !elem->hasChildNodes();
         }
     }
     return false;
@@ -1303,19 +1313,18 @@ void ApplyStyleCommand::applyTextDecorationStyle(Node *node, CSSMutableStyleDecl
     if (!style || style->cssText().isEmpty())
         return;
 
-    if (node->isTextNode()) {
-        RefPtr<HTMLElement> styleSpan = createStyleSpanElement(document());
-        surroundNodeRangeWithElement(node, node, styleSpan.get());
-        node = styleSpan.get();
-    }
-
-    if (!node->isElementNode())
-        return;
+    StyleChange styleChange(style, Position(node, 0));
+    if (styleChange.cssStyle().length()) {
+        if (node->isTextNode()) {
+            RefPtr<HTMLElement> styleSpan = createStyleSpanElement(document());
+            surroundNodeRangeWithElement(node, node, styleSpan.get());
+            node = styleSpan.get();
+        }
 
-    HTMLElement *element = static_cast<HTMLElement *>(node);
+        if (!node->isElementNode())
+            return;
 
-    StyleChange styleChange(style, Position(element, 0));
-    if (styleChange.cssStyle().length()) {
+        HTMLElement *element = static_cast<HTMLElement *>(node);
         String cssText = styleChange.cssStyle();
         CSSMutableStyleDeclaration *decl = element->inlineStyleDecl();
         if (decl)
@@ -1675,6 +1684,20 @@ void ApplyStyleCommand::surroundNodeRangeWithElement(Node* startNode, Node* endN
             break;
         node = next;
     }
+
+    Node* nextSibling = element->nextSibling();
+    Node* previousSibling = element->previousSibling();
+    if (nextSibling && nextSibling->isElementNode() && nextSibling->isContentEditable()
+        && areIdenticalElements(element.get(), static_cast<Element*>(nextSibling)))
+        mergeIdenticalElements(element, static_cast<Element*>(nextSibling));
+
+    if (previousSibling && previousSibling->isElementNode() && previousSibling->isContentEditable()) {
+        Node* mergedElement = previousSibling->nextSibling();
+        if (mergedElement->isElementNode() && mergedElement->isContentEditable()
+            && areIdenticalElements(static_cast<Element*>(previousSibling), static_cast<Element*>(mergedElement)))
+            mergeIdenticalElements(static_cast<Element*>(previousSibling), static_cast<Element*>(mergedElement));
+    }
+
     // FIXME: We should probably call updateStartEnd if the start or end was in the node
     // range so that the endingSelection() is canonicalized.  See the comments at the end of
     // VisibleSelection::validate().
diff --git a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h
index 29aa483776..280460433d 100644
--- a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h
@@ -62,6 +62,7 @@ private:
     CSSMutableStyleDeclaration* style() const { return m_style.get(); }
 
     // style-removal helpers
+    bool shouldRemoveTextDecorationTag(CSSStyleDeclaration* styleToApply, int textDecorationAddedByTag) const;
     bool implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(HTMLElement*, CSSMutableStyleDeclaration*);
     void replaceWithSpanOrRemoveIfWithoutAttributes(HTMLElement*&);
     void removeHTMLFontStyle(CSSMutableStyleDeclaration*, HTMLElement*);
diff --git a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
index 196a4da380..abd0174ac5 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Igalia S.L.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -1096,6 +1097,19 @@ static bool enabledVisibleSelection(Frame* frame, Event* event, EditorCommandSou
     return (selection.isCaret() && selection.isContentEditable()) || selection.isRange();
 }
 
+static bool caretBrowsingEnabled(Frame* frame)
+{
+    return frame->settings() && frame->settings()->caretBrowsingEnabled();
+}
+
+static EditorCommandSource dummyEditorCommandSource = static_cast<EditorCommandSource>(0);
+
+static bool enabledVisibleSelectionOrCaretBrowsing(Frame* frame, Event* event, EditorCommandSource)
+{
+    // The EditorCommandSource parameter is unused in enabledVisibleSelection, so just pass a dummy variable
+    return caretBrowsingEnabled(frame) || enabledVisibleSelection(frame, event, dummyEditorCommandSource);
+}
+
 static bool enabledVisibleSelectionAndMark(Frame* frame, Event* event, EditorCommandSource)
 {
     const VisibleSelection& selection = frame->editor()->selectionForCommand(event);
@@ -1140,6 +1154,12 @@ static bool enabledInEditableText(Frame* frame, Event* event, EditorCommandSourc
     return frame->editor()->selectionForCommand(event).isContentEditable();
 }
 
+static bool enabledInEditableTextOrCaretBrowsing(Frame* frame, Event* event, EditorCommandSource)
+{
+    // The EditorCommandSource parameter is unused in enabledInEditableText, so just pass a dummy variable
+    return caretBrowsingEnabled(frame) || enabledInEditableText(frame, event, dummyEditorCommandSource);
+}
+
 static bool enabledInRichlyEditableText(Frame* frame, Event*, EditorCommandSource)
 {
     return frame->selection()->isCaretOrRange() && frame->selection()->isContentRichlyEditable();
@@ -1330,20 +1350,20 @@ static const CommandMap& createCommandMap()
         { "MakeTextWritingDirectionRightToLeft", { executeMakeTextWritingDirectionRightToLeft, supportedFromMenuOrKeyBinding, enabledInRichlyEditableText, stateTextWritingDirectionRightToLeft, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveBackward", { executeMoveBackward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveBackwardAndModifySelection", { executeMoveBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveDown", { executeMoveDown, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveDownAndModifySelection", { executeMoveDownAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveDown", { executeMoveDown, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveDownAndModifySelection", { executeMoveDownAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveForward", { executeMoveForward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveForwardAndModifySelection", { executeMoveForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveLeft", { executeMoveLeft, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveLeftAndModifySelection", { executeMoveLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveLeft", { executeMoveLeft, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveLeftAndModifySelection", { executeMoveLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageDown", { executeMovePageDown, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageDownAndModifySelection", { executeMovePageDownAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageUp", { executeMovePageUp, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageUpAndModifySelection", { executeMovePageUpAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveParagraphBackwardAndModifySelection", { executeMoveParagraphBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveParagraphForwardAndModifySelection", { executeMoveParagraphForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveRight", { executeMoveRight, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveRightAndModifySelection", { executeMoveRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveParagraphBackwardAndModifySelection", { executeMoveParagraphBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveParagraphForwardAndModifySelection", { executeMoveParagraphForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveRight", { executeMoveRight, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveRightAndModifySelection", { executeMoveRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToBeginningOfDocument", { executeMoveToBeginningOfDocument, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToBeginningOfDocumentAndModifySelection", { executeMoveToBeginningOfDocumentAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToBeginningOfLine", { executeMoveToBeginningOfLine, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
@@ -1364,16 +1384,16 @@ static const CommandMap& createCommandMap()
         { "MoveToLeftEndOfLineAndModifySelection", { executeMoveToLeftEndOfLineAndModifySelection, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToRightEndOfLine", { executeMoveToRightEndOfLine, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToRightEndOfLineAndModifySelection", { executeMoveToRightEndOfLineAndModifySelection, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveUp", { executeMoveUp, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveUpAndModifySelection", { executeMoveUpAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveUp", { executeMoveUp, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveUpAndModifySelection", { executeMoveUpAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordBackward", { executeMoveWordBackward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordBackwardAndModifySelection", { executeMoveWordBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordForward", { executeMoveWordForward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordForwardAndModifySelection", { executeMoveWordForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordLeft", { executeMoveWordLeft, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordLeftAndModifySelection", { executeMoveWordLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordRight", { executeMoveWordRight, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordRightAndModifySelection", { executeMoveWordRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordLeft", { executeMoveWordLeft, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordLeftAndModifySelection", { executeMoveWordLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordRight", { executeMoveWordRight, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordRightAndModifySelection", { executeMoveWordRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Outdent", { executeOutdent, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Paste", { executePaste, supportedPaste, enabledPaste, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
         { "PasteAndMatchStyle", { executePasteAndMatchStyle, supportedPaste, enabledPaste, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
index 308ba744df..84fa147d2b 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
@@ -33,7 +33,6 @@
 #include "InsertLineBreakCommand.h"
 #include "InsertListCommand.h"
 #include "Range.h"
-#include "DocumentFragment.h"
 #include "SplitElementCommand.h"
 #include "TextIterator.h"
 #include "htmlediting.h"
@@ -68,6 +67,37 @@ IndentOutdentCommand::IndentOutdentCommand(Document* document, EIndentType typeO
 {
 }
 
+// This function is a workaround for moveParagraph's tendency to strip blockquotes. It updates lastBlockquote to point to the
+// correct level for the current paragraph, and returns a pointer to a placeholder br where the insertion should be performed.
+PassRefPtr<Element> IndentOutdentCommand::prepareBlockquoteLevelForInsertion(const VisiblePosition& currentParagraph, RefPtr<Element>& lastBlockquote)
+{
+    int currentBlockquoteLevel = 0;
+    int lastBlockquoteLevel = 0;
+    Node* node = currentParagraph.deepEquivalent().node();
+    while ((node = enclosingNodeWithTag(Position(node->parentNode(), 0), blockquoteTag)))
+        currentBlockquoteLevel++;
+    node = lastBlockquote.get();
+    while ((node = enclosingNodeWithTag(Position(node->parentNode(), 0), blockquoteTag)))
+        lastBlockquoteLevel++;
+    while (currentBlockquoteLevel > lastBlockquoteLevel) {
+        RefPtr<Element> newBlockquote = createIndentBlockquoteElement(document());
+        appendNode(newBlockquote, lastBlockquote);
+        lastBlockquote = newBlockquote;
+        lastBlockquoteLevel++;
+    }
+    while (currentBlockquoteLevel < lastBlockquoteLevel) {
+        lastBlockquote = static_cast<Element*>(enclosingNodeWithTag(Position(lastBlockquote->parentNode(), 0), blockquoteTag));
+        lastBlockquoteLevel--;
+    }
+    RefPtr<Element> placeholder = createBreakElement(document());
+    appendNode(placeholder, lastBlockquote);
+    // Add another br before the placeholder if it collapsed.
+    VisiblePosition visiblePos(Position(placeholder.get(), 0));
+    if (!isStartOfParagraph(visiblePos))
+        insertNodeBefore(createBreakElement(document()), placeholder);
+    return placeholder.release();
+}
+
 bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCurrentParagraph)
 {
     // If our selection is not inside a list, bail out.
@@ -81,14 +111,19 @@ bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCu
     // FIXME: we need to deal with the case where there is no li (malformed HTML)
     if (!selectedListItem->hasTagName(liTag))
         return false;
-
+    
     // FIXME: previousElementSibling does not ignore non-rendered content like <span></span>.  Should we?
     Element* previousList = selectedListItem->previousElementSibling();
     Element* nextList = selectedListItem->nextElementSibling();
 
     RefPtr<Element> newList = document()->createElement(listNode->tagQName(), false);
+    RefPtr<Element> newListItem = selectedListItem->cloneElementWithoutChildren();
+    RefPtr<Element> placeholder = createBreakElement(document());
     insertNodeBefore(newList, selectedListItem);
-    appendParagraphIntoNode(visiblePositionBeforeNode(selectedListItem), visiblePositionAfterNode(selectedListItem), newList.get());
+    appendNode(newListItem, newList);
+    appendNode(placeholder, newListItem);
+
+    moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(placeholder, 0)), true);
 
     if (canMergeLists(previousList, newList.get()))
         mergeIdenticalElements(previousList, newList);
@@ -98,79 +133,29 @@ bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCu
     return true;
 }
     
-void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& startOfCurrentParagraph, const VisiblePosition& endOfCurrentParagraph, RefPtr<Element>& targetBlockquote, Node* nodeToSplitTo)
+void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& endOfCurrentParagraph, const VisiblePosition& endOfNextParagraph, RefPtr<Element>& targetBlockquote)
 {
     Node* enclosingCell = 0;
 
     if (!targetBlockquote) {
-        // Create a new blockquote and insert it as a child of the enclosing block element. We accomplish
+        // Create a new blockquote and insert it as a child of the root editable element. We accomplish
         // this by splitting all parents of the current paragraph up to that point.
         targetBlockquote = createIndentBlockquoteElement(document());
-        if (isTableCell(nodeToSplitTo))
-            enclosingCell = nodeToSplitTo;
-        RefPtr<Node> startOfNewBlock = splitTreeToNode(startOfCurrentParagraph.deepEquivalent().node(), nodeToSplitTo);
+        Position start = startOfParagraph(endOfCurrentParagraph).deepEquivalent();
+        enclosingCell = enclosingNodeOfType(start, &isTableCell);
+        Node* nodeToSplitTo = enclosingCell ? enclosingCell : editableRootForPosition(start);
+        RefPtr<Node> startOfNewBlock = splitTreeToNode(start.node(), nodeToSplitTo);
         insertNodeBefore(targetBlockquote, startOfNewBlock);
     }
 
-    VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
-    appendParagraphIntoNode(startOfCurrentParagraph, endOfCurrentParagraph, targetBlockquote.get());
+    RefPtr<Element> insertionPoint = prepareBlockquoteLevelForInsertion(endOfCurrentParagraph, targetBlockquote);
 
     // Don't put the next paragraph in the blockquote we just created for this paragraph unless 
     // the next paragraph is in the same cell.
     if (enclosingCell && enclosingCell != enclosingNodeOfType(endOfNextParagraph.deepEquivalent(), &isTableCell))
         targetBlockquote = 0;
-}
-
-// Enclose all nodes between start and end by newParent, which is a sibling node of nodes between start and end
-// FIXME: moveParagraph is overly complicated.  We need to clean up moveParagraph so that it uses appendParagraphIntoNode
-// or prepare more specialized functions and delete moveParagraph
-void IndentOutdentCommand::appendParagraphIntoNode(const VisiblePosition& start, const VisiblePosition& end, Node* newParent)
-{
-    ASSERT(newParent);
-    ASSERT(newParent->isContentEditable());
-    ASSERT(isStartOfParagraph(start) && isEndOfParagraph(end));
-
-    Position endOfParagraph = end.deepEquivalent().downstream();
-    Node* insertionPoint = newParent->lastChild();// Remember the place to put br later
-    // Look for the beginning of the last paragraph in newParent
-    Node* startOfLastParagraph = startOfParagraph(Position(newParent, newParent->childNodeCount())).deepEquivalent().node();
-    if (startOfLastParagraph && !startOfLastParagraph->isDescendantOf(newParent))
-        startOfLastParagraph = 0;
-
-    // Extend the range so that we can append wrapping nodes as well if they're containd within the paragraph
-    ExceptionCode ec = 0;
-    RefPtr<Range> selectedRange = createRange(document(), start, end, ec);
-    RefPtr<Range> extendedRange = extendRangeToWrappingNodes(selectedRange, selectedRange.get(), newParent->parentNode());
-    newParent->appendChild(extendedRange->extractContents(ec), ec);
-
-    // If the start of paragraph didn't change by appending nodes, we should insert br to seperate the paragraphs.
-    Node* startOfNewParagraph = startOfParagraph(Position(newParent, newParent->childNodeCount())).deepEquivalent().node();
-    if (startOfNewParagraph == startOfLastParagraph) {
-        if (insertionPoint)
-            newParent->insertBefore(createBreakElement(document()), insertionPoint->nextSibling(), ec);
-        else
-            newParent->appendChild(createBreakElement(document()), ec);
-    }
-
-    // Remove unnecessary br from the place where we moved the paragraph from
-    removeUnnecessaryLineBreakAt(endOfParagraph);
-}
-
-void IndentOutdentCommand::removeUnnecessaryLineBreakAt(const Position& endOfParagraph)
-{
-    // If there is something in this paragraph, then don't remove br.
-    if (!isStartOfParagraph(endOfParagraph) || !isEndOfParagraph(endOfParagraph))
-        return;
-
-    // We only care about br at the end of paragraph
-    Node* br = endOfParagraph.node();
-    Node* parentNode = br->parentNode();
-
-    // If the node isn't br or the parent node is empty, then don't remove.
-    if (!br->hasTagName(brTag) || isVisiblyAdjacent(positionInParentBeforeNode(parentNode), positionInParentAfterNode(parentNode)))
-        return;
 
-    removeNodeAndPruneAncestors(br);
+    moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(insertionPoint, 0)), true);
 }
 
 void IndentOutdentCommand::indentRegion()
@@ -178,7 +163,8 @@ void IndentOutdentCommand::indentRegion()
     VisibleSelection selection = selectionForParagraphIteration(endingSelection());
     VisiblePosition startOfSelection = selection.visibleStart();
     VisiblePosition endOfSelection = selection.visibleEnd();
-    RefPtr<Range> selectedRange = selection.firstRange();
+    int startIndex = indexForVisiblePosition(startOfSelection);
+    int endIndex = indexForVisiblePosition(endOfSelection);
 
     ASSERT(!startOfSelection.isNull());
     ASSERT(!endOfSelection.isNull());
@@ -203,24 +189,10 @@ void IndentOutdentCommand::indentRegion()
         VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
         if (tryIndentingAsListItem(endOfCurrentParagraph))
             blockquoteForNextIndent = 0;
-        else {
-            VisiblePosition startOfCurrentParagraph = startOfParagraph(endOfCurrentParagraph);
-            Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()->parentNode());
-            // extend the region so that it contains all the ancestor blocks within the selection
-            ExceptionCode ec;
-            Element* unsplittableNode = unsplittableElementForPosition(endOfCurrentParagraph.deepEquivalent());
-            RefPtr<Range> originalRange = createRange(document(), endOfCurrentParagraph, endOfCurrentParagraph, ec);
-            RefPtr<Range> extendedRange = extendRangeToWrappingNodes(originalRange, selectedRange.get(), unsplittableNode);
-            if (originalRange != extendedRange) {
-                ExceptionCode ec = 0;
-                endOfCurrentParagraph = endOfParagraph(extendedRange->endPosition().previous());
-                blockNode = enclosingBlock(extendedRange->commonAncestorContainer(ec));
-            }
-
-            endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
-            indentIntoBlockquote(startOfCurrentParagraph, endOfCurrentParagraph, blockquoteForNextIndent, blockNode);
-            // blockquoteForNextIndent will be updated in the function
-        }
+        else
+            indentIntoBlockquote(endOfCurrentParagraph, endOfNextParagraph, blockquoteForNextIndent);
+            // blockquoteForNextIndent maybe updated
+            // this is due to the way prepareBlockquoteLevelForInsertion was designed.
         // Sanity check: Make sure our moveParagraph calls didn't remove endOfNextParagraph.deepEquivalent().node()
         // If somehow we did, return to prevent crashes.
         if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
@@ -229,7 +201,13 @@ void IndentOutdentCommand::indentRegion()
         }
         endOfCurrentParagraph = endOfNextParagraph;
     }
-
+    
+    updateLayout();
+    
+    RefPtr<Range> startRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, 0, true);
+    RefPtr<Range> endRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endIndex, 0, true);
+    if (startRange && endRange)
+        setEndingSelection(VisibleSelection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
 }
 
 void IndentOutdentCommand::outdentParagraph()
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
index d83128e7b6..419f832f0d 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
@@ -46,14 +46,12 @@ private:
     virtual void doApply();
     virtual EditAction editingAction() const { return m_typeOfAction == Indent ? EditActionIndent : EditActionOutdent; }
 
-    void appendParagraphIntoNode(const VisiblePosition& start, const VisiblePosition& end, Node* newParent);
-    void removeUnnecessaryLineBreakAt(const Position& endOfParagraph);
-
     void indentRegion();
     void outdentRegion();
     void outdentParagraph();
+    PassRefPtr<Element> prepareBlockquoteLevelForInsertion(const VisiblePosition&, RefPtr<Element>&);
     bool tryIndentingAsListItem(const VisiblePosition&);
-    void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>& targetBlockquote, Node* nodeToSplitTo);
+    void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>&);
 
     EIndentType m_typeOfAction;
     int m_marginInPixels;
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
index a3a43b34af..b40dab2453 100644
--- a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -695,8 +695,17 @@ void ReplaceSelectionCommand::mergeEndIfNeeded()
     
     VisiblePosition destination = mergeForward ? endOfInsertedContent.next() : endOfInsertedContent;
     VisiblePosition startOfParagraphToMove = mergeForward ? startOfParagraph(endOfInsertedContent) : endOfInsertedContent.next();
+   
+    // Merging forward could result in deleting the destination anchor node.
+    // To avoid this, we add a placeholder node before the start of the paragraph.
+    if (endOfParagraph(startOfParagraphToMove) == destination) {
+        RefPtr<Node> placeholder = createBreakElement(document());
+        insertNodeBefore(placeholder, startOfParagraphToMove.deepEquivalent().node());
+        destination = VisiblePosition(Position(placeholder.get(), 0));
+    }
 
     moveParagraph(startOfParagraphToMove, endOfParagraph(startOfParagraphToMove), destination);
+    
     // Merging forward will remove m_lastLeafInserted from the document.
     // FIXME: Maintain positions for the start and end of inserted content instead of keeping nodes.  The nodes are
     // only ever used to create positions where inserted content starts/ends.  Also, we sometimes insert content
@@ -705,6 +714,10 @@ void ReplaceSelectionCommand::mergeEndIfNeeded()
         m_lastLeafInserted = destination.previous().deepEquivalent().node();
         if (!m_firstNodeInserted->inDocument())
             m_firstNodeInserted = endingSelection().visibleStart().deepEquivalent().node();
+        // If we merged text nodes, m_lastLeafInserted could be null. If this is the case,
+        // we use m_firstNodeInserted.
+        if (!m_lastLeafInserted)
+            m_lastLeafInserted = m_firstNodeInserted;
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
index 8adfd71f35..206de86334 100644
--- a/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
@@ -237,7 +237,7 @@ void VisibleSelection::appendTrailingWhitespace()
 
     for (; charIt.length(); charIt.advance(1)) {
         UChar c = charIt.characters()[0];
-        if (!isSpaceOrNewline(c) && c != noBreakSpace)
+        if (!isSpaceOrNewline(c) && c != noBreakSpace || c == '\n')
             break;
         m_end = charIt.range()->endPosition();
     }
diff --git a/src/3rdparty/webkit/WebCore/editing/markup.cpp b/src/3rdparty/webkit/WebCore/editing/markup.cpp
index 43e7c92407..47714e7371 100644
--- a/src/3rdparty/webkit/WebCore/editing/markup.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/markup.cpp
@@ -983,8 +983,16 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
                 if (!fullySelectedRootStyle->getPropertyCSSValue(CSSPropertyBackgroundImage) && static_cast<Element*>(fullySelectedRoot)->hasAttribute(backgroundAttr))
                     fullySelectedRootStyle->setProperty(CSSPropertyBackgroundImage, "url('" + static_cast<Element*>(fullySelectedRoot)->getAttribute(backgroundAttr) + "')");
                 
-                if (fullySelectedRootStyle->length())
+                if (fullySelectedRootStyle->length()) {
+                    // Reset the CSS properties to avoid an assertion error in addStyleMarkup().
+                    // This assertion is caused at least when we select all text of a <body> element whose
+                    // 'text-decoration' property is "inherit", and copy it.
+                    if (!propertyMissingOrEqualToNone(fullySelectedRootStyle.get(), CSSPropertyTextDecoration))
+                        fullySelectedRootStyle->setProperty(CSSPropertyTextDecoration, CSSValueNone);
+                    if (!propertyMissingOrEqualToNone(fullySelectedRootStyle.get(), CSSPropertyWebkitTextDecorationsInEffect))
+                        fullySelectedRootStyle->setProperty(CSSPropertyWebkitTextDecorationsInEffect, CSSValueNone);
                     addStyleMarkup(preMarkups, markups, fullySelectedRootStyle.get(), document, true);
+                }
             } else {
                 // Since this node and all the other ancestors are not in the selection we want to set RangeFullySelectsNode to DoesNotFullySelectNode
                 // so that styles that affect the exterior of the node are not included.
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
index 6428e64464..335562ed3b 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
@@ -554,9 +554,9 @@ union yyalloc
 #endif
 
 /* YYFINAL -- State number of the termination state.  */
-#define YYFINAL  28
+#define YYFINAL  24
 /* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   1329
+#define YYLAST   1275
 
 /* YYNTOKENS -- Number of terminals.  */
 #define YYNTOKENS  86
@@ -565,7 +565,7 @@ union yyalloc
 /* YYNRULES -- Number of rules.  */
 #define YYNRULES  268
 /* YYNRULES -- Number of states.  */
-#define YYNSTATES  515
+#define YYNSTATES  516
 
 /* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX.  */
 #define YYUNDEFTOK  2
@@ -617,130 +617,130 @@ static const yytype_uint8 yytranslate[] =
    YYRHS.  */
 static const yytype_uint16 yyprhs[] =
 {
-       0,     0,     3,    10,    13,    16,    19,    22,    25,    28,
-      31,    33,    35,    42,    49,    55,    61,    67,    73,    79,
-      80,    83,    84,    87,    90,    91,    93,    95,    97,   103,
-     107,   111,   112,   116,   118,   119,   123,   124,   128,   129,
-     133,   135,   137,   139,   141,   143,   145,   147,   149,   151,
-     152,   156,   158,   160,   162,   164,   166,   168,   170,   172,
-     174,   181,   188,   192,   196,   204,   212,   213,   217,   219,
-     222,   224,   228,   230,   233,   237,   242,   246,   252,   257,
-     262,   269,   274,   282,   285,   291,   295,   300,   303,   310,
-     314,   318,   319,   322,   324,   326,   329,   330,   335,   343,
-     345,   351,   352,   356,   357,   359,   361,   363,   368,   369,
-     371,   373,   378,   381,   389,   396,   399,   408,   410,   412,
-     413,   417,   424,   426,   432,   434,   436,   440,   444,   452,
-     456,   460,   463,   466,   469,   471,   473,   479,   481,   486,
-     489,   492,   494,   496,   499,   503,   506,   508,   511,   514,
-     516,   519,   521,   524,   528,   531,   533,   535,   537,   540,
-     543,   545,   547,   549,   551,   553,   556,   559,   564,   573,
-     579,   589,   591,   593,   595,   597,   599,   601,   603,   605,
-     608,   612,   617,   622,   627,   634,   636,   639,   641,   645,
-     647,   650,   653,   657,   662,   666,   672,   677,   682,   689,
-     695,   698,   701,   708,   715,   718,   722,   727,   730,   733,
-     736,   737,   739,   743,   746,   749,   752,   753,   755,   758,
-     761,   764,   767,   771,   774,   777,   779,   782,   784,   787,
-     790,   793,   796,   799,   802,   805,   808,   811,   814,   817,
-     820,   823,   826,   829,   832,   835,   838,   841,   844,   847,
-     850,   853,   855,   861,   865,   868,   871,   873,   876,   880,
-     884,   887,   891,   893,   895,   898,   904,   908,   910
+       0,     0,     3,    11,    14,    17,    20,    23,    26,    29,
+      32,    34,    36,    43,    50,    56,    62,    68,    74,    80,
+      81,    84,    85,    88,    91,    92,    94,    96,    98,   104,
+     108,   112,   113,   117,   119,   120,   124,   125,   129,   130,
+     134,   136,   138,   140,   142,   144,   146,   148,   150,   152,
+     153,   157,   159,   161,   163,   165,   167,   169,   171,   173,
+     175,   182,   189,   193,   197,   205,   213,   214,   218,   220,
+     223,   225,   229,   231,   234,   238,   243,   247,   253,   258,
+     263,   270,   275,   283,   286,   292,   296,   301,   304,   311,
+     315,   319,   320,   323,   325,   327,   330,   331,   336,   344,
+     346,   352,   353,   357,   358,   360,   362,   364,   369,   370,
+     372,   374,   379,   382,   390,   397,   400,   409,   411,   413,
+     414,   418,   425,   427,   433,   435,   437,   441,   445,   453,
+     457,   461,   464,   467,   470,   472,   474,   480,   482,   487,
+     490,   493,   495,   497,   500,   504,   507,   509,   512,   515,
+     517,   520,   522,   525,   529,   532,   534,   536,   538,   541,
+     544,   546,   548,   550,   552,   554,   557,   560,   565,   574,
+     580,   590,   592,   594,   596,   598,   600,   602,   604,   606,
+     609,   613,   618,   623,   628,   635,   637,   640,   642,   646,
+     648,   651,   654,   658,   663,   667,   673,   678,   683,   690,
+     696,   699,   702,   709,   716,   719,   723,   728,   731,   734,
+     737,   738,   740,   744,   747,   750,   753,   754,   756,   759,
+     762,   765,   768,   772,   775,   778,   780,   783,   785,   788,
+     791,   794,   797,   800,   803,   806,   809,   812,   815,   818,
+     821,   824,   827,   830,   833,   836,   839,   842,   845,   848,
+     851,   854,   856,   862,   866,   869,   872,   874,   877,   881,
+     885,   888,   892,   894,   896,   899,   905,   909,   911
 };
 
 /* YYRHS -- A `-1'-separated list of the rules' RHS.  */
 static const yytype_int16 yyrhs[] =
 {
-      87,     0,    -1,    98,    97,   101,   102,   103,   104,    -1,
-      89,    96,    -1,    91,    96,    -1,    93,    96,    -1,    94,
-      96,    -1,    95,    96,    -1,    92,    96,    -1,    90,    96,
-      -1,   105,    -1,   110,    -1,    28,    71,    96,    88,    96,
-      72,    -1,    30,    71,    96,   134,    96,    72,    -1,    29,
-      71,    96,   156,    72,    -1,    38,    71,    96,   113,    72,
-      -1,    32,    71,    96,   161,    72,    -1,    33,     5,    96,
-     126,    72,    -1,    34,    71,    96,   142,    72,    -1,    -1,
-      96,     5,    -1,    -1,    97,     6,    -1,    97,     5,    -1,
-      -1,   100,    -1,    72,    -1,     0,    -1,    26,    96,    12,
-      96,    73,    -1,    26,     1,   174,    -1,    26,     1,    73,
-      -1,    -1,   101,   110,    97,    -1,   170,    -1,    -1,   102,
-     111,    97,    -1,    -1,   103,   117,    97,    -1,    -1,   104,
-     106,    97,    -1,   141,    -1,   129,    -1,   137,    -1,   138,
-      -1,   131,    -1,   105,    -1,   173,    -1,   169,    -1,   171,
-      -1,    -1,   107,   109,    97,    -1,   141,    -1,   137,    -1,
-     138,    -1,   131,    -1,   108,    -1,   173,    -1,   169,    -1,
-     171,    -1,   172,    -1,    22,    96,   119,    96,   127,    73,
-      -1,    22,    96,   119,    96,   127,   174,    -1,    22,     1,
-      73,    -1,    22,     1,   174,    -1,    35,    96,   127,    71,
-      96,   113,    72,    -1,    36,    96,   112,    71,    96,   113,
-      72,    -1,    -1,    37,     5,   128,    -1,   115,    -1,   114,
-     115,    -1,   114,    -1,     1,   175,     1,    -1,     1,    -1,
-     114,     1,    -1,   115,    73,    96,    -1,   115,   175,    73,
-      96,    -1,     1,    73,    96,    -1,     1,   175,     1,    73,
-      96,    -1,   114,   115,    73,    96,    -1,   114,     1,    73,
-      96,    -1,   114,     1,   175,     1,    73,    96,    -1,   116,
-      17,    96,   161,    -1,   116,    96,    71,    96,   156,    72,
-      96,    -1,   116,     1,    -1,   116,    17,    96,     1,   161,
-      -1,   116,    17,    96,    -1,   116,    17,    96,     1,    -1,
-      13,    96,    -1,    27,    96,   118,   119,    96,    73,    -1,
-      27,     1,   174,    -1,    27,     1,    73,    -1,    -1,    13,
-       5,    -1,    12,    -1,    66,    -1,    13,    96,    -1,    -1,
-      17,    96,   161,    96,    -1,    74,    96,   120,    96,   121,
-      75,    96,    -1,   122,    -1,   123,    96,    43,    96,   122,
-      -1,    -1,    43,    96,   123,    -1,    -1,    41,    -1,    42,
-      -1,   123,    -1,   125,    96,   130,   124,    -1,    -1,   128,
-      -1,   126,    -1,   128,    76,    96,   126,    -1,   128,     1,
-      -1,    24,    96,   128,    71,    96,   107,   168,    -1,    24,
-      96,    71,    96,   107,   168,    -1,    13,    96,    -1,    31,
-      96,   132,    96,    71,    96,   133,    72,    -1,    13,    -1,
-      12,    -1,    -1,   133,   134,    96,    -1,   135,    96,    71,
-      96,   156,    72,    -1,   136,    -1,   135,    96,    76,    96,
-     136,    -1,    63,    -1,    13,    -1,    23,     1,   174,    -1,
-      23,     1,    73,    -1,    25,    96,    71,    96,   156,    72,
-      96,    -1,    25,     1,   174,    -1,    25,     1,    73,    -1,
-      77,    96,    -1,    78,    96,    -1,    79,    96,    -1,    80,
-      -1,    77,    -1,   142,    71,    96,   156,    99,    -1,   144,
-      -1,   142,    76,    96,   144,    -1,   142,     1,    -1,   144,
-       5,    -1,   146,    -1,   143,    -1,   143,   146,    -1,   144,
-     139,   146,    -1,   144,     1,    -1,    21,    -1,    20,    21,
-      -1,    13,    21,    -1,   147,    -1,   147,   148,    -1,   148,
-      -1,   145,   147,    -1,   145,   147,   148,    -1,   145,   148,
-      -1,    13,    -1,    20,    -1,   149,    -1,   148,   149,    -1,
-     148,     1,    -1,    16,    -1,    15,    -1,   150,    -1,   152,
-      -1,   155,    -1,    18,    13,    -1,    13,    96,    -1,    19,
-      96,   151,    81,    -1,    19,    96,   151,   153,    96,   154,
-      96,    81,    -1,    19,    96,   145,   151,    81,    -1,    19,
-      96,   145,   151,   153,    96,   154,    96,    81,    -1,    82,
-      -1,     7,    -1,     8,    -1,     9,    -1,    10,    -1,    11,
-      -1,    13,    -1,    12,    -1,    17,    13,    -1,    17,    17,
-      13,    -1,    17,    67,    14,    75,    -1,    17,    67,    65,
-      75,    -1,    17,    67,    13,    75,    -1,    17,    68,    96,
-     146,    96,    75,    -1,   158,    -1,   157,   158,    -1,   157,
-      -1,     1,   175,     1,    -1,     1,    -1,   157,     1,    -1,
-     157,   175,    -1,   158,    73,    96,    -1,   158,   175,    73,
-      96,    -1,     1,    73,    96,    -1,     1,   175,     1,    73,
-      96,    -1,   157,   158,    73,    96,    -1,   157,     1,    73,
-      96,    -1,   157,     1,   175,     1,    73,    96,    -1,   159,
-      17,    96,   161,   160,    -1,   165,    96,    -1,   159,     1,
-      -1,   159,    17,    96,     1,   161,   160,    -1,   159,    17,
-      96,   161,   160,     1,    -1,    40,    96,    -1,   159,    17,
-      96,    -1,   159,    17,    96,     1,    -1,   159,   174,    -1,
-      13,    96,    -1,    40,    96,    -1,    -1,   163,    -1,   161,
-     162,   163,    -1,   161,     1,    -1,    83,    96,    -1,    76,
-      96,    -1,    -1,   164,    -1,   140,   164,    -1,    12,    96,
-      -1,    13,    96,    -1,    62,    96,    -1,   140,    62,    96,
-      -1,    66,    96,    -1,    69,    96,    -1,   167,    -1,    84,
-      96,    -1,   166,    -1,   165,    96,    -1,    85,    96,    -1,
-      65,    96,    -1,    64,    96,    -1,    63,    96,    -1,    48,
-      96,    -1,    49,    96,    -1,    50,    96,    -1,    51,    96,
-      -1,    52,    96,    -1,    53,    96,    -1,    54,    96,    -1,
-      55,    96,    -1,    56,    96,    -1,    57,    96,    -1,    58,
-      96,    -1,    59,    96,    -1,    60,    96,    -1,    61,    96,
-      -1,    46,    96,    -1,    45,    96,    -1,    47,    96,    -1,
-      44,    96,    -1,    70,    -1,    67,    96,   161,    75,    96,
-      -1,    67,    96,     1,    -1,    15,    96,    -1,    16,    96,
-      -1,    99,    -1,     1,    99,    -1,    39,     1,   174,    -1,
-      39,     1,    73,    -1,   169,    97,    -1,   170,   169,    97,
-      -1,   110,    -1,   129,    -1,     1,   174,    -1,    71,     1,
-     175,     1,    99,    -1,    71,     1,    99,    -1,   174,    -1,
-     175,     1,   174,    -1
+      87,     0,    -1,    96,    98,    97,   101,   102,   103,   104,
+      -1,    89,    96,    -1,    91,    96,    -1,    93,    96,    -1,
+      94,    96,    -1,    95,    96,    -1,    92,    96,    -1,    90,
+      96,    -1,   105,    -1,   110,    -1,    28,    71,    96,    88,
+      96,    72,    -1,    30,    71,    96,   134,    96,    72,    -1,
+      29,    71,    96,   156,    72,    -1,    38,    71,    96,   113,
+      72,    -1,    32,    71,    96,   161,    72,    -1,    33,     5,
+      96,   126,    72,    -1,    34,    71,    96,   142,    72,    -1,
+      -1,    96,     5,    -1,    -1,    97,     6,    -1,    97,     5,
+      -1,    -1,   100,    -1,    72,    -1,     0,    -1,    26,    96,
+      12,    96,    73,    -1,    26,     1,   174,    -1,    26,     1,
+      73,    -1,    -1,   101,   110,    97,    -1,   170,    -1,    -1,
+     102,   111,    97,    -1,    -1,   103,   117,    97,    -1,    -1,
+     104,   106,    97,    -1,   141,    -1,   129,    -1,   137,    -1,
+     138,    -1,   131,    -1,   105,    -1,   173,    -1,   169,    -1,
+     171,    -1,    -1,   107,   109,    97,    -1,   141,    -1,   137,
+      -1,   138,    -1,   131,    -1,   108,    -1,   173,    -1,   169,
+      -1,   171,    -1,   172,    -1,    22,    96,   119,    96,   127,
+      73,    -1,    22,    96,   119,    96,   127,   174,    -1,    22,
+       1,    73,    -1,    22,     1,   174,    -1,    35,    96,   127,
+      71,    96,   113,    72,    -1,    36,    96,   112,    71,    96,
+     113,    72,    -1,    -1,    37,     5,   128,    -1,   115,    -1,
+     114,   115,    -1,   114,    -1,     1,   175,     1,    -1,     1,
+      -1,   114,     1,    -1,   115,    73,    96,    -1,   115,   175,
+      73,    96,    -1,     1,    73,    96,    -1,     1,   175,     1,
+      73,    96,    -1,   114,   115,    73,    96,    -1,   114,     1,
+      73,    96,    -1,   114,     1,   175,     1,    73,    96,    -1,
+     116,    17,    96,   161,    -1,   116,    96,    71,    96,   156,
+      72,    96,    -1,   116,     1,    -1,   116,    17,    96,     1,
+     161,    -1,   116,    17,    96,    -1,   116,    17,    96,     1,
+      -1,    13,    96,    -1,    27,    96,   118,   119,    96,    73,
+      -1,    27,     1,   174,    -1,    27,     1,    73,    -1,    -1,
+      13,     5,    -1,    12,    -1,    66,    -1,    13,    96,    -1,
+      -1,    17,    96,   161,    96,    -1,    74,    96,   120,    96,
+     121,    75,    96,    -1,   122,    -1,   123,    96,    43,    96,
+     122,    -1,    -1,    43,    96,   123,    -1,    -1,    41,    -1,
+      42,    -1,   123,    -1,   125,    96,   130,   124,    -1,    -1,
+     128,    -1,   126,    -1,   128,    76,    96,   126,    -1,   128,
+       1,    -1,    24,    96,   128,    71,    96,   107,   168,    -1,
+      24,    96,    71,    96,   107,   168,    -1,    13,    96,    -1,
+      31,    96,   132,    96,    71,    96,   133,    72,    -1,    13,
+      -1,    12,    -1,    -1,   133,   134,    96,    -1,   135,    96,
+      71,    96,   156,    72,    -1,   136,    -1,   135,    96,    76,
+      96,   136,    -1,    63,    -1,    13,    -1,    23,     1,   174,
+      -1,    23,     1,    73,    -1,    25,    96,    71,    96,   156,
+      72,    96,    -1,    25,     1,   174,    -1,    25,     1,    73,
+      -1,    77,    96,    -1,    78,    96,    -1,    79,    96,    -1,
+      80,    -1,    77,    -1,   142,    71,    96,   156,    99,    -1,
+     144,    -1,   142,    76,    96,   144,    -1,   142,     1,    -1,
+     144,     5,    -1,   146,    -1,   143,    -1,   143,   146,    -1,
+     144,   139,   146,    -1,   144,     1,    -1,    21,    -1,    20,
+      21,    -1,    13,    21,    -1,   147,    -1,   147,   148,    -1,
+     148,    -1,   145,   147,    -1,   145,   147,   148,    -1,   145,
+     148,    -1,    13,    -1,    20,    -1,   149,    -1,   148,   149,
+      -1,   148,     1,    -1,    16,    -1,    15,    -1,   150,    -1,
+     152,    -1,   155,    -1,    18,    13,    -1,    13,    96,    -1,
+      19,    96,   151,    81,    -1,    19,    96,   151,   153,    96,
+     154,    96,    81,    -1,    19,    96,   145,   151,    81,    -1,
+      19,    96,   145,   151,   153,    96,   154,    96,    81,    -1,
+      82,    -1,     7,    -1,     8,    -1,     9,    -1,    10,    -1,
+      11,    -1,    13,    -1,    12,    -1,    17,    13,    -1,    17,
+      17,    13,    -1,    17,    67,    14,    75,    -1,    17,    67,
+      65,    75,    -1,    17,    67,    13,    75,    -1,    17,    68,
+      96,   146,    96,    75,    -1,   158,    -1,   157,   158,    -1,
+     157,    -1,     1,   175,     1,    -1,     1,    -1,   157,     1,
+      -1,   157,   175,    -1,   158,    73,    96,    -1,   158,   175,
+      73,    96,    -1,     1,    73,    96,    -1,     1,   175,     1,
+      73,    96,    -1,   157,   158,    73,    96,    -1,   157,     1,
+      73,    96,    -1,   157,     1,   175,     1,    73,    96,    -1,
+     159,    17,    96,   161,   160,    -1,   165,    96,    -1,   159,
+       1,    -1,   159,    17,    96,     1,   161,   160,    -1,   159,
+      17,    96,   161,   160,     1,    -1,    40,    96,    -1,   159,
+      17,    96,    -1,   159,    17,    96,     1,    -1,   159,   174,
+      -1,    13,    96,    -1,    40,    96,    -1,    -1,   163,    -1,
+     161,   162,   163,    -1,   161,     1,    -1,    83,    96,    -1,
+      76,    96,    -1,    -1,   164,    -1,   140,   164,    -1,    12,
+      96,    -1,    13,    96,    -1,    62,    96,    -1,   140,    62,
+      96,    -1,    66,    96,    -1,    69,    96,    -1,   167,    -1,
+      84,    96,    -1,   166,    -1,   165,    96,    -1,    85,    96,
+      -1,    65,    96,    -1,    64,    96,    -1,    63,    96,    -1,
+      48,    96,    -1,    49,    96,    -1,    50,    96,    -1,    51,
+      96,    -1,    52,    96,    -1,    53,    96,    -1,    54,    96,
+      -1,    55,    96,    -1,    56,    96,    -1,    57,    96,    -1,
+      58,    96,    -1,    59,    96,    -1,    60,    96,    -1,    61,
+      96,    -1,    46,    96,    -1,    45,    96,    -1,    47,    96,
+      -1,    44,    96,    -1,    70,    -1,    67,    96,   161,    75,
+      96,    -1,    67,    96,     1,    -1,    15,    96,    -1,    16,
+      96,    -1,    99,    -1,     1,    99,    -1,    39,     1,   174,
+      -1,    39,     1,    73,    -1,   169,    97,    -1,   170,   169,
+      97,    -1,   110,    -1,   129,    -1,     1,   174,    -1,    71,
+       1,   175,     1,    99,    -1,    71,     1,    99,    -1,   174,
+      -1,   175,     1,   174,    -1
 };
 
 /* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
@@ -873,7 +873,7 @@ static const yytype_uint8 yyr1[] =
 /* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN.  */
 static const yytype_uint8 yyr2[] =
 {
-       0,     2,     6,     2,     2,     2,     2,     2,     2,     2,
+       0,     2,     7,     2,     2,     2,     2,     2,     2,     2,
        1,     1,     6,     6,     5,     5,     5,     5,     5,     0,
        2,     0,     2,     2,     0,     1,     1,     1,     5,     3,
        3,     0,     3,     1,     0,     3,     0,     3,     0,     3,
@@ -907,145 +907,145 @@ static const yytype_uint8 yyr2[] =
    means the default is an error.  */
 static const yytype_uint16 yydefact[] =
 {
-      24,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-      19,    19,    19,    19,    19,    19,    19,    21,    25,     0,
-       0,    19,    19,    19,    19,    19,    19,    19,     1,     3,
-       9,     4,     8,     5,     6,     7,    31,     0,    30,    29,
-      20,    19,     0,     0,     0,     0,   103,     0,     0,    23,
-      22,     0,    34,    21,    33,     0,     0,   155,   161,   160,
-       0,     0,    19,   156,   146,     0,     0,    19,     0,    19,
-      19,    10,    11,    41,    44,    42,    43,    40,     0,   142,
-       0,     0,   141,   149,     0,   157,   162,   163,   164,   189,
-      19,    19,   251,     0,     0,   185,     0,    19,   125,   124,
-      19,    19,   122,    19,    19,    19,    19,    19,    19,    19,
+      19,     0,     0,     0,     0,     0,     0,     0,     0,    19,
+      19,    19,    19,    19,    19,    19,    24,    19,    19,    19,
+      19,    19,    19,    19,     1,     3,     9,     4,     8,     5,
+       6,     7,    20,     0,    21,    25,     0,     0,     0,     0,
+     103,     0,     0,     0,     0,    31,   155,   161,   160,     0,
+       0,    19,   156,   146,     0,     0,    19,     0,    19,    19,
+      10,    11,    41,    44,    42,    43,    40,     0,   142,     0,
+       0,   141,   149,     0,   157,   162,   163,   164,   189,    19,
+      19,   251,     0,     0,   185,     0,    19,   125,   124,    19,
+      19,   122,    19,    19,    19,    19,    19,    19,    19,    19,
       19,    19,    19,    19,    19,    19,    19,    19,    19,    19,
       19,    19,    19,    19,    19,    19,    19,    19,    19,    19,
-      19,    19,   135,   134,    19,    19,     0,     0,   211,   217,
-      19,   227,   225,   104,   105,    19,    99,   106,    19,     0,
-       0,    72,    19,     0,     0,    68,     0,     0,    36,    21,
-     260,    21,    27,    26,   266,   267,     0,    28,   148,   179,
-       0,     0,    19,   165,     0,   147,     0,     0,     0,   103,
-       0,     0,     0,     0,   139,    19,    19,   143,   145,   140,
-      19,    19,    19,     0,   155,   156,   152,     0,     0,   159,
-     158,    19,     0,   208,   204,    14,   190,   186,     0,    19,
-       0,   201,    19,   207,   200,     0,     0,   219,   220,   254,
-     255,   250,   248,   247,   249,   233,   234,   235,   236,   237,
-     238,   239,   240,   241,   242,   243,   244,   245,   246,   221,
-     232,   231,   230,   223,     0,   224,   226,   229,    19,   218,
-     213,    16,    19,    19,     0,   228,     0,     0,     0,    17,
-      18,    19,     0,    87,    15,    73,    69,    19,     0,    83,
-      19,     0,   259,   258,    19,    19,    38,    21,    32,   261,
-       0,   180,     0,     0,     0,     0,    19,     0,     0,     0,
-      62,    63,    93,    94,    19,   127,   126,    19,   110,     0,
-     130,   129,    19,   118,   117,    19,    12,     0,     0,   131,
-     132,   133,   144,     0,   194,   188,    19,     0,    19,     0,
-     192,    19,     0,    13,    19,    19,   253,     0,   222,   215,
-     214,   212,    19,    19,    19,    19,   101,    76,    71,    19,
-       0,    19,    74,    19,     0,    19,   103,    66,     0,     0,
-      21,    35,   265,   268,   183,   181,   182,    19,   166,    19,
-       0,   172,   173,   174,   175,   176,   167,   171,    19,   108,
-      49,   112,    19,    19,     0,     0,     0,     0,    19,   197,
-       0,   196,   193,   206,     0,     0,     0,    19,    95,    96,
-       0,   115,    19,   107,    19,    79,     0,    78,    75,    86,
-       0,     0,     0,     0,     0,     0,     0,    91,     0,    45,
-      21,   262,    47,    48,    46,    37,     0,   169,    19,     0,
-       0,     0,    49,   103,     0,    19,   136,   195,    19,     0,
-      19,     0,     0,   123,   252,    19,     0,   100,     0,    77,
-      19,     0,     0,    19,   103,    19,    90,    89,     0,     0,
-     264,    39,   184,     0,   178,   177,    19,    60,    61,     0,
-     256,    55,    21,   263,    54,    52,    53,    51,   114,    57,
-      58,    59,    56,     0,   111,    19,   119,   198,   202,   209,
-     203,   121,     0,    19,   102,    80,    19,     0,     0,     0,
-      92,    19,    19,     0,   257,    50,   113,   128,     0,     0,
-      98,    82,     0,     0,     0,     0,   168,   116,    19,    97,
-      64,    65,    88,   170,   120
+      19,   135,   134,    19,    19,     0,     0,   211,   217,    19,
+     227,   225,   104,   105,    19,    99,   106,    19,     0,     0,
+      72,    19,     0,     0,    68,     0,     0,    30,    29,    19,
+      23,    22,     0,    34,    21,    33,   148,   179,     0,     0,
+      19,   165,     0,   147,     0,     0,     0,   103,     0,     0,
+       0,     0,   139,    19,    19,   143,   145,   140,    19,    19,
+      19,     0,   155,   156,   152,     0,     0,   159,   158,    19,
+     267,     0,   208,   204,    14,   190,   186,     0,    19,     0,
+     201,    19,   207,   200,     0,     0,   219,   220,   254,   255,
+     250,   248,   247,   249,   233,   234,   235,   236,   237,   238,
+     239,   240,   241,   242,   243,   244,   245,   246,   221,   232,
+     231,   230,   223,     0,   224,   226,   229,    19,   218,   213,
+      16,    19,    19,     0,   228,     0,     0,     0,    17,    18,
+      19,     0,    87,    15,    73,    69,    19,     0,    83,    19,
+       0,     0,     0,     0,    36,    21,   260,    21,   180,     0,
+       0,     0,     0,    19,     0,     0,     0,    62,    63,    93,
+      94,    19,   127,   126,    19,   110,     0,   130,   129,    19,
+     118,   117,    19,    12,     0,     0,   131,   132,   133,   144,
+       0,   194,   188,    19,     0,    19,     0,   192,    19,     0,
+      13,    19,    19,   253,     0,   222,   215,   214,   212,    19,
+      19,    19,    19,   101,    76,    71,    19,     0,    19,    74,
+      19,     0,    19,    27,    26,   266,     0,    28,   259,   258,
+      19,    19,    38,    21,    32,   261,   183,   181,   182,    19,
+     166,    19,     0,   172,   173,   174,   175,   176,   167,   171,
+      19,   108,    49,   112,    19,    19,     0,     0,     0,     0,
+      19,   268,   197,     0,   196,   193,   206,     0,     0,     0,
+      19,    95,    96,     0,   115,    19,   107,    19,    79,     0,
+      78,    75,    86,     0,     0,     0,   103,    66,     0,     0,
+      21,    35,     0,   169,    19,     0,     0,     0,     0,    49,
+     103,     0,    19,   136,   195,    19,     0,    19,     0,     0,
+     123,   252,    19,     0,   100,     0,    77,    19,     0,     0,
+     265,     0,     0,     0,     0,    91,     0,    45,    21,   262,
+      47,    48,    46,    37,   184,     0,   178,   177,    19,    60,
+      61,     0,   256,    55,    21,   263,    54,    52,    53,    51,
+     114,    57,    58,    59,    56,     0,   111,    19,   119,   198,
+     202,   209,   203,   121,     0,    19,   102,    80,    19,    19,
+     103,    19,    90,    89,     0,     0,   264,    39,    19,     0,
+     257,    50,   113,   128,     0,     0,    98,    82,     0,     0,
+       0,    92,    19,     0,   168,   116,    19,    97,     0,     0,
+       0,   170,   120,    64,    65,    88
 };
 
 /* YYDEFGOTO[NTERM-NUM].  */
 static const yytype_int16 yydefgoto[] =
 {
-      -1,     9,    70,    10,    11,    12,    13,    14,    15,    16,
-     257,    36,    17,   460,    18,    52,   158,   276,   349,    71,
-     410,   421,   461,   462,   411,   277,   405,   153,   154,   155,
-     156,   350,   449,   294,   333,   436,   146,   147,   393,   148,
-     298,   402,   403,    73,   336,    74,   305,   498,   100,   101,
-     102,    75,    76,   193,   136,    77,    78,    79,    80,    81,
-      82,    83,    84,    85,    86,   289,    87,   368,   456,    88,
-      93,    94,    95,    96,   431,   137,   254,   138,   139,   140,
-     141,   142,   468,   469,    54,   470,   471,   472,   165,   166
+      -1,     8,    59,     9,    10,    11,    12,    13,    14,    15,
+     246,    45,    34,   452,    35,   153,   264,   342,   399,    60,
+     438,   408,   453,   454,   439,   343,   433,   142,   143,   144,
+     145,   400,   485,   281,   320,   423,   135,   136,   386,   137,
+     285,   406,   407,    62,   323,    63,   292,   494,    89,    90,
+      91,    64,    65,   181,   125,    66,    67,    68,    69,    70,
+      71,    72,    73,    74,    75,   276,    76,   360,   448,    77,
+      82,    83,    84,    85,   418,   126,   243,   127,   128,   129,
+     130,   131,   460,   461,   155,   462,   463,   464,   190,   191
 };
 
 /* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
    STATE-NUM.  */
-#define YYPACT_NINF -301
+#define YYPACT_NINF -240
 static const yytype_int16 yypact[] =
 {
-     467,    43,    -9,   143,   155,   174,    47,   179,   199,   202,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,   -15,
-     220,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,   233,
-     233,   233,   233,   233,   233,   233,    31,   325,  -301,  -301,
-    -301,  -301,   769,   191,   420,  1125,   407,   556,    38,  -301,
-    -301,   336,   290,  -301,   345,   146,    14,   374,  -301,  -301,
-     419,   393,  -301,   397,  -301,   402,   446,  -301,   194,  -301,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,    82,   616,
-     297,   629,  -301,   454,   164,  -301,  -301,  -301,  -301,   236,
-    -301,  -301,  -301,   384,   640,   237,   277,  -301,  -301,  -301,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,
-    -301,  -301,  -301,  -301,  -301,  -301,   807,   911,  -301,  -301,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,    28,  -301,   390,
-      87,   248,  -301,   394,   185,   308,   229,   355,   319,  -301,
-     405,  -301,  -301,  -301,  -301,  -301,   450,  -301,  -301,  -301,
-     471,   292,  -301,  -301,    25,  -301,   364,   285,   367,   311,
-     379,    22,    37,   196,  -301,  -301,  -301,  -301,  -301,  -301,
-    -301,  -301,  -301,   616,  -301,  -301,   454,   205,   344,  -301,
-    -301,  -301,   466,   233,   233,  -301,   484,   416,    94,  -301,
-      62,  -301,  -301,  -301,   233,   223,   183,   233,   233,   233,
-     233,   233,   233,   233,   233,   233,   233,   233,   233,   233,
-     233,   233,   233,   233,   233,   233,   233,   233,   233,   233,
-     233,   233,   233,   233,  1062,   233,   233,   233,  -301,  -301,
-    -301,  -301,  -301,  -301,  1184,   233,    60,    29,   383,  -301,
-    -301,  -301,   493,   233,  -301,   507,   429,  -301,    83,  -301,
-    -301,   192,  -301,  -301,  -301,  -301,   476,  -301,   405,   405,
-     146,  -301,   431,   457,   470,   556,   374,   397,   529,    68,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,    96,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,   191,   556,   233,
-     233,   233,  -301,   382,   233,   508,  -301,   545,  -301,   481,
-     233,  -301,   538,  -301,  -301,  -301,  -301,   985,   233,   233,
-     233,  -301,  -301,  -301,  -301,  -301,   519,   233,   541,  -301,
-     569,  -301,   233,  -301,   760,  -301,   404,    23,   555,   915,
-    -301,   405,  -301,  -301,  -301,  -301,  -301,  -301,   233,  -301,
-     167,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,   389,
-     233,  -301,  -301,  -301,   191,   208,   161,   487,  -301,   233,
-     546,   233,   233,  1184,   464,   191,   420,  -301,   233,    36,
-     131,   233,  -301,  -301,  -301,   233,   579,   233,   233,  1184,
-     612,   191,   535,    97,   611,   549,   620,   400,   481,  -301,
-    -301,  -301,  -301,  -301,  -301,   405,   152,  -301,  -301,   323,
-     632,  1257,   233,   407,   554,  -301,  -301,   233,  -301,   464,
-    -301,   215,   558,  -301,   233,  -301,   563,  -301,   131,   233,
-    -301,   686,   567,  -301,   272,  -301,  -301,  -301,   638,   299,
-    -301,   405,  -301,   323,  -301,  -301,  -301,  -301,  -301,   146,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,
-    -301,  -301,  -301,  1257,  -301,  -301,   233,   233,  -301,   233,
-    -301,  -301,  1125,  -301,    28,   233,  -301,    38,   136,    38,
-    -301,  -301,  -301,     0,  -301,   405,  -301,   233,   181,   834,
-     233,   233,   582,   583,   182,     1,  -301,  -301,  -301,   233,
-    -301,  -301,  -301,  -301,   233
+     616,    -4,    91,   115,   122,    66,   194,   201,    72,  -240,
+    -240,  -240,  -240,  -240,  -240,  -240,    36,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,   244,   244,   244,   244,   244,
+     244,   244,  -240,   489,  -240,  -240,   844,   343,    25,  1131,
+     347,   557,   333,    -3,    37,    34,   257,  -240,  -240,   310,
+     291,  -240,   304,  -240,   495,   346,  -240,   220,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,  -240,  -240,    80,   640,   330,
+     703,  -240,   777,   152,  -240,  -240,  -240,  -240,   143,  -240,
+    -240,  -240,   278,   433,   212,   203,  -240,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,   964,   917,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,  -240,    41,  -240,   281,   163,
+     313,  -240,   290,   174,   326,   243,   362,  -240,  -240,  -240,
+    -240,  -240,   375,   359,  -240,   357,  -240,  -240,   387,    22,
+    -240,  -240,    32,  -240,   355,   179,   374,   295,   378,   200,
+     275,   183,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
+    -240,   640,  -240,  -240,   777,   191,   564,  -240,  -240,  -240,
+    -240,   404,   244,   244,  -240,   440,   337,    63,  -240,     4,
+    -240,  -240,  -240,   244,   185,   123,   244,   244,   244,   244,
+     244,   244,   244,   244,   244,   244,   244,   244,   244,   244,
+     244,   244,   244,   244,   244,   244,   244,   244,   244,   244,
+     244,   244,   244,  1068,   244,   244,   244,  -240,  -240,  -240,
+    -240,  -240,  -240,  1190,   244,   294,   233,   305,  -240,  -240,
+    -240,   418,   244,  -240,   493,   350,  -240,   129,  -240,  -240,
+     206,     3,   167,   513,     8,  -240,    42,  -240,  -240,   388,
+     389,   394,   557,   257,   304,   464,   286,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,  -240,   124,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,   343,   557,   244,   244,   244,  -240,
+     712,   244,   514,  -240,   479,  -240,   413,   244,  -240,   544,
+    -240,  -240,  -240,  -240,   991,   244,   244,   244,  -240,  -240,
+    -240,  -240,  -240,   446,   244,   547,  -240,   491,  -240,   244,
+    -240,   766,  -240,  -240,  -240,  -240,   492,  -240,  -240,  -240,
+    -240,  -240,   481,  -240,    42,    42,  -240,  -240,  -240,  -240,
+     244,  -240,   384,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
+    -240,   398,   244,  -240,  -240,  -240,   343,   208,   154,   353,
+    -240,  -240,   244,   552,   244,   244,  1190,   470,   343,    25,
+    -240,   244,   180,   160,   244,  -240,  -240,  -240,   244,   626,
+     244,   244,  1190,   618,   343,     3,   301,   227,   486,   921,
+    -240,    42,    56,  -240,  -240,   431,   638,    90,   437,   244,
+     347,   425,  -240,  -240,   244,  -240,   470,  -240,   181,   466,
+    -240,   244,  -240,   473,  -240,   160,   244,  -240,   692,   496,
+    -240,   441,   546,   487,   639,   311,   413,  -240,  -240,  -240,
+    -240,  -240,  -240,    42,  -240,   431,  -240,  -240,  -240,  -240,
+    -240,     3,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,   437,  -240,  -240,   244,   244,
+    -240,   244,  -240,  -240,  1131,  -240,    41,   244,  -240,  -240,
+     400,  -240,  -240,  -240,   558,    12,  -240,    42,  -240,     1,
+    -240,    42,  -240,   244,    13,   840,   244,   244,   333,   146,
+     333,  -240,  -240,     2,  -240,  -240,  -240,   244,   499,   540,
+     178,  -240,   244,  -240,  -240,  -240
 };
 
 /* YYPGOTO[NTERM-NUM].  */
 static const yytype_int16 yypgoto[] =
 {
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,
-      -1,   -21,  -301,   -51,  -301,  -301,  -301,  -301,  -301,   302,
-    -301,   264,  -301,  -301,     5,  -301,  -301,   217,  -301,   536,
-    -301,  -301,  -301,   245,  -301,  -301,   310,   269,  -301,  -301,
-     -45,   339,  -177,  -202,  -301,  -146,  -301,  -301,   211,  -301,
-     327,  -132,  -130,  -301,  -301,  -103,   667,  -301,   408,   543,
-     -48,   634,   -65,   -55,  -301,   430,  -301,   359,   267,  -301,
-    -300,  -301,   627,  -301,   293,  -190,  -301,   469,   588,   -35,
-    -301,  -301,   252,   -19,  -301,   377,  -301,   378,   -16,    -3
+    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
+       0,  -125,  -240,  -236,  -240,  -240,  -240,  -240,  -240,   168,
+    -240,   213,  -240,  -240,   -20,  -240,  -240,   -84,  -240,   483,
+    -240,  -240,  -240,   142,  -240,  -240,   249,   222,  -240,  -240,
+     -39,   241,  -165,  -232,  -240,  -126,  -240,  -240,   144,  -240,
+     272,  -110,  -106,  -240,  -240,   -91,   611,  -240,   391,   530,
+     -60,   630,   -38,   -42,  -240,   421,  -240,   354,   269,  -240,
+    -239,  -240,   632,  -240,   308,  -173,  -240,   482,   601,   -33,
+    -240,  -240,   267,   -17,  -240,   334,  -240,   335,   -16,   -18
 };
 
 /* YYTABLE[YYPACT[STATE-NUM]].  What to do in state STATE-NUM.  If
@@ -1055,334 +1055,324 @@ static const yytype_int16 yypgoto[] =
 #define YYTABLE_NINF -217
 static const yytype_int16 yytable[] =
 {
-      20,   149,   299,    39,   164,    40,    40,   376,    97,    29,
-      30,    31,    32,    33,    34,    35,   197,    53,   198,    40,
-      42,    43,    44,    45,    46,    47,    48,    40,    40,   200,
-      40,   187,   160,   -19,    40,   161,    49,    50,   286,   151,
-      56,    40,    40,    40,    19,   287,    64,    72,   -19,   303,
-     304,   152,    25,   435,   327,   -19,    37,   159,    38,    97,
-     404,   174,    21,   319,   177,    40,   179,   181,   182,   183,
-      51,   -19,   334,   332,   424,   361,   362,   363,   364,   365,
-     213,   506,   513,   184,   319,   432,   202,   167,   184,   203,
-     204,   208,   210,   302,  -191,   319,   214,   371,   371,   215,
-     216,   442,   217,   218,   219,   220,   221,   222,   223,   224,
-     225,   226,   227,   228,   229,   230,   231,   232,   233,   234,
-     235,   236,   237,   238,   239,   240,   241,   242,   243,   244,
-     245,   313,   384,   246,   247,   321,    40,   371,   278,   255,
-     279,   273,   200,   200,   256,   312,   162,   258,   262,   366,
-     367,   263,   268,   185,   400,   271,   343,    40,   186,   260,
-     291,   162,   296,   186,   301,   199,  -191,   372,  -109,  -151,
-    -109,   285,   373,   373,   361,   362,   363,   364,   365,    58,
-      59,    60,    61,    62,   307,   308,   265,    40,    40,   309,
-     310,   311,    89,   429,    98,   180,    40,    40,   152,   -19,
-     314,    40,    28,   317,    90,   145,   199,   -67,   320,   441,
-    -154,   322,   373,    40,    22,  -199,   480,    37,   163,   463,
-      58,    59,    60,    61,    62,    40,    23,   452,    40,   352,
-     269,    91,    41,   163,   -19,  -151,  -151,   357,    40,  -151,
-    -151,  -151,  -151,  -151,    99,    24,   270,   328,   417,   367,
-      26,   329,   330,   507,   324,   512,   351,   -70,   200,   325,
-     337,    92,   340,   345,   353,   -19,   342,   488,   306,   344,
-      27,   463,    97,   346,   347,   464,  -154,  -154,   211,   425,
-    -154,  -154,  -154,  -154,  -154,   358,  -199,  -199,  -199,   465,
-      40,   466,   499,   369,   212,   323,   370,   292,   188,   353,
-     -19,   374,   189,   353,   375,   282,   283,    37,    37,   201,
-     209,   292,    65,   143,   144,   379,    40,   381,   467,    37,
-     382,   261,   353,   385,   386,   426,    55,   464,    40,   415,
-     412,   388,   389,   390,   391,   454,   455,   157,   395,    97,
-     397,   465,   398,   466,   401,   199,   145,   407,    37,  -150,
-      97,   293,   143,   144,   274,   275,   416,   284,   358,    58,
-      59,    60,    61,    62,   353,   293,    97,   419,  -137,  -137,
-     467,   422,   423,  -137,   190,   191,   192,   427,   474,    37,
-     353,   267,   297,   199,    51,   145,   434,  -153,    40,   451,
-     447,   438,   450,   439,    40,   168,   335,    58,    59,    60,
-      61,    62,  -103,   176,   458,    40,   173,   -19,   494,    40,
-      49,    50,    40,   448,   -19,  -150,  -150,   453,   175,  -150,
-    -150,  -150,  -150,  -150,   476,    40,    37,   477,   272,   479,
-     143,   144,   169,    98,   482,    37,   170,   290,    37,   485,
-     295,   495,   487,   450,   489,   143,   144,   178,   143,   144,
-      37,   280,   300,  -153,  -153,   493,   205,  -153,  -153,  -153,
-    -153,  -153,   259,   145,  -210,   250,   264,   315,   -19,    58,
-      59,    60,    61,    62,   497,  -108,  -216,  -216,   145,  -216,
-    -216,   145,   500,    99,   281,   501,   171,   172,   188,   318,
-     504,   505,   189,     1,   338,     2,     3,     4,   509,     5,
-       6,     7,   341,   348,   430,     8,   354,   514,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,   355,  -216,  -216,  -210,  -210,  -210,  -205,   383,
-     252,  -216,   359,    40,  -216,   356,   380,   253,  -216,  -216,
-     103,   104,    37,   105,   106,    37,   406,   316,  -138,  -138,
-     -19,    40,   392,  -138,   190,   191,   192,   -19,   -19,    57,
-     396,    58,    59,    60,    61,    62,    63,    64,    37,    37,
-     339,   378,   107,   108,   109,   110,   111,   112,   113,   114,
-     115,   116,   117,   118,   119,   120,   121,   122,   123,   124,
-     125,   126,   127,   128,   129,   130,   443,   131,    92,  -205,
-    -205,  -205,    37,   250,   394,   132,   444,    37,   133,   428,
-     445,   -19,   134,   135,  -216,  -216,   475,  -216,  -216,    57,
-     481,    58,    59,    60,    61,    62,    63,    64,   483,   486,
-    -187,   206,   194,   490,    58,    59,    60,    61,    62,   195,
-      37,   409,   440,    90,   510,   511,  -216,  -216,  -216,  -216,
+      16,   138,   286,   333,    86,   306,    32,    32,   175,    25,
+      26,    27,    28,    29,    30,    31,    61,    36,    37,    38,
+      39,    40,    41,    42,   279,   335,    87,   148,   154,   266,
+      32,   188,   185,    44,   186,   269,   270,    32,    87,   150,
+     151,    32,    32,   340,   341,   273,   -19,   150,   151,   149,
+      86,   162,   274,    53,   165,   368,   167,   169,   170,   171,
+     314,    32,    33,  -191,   306,   197,   199,    17,   146,   202,
+     147,    21,    24,   152,   146,   334,    88,   308,   280,   192,
+     193,   172,   504,   511,   -19,   505,   203,   271,    88,   204,
+     205,   363,   206,   207,   208,   209,   210,   211,   212,   213,
+     214,   215,   216,   217,   218,   219,   220,   221,   222,   223,
+     224,   225,   226,   227,   228,   229,   230,   231,   232,   233,
+     234,   299,   251,   235,   236,   363,   257,   411,    32,   244,
+     306,   444,   413,   265,   245,  -191,   377,   247,   267,   419,
+     344,   252,   345,   188,   188,   260,   300,   363,   278,   262,
+     283,   173,   288,   187,   333,   429,   174,  -151,   393,   430,
+     272,  -109,    18,  -109,   172,    32,   365,    47,    48,    49,
+      50,    51,    32,   294,   295,   254,   455,   304,   296,   297,
+     298,  -199,   472,    32,    32,    32,    19,   141,    32,   301,
+      32,   279,   187,    20,   311,   364,  -154,   422,   307,   312,
+     365,   309,   330,   416,   200,    32,    47,    48,    49,    50,
+      51,    32,   349,    32,   146,   490,   189,   -67,   401,   428,
+     201,   168,   365,  -151,  -151,   -19,   334,  -151,  -151,  -151,
+    -151,  -151,    32,   455,   134,   249,   327,   315,    32,   174,
+     337,   316,   317,   336,   258,   280,   -70,   339,   -19,    32,
+     324,   515,  -199,  -199,  -199,   293,   329,   310,   188,   331,
+     259,    86,  -154,  -154,   432,    22,  -154,  -154,  -154,  -154,
+    -154,   289,    23,   350,   146,   443,   321,   332,   156,   412,
+      32,   361,   456,   146,   362,   198,   371,   290,   291,   366,
+     371,   -19,   367,   353,   354,   355,   356,   357,   457,    32,
+      32,   495,   458,   372,   161,   374,    32,   319,   375,   371,
+      32,   378,   379,   487,   -19,   499,    32,   459,   322,   381,
+     382,   383,   384,   157,   484,   163,   388,   158,   390,   491,
+     391,   176,   394,    86,   140,   177,   132,   133,    32,   456,
+     396,   397,   132,   133,    78,    86,   141,   166,    32,   402,
+     194,   350,    32,   248,   176,   457,    79,   371,   177,   458,
+     405,    86,   253,   261,   409,   410,   284,   358,   359,   134,
+     414,   466,  -108,   371,   459,   134,   263,   159,   160,   371,
+     421,    54,   440,    80,   146,   425,   250,   426,   132,   133,
+     450,   353,   354,   355,   356,   357,   152,   146,   435,   256,
+     268,  -137,  -137,    32,   445,   302,  -137,   178,   179,   180,
+     305,  -103,   468,    81,   508,   469,   509,   471,   483,   325,
+     486,   134,   474,   328,  -138,  -138,   146,   477,   277,  -138,
+     178,   179,   180,  -187,   195,   486,    32,   333,   451,   132,
+     133,   132,   133,   446,   447,   146,    79,   282,   489,   146,
+      46,   287,    47,    48,    49,    50,    51,    52,    53,    54,
+      55,    56,    57,   346,   347,   403,   359,   493,    58,   348,
+    -210,   239,   134,    80,   134,   496,   152,   351,   497,   498,
+     373,   500,  -216,  -216,   146,  -216,  -216,   434,   503,   385,
+      43,   -19,   389,   395,   -19,   507,   164,   467,   -19,   -19,
+     -19,   -19,   510,    81,   146,  -187,   512,   -19,   398,   334,
+     417,   146,   479,   303,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
+    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,   473,  -216,
+    -216,  -210,  -210,  -210,  -205,   376,   241,  -216,   475,    32,
+    -216,   480,   -19,   242,  -216,  -216,    92,    93,   481,    94,
+      95,   -19,    32,   501,   146,   187,   326,   437,   478,  -150,
+      46,   513,    47,    48,    49,    50,    51,    52,    53,    47,
+      48,    49,    50,    51,   146,   146,   338,   370,    96,    97,
+      98,    99,   100,   101,   102,   103,   104,   105,   106,   107,
+     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
+     118,   119,   514,   120,    81,  -205,  -205,  -205,   146,   239,
+     387,   121,   465,   146,   122,   415,   255,   502,   123,   124,
+    -216,  -216,   424,  -216,  -216,  -150,  -150,   431,   506,  -150,
+    -150,  -150,  -150,  -150,     1,     2,     3,   476,     4,     5,
+       6,   420,   139,    46,     7,    47,    48,    49,    50,    51,
+      52,    53,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-      91,  -216,  -216,   -81,   -81,   -81,   473,   250,   252,  -216,
-     266,    37,  -216,   446,   491,   253,  -216,  -216,  -216,  -216,
-     437,  -216,  -216,    37,   502,   457,   503,   484,   420,   508,
-      92,    37,  -187,   433,   150,   196,   377,   288,   360,   418,
-     492,   207,   478,   331,   249,   496,   413,   414,     0,     0,
+    -216,  -216,  -216,  -216,  -216,  -216,   369,  -216,  -216,   -81,
+     -81,   -81,   275,   239,   241,  -216,   352,   146,  -216,   427,
+     184,   242,  -216,  -216,  -216,  -216,   404,  -216,  -216,   146,
+     146,   449,   482,   187,   488,   196,   182,  -153,    47,    48,
+      49,    50,    51,   183,   470,   318,   238,    47,    48,    49,
+      50,    51,   492,   441,   442,     0,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,     0,  -216,  -216,   -84,   -84,   -84,
-       0,   399,   252,  -216,     0,    40,  -216,     0,     0,   253,
-    -216,  -216,   103,   104,    40,   105,   106,     0,     0,     0,
-       0,     0,    57,     0,    58,    59,    60,    61,    62,    63,
-      64,    65,    66,    67,    68,     0,     0,     0,     0,     0,
-      69,     0,     0,     0,   107,   108,   109,   110,   111,   112,
-     113,   114,   115,   116,   117,   118,   119,   120,   121,   122,
-     123,   124,   125,   126,   127,   128,   129,   130,     0,   131,
-      92,   -85,   -85,   -85,     0,   250,     0,   132,     0,   -19,
-     133,     0,     0,     0,   134,   135,  -216,  -216,     0,  -216,
-    -216,   107,   108,   109,   110,   111,   112,   113,   114,   115,
-     116,   117,   118,   119,   120,   121,   122,   123,   124,   248,
-     126,   127,   128,     0,     0,     0,     0,     0,  -216,  -216,
+       0,  -216,  -216,   -84,   -84,   -84,     0,   392,   241,  -216,
+       0,    32,  -216,     0,     0,   242,  -216,  -216,    92,    93,
+       0,    94,    95,  -153,  -153,     0,     0,  -153,  -153,  -153,
+    -153,  -153,    47,    48,    49,    50,    51,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+      96,    97,    98,    99,   100,   101,   102,   103,   104,   105,
+     106,   107,   108,   109,   110,   111,   112,   113,   114,   115,
+     116,   117,   118,   119,     0,   120,    81,   -85,   -85,   -85,
+       0,   239,     0,   121,     0,   -19,   122,     0,     0,    32,
+     123,   124,  -216,  -216,     0,  -216,  -216,    46,     0,    47,
+      48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
+       0,     0,     0,     0,     0,    58,     0,     0,     0,     0,
+       0,     0,     0,     0,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
+    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,     0,  -216,
+    -216,     0,     0,     0,     0,   -19,   241,  -216,   239,     0,
+    -216,    -2,   436,   242,  -216,  -216,     0,     0,     0,  -216,
+    -216,     0,  -216,  -216,    46,     0,    47,    48,    49,    50,
+      51,    52,    53,    54,    55,    56,    57,     0,     0,     0,
+       0,     0,    58,     0,     0,     0,     0,     0,     0,     0,
+     152,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,     0,  -216,  -216,     0,     0,     0,     0,   -19,
-     252,  -216,   250,     0,  -216,    -2,   408,   253,  -216,  -216,
-       0,     0,     0,  -216,  -216,     0,  -216,  -216,    57,     0,
-      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
-      68,     0,     0,     0,     0,     0,    69,     0,     0,     0,
-       0,     0,     0,     0,    51,  -216,  -216,  -216,  -216,  -216,
+    -216,  -216,  -216,  -216,  -216,     0,  -216,  -216,     0,   240,
+       0,     0,   239,   241,  -216,     0,     0,  -216,     0,     0,
+     242,  -216,  -216,  -216,  -216,     0,  -216,  -216,    96,    97,
+      98,    99,   100,   101,   102,   103,   104,   105,   106,   107,
+     108,   109,   110,   111,   112,   113,   237,   115,   116,   117,
+       0,     0,     0,     0,     0,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,     0,
-    -216,  -216,     0,   251,     0,     0,   250,   252,  -216,     0,
-       0,  -216,     0,     0,   253,  -216,  -216,  -216,  -216,     0,
-    -216,  -216,     0,     0,     0,     0,     0,     0,     0,     0,
+    -216,  -216,     0,     0,     0,     0,   380,   241,  -216,   313,
+       0,  -216,     0,    32,   242,  -216,  -216,     0,     0,     0,
+      92,    93,     0,    94,    95,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,     0,  -216,  -216,     0,     0,     0,     0,
-     387,   252,  -216,   326,     0,  -216,     0,    40,   253,  -216,
-    -216,     0,     0,     0,   103,   104,     0,   105,   106,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,   107,   108,   109,   110,
-     111,   112,   113,   114,   115,   116,   117,   118,   119,   120,
-     121,   122,   123,   124,   125,   126,   127,   128,   129,   130,
-      40,   131,    92,     0,     0,     0,     0,   103,   104,   132,
-     105,   106,   133,     0,     0,     0,   134,   135,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,   107,
-     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
-     118,   119,   120,   121,   122,   123,   124,   125,   126,   127,
-     128,   129,   130,     0,   131,    92,   103,   104,     0,   105,
-     106,     0,   132,     0,     0,   133,     0,     0,     0,   134,
-     135,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,   107,   108,
-     109,   110,   111,   112,   113,   114,   115,   116,   117,   118,
-     119,   120,   121,   122,   123,   124,   125,   126,   127,   128,
-     129,   130,     0,   131,    92,     0,     0,   162,   459,     0,
-       0,   132,     0,     0,   133,     0,     0,     0,   134,   135,
-      57,     0,    58,    59,    60,    61,    62,    63,    64,    65,
-      66,    67,    68,     0,     0,     0,     0,     0,    69,     0,
-       0,     0,     0,     0,     0,     0,    51,     0,     0,     0,
+       0,     0,    96,    97,    98,    99,   100,   101,   102,   103,
+     104,   105,   106,   107,   108,   109,   110,   111,   112,   113,
+     114,   115,   116,   117,   118,   119,    32,   120,    81,     0,
+       0,     0,     0,    92,    93,   121,    94,    95,   122,     0,
+       0,     0,   123,   124,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,    96,    97,    98,    99,   100,
+     101,   102,   103,   104,   105,   106,   107,   108,   109,   110,
+     111,   112,   113,   114,   115,   116,   117,   118,   119,     0,
+     120,    81,    92,    93,     0,    94,    95,     0,   121,     0,
+       0,   122,     0,     0,     0,   123,   124,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,   163
+       0,     0,     0,     0,    96,    97,    98,    99,   100,   101,
+     102,   103,   104,   105,   106,   107,   108,   109,   110,   111,
+     112,   113,   114,   115,   116,   117,   118,   119,     0,   120,
+      81,     0,     0,     0,     0,     0,     0,   121,     0,     0,
+     122,     0,     0,     0,   123,   124
 };
 
 static const yytype_int16 yycheck[] =
 {
-       1,    46,   179,    19,    55,     5,     5,   307,    43,    10,
-      11,    12,    13,    14,    15,    16,    81,    36,    83,     5,
-      21,    22,    23,    24,    25,    26,    27,     5,     5,    84,
-       5,    79,    53,     5,     5,    54,     5,     6,    13,     1,
-      41,     5,     5,     5,     1,    20,    21,    42,     5,    12,
-      13,    13,     5,    17,   244,    12,    71,    52,    73,    94,
-      37,    62,    71,     1,    65,     5,    67,    68,    69,    70,
-      39,    43,    43,    13,   374,     7,     8,     9,    10,    11,
-      96,    81,    81,     1,     1,   385,    89,    73,     1,    90,
-      91,    94,    95,    71,     0,     1,    97,     1,     1,   100,
-     101,   401,   103,   104,   105,   106,   107,   108,   109,   110,
-     111,   112,   113,   114,   115,   116,   117,   118,   119,   120,
-     121,   122,   123,   124,   125,   126,   127,   128,   129,   130,
-     131,   196,   322,   134,   135,    73,     5,     1,   159,   140,
-     161,   157,   197,   198,   145,   193,     0,   148,   151,    81,
-      82,   152,   155,    71,   344,   156,    73,     5,    76,    72,
-     176,     0,   178,    76,   180,     1,    72,    71,    71,     5,
-      73,   172,    76,    76,     7,     8,     9,    10,    11,    15,
-      16,    17,    18,    19,   185,   186,     1,     5,     5,   190,
-     191,   192,     1,   383,    13,     1,     5,     5,    13,     5,
-     201,     5,     0,   206,    13,    74,     1,    71,   209,   399,
-       5,   212,    76,     5,    71,     0,     1,    71,    72,   421,
-      15,    16,    17,    18,    19,     5,    71,    75,     5,   280,
-       1,    40,    12,    72,     5,    71,    72,   285,     5,    75,
-      76,    77,    78,    79,    63,    71,    17,   248,    81,    82,
-      71,   252,   253,    72,    71,    73,   277,    72,   313,    76,
-     261,    70,   265,    71,   280,    71,   267,   444,    72,   270,
-      71,   473,   307,   274,   275,   421,    71,    72,     1,    71,
-      75,    76,    77,    78,    79,   286,    71,    72,    73,   421,
-       5,   421,   482,   294,    17,    72,   297,    12,     1,   315,
-      71,   302,     5,   319,   305,    13,    14,    71,    71,    73,
-      73,    12,    22,    41,    42,   316,     5,   318,   421,    71,
-     321,    73,   338,   324,   325,   376,     1,   473,     5,   350,
-     349,   332,   333,   334,   335,    12,    13,     1,   339,   374,
-     341,   473,   343,   473,   345,     1,    74,   348,    71,     5,
-     385,    66,    41,    42,    35,    36,   357,    65,   359,    15,
-      16,    17,    18,    19,   380,    66,   401,   368,    71,    72,
-     473,   372,   373,    76,    77,    78,    79,   378,   423,    71,
-     396,    73,    71,     1,    39,    74,   387,     5,     5,   410,
-     406,   392,   408,   394,     5,    21,    13,    15,    16,    17,
-      18,    19,    13,     1,   420,     5,    13,     5,   459,     5,
-       5,     6,     5,    13,    12,    71,    72,   418,    21,    75,
-      76,    77,    78,    79,   425,     5,    71,   428,    73,   430,
-      41,    42,    13,    13,   435,    71,    17,    73,    71,   440,
-      73,   462,   443,   459,   445,    41,    42,     1,    41,    42,
-      71,     1,    73,    71,    72,   456,    72,    75,    76,    77,
-      78,    79,    72,    74,     0,     1,    72,     1,    66,    15,
-      16,    17,    18,    19,   475,    71,    12,    13,    74,    15,
-      16,    74,   483,    63,    13,   486,    67,    68,     1,    73,
-     491,   492,     5,    26,     1,    28,    29,    30,   499,    32,
-      33,    34,    73,    27,    40,    38,    75,   508,    44,    45,
+       0,    40,   167,     0,    37,     1,     5,     5,    68,     9,
+      10,    11,    12,    13,    14,    15,    36,    17,    18,    19,
+      20,    21,    22,    23,    12,   261,    13,    43,    45,   154,
+       5,    73,    70,    33,    72,    13,    14,     5,    13,     5,
+       6,     5,     5,    35,    36,    13,     5,     5,     6,    12,
+      83,    51,    20,    21,    54,   294,    56,    57,    58,    59,
+     233,     5,    26,     0,     1,    83,    84,    71,    71,    85,
+      73,     5,     0,    39,    71,    72,    63,    73,    66,    79,
+      80,     1,    81,    81,    43,    72,    86,    65,    63,    89,
+      90,     1,    92,    93,    94,    95,    96,    97,    98,    99,
+     100,   101,   102,   103,   104,   105,   106,   107,   108,   109,
+     110,   111,   112,   113,   114,   115,   116,   117,   118,   119,
+     120,   181,   140,   123,   124,     1,   144,   366,     5,   129,
+       1,    75,   368,   153,   134,    72,   309,   137,   155,   378,
+     265,   141,   267,   185,   186,   145,   184,     1,   164,   149,
+     166,    71,   168,     1,     0,   394,    76,     5,   331,   395,
+     160,    71,    71,    73,     1,     5,    76,    15,    16,    17,
+      18,    19,     5,   173,   174,     1,   408,   195,   178,   179,
+     180,     0,     1,     5,     5,     5,    71,    13,     5,   189,
+       5,    12,     1,    71,    71,    71,     5,    17,   198,    76,
+      76,   201,    73,   376,     1,     5,    15,    16,    17,    18,
+      19,     5,   272,     5,    71,   451,    73,    71,   343,   392,
+      17,     1,    76,    71,    72,     5,    72,    75,    76,    77,
+      78,    79,     5,   465,    74,    72,   254,   237,     5,    76,
+      73,   241,   242,   261,     1,    66,    72,   263,     5,     5,
+     250,    73,    71,    72,    73,    72,   256,    72,   300,   259,
+      17,   294,    71,    72,    37,    71,    75,    76,    77,    78,
+      79,    71,    71,   273,    71,   400,    43,    71,    21,    71,
+       5,   281,   408,    71,   284,    73,   302,    12,    13,   289,
+     306,    71,   292,     7,     8,     9,    10,    11,   408,     5,
+       5,   474,   408,   303,    13,   305,     5,    13,   308,   325,
+       5,   311,   312,   438,    71,   480,     5,   408,    13,   319,
+     320,   321,   322,    13,    13,    21,   326,    17,   328,   454,
+     330,     1,   332,   366,     1,     5,    41,    42,     5,   465,
+     340,   341,    41,    42,     1,   378,    13,     1,     5,   349,
+      72,   351,     5,    72,     1,   465,    13,   373,     5,   465,
+     360,   394,    72,     1,   364,   365,    71,    81,    82,    74,
+     370,   410,    71,   389,   465,    74,     1,    67,    68,   395,
+     380,    22,   399,    40,    71,   385,    73,   387,    41,    42,
+     406,     7,     8,     9,    10,    11,    39,    71,   398,    73,
+      13,    71,    72,     5,   404,     1,    76,    77,    78,    79,
+      73,    13,   412,    70,   498,   415,   500,   417,   434,     1,
+     436,    74,   422,    73,    71,    72,    71,   427,    73,    76,
+      77,    78,    79,     0,     1,   451,     5,     0,     1,    41,
+      42,    41,    42,    12,    13,    71,    13,    73,   448,    71,
+      13,    73,    15,    16,    17,    18,    19,    20,    21,    22,
+      23,    24,    25,    75,    75,    81,    82,   467,    31,    75,
+       0,     1,    74,    40,    74,   475,    39,    13,   478,   479,
+       1,   481,    12,    13,    71,    15,    16,     1,   488,    43,
+       1,     5,     1,     1,     5,   495,     1,    72,    12,    13,
+       5,    12,   502,    70,    71,    72,   506,    12,    27,    72,
+      40,    71,    71,    73,    44,    45,    46,    47,    48,    49,
+      50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
+      60,    61,    62,    63,    64,    65,    66,    67,    72,    69,
+      70,    71,    72,    73,     0,     1,    76,    77,    75,     5,
+      80,     5,    66,    83,    84,    85,    12,    13,    71,    15,
+      16,    66,     5,     5,    71,     1,    73,   399,    72,     5,
+      13,    72,    15,    16,    17,    18,    19,    20,    21,    15,
+      16,    17,    18,    19,    71,    71,    73,    73,    44,    45,
       46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
       56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-      66,    67,    75,    69,    70,    71,    72,    73,     0,     1,
-      76,    77,    13,     5,    80,    75,     1,    83,    84,    85,
-      12,    13,    71,    15,    16,    71,     1,    73,    71,    72,
-       5,     5,    43,    76,    77,    78,    79,    12,    13,    13,
-       1,    15,    16,    17,    18,    19,    20,    21,    71,    71,
-      73,    73,    44,    45,    46,    47,    48,    49,    50,    51,
+      66,    67,    72,    69,    70,    71,    72,    73,    71,     1,
+      73,    77,   409,    71,    80,    73,   143,   485,    84,    85,
+      12,    13,   383,    15,    16,    71,    72,   396,   494,    75,
+      76,    77,    78,    79,    28,    29,    30,   425,    32,    33,
+      34,   379,    41,    13,    38,    15,    16,    17,    18,    19,
+      20,    21,    44,    45,    46,    47,    48,    49,    50,    51,
       52,    53,    54,    55,    56,    57,    58,    59,    60,    61,
-      62,    63,    64,    65,    66,    67,    71,    69,    70,    71,
-      72,    73,    71,     1,    73,    77,     5,    71,    80,    73,
-      71,    66,    84,    85,    12,    13,    72,    15,    16,    13,
-      72,    15,    16,    17,    18,    19,    20,    21,    75,    72,
-       0,     1,    13,     5,    15,    16,    17,    18,    19,    20,
-      71,   349,    73,    13,    72,    72,    44,    45,    46,    47,
+      62,    63,    64,    65,    66,    67,   295,    69,    70,    71,
+      72,    73,   162,     1,    76,    77,   275,    71,    80,    73,
+      70,    83,    84,    85,    12,    13,   352,    15,    16,    71,
+      71,    73,    73,     1,   445,    83,    13,     5,    15,    16,
+      17,    18,    19,    20,   416,   243,   125,    15,    16,    17,
+      18,    19,   465,   399,   399,    -1,    44,    45,    46,    47,
       48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
       58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
-      40,    69,    70,    71,    72,    73,   422,     1,    76,    77,
-     154,    71,    80,    73,   449,    83,    84,    85,    12,    13,
-     390,    15,    16,    71,   487,    73,   489,   438,   369,   498,
-      70,    71,    72,   386,    47,    81,   308,   174,   288,   360,
-     453,    94,   429,   254,   136,   473,   349,   349,    -1,    -1,
+      -1,    69,    70,    71,    72,    73,    -1,     1,    76,    77,
+      -1,     5,    80,    -1,    -1,    83,    84,    85,    12,    13,
+      -1,    15,    16,    71,    72,    -1,    -1,    75,    76,    77,
+      78,    79,    15,    16,    17,    18,    19,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
       44,    45,    46,    47,    48,    49,    50,    51,    52,    53,
       54,    55,    56,    57,    58,    59,    60,    61,    62,    63,
       64,    65,    66,    67,    -1,    69,    70,    71,    72,    73,
-      -1,     1,    76,    77,    -1,     5,    80,    -1,    -1,    83,
-      84,    85,    12,    13,     5,    15,    16,    -1,    -1,    -1,
-      -1,    -1,    13,    -1,    15,    16,    17,    18,    19,    20,
-      21,    22,    23,    24,    25,    -1,    -1,    -1,    -1,    -1,
-      31,    -1,    -1,    -1,    44,    45,    46,    47,    48,    49,
+      -1,     1,    -1,    77,    -1,     5,    80,    -1,    -1,     5,
+      84,    85,    12,    13,    -1,    15,    16,    13,    -1,    15,
+      16,    17,    18,    19,    20,    21,    22,    23,    24,    25,
+      -1,    -1,    -1,    -1,    -1,    31,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,    49,
       50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
       60,    61,    62,    63,    64,    65,    66,    67,    -1,    69,
-      70,    71,    72,    73,    -1,     1,    -1,    77,    -1,     5,
-      80,    -1,    -1,    -1,    84,    85,    12,    13,    -1,    15,
-      16,    44,    45,    46,    47,    48,    49,    50,    51,    52,
+      70,    -1,    -1,    -1,    -1,    75,    76,    77,     1,    -1,
+      80,     0,     1,    83,    84,    85,    -1,    -1,    -1,    12,
+      13,    -1,    15,    16,    13,    -1,    15,    16,    17,    18,
+      19,    20,    21,    22,    23,    24,    25,    -1,    -1,    -1,
+      -1,    -1,    31,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      39,    44,    45,    46,    47,    48,    49,    50,    51,    52,
       53,    54,    55,    56,    57,    58,    59,    60,    61,    62,
-      63,    64,    65,    -1,    -1,    -1,    -1,    -1,    44,    45,
+      63,    64,    65,    66,    67,    -1,    69,    70,    -1,    72,
+      -1,    -1,     1,    76,    77,    -1,    -1,    80,    -1,    -1,
+      83,    84,    85,    12,    13,    -1,    15,    16,    44,    45,
       46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
       56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-      66,    67,    -1,    69,    70,    -1,    -1,    -1,    -1,    75,
-      76,    77,     1,    -1,    80,     0,     1,    83,    84,    85,
-      -1,    -1,    -1,    12,    13,    -1,    15,    16,    13,    -1,
-      15,    16,    17,    18,    19,    20,    21,    22,    23,    24,
-      25,    -1,    -1,    -1,    -1,    -1,    31,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    39,    44,    45,    46,    47,    48,
+      -1,    -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,
       49,    50,    51,    52,    53,    54,    55,    56,    57,    58,
       59,    60,    61,    62,    63,    64,    65,    66,    67,    -1,
-      69,    70,    -1,    72,    -1,    -1,     1,    76,    77,    -1,
-      -1,    80,    -1,    -1,    83,    84,    85,    12,    13,    -1,
-      15,    16,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      69,    70,    -1,    -1,    -1,    -1,    75,    76,    77,     1,
+      -1,    80,    -1,     5,    83,    84,    85,    -1,    -1,    -1,
+      12,    13,    -1,    15,    16,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,
-      45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
-      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
-      65,    66,    67,    -1,    69,    70,    -1,    -1,    -1,    -1,
-      75,    76,    77,     1,    -1,    80,    -1,     5,    83,    84,
-      85,    -1,    -1,    -1,    12,    13,    -1,    15,    16,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    44,    45,    46,    47,    48,    49,    50,    51,
+      52,    53,    54,    55,    56,    57,    58,    59,    60,    61,
+      62,    63,    64,    65,    66,    67,     5,    69,    70,    -1,
+      -1,    -1,    -1,    12,    13,    77,    15,    16,    80,    -1,
+      -1,    -1,    84,    85,    -1,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    44,    45,    46,    47,
-      48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
-       5,    69,    70,    -1,    -1,    -1,    -1,    12,    13,    77,
-      15,    16,    80,    -1,    -1,    -1,    84,    85,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,
-      45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
-      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
-      65,    66,    67,    -1,    69,    70,    12,    13,    -1,    15,
-      16,    -1,    77,    -1,    -1,    80,    -1,    -1,    -1,    84,
-      85,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,    45,
-      46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
-      56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-      66,    67,    -1,    69,    70,    -1,    -1,     0,     1,    -1,
-      -1,    77,    -1,    -1,    80,    -1,    -1,    -1,    84,    85,
-      13,    -1,    15,    16,    17,    18,    19,    20,    21,    22,
-      23,    24,    25,    -1,    -1,    -1,    -1,    -1,    31,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    39,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,
+      49,    50,    51,    52,    53,    54,    55,    56,    57,    58,
+      59,    60,    61,    62,    63,    64,    65,    66,    67,    -1,
+      69,    70,    12,    13,    -1,    15,    16,    -1,    77,    -1,
+      -1,    80,    -1,    -1,    -1,    84,    85,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    72
+      -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,    49,
+      50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
+      60,    61,    62,    63,    64,    65,    66,    67,    -1,    69,
+      70,    -1,    -1,    -1,    -1,    -1,    -1,    77,    -1,    -1,
+      80,    -1,    -1,    -1,    84,    85
 };
 
 /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
    symbol of state STATE-NUM.  */
 static const yytype_uint8 yystos[] =
 {
-       0,    26,    28,    29,    30,    32,    33,    34,    38,    87,
-      89,    90,    91,    92,    93,    94,    95,    98,   100,     1,
-      96,    71,    71,    71,    71,     5,    71,    71,     0,    96,
-      96,    96,    96,    96,    96,    96,    97,    71,    73,   174,
-       5,    12,    96,    96,    96,    96,    96,    96,    96,     5,
-       6,    39,   101,   169,   170,     1,    96,    13,    15,    16,
-      17,    18,    19,    20,    21,    22,    23,    24,    25,    31,
-      88,   105,   110,   129,   131,   137,   138,   141,   142,   143,
-     144,   145,   146,   147,   148,   149,   150,   152,   155,     1,
-      13,    40,    70,   156,   157,   158,   159,   165,    13,    63,
-     134,   135,   136,    12,    13,    15,    16,    44,    45,    46,
-      47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
-      57,    58,    59,    60,    61,    62,    63,    64,    65,    66,
-      67,    69,    77,    80,    84,    85,   140,   161,   163,   164,
-     165,   166,   167,    41,    42,    74,   122,   123,   125,   126,
-     142,     1,    13,   113,   114,   115,   116,     1,   102,   110,
-      97,   169,     0,    72,    99,   174,   175,    73,    21,    13,
-      17,    67,    68,    13,    96,    21,     1,    96,     1,    96,
-       1,    96,    96,    96,     1,    71,    76,   146,     1,     5,
-      77,    78,    79,   139,    13,    20,   147,   148,   148,     1,
-     149,    73,   175,    96,    96,    72,     1,   158,   175,    73,
-     175,     1,    17,   174,    96,    96,    96,    96,    96,    96,
+       0,    28,    29,    30,    32,    33,    34,    38,    87,    89,
+      90,    91,    92,    93,    94,    95,    96,    71,    71,    71,
+      71,     5,    71,    71,     0,    96,    96,    96,    96,    96,
+      96,    96,     5,    26,    98,   100,    96,    96,    96,    96,
+      96,    96,    96,     1,    96,    97,    13,    15,    16,    17,
+      18,    19,    20,    21,    22,    23,    24,    25,    31,    88,
+     105,   110,   129,   131,   137,   138,   141,   142,   143,   144,
+     145,   146,   147,   148,   149,   150,   152,   155,     1,    13,
+      40,    70,   156,   157,   158,   159,   165,    13,    63,   134,
+     135,   136,    12,    13,    15,    16,    44,    45,    46,    47,
+      48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
+      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
+      69,    77,    80,    84,    85,   140,   161,   163,   164,   165,
+     166,   167,    41,    42,    74,   122,   123,   125,   126,   142,
+       1,    13,   113,   114,   115,   116,    71,    73,   174,    12,
+       5,     6,    39,   101,   169,   170,    21,    13,    17,    67,
+      68,    13,    96,    21,     1,    96,     1,    96,     1,    96,
+      96,    96,     1,    71,    76,   146,     1,     5,    77,    78,
+      79,   139,    13,    20,   147,   148,   148,     1,   149,    73,
+     174,   175,    96,    96,    72,     1,   158,   175,    73,   175,
+       1,    17,   174,    96,    96,    96,    96,    96,    96,    96,
       96,    96,    96,    96,    96,    96,    96,    96,    96,    96,
       96,    96,    96,    96,    96,    96,    96,    96,    96,    96,
-      96,    96,    96,    96,    96,    96,    96,    96,    62,   164,
-       1,    72,    76,    83,   162,    96,    96,    96,    96,    72,
-      72,    73,   175,    96,    72,     1,   115,    73,   175,     1,
-      17,    96,    73,   174,    35,    36,   103,   111,    97,    97,
-       1,    13,    13,    14,    65,    96,    13,    20,   145,   151,
-      73,   174,    12,    66,   119,    73,   174,    71,   126,   128,
-      73,   174,    71,    12,    13,   132,    72,    96,    96,    96,
-      96,    96,   146,   148,    96,     1,    73,   175,    73,     1,
-      96,    73,    96,    72,    71,    76,     1,   161,    96,    96,
-      96,   163,    13,   120,    43,    13,   130,    96,     1,    73,
-     175,    73,    96,    73,    96,    71,    96,    96,    27,   104,
-     117,    97,    99,   174,    75,    75,    75,   146,    96,    13,
-     151,     7,     8,     9,    10,    11,    81,    82,   153,    96,
-      96,     1,    71,    76,    96,    96,   156,   144,    73,    96,
-       1,    96,    96,     1,   161,    96,    96,    75,    96,    96,
-      96,    96,    43,   124,    73,    96,     1,    96,    96,     1,
-     161,    96,   127,   128,    37,   112,     1,    96,     1,   105,
-     106,   110,   169,   171,   173,    97,    96,    81,   153,    96,
-     127,   107,    96,    96,   156,    71,    99,    96,    73,   161,
-      40,   160,   156,   136,    96,    17,   121,   122,    96,    96,
-      73,   161,   156,    71,     5,    71,    73,   174,    13,   118,
-     174,    97,    75,    96,    12,    13,   154,    73,   174,     1,
-      99,   108,   109,   129,   131,   137,   138,   141,   168,   169,
-     171,   172,   173,   107,   126,    72,    96,    96,   160,    96,
-       1,    72,    96,    75,   123,    96,    72,    96,   128,    96,
-       5,   119,   154,    96,    99,    97,   168,    96,   133,   161,
-      96,    96,   113,   113,    96,    96,    81,    72,   134,    96,
-      72,    72,    73,    81,    96
+      96,    96,    96,    96,    96,    96,    96,    62,   164,     1,
+      72,    76,    83,   162,    96,    96,    96,    96,    72,    72,
+      73,   175,    96,    72,     1,   115,    73,   175,     1,    17,
+      96,     1,    96,     1,   102,   110,    97,   169,    13,    13,
+      14,    65,    96,    13,    20,   145,   151,    73,   174,    12,
+      66,   119,    73,   174,    71,   126,   128,    73,   174,    71,
+      12,    13,   132,    72,    96,    96,    96,    96,    96,   146,
+     148,    96,     1,    73,   175,    73,     1,    96,    73,    96,
+      72,    71,    76,     1,   161,    96,    96,    96,   163,    13,
+     120,    43,    13,   130,    96,     1,    73,   175,    73,    96,
+      73,    96,    71,     0,    72,    99,   175,    73,    73,   174,
+      35,    36,   103,   111,    97,    97,    75,    75,    75,   146,
+      96,    13,   151,     7,     8,     9,    10,    11,    81,    82,
+     153,    96,    96,     1,    71,    76,    96,    96,   156,   144,
+      73,   174,    96,     1,    96,    96,     1,   161,    96,    96,
+      75,    96,    96,    96,    96,    43,   124,    73,    96,     1,
+      96,    96,     1,   161,    96,     1,    96,    96,    27,   104,
+     117,    97,    96,    81,   153,    96,   127,   128,   107,    96,
+      96,   156,    71,    99,    96,    73,   161,    40,   160,   156,
+     136,    96,    17,   121,   122,    96,    96,    73,   161,   156,
+      99,   127,    37,   112,     1,    96,     1,   105,   106,   110,
+     169,   171,   173,    97,    75,    96,    12,    13,   154,    73,
+     174,     1,    99,   108,   109,   129,   131,   137,   138,   141,
+     168,   169,   171,   172,   173,   107,   126,    72,    96,    96,
+     160,    96,     1,    72,    96,    75,   123,    96,    72,    71,
+       5,    71,    73,   174,    13,   118,   174,    97,   154,    96,
+      99,    97,   168,    96,   133,   161,    96,    96,    96,   128,
+      96,     5,   119,    96,    81,    72,   134,    96,   113,   113,
+      96,    81,    96,    72,    72,    73
 };
 
 #define yyerrok		(yyerrstatus = 0)
@@ -3907,7 +3897,7 @@ yyreduce:
 
 
 /* Line 1267 of yacc.c.  */
-#line 3911 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+#line 3901 "WebCore/tmp/../generated/CSSGrammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
index d4e26cc704..8780c3684f 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
@@ -241,25 +241,25 @@ findProp (register const char *str, register unsigned int len)
       {"zoom", CSSPropertyZoom},
 #line 23 "CSSPropertyNames.gperf"
       {"border", CSSPropertyBorder},
-#line 266 "CSSPropertyNames.gperf"
+#line 267 "CSSPropertyNames.gperf"
       {"marker", CSSPropertyMarker},
 #line 24 "CSSPropertyNames.gperf"
       {"border-bottom", CSSPropertyBorderBottom},
-#line 268 "CSSPropertyNames.gperf"
+#line 269 "CSSPropertyNames.gperf"
       {"marker-mid", CSSPropertyMarkerMid},
-#line 79 "CSSPropertyNames.gperf"
+#line 78 "CSSPropertyNames.gperf"
       {"margin", CSSPropertyMargin},
 #line 285 "CSSPropertyNames.gperf"
       {"kerning", CSSPropertyKerning},
-#line 267 "CSSPropertyNames.gperf"
+#line 268 "CSSPropertyNames.gperf"
       {"marker-end", CSSPropertyMarkerEnd},
-#line 80 "CSSPropertyNames.gperf"
+#line 79 "CSSPropertyNames.gperf"
       {"margin-bottom", CSSPropertyMarginBottom},
-#line 250 "CSSPropertyNames.gperf"
+#line 251 "CSSPropertyNames.gperf"
       {"mask", CSSPropertyMask},
-#line 271 "CSSPropertyNames.gperf"
+#line 272 "CSSPropertyNames.gperf"
       {"stroke", CSSPropertyStroke},
-#line 112 "CSSPropertyNames.gperf"
+#line 111 "CSSPropertyNames.gperf"
       {"size", CSSPropertySize},
 #line 144 "CSSPropertyNames.gperf"
       {"word-break", CSSPropertyWordBreak},
@@ -267,115 +267,115 @@ findProp (register const char *str, register unsigned int len)
       {"writing-mode", CSSPropertyWritingMode},
 #line 162 "CSSPropertyNames.gperf"
       {"-webkit-binding", CSSPropertyWebkitBinding},
-#line 110 "CSSPropertyNames.gperf"
+#line 109 "CSSPropertyNames.gperf"
       {"resize", CSSPropertyResize},
-#line 265 "CSSPropertyNames.gperf"
+#line 266 "CSSPropertyNames.gperf"
       {"image-rendering", CSSPropertyImageRendering},
 #line 149 "CSSPropertyNames.gperf"
       {"-webkit-animation", CSSPropertyWebkitAnimation},
 #line 165 "CSSPropertyNames.gperf"
       {"-webkit-border-image", CSSPropertyWebkitBorderImage},
-#line 204 "CSSPropertyNames.gperf"
+#line 205 "CSSPropertyNames.gperf"
       {"-webkit-mask", CSSPropertyWebkitMask},
 #line 136 "CSSPropertyNames.gperf"
       {"top", CSSPropertyTop},
 #line 142 "CSSPropertyNames.gperf"
       {"widows", CSSPropertyWidows},
-#line 269 "CSSPropertyNames.gperf"
+#line 270 "CSSPropertyNames.gperf"
       {"marker-start", CSSPropertyMarkerStart},
 #line 154 "CSSPropertyNames.gperf"
       {"-webkit-animation-name", CSSPropertyWebkitAnimationName},
-#line 103 "CSSPropertyNames.gperf"
+#line 102 "CSSPropertyNames.gperf"
       {"page", CSSPropertyPage},
-#line 209 "CSSPropertyNames.gperf"
+#line 210 "CSSPropertyNames.gperf"
       {"-webkit-mask-image", CSSPropertyWebkitMaskImage},
 #line 43 "CSSPropertyNames.gperf"
       {"border-top", CSSPropertyBorderTop},
-#line 98 "CSSPropertyNames.gperf"
+#line 97 "CSSPropertyNames.gperf"
       {"padding", CSSPropertyPadding},
-#line 239 "CSSPropertyNames.gperf"
+#line 240 "CSSPropertyNames.gperf"
       {"-webkit-transition", CSSPropertyWebkitTransition},
-#line 210 "CSSPropertyNames.gperf"
+#line 211 "CSSPropertyNames.gperf"
       {"-webkit-mask-origin", CSSPropertyWebkitMaskOrigin},
-#line 99 "CSSPropertyNames.gperf"
+#line 98 "CSSPropertyNames.gperf"
       {"padding-bottom", CSSPropertyPaddingBottom},
-#line 83 "CSSPropertyNames.gperf"
+#line 82 "CSSPropertyNames.gperf"
       {"margin-top", CSSPropertyMarginTop},
-#line 196 "CSSPropertyNames.gperf"
+#line 197 "CSSPropertyNames.gperf"
       {"-webkit-margin-start", CSSPropertyWebkitMarginStart},
-#line 56 "CSSPropertyNames.gperf"
+#line 55 "CSSPropertyNames.gperf"
       {"content", CSSPropertyContent},
-#line 108 "CSSPropertyNames.gperf"
+#line 107 "CSSPropertyNames.gperf"
       {"position", CSSPropertyPosition},
-#line 60 "CSSPropertyNames.gperf"
+#line 59 "CSSPropertyNames.gperf"
       {"direction", CSSPropertyDirection},
-#line 217 "CSSPropertyNames.gperf"
+#line 218 "CSSPropertyNames.gperf"
       {"-webkit-mask-size", CSSPropertyWebkitMaskSize},
-#line 113 "CSSPropertyNames.gperf"
+#line 112 "CSSPropertyNames.gperf"
       {"src", CSSPropertySrc},
 #line 146 "CSSPropertyNames.gperf"
       {"word-wrap", CSSPropertyWordWrap},
-#line 219 "CSSPropertyNames.gperf"
+#line 220 "CSSPropertyNames.gperf"
       {"-webkit-nbsp-mode", CSSPropertyWebkitNbspMode},
-#line 106 "CSSPropertyNames.gperf"
+#line 105 "CSSPropertyNames.gperf"
       {"page-break-inside", CSSPropertyPageBreakInside},
-#line 214 "CSSPropertyNames.gperf"
+#line 215 "CSSPropertyNames.gperf"
       {"-webkit-mask-repeat", CSSPropertyWebkitMaskRepeat},
-#line 102 "CSSPropertyNames.gperf"
+#line 101 "CSSPropertyNames.gperf"
       {"padding-top", CSSPropertyPaddingTop},
-#line 220 "CSSPropertyNames.gperf"
+#line 221 "CSSPropertyNames.gperf"
       {"-webkit-padding-start", CSSPropertyWebkitPaddingStart},
 #line 151 "CSSPropertyNames.gperf"
       {"-webkit-animation-direction", CSSPropertyWebkitAnimationDirection},
-#line 211 "CSSPropertyNames.gperf"
+#line 212 "CSSPropertyNames.gperf"
       {"-webkit-mask-position", CSSPropertyWebkitMaskPosition},
-#line 192 "CSSPropertyNames.gperf"
+#line 193 "CSSPropertyNames.gperf"
       {"-webkit-line-break", CSSPropertyWebkitLineBreak},
-#line 276 "CSSPropertyNames.gperf"
+#line 277 "CSSPropertyNames.gperf"
       {"stroke-miterlimit", CSSPropertyStrokeMiterlimit},
-#line 225 "CSSPropertyNames.gperf"
+#line 226 "CSSPropertyNames.gperf"
       {"-webkit-rtl-ordering", CSSPropertyWebkitRtlOrdering},
-#line 275 "CSSPropertyNames.gperf"
+#line 276 "CSSPropertyNames.gperf"
       {"stroke-linejoin", CSSPropertyStrokeLinejoin},
 #line 282 "CSSPropertyNames.gperf"
       {"dominant-baseline", CSSPropertyDominantBaseline},
-#line 52 "CSSPropertyNames.gperf"
+#line 51 "CSSPropertyNames.gperf"
       {"caption-side", CSSPropertyCaptionSide},
-#line 107 "CSSPropertyNames.gperf"
+#line 106 "CSSPropertyNames.gperf"
       {"pointer-events", CSSPropertyPointerEvents},
-#line 55 "CSSPropertyNames.gperf"
+#line 54 "CSSPropertyNames.gperf"
       {"color", CSSPropertyColor},
 #line 41 "CSSPropertyNames.gperf"
       {"border-spacing", CSSPropertyBorderSpacing},
-#line 53 "CSSPropertyNames.gperf"
+#line 52 "CSSPropertyNames.gperf"
       {"clear", CSSPropertyClear},
 #line 36 "CSSPropertyNames.gperf"
       {"border-radius", CSSPropertyBorderRadius},
-#line 109 "CSSPropertyNames.gperf"
+#line 108 "CSSPropertyNames.gperf"
       {"quotes", CSSPropertyQuotes},
 #line 145 "CSSPropertyNames.gperf"
       {"word-spacing", CSSPropertyWordSpacing},
 #line 31 "CSSPropertyNames.gperf"
       {"border-color", CSSPropertyBorderColor},
-#line 198 "CSSPropertyNames.gperf"
+#line 199 "CSSPropertyNames.gperf"
       {"-webkit-marquee", CSSPropertyWebkitMarquee},
 #line 25 "CSSPropertyNames.gperf"
       {"border-bottom-color", CSSPropertyBorderBottomColor},
 #line 152 "CSSPropertyNames.gperf"
       {"-webkit-animation-duration", CSSPropertyWebkitAnimationDuration},
-#line 244 "CSSPropertyNames.gperf"
+#line 245 "CSSPropertyNames.gperf"
       {"-webkit-user-drag", CSSPropertyWebkitUserDrag},
 #line 166 "CSSPropertyNames.gperf"
       {"-webkit-border-radius", CSSPropertyWebkitBorderRadius},
-#line 208 "CSSPropertyNames.gperf"
+#line 209 "CSSPropertyNames.gperf"
       {"-webkit-mask-composite", CSSPropertyWebkitMaskComposite},
-#line 261 "CSSPropertyNames.gperf"
+#line 262 "CSSPropertyNames.gperf"
       {"color-rendering", CSSPropertyColorRendering},
 #line 137 "CSSPropertyNames.gperf"
       {"unicode-bidi", CSSPropertyUnicodeBidi},
-#line 54 "CSSPropertyNames.gperf"
+#line 53 "CSSPropertyNames.gperf"
       {"clip", CSSPropertyClip},
-#line 241 "CSSPropertyNames.gperf"
+#line 242 "CSSPropertyNames.gperf"
       {"-webkit-transition-duration", CSSPropertyWebkitTransitionDuration},
 #line 157 "CSSPropertyNames.gperf"
       {"-webkit-appearance", CSSPropertyWebkitAppearance},
@@ -383,9 +383,9 @@ findProp (register const char *str, register unsigned int len)
       {"background", CSSPropertyBackground},
 #line 138 "CSSPropertyNames.gperf"
       {"unicode-range", CSSPropertyUnicodeRange},
-#line 59 "CSSPropertyNames.gperf"
+#line 58 "CSSPropertyNames.gperf"
       {"cursor", CSSPropertyCursor},
-#line 90 "CSSPropertyNames.gperf"
+#line 89 "CSSPropertyNames.gperf"
       {"outline", CSSPropertyOutline},
 #line 14 "CSSPropertyNames.gperf"
       {"background-image", CSSPropertyBackgroundImage},
@@ -393,171 +393,171 @@ findProp (register const char *str, register unsigned int len)
       {"border-top-color", CSSPropertyBorderTopColor},
 #line 15 "CSSPropertyNames.gperf"
       {"background-origin", CSSPropertyBackgroundOrigin},
-#line 58 "CSSPropertyNames.gperf"
+#line 57 "CSSPropertyNames.gperf"
       {"counter-reset", CSSPropertyCounterReset},
-#line 256 "CSSPropertyNames.gperf"
+#line 257 "CSSPropertyNames.gperf"
       {"stop-color", CSSPropertyStopColor},
 #line 280 "CSSPropertyNames.gperf"
       {"alignment-baseline", CSSPropertyAlignmentBaseline},
 #line 22 "CSSPropertyNames.gperf"
       {"background-size", CSSPropertyBackgroundSize},
-#line 201 "CSSPropertyNames.gperf"
+#line 202 "CSSPropertyNames.gperf"
       {"-webkit-marquee-repetition", CSSPropertyWebkitMarqueeRepetition},
-#line 274 "CSSPropertyNames.gperf"
+#line 275 "CSSPropertyNames.gperf"
       {"stroke-linecap", CSSPropertyStrokeLinecap},
 #line 161 "CSSPropertyNames.gperf"
       {"-webkit-background-origin", CSSPropertyWebkitBackgroundOrigin},
-#line 73 "CSSPropertyNames.gperf"
+#line 72 "CSSPropertyNames.gperf"
       {"letter-spacing", CSSPropertyLetterSpacing},
-#line 202 "CSSPropertyNames.gperf"
+#line 203 "CSSPropertyNames.gperf"
       {"-webkit-marquee-speed", CSSPropertyWebkitMarqueeSpeed},
-#line 207 "CSSPropertyNames.gperf"
+#line 208 "CSSPropertyNames.gperf"
       {"-webkit-mask-clip", CSSPropertyWebkitMaskClip},
 #line 153 "CSSPropertyNames.gperf"
       {"-webkit-animation-iteration-count", CSSPropertyWebkitAnimationIterationCount},
-#line 199 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-direction", CSSPropertyWebkitMarqueeDirection},
 #line 200 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-direction", CSSPropertyWebkitMarqueeDirection},
+#line 201 "CSSPropertyNames.gperf"
       {"-webkit-marquee-increment", CSSPropertyWebkitMarqueeIncrement},
 #line 19 "CSSPropertyNames.gperf"
       {"background-repeat", CSSPropertyBackgroundRepeat},
-#line 221 "CSSPropertyNames.gperf"
+#line 222 "CSSPropertyNames.gperf"
       {"-webkit-perspective", CSSPropertyWebkitPerspective},
-#line 111 "CSSPropertyNames.gperf"
+#line 110 "CSSPropertyNames.gperf"
       {"right", CSSPropertyRight},
-#line 57 "CSSPropertyNames.gperf"
+#line 56 "CSSPropertyNames.gperf"
       {"counter-increment", CSSPropertyCounterIncrement},
 #line 143 "CSSPropertyNames.gperf"
       {"width", CSSPropertyWidth},
 #line 16 "CSSPropertyNames.gperf"
       {"background-position", CSSPropertyBackgroundPosition},
-#line 87 "CSSPropertyNames.gperf"
+#line 86 "CSSPropertyNames.gperf"
       {"min-width", CSSPropertyMinWidth},
-#line 222 "CSSPropertyNames.gperf"
+#line 223 "CSSPropertyNames.gperf"
       {"-webkit-perspective-origin", CSSPropertyWebkitPerspectiveOrigin},
 #line 37 "CSSPropertyNames.gperf"
       {"border-right", CSSPropertyBorderRight},
 #line 49 "CSSPropertyNames.gperf"
       {"border-width", CSSPropertyBorderWidth},
-#line 64 "CSSPropertyNames.gperf"
+#line 63 "CSSPropertyNames.gperf"
       {"font", CSSPropertyFont},
-#line 82 "CSSPropertyNames.gperf"
+#line 81 "CSSPropertyNames.gperf"
       {"margin-right", CSSPropertyMarginRight},
 #line 29 "CSSPropertyNames.gperf"
       {"border-bottom-width", CSSPropertyBorderBottomWidth},
-#line 251 "CSSPropertyNames.gperf"
+#line 252 "CSSPropertyNames.gperf"
       {"enable-background", CSSPropertyEnableBackground},
-#line 278 "CSSPropertyNames.gperf"
+#line 279 "CSSPropertyNames.gperf"
       {"stroke-width", CSSPropertyStrokeWidth},
-#line 188 "CSSPropertyNames.gperf"
+#line 189 "CSSPropertyNames.gperf"
       {"-webkit-columns", CSSPropertyWebkitColumns},
-#line 193 "CSSPropertyNames.gperf"
+#line 194 "CSSPropertyNames.gperf"
       {"-webkit-line-clamp", CSSPropertyWebkitLineClamp},
-#line 258 "CSSPropertyNames.gperf"
+#line 259 "CSSPropertyNames.gperf"
       {"color-interpolation", CSSPropertyColorInterpolation},
 #line 163 "CSSPropertyNames.gperf"
       {"-webkit-border-fit", CSSPropertyWebkitBorderFit},
-#line 66 "CSSPropertyNames.gperf"
+#line 65 "CSSPropertyNames.gperf"
       {"font-size", CSSPropertyFontSize},
 #line 30 "CSSPropertyNames.gperf"
       {"border-collapse", CSSPropertyBorderCollapse},
-#line 117 "CSSPropertyNames.gperf"
+#line 116 "CSSPropertyNames.gperf"
       {"text-indent", CSSPropertyTextIndent},
 #line 147 "CSSPropertyNames.gperf"
       {"z-index", CSSPropertyZIndex},
 #line 139 "CSSPropertyNames.gperf"
       {"vertical-align", CSSPropertyVerticalAlign},
-#line 180 "CSSPropertyNames.gperf"
+#line 181 "CSSPropertyNames.gperf"
       {"-webkit-column-break-inside", CSSPropertyWebkitColumnBreakInside},
-#line 101 "CSSPropertyNames.gperf"
+#line 100 "CSSPropertyNames.gperf"
       {"padding-right", CSSPropertyPaddingRight},
-#line 246 "CSSPropertyNames.gperf"
+#line 247 "CSSPropertyNames.gperf"
       {"-webkit-user-select", CSSPropertyWebkitUserSelect},
 #line 48 "CSSPropertyNames.gperf"
       {"border-top-width", CSSPropertyBorderTopWidth},
-#line 279 "CSSPropertyNames.gperf"
+#line 128 "CSSPropertyNames.gperf"
       {"text-rendering", CSSPropertyTextRendering},
-#line 89 "CSSPropertyNames.gperf"
+#line 88 "CSSPropertyNames.gperf"
       {"orphans", CSSPropertyOrphans},
 #line 174 "CSSPropertyNames.gperf"
       {"-webkit-box-orient", CSSPropertyWebkitBoxOrient},
-#line 233 "CSSPropertyNames.gperf"
+#line 234 "CSSPropertyNames.gperf"
       {"-webkit-transform", CSSPropertyWebkitTransform},
-#line 182 "CSSPropertyNames.gperf"
+#line 183 "CSSPropertyNames.gperf"
       {"-webkit-column-gap", CSSPropertyWebkitColumnGap},
-#line 195 "CSSPropertyNames.gperf"
+#line 196 "CSSPropertyNames.gperf"
       {"-webkit-margin-collapse", CSSPropertyWebkitMarginCollapse},
 #line 160 "CSSPropertyNames.gperf"
       {"-webkit-background-composite", CSSPropertyWebkitBackgroundComposite},
-#line 194 "CSSPropertyNames.gperf"
+#line 195 "CSSPropertyNames.gperf"
       {"-webkit-margin-bottom-collapse", CSSPropertyWebkitMarginBottomCollapse},
 #line 13 "CSSPropertyNames.gperf"
       {"background-color", CSSPropertyBackgroundColor},
-#line 230 "CSSPropertyNames.gperf"
+#line 231 "CSSPropertyNames.gperf"
       {"-webkit-text-stroke", CSSPropertyWebkitTextStroke},
-#line 270 "CSSPropertyNames.gperf"
+#line 271 "CSSPropertyNames.gperf"
       {"shape-rendering", CSSPropertyShapeRendering},
-#line 105 "CSSPropertyNames.gperf"
+#line 104 "CSSPropertyNames.gperf"
       {"page-break-before", CSSPropertyPageBreakBefore},
-#line 234 "CSSPropertyNames.gperf"
+#line 235 "CSSPropertyNames.gperf"
       {"-webkit-transform-origin", CSSPropertyWebkitTransformOrigin},
-#line 104 "CSSPropertyNames.gperf"
+#line 103 "CSSPropertyNames.gperf"
       {"page-break-after", CSSPropertyPageBreakAfter},
-#line 91 "CSSPropertyNames.gperf"
+#line 90 "CSSPropertyNames.gperf"
       {"outline-color", CSSPropertyOutlineColor},
-#line 206 "CSSPropertyNames.gperf"
+#line 207 "CSSPropertyNames.gperf"
       {"-webkit-mask-box-image", CSSPropertyWebkitMaskBoxImage},
-#line 177 "CSSPropertyNames.gperf"
+#line 178 "CSSPropertyNames.gperf"
       {"-webkit-box-sizing", CSSPropertyWebkitBoxSizing},
-#line 72 "CSSPropertyNames.gperf"
+#line 71 "CSSPropertyNames.gperf"
       {"left", CSSPropertyLeft},
-#line 237 "CSSPropertyNames.gperf"
+#line 238 "CSSPropertyNames.gperf"
       {"-webkit-transform-origin-z", CSSPropertyWebkitTransformOriginZ},
-#line 69 "CSSPropertyNames.gperf"
+#line 68 "CSSPropertyNames.gperf"
       {"font-variant", CSSPropertyFontVariant},
-#line 63 "CSSPropertyNames.gperf"
+#line 62 "CSSPropertyNames.gperf"
       {"float", CSSPropertyFloat},
-#line 252 "CSSPropertyNames.gperf"
+#line 253 "CSSPropertyNames.gperf"
       {"filter", CSSPropertyFilter},
 #line 32 "CSSPropertyNames.gperf"
       {"border-left", CSSPropertyBorderLeft},
-#line 205 "CSSPropertyNames.gperf"
+#line 206 "CSSPropertyNames.gperf"
       {"-webkit-mask-attachment", CSSPropertyWebkitMaskAttachment},
-#line 116 "CSSPropertyNames.gperf"
+#line 115 "CSSPropertyNames.gperf"
       {"text-decoration", CSSPropertyTextDecoration},
-#line 81 "CSSPropertyNames.gperf"
+#line 80 "CSSPropertyNames.gperf"
       {"margin-left", CSSPropertyMarginLeft},
 #line 12 "CSSPropertyNames.gperf"
       {"background-clip", CSSPropertyBackgroundClip},
-#line 197 "CSSPropertyNames.gperf"
+#line 198 "CSSPropertyNames.gperf"
       {"-webkit-margin-top-collapse", CSSPropertyWebkitMarginTopCollapse},
 #line 167 "CSSPropertyNames.gperf"
       {"-webkit-border-vertical-spacing", CSSPropertyWebkitBorderVerticalSpacing},
-#line 249 "CSSPropertyNames.gperf"
+#line 250 "CSSPropertyNames.gperf"
       {"clip-rule", CSSPropertyClipRule},
 #line 169 "CSSPropertyNames.gperf"
       {"-webkit-box-direction", CSSPropertyWebkitBoxDirection},
 #line 141 "CSSPropertyNames.gperf"
       {"white-space", CSSPropertyWhiteSpace},
-#line 115 "CSSPropertyNames.gperf"
+#line 114 "CSSPropertyNames.gperf"
       {"text-align", CSSPropertyTextAlign},
-#line 215 "CSSPropertyNames.gperf"
+#line 216 "CSSPropertyNames.gperf"
       {"-webkit-mask-repeat-x", CSSPropertyWebkitMaskRepeatX},
 #line 159 "CSSPropertyNames.gperf"
       {"-webkit-background-clip", CSSPropertyWebkitBackgroundClip},
-#line 216 "CSSPropertyNames.gperf"
+#line 217 "CSSPropertyNames.gperf"
       {"-webkit-mask-repeat-y", CSSPropertyWebkitMaskRepeatY},
 #line 168 "CSSPropertyNames.gperf"
       {"-webkit-box-align", CSSPropertyWebkitBoxAlign},
-#line 212 "CSSPropertyNames.gperf"
+#line 213 "CSSPropertyNames.gperf"
       {"-webkit-mask-position-x", CSSPropertyWebkitMaskPositionX},
-#line 100 "CSSPropertyNames.gperf"
+#line 99 "CSSPropertyNames.gperf"
       {"padding-left", CSSPropertyPaddingLeft},
-#line 189 "CSSPropertyNames.gperf"
+#line 190 "CSSPropertyNames.gperf"
       {"-webkit-font-size-delta", CSSPropertyWebkitFontSizeDelta},
 #line 27 "CSSPropertyNames.gperf"
       {"border-bottom-right-radius", CSSPropertyBorderBottomRightRadius},
-#line 88 "CSSPropertyNames.gperf"
+#line 87 "CSSPropertyNames.gperf"
       {"opacity", CSSPropertyOpacity},
 #line 38 "CSSPropertyNames.gperf"
       {"border-right-color", CSSPropertyBorderRightColor},
@@ -567,61 +567,61 @@ findProp (register const char *str, register unsigned int len)
       {"-webkit-box-lines", CSSPropertyWebkitBoxLines},
 #line 42 "CSSPropertyNames.gperf"
       {"border-style", CSSPropertyBorderStyle},
-#line 213 "CSSPropertyNames.gperf"
+#line 214 "CSSPropertyNames.gperf"
       {"-webkit-mask-position-y", CSSPropertyWebkitMaskPositionY},
-#line 95 "CSSPropertyNames.gperf"
+#line 94 "CSSPropertyNames.gperf"
       {"overflow", CSSPropertyOverflow},
 #line 28 "CSSPropertyNames.gperf"
       {"border-bottom-style", CSSPropertyBorderBottomStyle},
-#line 262 "CSSPropertyNames.gperf"
+#line 263 "CSSPropertyNames.gperf"
       {"fill", CSSPropertyFill},
 #line 150 "CSSPropertyNames.gperf"
       {"-webkit-animation-delay", CSSPropertyWebkitAnimationDelay},
-#line 277 "CSSPropertyNames.gperf"
+#line 278 "CSSPropertyNames.gperf"
       {"stroke-opacity", CSSPropertyStrokeOpacity},
-#line 124 "CSSPropertyNames.gperf"
+#line 123 "CSSPropertyNames.gperf"
       {"text-overline", CSSPropertyTextOverline},
-#line 181 "CSSPropertyNames.gperf"
+#line 182 "CSSPropertyNames.gperf"
       {"-webkit-column-count", CSSPropertyWebkitColumnCount},
-#line 126 "CSSPropertyNames.gperf"
+#line 125 "CSSPropertyNames.gperf"
       {"text-overline-mode", CSSPropertyTextOverlineMode},
 #line 46 "CSSPropertyNames.gperf"
       {"border-top-right-radius", CSSPropertyBorderTopRightRadius},
-#line 240 "CSSPropertyNames.gperf"
+#line 241 "CSSPropertyNames.gperf"
       {"-webkit-transition-delay", CSSPropertyWebkitTransitionDelay},
-#line 61 "CSSPropertyNames.gperf"
+#line 60 "CSSPropertyNames.gperf"
       {"display", CSSPropertyDisplay},
-#line 94 "CSSPropertyNames.gperf"
+#line 93 "CSSPropertyNames.gperf"
       {"outline-width", CSSPropertyOutlineWidth},
-#line 242 "CSSPropertyNames.gperf"
+#line 243 "CSSPropertyNames.gperf"
       {"-webkit-transition-property", CSSPropertyWebkitTransitionProperty},
 #line 47 "CSSPropertyNames.gperf"
       {"border-top-style", CSSPropertyBorderTopStyle},
-#line 183 "CSSPropertyNames.gperf"
+#line 184 "CSSPropertyNames.gperf"
       {"-webkit-column-rule", CSSPropertyWebkitColumnRule},
 #line 140 "CSSPropertyNames.gperf"
       {"visibility", CSSPropertyVisibility},
-#line 248 "CSSPropertyNames.gperf"
+#line 249 "CSSPropertyNames.gperf"
       {"clip-path", CSSPropertyClipPath},
-#line 257 "CSSPropertyNames.gperf"
+#line 258 "CSSPropertyNames.gperf"
       {"stop-opacity", CSSPropertyStopOpacity},
-#line 247 "CSSPropertyNames.gperf"
+#line 248 "CSSPropertyNames.gperf"
       {"-webkit-variable-declaration-block", CSSPropertyWebkitVariableDeclarationBlock},
-#line 229 "CSSPropertyNames.gperf"
+#line 230 "CSSPropertyNames.gperf"
       {"-webkit-text-size-adjust", CSSPropertyWebkitTextSizeAdjust},
-#line 231 "CSSPropertyNames.gperf"
+#line 232 "CSSPropertyNames.gperf"
       {"-webkit-text-stroke-color", CSSPropertyWebkitTextStrokeColor},
-#line 255 "CSSPropertyNames.gperf"
+#line 256 "CSSPropertyNames.gperf"
       {"lighting-color", CSSPropertyLightingColor},
-#line 71 "CSSPropertyNames.gperf"
+#line 70 "CSSPropertyNames.gperf"
       {"height", CSSPropertyHeight},
-#line 253 "CSSPropertyNames.gperf"
+#line 254 "CSSPropertyNames.gperf"
       {"flood-color", CSSPropertyFloodColor},
 #line 156 "CSSPropertyNames.gperf"
       {"-webkit-animation-timing-function", CSSPropertyWebkitAnimationTimingFunction},
 #line 131 "CSSPropertyNames.gperf"
       {"text-underline", CSSPropertyTextUnderline},
-#line 86 "CSSPropertyNames.gperf"
+#line 85 "CSSPropertyNames.gperf"
       {"min-height", CSSPropertyMinHeight},
 #line 155 "CSSPropertyNames.gperf"
       {"-webkit-animation-play-state", CSSPropertyWebkitAnimationPlayState},
@@ -633,23 +633,23 @@ findProp (register const char *str, register unsigned int len)
       {"background-attachment", CSSPropertyBackgroundAttachment},
 #line 33 "CSSPropertyNames.gperf"
       {"border-left-color", CSSPropertyBorderLeftColor},
-#line 75 "CSSPropertyNames.gperf"
+#line 74 "CSSPropertyNames.gperf"
       {"list-style", CSSPropertyListStyle},
 #line 164 "CSSPropertyNames.gperf"
       {"-webkit-border-horizontal-spacing", CSSPropertyWebkitBorderHorizontalSpacing},
-#line 243 "CSSPropertyNames.gperf"
+#line 244 "CSSPropertyNames.gperf"
       {"-webkit-transition-timing-function", CSSPropertyWebkitTransitionTimingFunction},
-#line 76 "CSSPropertyNames.gperf"
+#line 75 "CSSPropertyNames.gperf"
       {"list-style-image", CSSPropertyListStyleImage},
 #line 40 "CSSPropertyNames.gperf"
       {"border-right-width", CSSPropertyBorderRightWidth},
-#line 187 "CSSPropertyNames.gperf"
+#line 188 "CSSPropertyNames.gperf"
       {"-webkit-column-width", CSSPropertyWebkitColumnWidth},
 #line 20 "CSSPropertyNames.gperf"
       {"background-repeat-x", CSSPropertyBackgroundRepeatX},
-#line 70 "CSSPropertyNames.gperf"
+#line 69 "CSSPropertyNames.gperf"
       {"font-weight", CSSPropertyFontWeight},
-#line 260 "CSSPropertyNames.gperf"
+#line 261 "CSSPropertyNames.gperf"
       {"color-profile", CSSPropertyColorProfile},
 #line 45 "CSSPropertyNames.gperf"
       {"border-top-left-radius", CSSPropertyBorderTopLeftRadius},
@@ -657,139 +657,139 @@ findProp (register const char *str, register unsigned int len)
       {"background-repeat-y", CSSPropertyBackgroundRepeatY},
 #line 17 "CSSPropertyNames.gperf"
       {"background-position-x", CSSPropertyBackgroundPositionX},
-#line 85 "CSSPropertyNames.gperf"
+#line 84 "CSSPropertyNames.gperf"
       {"max-width", CSSPropertyMaxWidth},
-#line 223 "CSSPropertyNames.gperf"
+#line 224 "CSSPropertyNames.gperf"
       {"-webkit-perspective-origin-x", CSSPropertyWebkitPerspectiveOriginX},
-#line 179 "CSSPropertyNames.gperf"
+#line 180 "CSSPropertyNames.gperf"
       {"-webkit-column-break-before", CSSPropertyWebkitColumnBreakBefore},
-#line 178 "CSSPropertyNames.gperf"
+#line 179 "CSSPropertyNames.gperf"
       {"-webkit-column-break-after", CSSPropertyWebkitColumnBreakAfter},
 #line 18 "CSSPropertyNames.gperf"
       {"background-position-y", CSSPropertyBackgroundPositionY},
-#line 190 "CSSPropertyNames.gperf"
+#line 191 "CSSPropertyNames.gperf"
       {"-webkit-font-smoothing", CSSPropertyWebkitFontSmoothing},
 #line 173 "CSSPropertyNames.gperf"
       {"-webkit-box-ordinal-group", CSSPropertyWebkitBoxOrdinalGroup},
-#line 203 "CSSPropertyNames.gperf"
+#line 204 "CSSPropertyNames.gperf"
       {"-webkit-marquee-style", CSSPropertyWebkitMarqueeStyle},
-#line 224 "CSSPropertyNames.gperf"
+#line 225 "CSSPropertyNames.gperf"
       {"-webkit-perspective-origin-y", CSSPropertyWebkitPerspectiveOriginY},
-#line 51 "CSSPropertyNames.gperf"
-      {"box-shadow", CSSPropertyBoxShadow},
 #line 129 "CSSPropertyNames.gperf"
       {"text-shadow", CSSPropertyTextShadow},
-#line 74 "CSSPropertyNames.gperf"
+#line 73 "CSSPropertyNames.gperf"
       {"line-height", CSSPropertyLineHeight},
-#line 77 "CSSPropertyNames.gperf"
+#line 76 "CSSPropertyNames.gperf"
       {"list-style-position", CSSPropertyListStylePosition},
-#line 114 "CSSPropertyNames.gperf"
+#line 113 "CSSPropertyNames.gperf"
       {"table-layout", CSSPropertyTableLayout},
-#line 125 "CSSPropertyNames.gperf"
+#line 177 "CSSPropertyNames.gperf"
+      {"-webkit-box-shadow", CSSPropertyWebkitBoxShadow},
+#line 124 "CSSPropertyNames.gperf"
       {"text-overline-color", CSSPropertyTextOverlineColor},
-#line 62 "CSSPropertyNames.gperf"
+#line 61 "CSSPropertyNames.gperf"
       {"empty-cells", CSSPropertyEmptyCells},
-#line 232 "CSSPropertyNames.gperf"
+#line 233 "CSSPropertyNames.gperf"
       {"-webkit-text-stroke-width", CSSPropertyWebkitTextStrokeWidth},
 #line 130 "CSSPropertyNames.gperf"
       {"text-transform", CSSPropertyTextTransform},
-#line 67 "CSSPropertyNames.gperf"
+#line 66 "CSSPropertyNames.gperf"
       {"font-stretch", CSSPropertyFontStretch},
-#line 93 "CSSPropertyNames.gperf"
+#line 92 "CSSPropertyNames.gperf"
       {"outline-style", CSSPropertyOutlineStyle},
 #line 286 "CSSPropertyNames.gperf"
       {"text-anchor", CSSPropertyTextAnchor},
-#line 184 "CSSPropertyNames.gperf"
+#line 185 "CSSPropertyNames.gperf"
       {"-webkit-column-rule-color", CSSPropertyWebkitColumnRuleColor},
-#line 272 "CSSPropertyNames.gperf"
+#line 273 "CSSPropertyNames.gperf"
       {"stroke-dasharray", CSSPropertyStrokeDasharray},
 #line 35 "CSSPropertyNames.gperf"
       {"border-left-width", CSSPropertyBorderLeftWidth},
-#line 264 "CSSPropertyNames.gperf"
+#line 265 "CSSPropertyNames.gperf"
       {"fill-rule", CSSPropertyFillRule},
-#line 235 "CSSPropertyNames.gperf"
+#line 236 "CSSPropertyNames.gperf"
       {"-webkit-transform-origin-x", CSSPropertyWebkitTransformOriginX},
 #line 281 "CSSPropertyNames.gperf"
       {"baseline-shift", CSSPropertyBaselineShift},
 #line 132 "CSSPropertyNames.gperf"
       {"text-underline-color", CSSPropertyTextUnderlineColor},
-#line 236 "CSSPropertyNames.gperf"
+#line 237 "CSSPropertyNames.gperf"
       {"-webkit-transform-origin-y", CSSPropertyWebkitTransformOriginY},
-#line 259 "CSSPropertyNames.gperf"
+#line 260 "CSSPropertyNames.gperf"
       {"color-interpolation-filters", CSSPropertyColorInterpolationFilters},
 #line 39 "CSSPropertyNames.gperf"
       {"border-right-style", CSSPropertyBorderRightStyle},
-#line 68 "CSSPropertyNames.gperf"
+#line 67 "CSSPropertyNames.gperf"
       {"font-style", CSSPropertyFontStyle},
-#line 128 "CSSPropertyNames.gperf"
+#line 127 "CSSPropertyNames.gperf"
       {"text-overline-width", CSSPropertyTextOverlineWidth},
-#line 96 "CSSPropertyNames.gperf"
+#line 95 "CSSPropertyNames.gperf"
       {"overflow-x", CSSPropertyOverflowX},
-#line 123 "CSSPropertyNames.gperf"
+#line 122 "CSSPropertyNames.gperf"
       {"text-overflow", CSSPropertyTextOverflow},
 #line 176 "CSSPropertyNames.gperf"
       {"-webkit-box-reflect", CSSPropertyWebkitBoxReflect},
-#line 245 "CSSPropertyNames.gperf"
+#line 246 "CSSPropertyNames.gperf"
       {"-webkit-user-modify", CSSPropertyWebkitUserModify},
-#line 186 "CSSPropertyNames.gperf"
+#line 187 "CSSPropertyNames.gperf"
       {"-webkit-column-rule-width", CSSPropertyWebkitColumnRuleWidth},
-#line 97 "CSSPropertyNames.gperf"
+#line 96 "CSSPropertyNames.gperf"
       {"overflow-y", CSSPropertyOverflowY},
-#line 238 "CSSPropertyNames.gperf"
+#line 239 "CSSPropertyNames.gperf"
       {"-webkit-transform-style", CSSPropertyWebkitTransformStyle},
-#line 92 "CSSPropertyNames.gperf"
+#line 91 "CSSPropertyNames.gperf"
       {"outline-offset", CSSPropertyOutlineOffset},
 #line 135 "CSSPropertyNames.gperf"
       {"text-underline-width", CSSPropertyTextUnderlineWidth},
-#line 254 "CSSPropertyNames.gperf"
+#line 255 "CSSPropertyNames.gperf"
       {"flood-opacity", CSSPropertyFloodOpacity},
 #line 34 "CSSPropertyNames.gperf"
       {"border-left-style", CSSPropertyBorderLeftStyle},
-#line 84 "CSSPropertyNames.gperf"
+#line 83 "CSSPropertyNames.gperf"
       {"max-height", CSSPropertyMaxHeight},
-#line 228 "CSSPropertyNames.gperf"
+#line 229 "CSSPropertyNames.gperf"
       {"-webkit-text-security", CSSPropertyWebkitTextSecurity},
-#line 191 "CSSPropertyNames.gperf"
+#line 192 "CSSPropertyNames.gperf"
       {"-webkit-highlight", CSSPropertyWebkitHighlight},
-#line 263 "CSSPropertyNames.gperf"
+#line 264 "CSSPropertyNames.gperf"
       {"fill-opacity", CSSPropertyFillOpacity},
-#line 273 "CSSPropertyNames.gperf"
+#line 274 "CSSPropertyNames.gperf"
       {"stroke-dashoffset", CSSPropertyStrokeDashoffset},
-#line 127 "CSSPropertyNames.gperf"
+#line 126 "CSSPropertyNames.gperf"
       {"text-overline-style", CSSPropertyTextOverlineStyle},
-#line 78 "CSSPropertyNames.gperf"
+#line 77 "CSSPropertyNames.gperf"
       {"list-style-type", CSSPropertyListStyleType},
-#line 218 "CSSPropertyNames.gperf"
+#line 219 "CSSPropertyNames.gperf"
       {"-webkit-match-nearest-mail-blockquote-color", CSSPropertyWebkitMatchNearestMailBlockquoteColor},
-#line 185 "CSSPropertyNames.gperf"
+#line 186 "CSSPropertyNames.gperf"
       {"-webkit-column-rule-style", CSSPropertyWebkitColumnRuleStyle},
 #line 158 "CSSPropertyNames.gperf"
       {"-webkit-backface-visibility", CSSPropertyWebkitBackfaceVisibility},
-#line 227 "CSSPropertyNames.gperf"
+#line 228 "CSSPropertyNames.gperf"
       {"-webkit-text-fill-color", CSSPropertyWebkitTextFillColor},
 #line 134 "CSSPropertyNames.gperf"
       {"text-underline-style", CSSPropertyTextUnderlineStyle},
 #line 284 "CSSPropertyNames.gperf"
       {"glyph-orientation-vertical", CSSPropertyGlyphOrientationVertical},
-#line 65 "CSSPropertyNames.gperf"
+#line 64 "CSSPropertyNames.gperf"
       {"font-family", CSSPropertyFontFamily},
 #line 170 "CSSPropertyNames.gperf"
       {"-webkit-box-flex", CSSPropertyWebkitBoxFlex},
-#line 118 "CSSPropertyNames.gperf"
+#line 117 "CSSPropertyNames.gperf"
       {"text-line-through", CSSPropertyTextLineThrough},
-#line 120 "CSSPropertyNames.gperf"
+#line 119 "CSSPropertyNames.gperf"
       {"text-line-through-mode", CSSPropertyTextLineThroughMode},
-#line 226 "CSSPropertyNames.gperf"
+#line 227 "CSSPropertyNames.gperf"
       {"-webkit-text-decorations-in-effect", CSSPropertyWebkitTextDecorationsInEffect},
 #line 283 "CSSPropertyNames.gperf"
       {"glyph-orientation-horizontal", CSSPropertyGlyphOrientationHorizontal},
 #line 171 "CSSPropertyNames.gperf"
       {"-webkit-box-flex-group", CSSPropertyWebkitBoxFlexGroup},
-#line 119 "CSSPropertyNames.gperf"
+#line 118 "CSSPropertyNames.gperf"
       {"text-line-through-color", CSSPropertyTextLineThroughColor},
-#line 122 "CSSPropertyNames.gperf"
-      {"text-line-through-width", CSSPropertyTextLineThroughWidth},
 #line 121 "CSSPropertyNames.gperf"
+      {"text-line-through-width", CSSPropertyTextLineThroughWidth},
+#line 120 "CSSPropertyNames.gperf"
       {"text-line-through-style", CSSPropertyTextLineThroughStyle}
     };
 
@@ -869,9 +869,9 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1, 208,  -1, 209,  -1, 210,  -1,  -1, 211,
        -1,  -1,  -1, 212,  -1,  -1,  -1, 213,  -1,  -1,
        -1, 214,  -1,  -1,  -1,  -1, 215, 216,  -1,  -1,
-      217, 218,  -1, 219,  -1, 220, 221,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 222,  -1,  -1, 223,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 224,  -1, 225,
+      217, 218,  -1, 219,  -1,  -1, 220,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 221,  -1,  -1, 222,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 223, 224, 225,
        -1, 226,  -1,  -1,  -1, 227,  -1,  -1,  -1, 228,
        -1,  -1, 229,  -1,  -1,  -1,  -1,  -1, 230,  -1,
        -1, 231,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1042,7 +1042,6 @@ static const char * const propertyNameStrings[278] = {
 "border-top-width",
 "border-width",
 "bottom",
-"box-shadow",
 "caption-side",
 "clear",
 "clip",
@@ -1120,6 +1119,7 @@ static const char * const propertyNameStrings[278] = {
 "text-overline-mode",
 "text-overline-style",
 "text-overline-width",
+"text-rendering",
 "text-shadow",
 "text-transform",
 "text-underline",
@@ -1168,6 +1168,7 @@ static const char * const propertyNameStrings[278] = {
 "-webkit-box-orient",
 "-webkit-box-pack",
 "-webkit-box-reflect",
+"-webkit-box-shadow",
 "-webkit-box-sizing",
 "-webkit-column-break-after",
 "-webkit-column-break-before",
@@ -1270,7 +1271,6 @@ static const char * const propertyNameStrings[278] = {
 "stroke-miterlimit",
 "stroke-opacity",
 "stroke-width",
-"text-rendering",
 "alignment-baseline",
 "baseline-shift",
 "dominant-baseline",
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
index 9af7f735e8..f1332e39c8 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
@@ -46,84 +46,84 @@ enum CSSPropertyID {
     CSSPropertyBorderTopWidth = 1039,
     CSSPropertyBorderWidth = 1040,
     CSSPropertyBottom = 1041,
-    CSSPropertyBoxShadow = 1042,
-    CSSPropertyCaptionSide = 1043,
-    CSSPropertyClear = 1044,
-    CSSPropertyClip = 1045,
-    CSSPropertyColor = 1046,
-    CSSPropertyContent = 1047,
-    CSSPropertyCounterIncrement = 1048,
-    CSSPropertyCounterReset = 1049,
-    CSSPropertyCursor = 1050,
-    CSSPropertyDirection = 1051,
-    CSSPropertyDisplay = 1052,
-    CSSPropertyEmptyCells = 1053,
-    CSSPropertyFloat = 1054,
-    CSSPropertyFont = 1055,
-    CSSPropertyFontFamily = 1056,
-    CSSPropertyFontSize = 1057,
-    CSSPropertyFontStretch = 1058,
-    CSSPropertyFontStyle = 1059,
-    CSSPropertyFontVariant = 1060,
-    CSSPropertyFontWeight = 1061,
-    CSSPropertyHeight = 1062,
-    CSSPropertyLeft = 1063,
-    CSSPropertyLetterSpacing = 1064,
-    CSSPropertyLineHeight = 1065,
-    CSSPropertyListStyle = 1066,
-    CSSPropertyListStyleImage = 1067,
-    CSSPropertyListStylePosition = 1068,
-    CSSPropertyListStyleType = 1069,
-    CSSPropertyMargin = 1070,
-    CSSPropertyMarginBottom = 1071,
-    CSSPropertyMarginLeft = 1072,
-    CSSPropertyMarginRight = 1073,
-    CSSPropertyMarginTop = 1074,
-    CSSPropertyMaxHeight = 1075,
-    CSSPropertyMaxWidth = 1076,
-    CSSPropertyMinHeight = 1077,
-    CSSPropertyMinWidth = 1078,
-    CSSPropertyOpacity = 1079,
-    CSSPropertyOrphans = 1080,
-    CSSPropertyOutline = 1081,
-    CSSPropertyOutlineColor = 1082,
-    CSSPropertyOutlineOffset = 1083,
-    CSSPropertyOutlineStyle = 1084,
-    CSSPropertyOutlineWidth = 1085,
-    CSSPropertyOverflow = 1086,
-    CSSPropertyOverflowX = 1087,
-    CSSPropertyOverflowY = 1088,
-    CSSPropertyPadding = 1089,
-    CSSPropertyPaddingBottom = 1090,
-    CSSPropertyPaddingLeft = 1091,
-    CSSPropertyPaddingRight = 1092,
-    CSSPropertyPaddingTop = 1093,
-    CSSPropertyPage = 1094,
-    CSSPropertyPageBreakAfter = 1095,
-    CSSPropertyPageBreakBefore = 1096,
-    CSSPropertyPageBreakInside = 1097,
-    CSSPropertyPointerEvents = 1098,
-    CSSPropertyPosition = 1099,
-    CSSPropertyQuotes = 1100,
-    CSSPropertyResize = 1101,
-    CSSPropertyRight = 1102,
-    CSSPropertySize = 1103,
-    CSSPropertySrc = 1104,
-    CSSPropertyTableLayout = 1105,
-    CSSPropertyTextAlign = 1106,
-    CSSPropertyTextDecoration = 1107,
-    CSSPropertyTextIndent = 1108,
-    CSSPropertyTextLineThrough = 1109,
-    CSSPropertyTextLineThroughColor = 1110,
-    CSSPropertyTextLineThroughMode = 1111,
-    CSSPropertyTextLineThroughStyle = 1112,
-    CSSPropertyTextLineThroughWidth = 1113,
-    CSSPropertyTextOverflow = 1114,
-    CSSPropertyTextOverline = 1115,
-    CSSPropertyTextOverlineColor = 1116,
-    CSSPropertyTextOverlineMode = 1117,
-    CSSPropertyTextOverlineStyle = 1118,
-    CSSPropertyTextOverlineWidth = 1119,
+    CSSPropertyCaptionSide = 1042,
+    CSSPropertyClear = 1043,
+    CSSPropertyClip = 1044,
+    CSSPropertyColor = 1045,
+    CSSPropertyContent = 1046,
+    CSSPropertyCounterIncrement = 1047,
+    CSSPropertyCounterReset = 1048,
+    CSSPropertyCursor = 1049,
+    CSSPropertyDirection = 1050,
+    CSSPropertyDisplay = 1051,
+    CSSPropertyEmptyCells = 1052,
+    CSSPropertyFloat = 1053,
+    CSSPropertyFont = 1054,
+    CSSPropertyFontFamily = 1055,
+    CSSPropertyFontSize = 1056,
+    CSSPropertyFontStretch = 1057,
+    CSSPropertyFontStyle = 1058,
+    CSSPropertyFontVariant = 1059,
+    CSSPropertyFontWeight = 1060,
+    CSSPropertyHeight = 1061,
+    CSSPropertyLeft = 1062,
+    CSSPropertyLetterSpacing = 1063,
+    CSSPropertyLineHeight = 1064,
+    CSSPropertyListStyle = 1065,
+    CSSPropertyListStyleImage = 1066,
+    CSSPropertyListStylePosition = 1067,
+    CSSPropertyListStyleType = 1068,
+    CSSPropertyMargin = 1069,
+    CSSPropertyMarginBottom = 1070,
+    CSSPropertyMarginLeft = 1071,
+    CSSPropertyMarginRight = 1072,
+    CSSPropertyMarginTop = 1073,
+    CSSPropertyMaxHeight = 1074,
+    CSSPropertyMaxWidth = 1075,
+    CSSPropertyMinHeight = 1076,
+    CSSPropertyMinWidth = 1077,
+    CSSPropertyOpacity = 1078,
+    CSSPropertyOrphans = 1079,
+    CSSPropertyOutline = 1080,
+    CSSPropertyOutlineColor = 1081,
+    CSSPropertyOutlineOffset = 1082,
+    CSSPropertyOutlineStyle = 1083,
+    CSSPropertyOutlineWidth = 1084,
+    CSSPropertyOverflow = 1085,
+    CSSPropertyOverflowX = 1086,
+    CSSPropertyOverflowY = 1087,
+    CSSPropertyPadding = 1088,
+    CSSPropertyPaddingBottom = 1089,
+    CSSPropertyPaddingLeft = 1090,
+    CSSPropertyPaddingRight = 1091,
+    CSSPropertyPaddingTop = 1092,
+    CSSPropertyPage = 1093,
+    CSSPropertyPageBreakAfter = 1094,
+    CSSPropertyPageBreakBefore = 1095,
+    CSSPropertyPageBreakInside = 1096,
+    CSSPropertyPointerEvents = 1097,
+    CSSPropertyPosition = 1098,
+    CSSPropertyQuotes = 1099,
+    CSSPropertyResize = 1100,
+    CSSPropertyRight = 1101,
+    CSSPropertySize = 1102,
+    CSSPropertySrc = 1103,
+    CSSPropertyTableLayout = 1104,
+    CSSPropertyTextAlign = 1105,
+    CSSPropertyTextDecoration = 1106,
+    CSSPropertyTextIndent = 1107,
+    CSSPropertyTextLineThrough = 1108,
+    CSSPropertyTextLineThroughColor = 1109,
+    CSSPropertyTextLineThroughMode = 1110,
+    CSSPropertyTextLineThroughStyle = 1111,
+    CSSPropertyTextLineThroughWidth = 1112,
+    CSSPropertyTextOverflow = 1113,
+    CSSPropertyTextOverline = 1114,
+    CSSPropertyTextOverlineColor = 1115,
+    CSSPropertyTextOverlineMode = 1116,
+    CSSPropertyTextOverlineStyle = 1117,
+    CSSPropertyTextOverlineWidth = 1118,
+    CSSPropertyTextRendering = 1119,
     CSSPropertyTextShadow = 1120,
     CSSPropertyTextTransform = 1121,
     CSSPropertyTextUnderline = 1122,
@@ -172,109 +172,109 @@ enum CSSPropertyID {
     CSSPropertyWebkitBoxOrient = 1165,
     CSSPropertyWebkitBoxPack = 1166,
     CSSPropertyWebkitBoxReflect = 1167,
-    CSSPropertyWebkitBoxSizing = 1168,
-    CSSPropertyWebkitColumnBreakAfter = 1169,
-    CSSPropertyWebkitColumnBreakBefore = 1170,
-    CSSPropertyWebkitColumnBreakInside = 1171,
-    CSSPropertyWebkitColumnCount = 1172,
-    CSSPropertyWebkitColumnGap = 1173,
-    CSSPropertyWebkitColumnRule = 1174,
-    CSSPropertyWebkitColumnRuleColor = 1175,
-    CSSPropertyWebkitColumnRuleStyle = 1176,
-    CSSPropertyWebkitColumnRuleWidth = 1177,
-    CSSPropertyWebkitColumnWidth = 1178,
-    CSSPropertyWebkitColumns = 1179,
-    CSSPropertyWebkitFontSizeDelta = 1180,
-    CSSPropertyWebkitFontSmoothing = 1181,
-    CSSPropertyWebkitHighlight = 1182,
-    CSSPropertyWebkitLineBreak = 1183,
-    CSSPropertyWebkitLineClamp = 1184,
-    CSSPropertyWebkitMarginBottomCollapse = 1185,
-    CSSPropertyWebkitMarginCollapse = 1186,
-    CSSPropertyWebkitMarginStart = 1187,
-    CSSPropertyWebkitMarginTopCollapse = 1188,
-    CSSPropertyWebkitMarquee = 1189,
-    CSSPropertyWebkitMarqueeDirection = 1190,
-    CSSPropertyWebkitMarqueeIncrement = 1191,
-    CSSPropertyWebkitMarqueeRepetition = 1192,
-    CSSPropertyWebkitMarqueeSpeed = 1193,
-    CSSPropertyWebkitMarqueeStyle = 1194,
-    CSSPropertyWebkitMask = 1195,
-    CSSPropertyWebkitMaskAttachment = 1196,
-    CSSPropertyWebkitMaskBoxImage = 1197,
-    CSSPropertyWebkitMaskClip = 1198,
-    CSSPropertyWebkitMaskComposite = 1199,
-    CSSPropertyWebkitMaskImage = 1200,
-    CSSPropertyWebkitMaskOrigin = 1201,
-    CSSPropertyWebkitMaskPosition = 1202,
-    CSSPropertyWebkitMaskPositionX = 1203,
-    CSSPropertyWebkitMaskPositionY = 1204,
-    CSSPropertyWebkitMaskRepeat = 1205,
-    CSSPropertyWebkitMaskRepeatX = 1206,
-    CSSPropertyWebkitMaskRepeatY = 1207,
-    CSSPropertyWebkitMaskSize = 1208,
-    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1209,
-    CSSPropertyWebkitNbspMode = 1210,
-    CSSPropertyWebkitPaddingStart = 1211,
-    CSSPropertyWebkitPerspective = 1212,
-    CSSPropertyWebkitPerspectiveOrigin = 1213,
-    CSSPropertyWebkitPerspectiveOriginX = 1214,
-    CSSPropertyWebkitPerspectiveOriginY = 1215,
-    CSSPropertyWebkitRtlOrdering = 1216,
-    CSSPropertyWebkitTextDecorationsInEffect = 1217,
-    CSSPropertyWebkitTextFillColor = 1218,
-    CSSPropertyWebkitTextSecurity = 1219,
-    CSSPropertyWebkitTextSizeAdjust = 1220,
-    CSSPropertyWebkitTextStroke = 1221,
-    CSSPropertyWebkitTextStrokeColor = 1222,
-    CSSPropertyWebkitTextStrokeWidth = 1223,
-    CSSPropertyWebkitTransform = 1224,
-    CSSPropertyWebkitTransformOrigin = 1225,
-    CSSPropertyWebkitTransformOriginX = 1226,
-    CSSPropertyWebkitTransformOriginY = 1227,
-    CSSPropertyWebkitTransformOriginZ = 1228,
-    CSSPropertyWebkitTransformStyle = 1229,
-    CSSPropertyWebkitTransition = 1230,
-    CSSPropertyWebkitTransitionDelay = 1231,
-    CSSPropertyWebkitTransitionDuration = 1232,
-    CSSPropertyWebkitTransitionProperty = 1233,
-    CSSPropertyWebkitTransitionTimingFunction = 1234,
-    CSSPropertyWebkitUserDrag = 1235,
-    CSSPropertyWebkitUserModify = 1236,
-    CSSPropertyWebkitUserSelect = 1237,
-    CSSPropertyWebkitVariableDeclarationBlock = 1238,
-    CSSPropertyClipPath = 1239,
-    CSSPropertyClipRule = 1240,
-    CSSPropertyMask = 1241,
-    CSSPropertyEnableBackground = 1242,
-    CSSPropertyFilter = 1243,
-    CSSPropertyFloodColor = 1244,
-    CSSPropertyFloodOpacity = 1245,
-    CSSPropertyLightingColor = 1246,
-    CSSPropertyStopColor = 1247,
-    CSSPropertyStopOpacity = 1248,
-    CSSPropertyColorInterpolation = 1249,
-    CSSPropertyColorInterpolationFilters = 1250,
-    CSSPropertyColorProfile = 1251,
-    CSSPropertyColorRendering = 1252,
-    CSSPropertyFill = 1253,
-    CSSPropertyFillOpacity = 1254,
-    CSSPropertyFillRule = 1255,
-    CSSPropertyImageRendering = 1256,
-    CSSPropertyMarker = 1257,
-    CSSPropertyMarkerEnd = 1258,
-    CSSPropertyMarkerMid = 1259,
-    CSSPropertyMarkerStart = 1260,
-    CSSPropertyShapeRendering = 1261,
-    CSSPropertyStroke = 1262,
-    CSSPropertyStrokeDasharray = 1263,
-    CSSPropertyStrokeDashoffset = 1264,
-    CSSPropertyStrokeLinecap = 1265,
-    CSSPropertyStrokeLinejoin = 1266,
-    CSSPropertyStrokeMiterlimit = 1267,
-    CSSPropertyStrokeOpacity = 1268,
-    CSSPropertyStrokeWidth = 1269,
-    CSSPropertyTextRendering = 1270,
+    CSSPropertyWebkitBoxShadow = 1168,
+    CSSPropertyWebkitBoxSizing = 1169,
+    CSSPropertyWebkitColumnBreakAfter = 1170,
+    CSSPropertyWebkitColumnBreakBefore = 1171,
+    CSSPropertyWebkitColumnBreakInside = 1172,
+    CSSPropertyWebkitColumnCount = 1173,
+    CSSPropertyWebkitColumnGap = 1174,
+    CSSPropertyWebkitColumnRule = 1175,
+    CSSPropertyWebkitColumnRuleColor = 1176,
+    CSSPropertyWebkitColumnRuleStyle = 1177,
+    CSSPropertyWebkitColumnRuleWidth = 1178,
+    CSSPropertyWebkitColumnWidth = 1179,
+    CSSPropertyWebkitColumns = 1180,
+    CSSPropertyWebkitFontSizeDelta = 1181,
+    CSSPropertyWebkitFontSmoothing = 1182,
+    CSSPropertyWebkitHighlight = 1183,
+    CSSPropertyWebkitLineBreak = 1184,
+    CSSPropertyWebkitLineClamp = 1185,
+    CSSPropertyWebkitMarginBottomCollapse = 1186,
+    CSSPropertyWebkitMarginCollapse = 1187,
+    CSSPropertyWebkitMarginStart = 1188,
+    CSSPropertyWebkitMarginTopCollapse = 1189,
+    CSSPropertyWebkitMarquee = 1190,
+    CSSPropertyWebkitMarqueeDirection = 1191,
+    CSSPropertyWebkitMarqueeIncrement = 1192,
+    CSSPropertyWebkitMarqueeRepetition = 1193,
+    CSSPropertyWebkitMarqueeSpeed = 1194,
+    CSSPropertyWebkitMarqueeStyle = 1195,
+    CSSPropertyWebkitMask = 1196,
+    CSSPropertyWebkitMaskAttachment = 1197,
+    CSSPropertyWebkitMaskBoxImage = 1198,
+    CSSPropertyWebkitMaskClip = 1199,
+    CSSPropertyWebkitMaskComposite = 1200,
+    CSSPropertyWebkitMaskImage = 1201,
+    CSSPropertyWebkitMaskOrigin = 1202,
+    CSSPropertyWebkitMaskPosition = 1203,
+    CSSPropertyWebkitMaskPositionX = 1204,
+    CSSPropertyWebkitMaskPositionY = 1205,
+    CSSPropertyWebkitMaskRepeat = 1206,
+    CSSPropertyWebkitMaskRepeatX = 1207,
+    CSSPropertyWebkitMaskRepeatY = 1208,
+    CSSPropertyWebkitMaskSize = 1209,
+    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1210,
+    CSSPropertyWebkitNbspMode = 1211,
+    CSSPropertyWebkitPaddingStart = 1212,
+    CSSPropertyWebkitPerspective = 1213,
+    CSSPropertyWebkitPerspectiveOrigin = 1214,
+    CSSPropertyWebkitPerspectiveOriginX = 1215,
+    CSSPropertyWebkitPerspectiveOriginY = 1216,
+    CSSPropertyWebkitRtlOrdering = 1217,
+    CSSPropertyWebkitTextDecorationsInEffect = 1218,
+    CSSPropertyWebkitTextFillColor = 1219,
+    CSSPropertyWebkitTextSecurity = 1220,
+    CSSPropertyWebkitTextSizeAdjust = 1221,
+    CSSPropertyWebkitTextStroke = 1222,
+    CSSPropertyWebkitTextStrokeColor = 1223,
+    CSSPropertyWebkitTextStrokeWidth = 1224,
+    CSSPropertyWebkitTransform = 1225,
+    CSSPropertyWebkitTransformOrigin = 1226,
+    CSSPropertyWebkitTransformOriginX = 1227,
+    CSSPropertyWebkitTransformOriginY = 1228,
+    CSSPropertyWebkitTransformOriginZ = 1229,
+    CSSPropertyWebkitTransformStyle = 1230,
+    CSSPropertyWebkitTransition = 1231,
+    CSSPropertyWebkitTransitionDelay = 1232,
+    CSSPropertyWebkitTransitionDuration = 1233,
+    CSSPropertyWebkitTransitionProperty = 1234,
+    CSSPropertyWebkitTransitionTimingFunction = 1235,
+    CSSPropertyWebkitUserDrag = 1236,
+    CSSPropertyWebkitUserModify = 1237,
+    CSSPropertyWebkitUserSelect = 1238,
+    CSSPropertyWebkitVariableDeclarationBlock = 1239,
+    CSSPropertyClipPath = 1240,
+    CSSPropertyClipRule = 1241,
+    CSSPropertyMask = 1242,
+    CSSPropertyEnableBackground = 1243,
+    CSSPropertyFilter = 1244,
+    CSSPropertyFloodColor = 1245,
+    CSSPropertyFloodOpacity = 1246,
+    CSSPropertyLightingColor = 1247,
+    CSSPropertyStopColor = 1248,
+    CSSPropertyStopOpacity = 1249,
+    CSSPropertyColorInterpolation = 1250,
+    CSSPropertyColorInterpolationFilters = 1251,
+    CSSPropertyColorProfile = 1252,
+    CSSPropertyColorRendering = 1253,
+    CSSPropertyFill = 1254,
+    CSSPropertyFillOpacity = 1255,
+    CSSPropertyFillRule = 1256,
+    CSSPropertyImageRendering = 1257,
+    CSSPropertyMarker = 1258,
+    CSSPropertyMarkerEnd = 1259,
+    CSSPropertyMarkerMid = 1260,
+    CSSPropertyMarkerStart = 1261,
+    CSSPropertyShapeRendering = 1262,
+    CSSPropertyStroke = 1263,
+    CSSPropertyStrokeDasharray = 1264,
+    CSSPropertyStrokeDashoffset = 1265,
+    CSSPropertyStrokeLinecap = 1266,
+    CSSPropertyStrokeLinejoin = 1267,
+    CSSPropertyStrokeMiterlimit = 1268,
+    CSSPropertyStrokeOpacity = 1269,
+    CSSPropertyStrokeWidth = 1270,
     CSSPropertyAlignmentBaseline = 1271,
     CSSPropertyBaselineShift = 1272,
     CSSPropertyDominantBaseline = 1273,
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
index 1975392e13..c2143c523e 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
+++ b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
@@ -191,7 +191,7 @@ findValue (register const char *str, register unsigned int len)
 {
   enum
     {
-      TOTAL_KEYWORDS = 548,
+      TOTAL_KEYWORDS = 549,
       MIN_WORD_LENGTH = 2,
       MAX_WORD_LENGTH = 31,
       MIN_HASH_VALUE = 0,
@@ -206,7 +206,7 @@ findValue (register const char *str, register unsigned int len)
       {"300", CSSValue300},
 #line 289 "CSSValueKeywords.gperf"
       {"end", CSSValueEnd},
-#line 556 "CSSValueKeywords.gperf"
+#line 557 "CSSValueKeywords.gperf"
       {"lr", CSSValueLr},
 #line 48 "CSSValueKeywords.gperf"
       {"900", CSSValue900},
@@ -226,7 +226,7 @@ findValue (register const char *str, register unsigned int len)
       {"400", CSSValue400},
 #line 41 "CSSValueKeywords.gperf"
       {"200", CSSValue200},
-#line 490 "CSSValueKeywords.gperf"
+#line 494 "CSSValueKeywords.gperf"
       {"oldlace", CSSValueOldlace},
 #line 71 "CSSValueKeywords.gperf"
       {"cursive", CSSValueCursive},
@@ -234,13 +234,13 @@ findValue (register const char *str, register unsigned int len)
       {"above", CSSValueAbove},
 #line 253 "CSSValueKeywords.gperf"
       {"cross", CSSValueCross},
-#line 411 "CSSValueKeywords.gperf"
+#line 415 "CSSValueKeywords.gperf"
       {"coral", CSSValueCoral},
 #line 13 "CSSValueKeywords.gperf"
       {"none", CSSValueNone},
-#line 502 "CSSValueKeywords.gperf"
+#line 506 "CSSValueKeywords.gperf"
       {"plum", CSSValuePlum},
-#line 558 "CSSValueKeywords.gperf"
+#line 559 "CSSValueKeywords.gperf"
       {"tb", CSSValueTb},
 #line 86 "CSSValueKeywords.gperf"
       {"purple", CSSValuePurple},
@@ -258,7 +258,7 @@ findValue (register const char *str, register unsigned int len)
       {"monospace", CSSValueMonospace},
 #line 216 "CSSValueKeywords.gperf"
       {"e-resize", CSSValueEResize},
-#line 378 "CSSValueKeywords.gperf"
+#line 379 "CSSValueKeywords.gperf"
       {"lines", CSSValueLines},
 #line 222 "CSSValueKeywords.gperf"
       {"s-resize", CSSValueSResize},
@@ -272,7 +272,7 @@ findValue (register const char *str, register unsigned int len)
       {"lime", CSSValueLime},
 #line 164 "CSSValueKeywords.gperf"
       {"circle", CSSValueCircle},
-#line 474 "CSSValueKeywords.gperf"
+#line 478 "CSSValueKeywords.gperf"
       {"linen", CSSValueLinen},
 #line 219 "CSSValueKeywords.gperf"
       {"n-resize", CSSValueNResize},
@@ -280,15 +280,15 @@ findValue (register const char *str, register unsigned int len)
       {"inset", CSSValueInset},
 #line 296 "CSSValueKeywords.gperf"
       {"multiple", CSSValueMultiple},
-#line 410 "CSSValueKeywords.gperf"
+#line 414 "CSSValueKeywords.gperf"
       {"chocolate", CSSValueChocolate},
 #line 314 "CSSValueKeywords.gperf"
       {"clip", CSSValueClip},
-#line 374 "CSSValueKeywords.gperf"
+#line 375 "CSSValueKeywords.gperf"
       {"contain", CSSValueContain},
-#line 414 "CSSValueKeywords.gperf"
+#line 418 "CSSValueKeywords.gperf"
       {"crimson", CSSValueCrimson},
-#line 413 "CSSValueKeywords.gperf"
+#line 417 "CSSValueKeywords.gperf"
       {"cornsilk", CSSValueCornsilk},
 #line 187 "CSSValueKeywords.gperf"
       {"compact", CSSValueCompact},
@@ -296,21 +296,21 @@ findValue (register const char *str, register unsigned int len)
       {"scroll", CSSValueScroll},
 #line 254 "CSSValueKeywords.gperf"
       {"embed", CSSValueEmbed},
-#line 521 "CSSValueKeywords.gperf"
+#line 525 "CSSValueKeywords.gperf"
       {"tomato", CSSValueTomato},
 #line 150 "CSSValueKeywords.gperf"
       {"top", CSSValueTop},
 #line 264 "CSSValueKeywords.gperf"
       {"loud", CSSValueLoud},
-#line 370 "CSSValueKeywords.gperf"
+#line 371 "CSSValueKeywords.gperf"
       {"content", CSSValueContent},
 #line 77 "CSSValueKeywords.gperf"
       {"blue", CSSValueBlue},
 #line 263 "CSSValueKeywords.gperf"
       {"local", CSSValueLocal},
-#line 523 "CSSValueKeywords.gperf"
+#line 527 "CSSValueKeywords.gperf"
       {"violet", CSSValueViolet},
-#line 501 "CSSValueKeywords.gperf"
+#line 505 "CSSValueKeywords.gperf"
       {"pink", CSSValuePink},
 #line 284 "CSSValueKeywords.gperf"
       {"thin", CSSValueThin},
@@ -324,23 +324,23 @@ findValue (register const char *str, register unsigned int len)
       {"initial", CSSValueInitial},
 #line 82 "CSSValueKeywords.gperf"
       {"maroon", CSSValueMaroon},
-#line 383 "CSSValueKeywords.gperf"
+#line 384 "CSSValueKeywords.gperf"
       {"ease", CSSValueEase},
-#line 507 "CSSValueKeywords.gperf"
+#line 511 "CSSValueKeywords.gperf"
       {"salmon", CSSValueSalmon},
-#line 519 "CSSValueKeywords.gperf"
+#line 523 "CSSValueKeywords.gperf"
       {"tan", CSSValueTan},
-#line 358 "CSSValueKeywords.gperf"
+#line 359 "CSSValueKeywords.gperf"
       {"caret", CSSValueCaret},
-#line 520 "CSSValueKeywords.gperf"
+#line 524 "CSSValueKeywords.gperf"
       {"thistle", CSSValueThistle},
 #line 189 "CSSValueKeywords.gperf"
       {"table", CSSValueTable},
 #line 283 "CSSValueKeywords.gperf"
       {"thick", CSSValueThick},
-#line 488 "CSSValueKeywords.gperf"
+#line 492 "CSSValueKeywords.gperf"
       {"moccasin", CSSValueMoccasin},
-#line 553 "CSSValueKeywords.gperf"
+#line 554 "CSSValueKeywords.gperf"
       {"lr-tb", CSSValueLrTb},
 #line 162 "CSSValueKeywords.gperf"
       {"inside", CSSValueInside},
@@ -348,23 +348,23 @@ findValue (register const char *str, register unsigned int len)
       {"slide", CSSValueSlide},
 #line 145 "CSSValueKeywords.gperf"
       {"middle", CSSValueMiddle},
-#line 401 "CSSValueKeywords.gperf"
+#line 405 "CSSValueKeywords.gperf"
       {"azure", CSSValueAzure},
 #line 75 "CSSValueKeywords.gperf"
       {"aqua", CSSValueAqua},
-#line 415 "CSSValueKeywords.gperf"
+#line 419 "CSSValueKeywords.gperf"
       {"cyan", CSSValueCyan},
-#line 557 "CSSValueKeywords.gperf"
+#line 558 "CSSValueKeywords.gperf"
       {"rl", CSSValueRl},
 #line 324 "CSSValueKeywords.gperf"
       {"space", CSSValueSpace},
-#line 405 "CSSValueKeywords.gperf"
+#line 409 "CSSValueKeywords.gperf"
       {"blueviolet", CSSValueBlueviolet},
 #line 184 "CSSValueKeywords.gperf"
       {"block", CSSValueBlock},
 #line 163 "CSSValueKeywords.gperf"
       {"disc", CSSValueDisc},
-#line 334 "CSSValueKeywords.gperf"
+#line 335 "CSSValueKeywords.gperf"
       {"listitem", CSSValueListitem},
 #line 16 "CSSValueKeywords.gperf"
       {"groove", CSSValueGroove},
@@ -372,13 +372,13 @@ findValue (register const char *str, register unsigned int len)
       {"ltr", CSSValueLtr},
 #line 202 "CSSValueKeywords.gperf"
       {"auto", CSSValueAuto},
-#line 453 "CSSValueKeywords.gperf"
+#line 457 "CSSValueKeywords.gperf"
       {"khaki", CSSValueKhaki},
-#line 451 "CSSValueKeywords.gperf"
+#line 455 "CSSValueKeywords.gperf"
       {"indigo", CSSValueIndigo},
-#line 555 "CSSValueKeywords.gperf"
+#line 556 "CSSValueKeywords.gperf"
       {"tb-rl", CSSValueTbRl},
-#line 380 "CSSValueKeywords.gperf"
+#line 381 "CSSValueKeywords.gperf"
       {"paused", CSSValuePaused},
 #line 22 "CSSValueKeywords.gperf"
       {"double", CSSValueDouble},
@@ -390,7 +390,7 @@ findValue (register const char *str, register unsigned int len)
       {"visible", CSSValueVisible},
 #line 37 "CSSValueKeywords.gperf"
       {"bold", CSSValueBold},
-#line 516 "CSSValueKeywords.gperf"
+#line 520 "CSSValueKeywords.gperf"
       {"snow", CSSValueSnow},
 #line 249 "CSSValueKeywords.gperf"
       {"blink", CSSValueBlink},
@@ -398,7 +398,7 @@ findValue (register const char *str, register unsigned int len)
       {"move", CSSValueMove},
 #line 302 "CSSValueKeywords.gperf"
       {"slow", CSSValueSlow},
-#line 384 "CSSValueKeywords.gperf"
+#line 385 "CSSValueKeywords.gperf"
       {"linear", CSSValueLinear},
 #line 88 "CSSValueKeywords.gperf"
       {"silver", CSSValueSilver},
@@ -410,9 +410,9 @@ findValue (register const char *str, register unsigned int len)
       {"caption", CSSValueCaption},
 #line 18 "CSSValueKeywords.gperf"
       {"outset", CSSValueOutset},
-#line 395 "CSSValueKeywords.gperf"
+#line 396 "CSSValueKeywords.gperf"
       {"stroke", CSSValueStroke},
-#line 527 "CSSValueKeywords.gperf"
+#line 531 "CSSValueKeywords.gperf"
       {"nonzero", CSSValueNonzero},
 #line 295 "CSSValueKeywords.gperf"
       {"single", CSSValueSingle},
@@ -426,7 +426,7 @@ findValue (register const char *str, register unsigned int len)
       {"black", CSSValueBlack},
 #line 223 "CSSValueKeywords.gperf"
       {"w-resize", CSSValueWResize},
-#line 428 "CSSValueKeywords.gperf"
+#line 432 "CSSValueKeywords.gperf"
       {"darksalmon", CSSValueDarksalmon},
 #line 304 "CSSValueKeywords.gperf"
       {"infinite", CSSValueInfinite},
@@ -436,13 +436,13 @@ findValue (register const char *str, register unsigned int len)
       {"inactivecaption", CSSValueInactivecaption},
 #line 144 "CSSValueKeywords.gperf"
       {"baseline", CSSValueBaseline},
-#line 367 "CSSValueKeywords.gperf"
+#line 368 "CSSValueKeywords.gperf"
       {"round", CSSValueRound},
 #line 238 "CSSValueKeywords.gperf"
       {"capitalize", CSSValueCapitalize},
 #line 244 "CSSValueKeywords.gperf"
       {"absolute", CSSValueAbsolute},
-#line 486 "CSSValueKeywords.gperf"
+#line 490 "CSSValueKeywords.gperf"
       {"mintcream", CSSValueMintcream},
 #line 33 "CSSValueKeywords.gperf"
       {"oblique", CSSValueOblique},
@@ -452,15 +452,15 @@ findValue (register const char *str, register unsigned int len)
       {"large", CSSValueLarge},
 #line 274 "CSSValueKeywords.gperf"
       {"portrait", CSSValuePortrait},
-#line 445 "CSSValueKeywords.gperf"
+#line 449 "CSSValueKeywords.gperf"
       {"gold", CSSValueGold},
 #line 57 "CSSValueKeywords.gperf"
       {"smaller", CSSValueSmaller},
-#line 434 "CSSValueKeywords.gperf"
+#line 438 "CSSValueKeywords.gperf"
       {"darkviolet", CSSValueDarkviolet},
-#line 377 "CSSValueKeywords.gperf"
+#line 378 "CSSValueKeywords.gperf"
       {"visual", CSSValueVisual},
-#line 450 "CSSValueKeywords.gperf"
+#line 454 "CSSValueKeywords.gperf"
       {"indianred", CSSValueIndianred},
 #line 85 "CSSValueKeywords.gperf"
       {"orange", CSSValueOrange},
@@ -470,13 +470,13 @@ findValue (register const char *str, register unsigned int len)
       {"pointer", CSSValuePointer},
 #line 90 "CSSValueKeywords.gperf"
       {"white", CSSValueWhite},
-#line 522 "CSSValueKeywords.gperf"
+#line 526 "CSSValueKeywords.gperf"
       {"turquoise", CSSValueTurquoise},
 #line 212 "CSSValueKeywords.gperf"
       {"no-drop", CSSValueNoDrop},
-#line 554 "CSSValueKeywords.gperf"
+#line 555 "CSSValueKeywords.gperf"
       {"rl-tb", CSSValueRlTb},
-#line 393 "CSSValueKeywords.gperf"
+#line 394 "CSSValueKeywords.gperf"
       {"painted", CSSValuePainted},
 #line 208 "CSSValueKeywords.gperf"
       {"cell", CSSValueCell},
@@ -486,27 +486,27 @@ findValue (register const char *str, register unsigned int len)
       {"pre", CSSValuePre},
 #line 165 "CSSValueKeywords.gperf"
       {"square", CSSValueSquare},
-#line 396 "CSSValueKeywords.gperf"
+#line 397 "CSSValueKeywords.gperf"
       {"antialiased", CSSValueAntialiased},
-#line 537 "CSSValueKeywords.gperf"
+#line 539 "CSSValueKeywords.gperf"
       {"butt", CSSValueButt},
-#line 406 "CSSValueKeywords.gperf"
+#line 410 "CSSValueKeywords.gperf"
       {"brown", CSSValueBrown},
 #line 32 "CSSValueKeywords.gperf"
       {"italic", CSSValueItalic},
-#line 535 "CSSValueKeywords.gperf"
+#line 538 "CSSValueKeywords.gperf"
       {"crispedges", CSSValueCrispedges},
-#line 512 "CSSValueKeywords.gperf"
+#line 516 "CSSValueKeywords.gperf"
       {"skyblue", CSSValueSkyblue},
 #line 330 "CSSValueKeywords.gperf"
       {"button", CSSValueButton},
-#line 525 "CSSValueKeywords.gperf"
+#line 529 "CSSValueKeywords.gperf"
       {"whitesmoke", CSSValueWhitesmoke},
 #line 282 "CSSValueKeywords.gperf"
       {"static", CSSValueStatic},
 #line 237 "CSSValueKeywords.gperf"
       {"rtl", CSSValueRtl},
-#line 400 "CSSValueKeywords.gperf"
+#line 404 "CSSValueKeywords.gperf"
       {"aquamarine", CSSValueAquamarine},
 #line 310 "CSSValueKeywords.gperf"
       {"element", CSSValueElement},
@@ -516,31 +516,31 @@ findValue (register const char *str, register unsigned int len)
       {"bottom", CSSValueBottom},
 #line 114 "CSSValueKeywords.gperf"
       {"scrollbar", CSSValueScrollbar},
-#line 394 "CSSValueKeywords.gperf"
+#line 395 "CSSValueKeywords.gperf"
       {"fill", CSSValueFill},
-#line 368 "CSSValueKeywords.gperf"
+#line 369 "CSSValueKeywords.gperf"
       {"border", CSSValueBorder},
 #line 35 "CSSValueKeywords.gperf"
       {"small-caps", CSSValueSmallCaps},
 #line 211 "CSSValueKeywords.gperf"
       {"progress", CSSValueProgress},
-#line 379 "CSSValueKeywords.gperf"
+#line 380 "CSSValueKeywords.gperf"
       {"running", CSSValueRunning},
 #line 38 "CSSValueKeywords.gperf"
       {"bolder", CSSValueBolder},
-#line 398 "CSSValueKeywords.gperf"
+#line 402 "CSSValueKeywords.gperf"
       {"aliceblue", CSSValueAliceblue},
 #line 197 "CSSValueKeywords.gperf"
       {"table-cell", CSSValueTableCell},
-#line 375 "CSSValueKeywords.gperf"
+#line 376 "CSSValueKeywords.gperf"
       {"cover", CSSValueCover},
-#line 385 "CSSValueKeywords.gperf"
+#line 386 "CSSValueKeywords.gperf"
       {"ease-in", CSSValueEaseIn},
 #line 92 "CSSValueKeywords.gperf"
       {"transparent", CSSValueTransparent},
-#line 511 "CSSValueKeywords.gperf"
+#line 515 "CSSValueKeywords.gperf"
       {"sienna", CSSValueSienna},
-#line 390 "CSSValueKeywords.gperf"
+#line 391 "CSSValueKeywords.gperf"
       {"visiblepainted", CSSValueVisiblepainted},
 #line 285 "CSSValueKeywords.gperf"
       {"underline", CSSValueUnderline},
@@ -558,13 +558,13 @@ findValue (register const char *str, register unsigned int len)
       {"ahead", CSSValueAhead},
 #line 185 "CSSValueKeywords.gperf"
       {"list-item", CSSValueListItem},
-#line 376 "CSSValueKeywords.gperf"
+#line 377 "CSSValueKeywords.gperf"
       {"logical", CSSValueLogical},
 #line 186 "CSSValueKeywords.gperf"
       {"run-in", CSSValueRunIn},
 #line 259 "CSSValueKeywords.gperf"
       {"invert", CSSValueInvert},
-#line 372 "CSSValueKeywords.gperf"
+#line 373 "CSSValueKeywords.gperf"
       {"padding", CSSValuePadding},
 #line 306 "CSSValueKeywords.gperf"
       {"alternate", CSSValueAlternate},
@@ -578,15 +578,15 @@ findValue (register const char *str, register unsigned int len)
       {"inline-table", CSSValueInlineTable},
 #line 19 "CSSValueKeywords.gperf"
       {"dotted", CSSValueDotted},
-#line 538 "CSSValueKeywords.gperf"
+#line 540 "CSSValueKeywords.gperf"
       {"miter", CSSValueMiter},
-#line 473 "CSSValueKeywords.gperf"
+#line 477 "CSSValueKeywords.gperf"
       {"limegreen", CSSValueLimegreen},
 #line 312 "CSSValueKeywords.gperf"
       {"intrinsic", CSSValueIntrinsic},
 #line 141 "CSSValueKeywords.gperf"
       {"xor", CSSValueXor},
-#line 491 "CSSValueKeywords.gperf"
+#line 495 "CSSValueKeywords.gperf"
       {"olivedrab", CSSValueOlivedrab},
 #line 188 "CSSValueKeywords.gperf"
       {"inline-block", CSSValueInlineBlock},
@@ -594,13 +594,13 @@ findValue (register const char *str, register unsigned int len)
       {"source-in", CSSValueSourceIn},
 #line 316 "CSSValueKeywords.gperf"
       {"discard", CSSValueDiscard},
-#line 497 "CSSValueKeywords.gperf"
+#line 501 "CSSValueKeywords.gperf"
       {"palevioletred", CSSValuePalevioletred},
 #line 27 "CSSValueKeywords.gperf"
       {"small-caption", CSSValueSmallCaption},
-#line 533 "CSSValueKeywords.gperf"
+#line 399 "CSSValueKeywords.gperf"
       {"optimizespeed", CSSValueOptimizespeed},
-#line 388 "CSSValueKeywords.gperf"
+#line 389 "CSSValueKeywords.gperf"
       {"document", CSSValueDocument},
 #line 89 "CSSValueKeywords.gperf"
       {"teal", CSSValueTeal},
@@ -608,15 +608,15 @@ findValue (register const char *str, register unsigned int len)
       {"larger", CSSValueLarger},
 #line 116 "CSSValueKeywords.gperf"
       {"threedface", CSSValueThreedface},
-#line 403 "CSSValueKeywords.gperf"
+#line 407 "CSSValueKeywords.gperf"
       {"bisque", CSSValueBisque},
-#line 381 "CSSValueKeywords.gperf"
+#line 382 "CSSValueKeywords.gperf"
       {"flat", CSSValueFlat},
-#line 408 "CSSValueKeywords.gperf"
+#line 412 "CSSValueKeywords.gperf"
       {"cadetblue", CSSValueCadetblue},
-#line 513 "CSSValueKeywords.gperf"
+#line 517 "CSSValueKeywords.gperf"
       {"slateblue", CSSValueSlateblue},
-#line 392 "CSSValueKeywords.gperf"
+#line 393 "CSSValueKeywords.gperf"
       {"visiblestroke", CSSValueVisiblestroke},
 #line 87 "CSSValueKeywords.gperf"
       {"red", CSSValueRed},
@@ -624,11 +624,11 @@ findValue (register const char *str, register unsigned int len)
       {"table-caption", CSSValueTableCaption},
 #line 136 "CSSValueKeywords.gperf"
       {"source-atop", CSSValueSourceAtop},
-#line 423 "CSSValueKeywords.gperf"
+#line 427 "CSSValueKeywords.gperf"
       {"darkmagenta", CSSValueDarkmagenta},
 #line 50 "CSSValueKeywords.gperf"
       {"x-small", CSSValueXSmall},
-#line 531 "CSSValueKeywords.gperf"
+#line 535 "CSSValueKeywords.gperf"
       {"srgb", CSSValueSrgb},
 #line 228 "CSSValueKeywords.gperf"
       {"col-resize", CSSValueColResize},
@@ -638,9 +638,9 @@ findValue (register const char *str, register unsigned int len)
       {"fast", CSSValueFast},
 #line 131 "CSSValueKeywords.gperf"
       {"clear", CSSValueClear},
-#line 427 "CSSValueKeywords.gperf"
+#line 431 "CSSValueKeywords.gperf"
       {"darkred", CSSValueDarkred},
-#line 495 "CSSValueKeywords.gperf"
+#line 499 "CSSValueKeywords.gperf"
       {"palegreen", CSSValuePalegreen},
 #line 320 "CSSValueKeywords.gperf"
       {"continuous", CSSValueContinuous},
@@ -662,15 +662,15 @@ findValue (register const char *str, register unsigned int len)
       {"menu", CSSValueMenu},
 #line 267 "CSSValueKeywords.gperf"
       {"mix", CSSValueMix},
-#line 543 "CSSValueKeywords.gperf"
+#line 544 "CSSValueKeywords.gperf"
       {"central", CSSValueCentral},
 #line 154 "CSSValueKeywords.gperf"
       {"left", CSSValueLeft},
 #line 14 "CSSValueKeywords.gperf"
       {"hidden", CSSValueHidden},
-#line 500 "CSSValueKeywords.gperf"
+#line 504 "CSSValueKeywords.gperf"
       {"peru", CSSValuePeru},
-#line 475 "CSSValueKeywords.gperf"
+#line 479 "CSSValueKeywords.gperf"
       {"magenta", CSSValueMagenta},
 #line 278 "CSSValueKeywords.gperf"
       {"relative", CSSValueRelative},
@@ -682,11 +682,11 @@ findValue (register const char *str, register unsigned int len)
       {"medium", CSSValueMedium},
 #line 220 "CSSValueKeywords.gperf"
       {"se-resize", CSSValueSeResize},
-#line 389 "CSSValueKeywords.gperf"
+#line 390 "CSSValueKeywords.gperf"
       {"reset", CSSValueReset},
-#line 505 "CSSValueKeywords.gperf"
+#line 509 "CSSValueKeywords.gperf"
       {"royalblue", CSSValueRoyalblue},
-#line 416 "CSSValueKeywords.gperf"
+#line 420 "CSSValueKeywords.gperf"
       {"darkblue", CSSValueDarkblue},
 #line 217 "CSSValueKeywords.gperf"
       {"ne-resize", CSSValueNeResize},
@@ -696,17 +696,17 @@ findValue (register const char *str, register unsigned int len)
       {"appworkspace", CSSValueAppworkspace},
 #line 251 "CSSValueKeywords.gperf"
       {"close-quote", CSSValueCloseQuote},
-#line 391 "CSSValueKeywords.gperf"
+#line 392 "CSSValueKeywords.gperf"
       {"visiblefill", CSSValueVisiblefill},
-#line 492 "CSSValueKeywords.gperf"
+#line 496 "CSSValueKeywords.gperf"
       {"orangered", CSSValueOrangered},
 #line 120 "CSSValueKeywords.gperf"
       {"window", CSSValueWindow},
-#line 524 "CSSValueKeywords.gperf"
+#line 528 "CSSValueKeywords.gperf"
       {"wheat", CSSValueWheat},
-#line 493 "CSSValueKeywords.gperf"
+#line 497 "CSSValueKeywords.gperf"
       {"orchid", CSSValueOrchid},
-#line 446 "CSSValueKeywords.gperf"
+#line 450 "CSSValueKeywords.gperf"
       {"goldenrod", CSSValueGoldenrod},
 #line 127 "CSSValueKeywords.gperf"
       {"repeat", CSSValueRepeat},
@@ -718,33 +718,33 @@ findValue (register const char *str, register unsigned int len)
       {"no-close-quote", CSSValueNoCloseQuote},
 #line 313 "CSSValueKeywords.gperf"
       {"min-intrinsic", CSSValueMinIntrinsic},
-#line 350 "CSSValueKeywords.gperf"
+#line 351 "CSSValueKeywords.gperf"
       {"menulist", CSSValueMenulist},
 #line 203 "CSSValueKeywords.gperf"
       {"crosshair", CSSValueCrosshair},
-#line 454 "CSSValueKeywords.gperf"
+#line 458 "CSSValueKeywords.gperf"
       {"lavender", CSSValueLavender},
 #line 133 "CSSValueKeywords.gperf"
       {"source-over", CSSValueSourceOver},
 #line 276 "CSSValueKeywords.gperf"
       {"pre-line", CSSValuePreLine},
-#line 420 "CSSValueKeywords.gperf"
+#line 424 "CSSValueKeywords.gperf"
       {"darkgreen", CSSValueDarkgreen},
-#line 430 "CSSValueKeywords.gperf"
+#line 434 "CSSValueKeywords.gperf"
       {"darkslateblue", CSSValueDarkslateblue},
 #line 269 "CSSValueKeywords.gperf"
       {"no-open-quote", CSSValueNoOpenQuote},
-#line 429 "CSSValueKeywords.gperf"
+#line 433 "CSSValueKeywords.gperf"
       {"darkseagreen", CSSValueDarkseagreen},
-#line 425 "CSSValueKeywords.gperf"
+#line 429 "CSSValueKeywords.gperf"
       {"darkorange", CSSValueDarkorange},
-#line 547 "CSSValueKeywords.gperf"
+#line 548 "CSSValueKeywords.gperf"
       {"alphabetic", CSSValueAlphabetic},
 #line 265 "CSSValueKeywords.gperf"
       {"lower", CSSValueLower},
-#line 386 "CSSValueKeywords.gperf"
+#line 387 "CSSValueKeywords.gperf"
       {"ease-out", CSSValueEaseOut},
-#line 551 "CSSValueKeywords.gperf"
+#line 552 "CSSValueKeywords.gperf"
       {"no-change", CSSValueNoChange},
 #line 287 "CSSValueKeywords.gperf"
       {"stretch", CSSValueStretch},
@@ -752,15 +752,15 @@ findValue (register const char *str, register unsigned int len)
       {"table-column", CSSValueTableColumn},
 #line 240 "CSSValueKeywords.gperf"
       {"lowercase", CSSValueLowercase},
-#line 424 "CSSValueKeywords.gperf"
+#line 428 "CSSValueKeywords.gperf"
       {"darkolivegreen", CSSValueDarkolivegreen},
-#line 517 "CSSValueKeywords.gperf"
+#line 521 "CSSValueKeywords.gperf"
       {"springgreen", CSSValueSpringgreen},
-#line 539 "CSSValueKeywords.gperf"
+#line 541 "CSSValueKeywords.gperf"
       {"bevel", CSSValueBevel},
 #line 179 "CSSValueKeywords.gperf"
       {"hiragana", CSSValueHiragana},
-#line 529 "CSSValueKeywords.gperf"
+#line 533 "CSSValueKeywords.gperf"
       {"accumulate", CSSValueAccumulate},
 #line 247 "CSSValueKeywords.gperf"
       {"below", CSSValueBelow},
@@ -768,7 +768,7 @@ findValue (register const char *str, register unsigned int len)
       {"nowrap", CSSValueNowrap},
 #line 69 "CSSValueKeywords.gperf"
       {"serif", CSSValueSerif},
-#line 443 "CSSValueKeywords.gperf"
+#line 447 "CSSValueKeywords.gperf"
       {"gainsboro", CSSValueGainsboro},
 #line 224 "CSSValueKeywords.gperf"
       {"ew-resize", CSSValueEwResize},
@@ -776,21 +776,21 @@ findValue (register const char *str, register unsigned int len)
       {"sw-resize", CSSValueSwResize},
 #line 135 "CSSValueKeywords.gperf"
       {"source-out", CSSValueSourceOut},
-#line 402 "CSSValueKeywords.gperf"
+#line 406 "CSSValueKeywords.gperf"
       {"beige", CSSValueBeige},
 #line 60 "CSSValueKeywords.gperf"
       {"narrower", CSSValueNarrower},
 #line 218 "CSSValueKeywords.gperf"
       {"nw-resize", CSSValueNwResize},
-#line 333 "CSSValueKeywords.gperf"
+#line 334 "CSSValueKeywords.gperf"
       {"listbox", CSSValueListbox},
-#line 449 "CSSValueKeywords.gperf"
+#line 453 "CSSValueKeywords.gperf"
       {"hotpink", CSSValueHotpink},
 #line 99 "CSSValueKeywords.gperf"
       {"buttonface", CSSValueButtonface},
-#line 494 "CSSValueKeywords.gperf"
+#line 498 "CSSValueKeywords.gperf"
       {"palegoldenrod", CSSValuePalegoldenrod},
-#line 532 "CSSValueKeywords.gperf"
+#line 536 "CSSValueKeywords.gperf"
       {"linearrgb", CSSValueLinearrgb},
 #line 20 "CSSValueKeywords.gperf"
       {"dashed", CSSValueDashed},
@@ -802,57 +802,59 @@ findValue (register const char *str, register unsigned int len)
       {"break-all", CSSValueBreakAll},
 #line 250 "CSSValueKeywords.gperf"
       {"both", CSSValueBoth},
-#line 409 "CSSValueKeywords.gperf"
+#line 413 "CSSValueKeywords.gperf"
       {"chartreuse", CSSValueChartreuse},
-#line 506 "CSSValueKeywords.gperf"
+#line 510 "CSSValueKeywords.gperf"
       {"saddlebrown", CSSValueSaddlebrown},
 #line 331 "CSSValueKeywords.gperf"
       {"button-bevel", CSSValueButtonBevel},
-#line 422 "CSSValueKeywords.gperf"
+#line 426 "CSSValueKeywords.gperf"
       {"darkkhaki", CSSValueDarkkhaki},
 #line 66 "CSSValueKeywords.gperf"
       {"expanded", CSSValueExpanded},
 #line 232 "CSSValueKeywords.gperf"
       {"help", CSSValueHelp},
-#line 440 "CSSValueKeywords.gperf"
+#line 444 "CSSValueKeywords.gperf"
       {"firebrick", CSSValueFirebrick},
-#line 528 "CSSValueKeywords.gperf"
+#line 532 "CSSValueKeywords.gperf"
       {"evenodd", CSSValueEvenodd},
 #line 142 "CSSValueKeywords.gperf"
       {"plus-darker", CSSValuePlusDarker},
 #line 273 "CSSValueKeywords.gperf"
       {"overline", CSSValueOverline},
-#line 417 "CSSValueKeywords.gperf"
+#line 421 "CSSValueKeywords.gperf"
       {"darkcyan", CSSValueDarkcyan},
 #line 293 "CSSValueKeywords.gperf"
       {"inline-axis", CSSValueInlineAxis},
 #line 107 "CSSValueKeywords.gperf"
       {"inactiveborder", CSSValueInactiveborder},
-#line 442 "CSSValueKeywords.gperf"
+#line 446 "CSSValueKeywords.gperf"
       {"forestgreen", CSSValueForestgreen},
 #line 103 "CSSValueKeywords.gperf"
       {"captiontext", CSSValueCaptiontext},
-#line 530 "CSSValueKeywords.gperf"
+#line 534 "CSSValueKeywords.gperf"
       {"new", CSSValueNew},
 #line 79 "CSSValueKeywords.gperf"
       {"gray", CSSValueGray},
 #line 194 "CSSValueKeywords.gperf"
       {"table-row", CSSValueTableRow},
-#line 549 "CSSValueKeywords.gperf"
+#line 333 "CSSValueKeywords.gperf"
+      {"list-button", CSSValueListButton},
+#line 550 "CSSValueKeywords.gperf"
       {"mathematical", CSSValueMathematical},
 #line 213 "CSSValueKeywords.gperf"
       {"not-allowed", CSSValueNotAllowed},
-#line 439 "CSSValueKeywords.gperf"
+#line 443 "CSSValueKeywords.gperf"
       {"dodgerblue", CSSValueDodgerblue},
-#line 487 "CSSValueKeywords.gperf"
+#line 491 "CSSValueKeywords.gperf"
       {"mistyrose", CSSValueMistyrose},
 #line 174 "CSSValueKeywords.gperf"
       {"upper-latin", CSSValueUpperLatin},
 #line 109 "CSSValueKeywords.gperf"
       {"inactivecaptiontext", CSSValueInactivecaptiontext},
-#line 509 "CSSValueKeywords.gperf"
+#line 513 "CSSValueKeywords.gperf"
       {"seagreen", CSSValueSeagreen},
-#line 355 "CSSValueKeywords.gperf"
+#line 356 "CSSValueKeywords.gperf"
       {"slider-vertical", CSSValueSliderVertical},
 #line 54 "CSSValueKeywords.gperf"
       {"x-large", CSSValueXLarge},
@@ -862,35 +864,35 @@ findValue (register const char *str, register unsigned int len)
       {"semi-condensed", CSSValueSemiCondensed},
 #line 78 "CSSValueKeywords.gperf"
       {"fuchsia", CSSValueFuchsia},
-#line 418 "CSSValueKeywords.gperf"
+#line 422 "CSSValueKeywords.gperf"
       {"darkgoldenrod", CSSValueDarkgoldenrod},
 #line 297 "CSSValueKeywords.gperf"
       {"forwards", CSSValueForwards},
-#line 510 "CSSValueKeywords.gperf"
+#line 514 "CSSValueKeywords.gperf"
       {"seashell", CSSValueSeashell},
 #line 298 "CSSValueKeywords.gperf"
       {"backwards", CSSValueBackwards},
 #line 119 "CSSValueKeywords.gperf"
       {"threedshadow", CSSValueThreedshadow},
-#line 382 "CSSValueKeywords.gperf"
+#line 383 "CSSValueKeywords.gperf"
       {"preserve-3d", CSSValuePreserve3d},
-#line 435 "CSSValueKeywords.gperf"
+#line 439 "CSSValueKeywords.gperf"
       {"deeppink", CSSValueDeeppink},
-#line 496 "CSSValueKeywords.gperf"
+#line 500 "CSSValueKeywords.gperf"
       {"paleturquoise", CSSValuePaleturquoise},
 #line 204 "CSSValueKeywords.gperf"
       {"default", CSSValueDefault},
 #line 138 "CSSValueKeywords.gperf"
       {"destination-in", CSSValueDestinationIn},
-#line 404 "CSSValueKeywords.gperf"
+#line 408 "CSSValueKeywords.gperf"
       {"blanchedalmond", CSSValueBlanchedalmond},
-#line 552 "CSSValueKeywords.gperf"
+#line 553 "CSSValueKeywords.gperf"
       {"reset-size", CSSValueResetSize},
-#line 518 "CSSValueKeywords.gperf"
+#line 522 "CSSValueKeywords.gperf"
       {"steelblue", CSSValueSteelblue},
 #line 70 "CSSValueKeywords.gperf"
       {"sans-serif", CSSValueSansSerif},
-#line 342 "CSSValueKeywords.gperf"
+#line 343 "CSSValueKeywords.gperf"
       {"media-slider", CSSValueMediaSlider},
 #line 230 "CSSValueKeywords.gperf"
       {"text", CSSValueText},
@@ -906,29 +908,29 @@ findValue (register const char *str, register unsigned int len)
       {"buttontext", CSSValueButtontext},
 #line 140 "CSSValueKeywords.gperf"
       {"destination-atop", CSSValueDestinationAtop},
-#line 477 "CSSValueKeywords.gperf"
+#line 481 "CSSValueKeywords.gperf"
       {"mediumblue", CSSValueMediumblue},
-#line 484 "CSSValueKeywords.gperf"
+#line 488 "CSSValueKeywords.gperf"
       {"mediumvioletred", CSSValueMediumvioletred},
-#line 452 "CSSValueKeywords.gperf"
+#line 456 "CSSValueKeywords.gperf"
       {"ivory", CSSValueIvory},
-#line 387 "CSSValueKeywords.gperf"
+#line 388 "CSSValueKeywords.gperf"
       {"ease-in-out", CSSValueEaseInOut},
-#line 548 "CSSValueKeywords.gperf"
+#line 549 "CSSValueKeywords.gperf"
       {"hanging", CSSValueHanging},
-#line 371 "CSSValueKeywords.gperf"
+#line 372 "CSSValueKeywords.gperf"
       {"content-box", CSSValueContentBox},
-#line 466 "CSSValueKeywords.gperf"
+#line 470 "CSSValueKeywords.gperf"
       {"lightsalmon", CSSValueLightsalmon},
-#line 397 "CSSValueKeywords.gperf"
+#line 398 "CSSValueKeywords.gperf"
       {"subpixel-antialiased", CSSValueSubpixelAntialiased},
-#line 407 "CSSValueKeywords.gperf"
+#line 411 "CSSValueKeywords.gperf"
       {"burlywood", CSSValueBurlywood},
-#line 444 "CSSValueKeywords.gperf"
+#line 448 "CSSValueKeywords.gperf"
       {"ghostwhite", CSSValueGhostwhite},
 #line 177 "CSSValueKeywords.gperf"
       {"georgian", CSSValueGeorgian},
-#line 426 "CSSValueKeywords.gperf"
+#line 430 "CSSValueKeywords.gperf"
       {"darkorchid", CSSValueDarkorchid},
 #line 245 "CSSValueKeywords.gperf"
       {"always", CSSValueAlways},
@@ -936,15 +938,15 @@ findValue (register const char *str, register unsigned int len)
       {"upper-roman", CSSValueUpperRoman},
 #line 172 "CSSValueKeywords.gperf"
       {"lower-latin", CSSValueLowerLatin},
-#line 456 "CSSValueKeywords.gperf"
+#line 460 "CSSValueKeywords.gperf"
       {"lawngreen", CSSValueLawngreen},
 #line 49 "CSSValueKeywords.gperf"
       {"xx-small", CSSValueXxSmall},
-#line 481 "CSSValueKeywords.gperf"
+#line 485 "CSSValueKeywords.gperf"
       {"mediumslateblue", CSSValueMediumslateblue},
 #line 271 "CSSValueKeywords.gperf"
       {"open-quote", CSSValueOpenQuote},
-#line 480 "CSSValueKeywords.gperf"
+#line 484 "CSSValueKeywords.gperf"
       {"mediumseagreen", CSSValueMediumseagreen},
 #line 326 "CSSValueKeywords.gperf"
       {"checkbox", CSSValueCheckbox},
@@ -956,37 +958,37 @@ findValue (register const char *str, register unsigned int len)
       {"fixed", CSSValueFixed},
 #line 72 "CSSValueKeywords.gperf"
       {"fantasy", CSSValueFantasy},
-#line 433 "CSSValueKeywords.gperf"
+#line 437 "CSSValueKeywords.gperf"
       {"darkturquoise", CSSValueDarkturquoise},
-#line 465 "CSSValueKeywords.gperf"
+#line 469 "CSSValueKeywords.gperf"
       {"lightpink", CSSValueLightpink},
 #line 277 "CSSValueKeywords.gperf"
       {"pre-wrap", CSSValuePreWrap},
 #line 125 "CSSValueKeywords.gperf"
       {"grey", CSSValueGrey},
-#line 479 "CSSValueKeywords.gperf"
+#line 483 "CSSValueKeywords.gperf"
       {"mediumpurple", CSSValueMediumpurple},
-#line 515 "CSSValueKeywords.gperf"
+#line 519 "CSSValueKeywords.gperf"
       {"slategrey", CSSValueSlategrey},
 #line 329 "CSSValueKeywords.gperf"
       {"square-button", CSSValueSquareButton},
-#line 514 "CSSValueKeywords.gperf"
+#line 518 "CSSValueKeywords.gperf"
       {"slategray", CSSValueSlategray},
-#line 438 "CSSValueKeywords.gperf"
+#line 442 "CSSValueKeywords.gperf"
       {"dimgrey", CSSValueDimgrey},
 #line 137 "CSSValueKeywords.gperf"
       {"destination-over", CSSValueDestinationOver},
-#line 437 "CSSValueKeywords.gperf"
+#line 441 "CSSValueKeywords.gperf"
       {"dimgray", CSSValueDimgray},
 #line 209 "CSSValueKeywords.gperf"
       {"context-menu", CSSValueContextMenu},
-#line 536 "CSSValueKeywords.gperf"
+#line 401 "CSSValueKeywords.gperf"
       {"geometricprecision", CSSValueGeometricprecision},
 #line 91 "CSSValueKeywords.gperf"
       {"yellow", CSSValueYellow},
 #line 317 "CSSValueKeywords.gperf"
       {"dot-dash", CSSValueDotDash},
-#line 485 "CSSValueKeywords.gperf"
+#line 489 "CSSValueKeywords.gperf"
       {"midnightblue", CSSValueMidnightblue},
 #line 155 "CSSValueKeywords.gperf"
       {"right", CSSValueRight},
@@ -994,43 +996,43 @@ findValue (register const char *str, register unsigned int len)
       {"background", CSSValueBackground},
 #line 39 "CSSValueKeywords.gperf"
       {"lighter", CSSValueLighter},
-#line 365 "CSSValueKeywords.gperf"
+#line 366 "CSSValueKeywords.gperf"
       {"textarea", CSSValueTextarea},
 #line 226 "CSSValueKeywords.gperf"
       {"nesw-resize", CSSValueNeswResize},
-#line 476 "CSSValueKeywords.gperf"
+#line 480 "CSSValueKeywords.gperf"
       {"mediumaquamarine", CSSValueMediumaquamarine},
 #line 110 "CSSValueKeywords.gperf"
       {"infobackground", CSSValueInfobackground},
 #line 113 "CSSValueKeywords.gperf"
       {"menutext", CSSValueMenutext},
-#line 550 "CSSValueKeywords.gperf"
+#line 551 "CSSValueKeywords.gperf"
       {"use-script", CSSValueUseScript},
-#line 489 "CSSValueKeywords.gperf"
+#line 493 "CSSValueKeywords.gperf"
       {"navajowhite", CSSValueNavajowhite},
 #line 61 "CSSValueKeywords.gperf"
       {"ultra-condensed", CSSValueUltraCondensed},
-#line 459 "CSSValueKeywords.gperf"
+#line 463 "CSSValueKeywords.gperf"
       {"lightcoral", CSSValueLightcoral},
 #line 143 "CSSValueKeywords.gperf"
       {"plus-lighter", CSSValuePlusLighter},
-#line 366 "CSSValueKeywords.gperf"
+#line 367 "CSSValueKeywords.gperf"
       {"caps-lock-indicator", CSSValueCapsLockIndicator},
 #line 168 "CSSValueKeywords.gperf"
       {"lower-roman", CSSValueLowerRoman},
-#line 503 "CSSValueKeywords.gperf"
+#line 507 "CSSValueKeywords.gperf"
       {"powderblue", CSSValuePowderblue},
 #line 101 "CSSValueKeywords.gperf"
       {"buttonshadow", CSSValueButtonshadow},
 #line 139 "CSSValueKeywords.gperf"
       {"destination-out", CSSValueDestinationOut},
-#line 542 "CSSValueKeywords.gperf"
+#line 543 "CSSValueKeywords.gperf"
       {"after-edge", CSSValueAfterEdge},
-#line 421 "CSSValueKeywords.gperf"
+#line 425 "CSSValueKeywords.gperf"
       {"darkgrey", CSSValueDarkgrey},
-#line 419 "CSSValueKeywords.gperf"
+#line 423 "CSSValueKeywords.gperf"
       {"darkgray", CSSValueDarkgray},
-#line 412 "CSSValueKeywords.gperf"
+#line 416 "CSSValueKeywords.gperf"
       {"cornflowerblue", CSSValueCornflowerblue},
 #line 328 "CSSValueKeywords.gperf"
       {"push-button", CSSValuePushButton},
@@ -1044,71 +1046,71 @@ findValue (register const char *str, register unsigned int len)
       {"hebrew", CSSValueHebrew},
 #line 122 "CSSValueKeywords.gperf"
       {"windowtext", CSSValueWindowtext},
-#line 432 "CSSValueKeywords.gperf"
+#line 436 "CSSValueKeywords.gperf"
       {"darkslategrey", CSSValueDarkslategrey},
-#line 431 "CSSValueKeywords.gperf"
+#line 435 "CSSValueKeywords.gperf"
       {"darkslategray", CSSValueDarkslategray},
-#line 546 "CSSValueKeywords.gperf"
+#line 547 "CSSValueKeywords.gperf"
       {"ideographic", CSSValueIdeographic},
 #line 207 "CSSValueKeywords.gperf"
       {"vertical-text", CSSValueVerticalText},
 #line 173 "CSSValueKeywords.gperf"
       {"upper-alpha", CSSValueUpperAlpha},
-#line 399 "CSSValueKeywords.gperf"
+#line 403 "CSSValueKeywords.gperf"
       {"antiquewhite", CSSValueAntiquewhite},
 #line 115 "CSSValueKeywords.gperf"
       {"threeddarkshadow", CSSValueThreeddarkshadow},
-#line 534 "CSSValueKeywords.gperf"
+#line 537 "CSSValueKeywords.gperf"
       {"optimizequality", CSSValueOptimizequality},
 #line 148 "CSSValueKeywords.gperf"
       {"text-top", CSSValueTextTop},
-#line 441 "CSSValueKeywords.gperf"
+#line 445 "CSSValueKeywords.gperf"
       {"floralwhite", CSSValueFloralwhite},
 #line 178 "CSSValueKeywords.gperf"
       {"cjk-ideographic", CSSValueCjkIdeographic},
-#line 369 "CSSValueKeywords.gperf"
+#line 370 "CSSValueKeywords.gperf"
       {"border-box", CSSValueBorderBox},
-#line 448 "CSSValueKeywords.gperf"
+#line 452 "CSSValueKeywords.gperf"
       {"honeydew", CSSValueHoneydew},
 #line 272 "CSSValueKeywords.gperf"
       {"overlay", CSSValueOverlay},
 #line 323 "CSSValueKeywords.gperf"
       {"break-word", CSSValueBreakWord},
-#line 458 "CSSValueKeywords.gperf"
+#line 462 "CSSValueKeywords.gperf"
       {"lightblue", CSSValueLightblue},
-#line 508 "CSSValueKeywords.gperf"
+#line 512 "CSSValueKeywords.gperf"
       {"sandybrown", CSSValueSandybrown},
-#line 504 "CSSValueKeywords.gperf"
+#line 508 "CSSValueKeywords.gperf"
       {"rosybrown", CSSValueRosybrown},
-#line 447 "CSSValueKeywords.gperf"
+#line 451 "CSSValueKeywords.gperf"
       {"greenyellow", CSSValueGreenyellow},
-#line 540 "CSSValueKeywords.gperf"
+#line 400 "CSSValueKeywords.gperf"
       {"optimizelegibility", CSSValueOptimizelegibility},
-#line 373 "CSSValueKeywords.gperf"
+#line 374 "CSSValueKeywords.gperf"
       {"padding-box", CSSValuePaddingBox},
 #line 182 "CSSValueKeywords.gperf"
       {"katakana-iroha", CSSValueKatakanaIroha},
 #line 321 "CSSValueKeywords.gperf"
       {"skip-white-space", CSSValueSkipWhiteSpace},
-#line 478 "CSSValueKeywords.gperf"
+#line 482 "CSSValueKeywords.gperf"
       {"mediumorchid", CSSValueMediumorchid},
-#line 471 "CSSValueKeywords.gperf"
+#line 475 "CSSValueKeywords.gperf"
       {"lightsteelblue", CSSValueLightsteelblue},
-#line 463 "CSSValueKeywords.gperf"
+#line 467 "CSSValueKeywords.gperf"
       {"lightgreen", CSSValueLightgreen},
 #line 65 "CSSValueKeywords.gperf"
       {"semi-expanded", CSSValueSemiExpanded},
-#line 467 "CSSValueKeywords.gperf"
+#line 471 "CSSValueKeywords.gperf"
       {"lightseagreen", CSSValueLightseagreen},
-#line 351 "CSSValueKeywords.gperf"
+#line 352 "CSSValueKeywords.gperf"
       {"menulist-button", CSSValueMenulistButton},
-#line 354 "CSSValueKeywords.gperf"
+#line 355 "CSSValueKeywords.gperf"
       {"slider-horizontal", CSSValueSliderHorizontal},
 #line 128 "CSSValueKeywords.gperf"
       {"repeat-x", CSSValueRepeatX},
 #line 170 "CSSValueKeywords.gperf"
       {"lower-greek", CSSValueLowerGreek},
-#line 483 "CSSValueKeywords.gperf"
+#line 487 "CSSValueKeywords.gperf"
       {"mediumturquoise", CSSValueMediumturquoise},
 #line 171 "CSSValueKeywords.gperf"
       {"lower-alpha", CSSValueLowerAlpha},
@@ -1118,41 +1120,41 @@ findValue (register const char *str, register unsigned int len)
       {"graytext", CSSValueGraytext},
 #line 129 "CSSValueKeywords.gperf"
       {"repeat-y", CSSValueRepeatY},
-#line 498 "CSSValueKeywords.gperf"
+#line 502 "CSSValueKeywords.gperf"
       {"papayawhip", CSSValuePapayawhip},
-#line 364 "CSSValueKeywords.gperf"
+#line 365 "CSSValueKeywords.gperf"
       {"textfield", CSSValueTextfield},
 #line 149 "CSSValueKeywords.gperf"
       {"text-bottom", CSSValueTextBottom},
-#line 541 "CSSValueKeywords.gperf"
+#line 542 "CSSValueKeywords.gperf"
       {"before-edge", CSSValueBeforeEdge},
 #line 62 "CSSValueKeywords.gperf"
       {"extra-condensed", CSSValueExtraCondensed},
-#line 455 "CSSValueKeywords.gperf"
+#line 459 "CSSValueKeywords.gperf"
       {"lavenderblush", CSSValueLavenderblush},
-#line 345 "CSSValueKeywords.gperf"
+#line 346 "CSSValueKeywords.gperf"
       {"media-volume-slider", CSSValueMediaVolumeSlider},
 #line 26 "CSSValueKeywords.gperf"
       {"message-box", CSSValueMessageBox},
-#line 352 "CSSValueKeywords.gperf"
+#line 353 "CSSValueKeywords.gperf"
       {"menulist-text", CSSValueMenulistText},
-#line 482 "CSSValueKeywords.gperf"
+#line 486 "CSSValueKeywords.gperf"
       {"mediumspringgreen", CSSValueMediumspringgreen},
-#line 460 "CSSValueKeywords.gperf"
+#line 464 "CSSValueKeywords.gperf"
       {"lightcyan", CSSValueLightcyan},
 #line 308 "CSSValueKeywords.gperf"
       {"read-write", CSSValueReadWrite},
 #line 258 "CSSValueKeywords.gperf"
       {"higher", CSSValueHigher},
-#line 526 "CSSValueKeywords.gperf"
+#line 530 "CSSValueKeywords.gperf"
       {"yellowgreen", CSSValueYellowgreen},
 #line 318 "CSSValueKeywords.gperf"
       {"dot-dot-dash", CSSValueDotDotDash},
-#line 457 "CSSValueKeywords.gperf"
+#line 461 "CSSValueKeywords.gperf"
       {"lemonchiffon", CSSValueLemonchiffon},
 #line 307 "CSSValueKeywords.gperf"
       {"read-only", CSSValueReadOnly},
-#line 359 "CSSValueKeywords.gperf"
+#line 360 "CSSValueKeywords.gperf"
       {"searchfield", CSSValueSearchfield},
 #line 181 "CSSValueKeywords.gperf"
       {"hiragana-iroha", CSSValueHiraganaIroha},
@@ -1162,7 +1164,7 @@ findValue (register const char *str, register unsigned int len)
       {"threedlightshadow", CSSValueThreedlightshadow},
 #line 201 "CSSValueKeywords.gperf"
       {"-wap-marquee", CSSValueWapMarquee},
-#line 336 "CSSValueKeywords.gperf"
+#line 337 "CSSValueKeywords.gperf"
       {"media-mute-button", CSSValueMediaMuteButton},
 #line 68 "CSSValueKeywords.gperf"
       {"ultra-expanded", CSSValueUltraExpanded},
@@ -1172,21 +1174,21 @@ findValue (register const char *str, register unsigned int len)
       {"-webkit-link", CSSValueWebkitLink},
 #line 167 "CSSValueKeywords.gperf"
       {"decimal-leading-zero", CSSValueDecimalLeadingZero},
-#line 357 "CSSValueKeywords.gperf"
+#line 358 "CSSValueKeywords.gperf"
       {"sliderthumb-vertical", CSSValueSliderthumbVertical},
 #line 94 "CSSValueKeywords.gperf"
       {"-webkit-activelink", CSSValueWebkitActivelink},
-#line 472 "CSSValueKeywords.gperf"
+#line 476 "CSSValueKeywords.gperf"
       {"lightyellow", CSSValueLightyellow},
-#line 436 "CSSValueKeywords.gperf"
+#line 440 "CSSValueKeywords.gperf"
       {"deepskyblue", CSSValueDeepskyblue},
 #line 191 "CSSValueKeywords.gperf"
       {"table-row-group", CSSValueTableRowGroup},
-#line 343 "CSSValueKeywords.gperf"
+#line 344 "CSSValueKeywords.gperf"
       {"media-sliderthumb", CSSValueMediaSliderthumb},
 #line 160 "CSSValueKeywords.gperf"
       {"-webkit-center", CSSValueWebkitCenter},
-#line 338 "CSSValueKeywords.gperf"
+#line 339 "CSSValueKeywords.gperf"
       {"media-seek-back-button", CSSValueMediaSeekBackButton},
 #line 30 "CSSValueKeywords.gperf"
       {"-webkit-control", CSSValueWebkitControl},
@@ -1194,37 +1196,37 @@ findValue (register const char *str, register unsigned int len)
       {"line-through", CSSValueLineThrough},
 #line 153 "CSSValueKeywords.gperf"
       {"-webkit-auto", CSSValueWebkitAuto},
-#line 464 "CSSValueKeywords.gperf"
+#line 468 "CSSValueKeywords.gperf"
       {"lightgrey", CSSValueLightgrey},
-#line 462 "CSSValueKeywords.gperf"
+#line 466 "CSSValueKeywords.gperf"
       {"lightgray", CSSValueLightgray},
 #line 325 "CSSValueKeywords.gperf"
       {"after-white-space", CSSValueAfterWhiteSpace},
-#line 468 "CSSValueKeywords.gperf"
+#line 472 "CSSValueKeywords.gperf"
       {"lightskyblue", CSSValueLightskyblue},
-#line 499 "CSSValueKeywords.gperf"
+#line 503 "CSSValueKeywords.gperf"
       {"peachpuff", CSSValuePeachpuff},
-#line 337 "CSSValueKeywords.gperf"
+#line 338 "CSSValueKeywords.gperf"
       {"media-play-button", CSSValueMediaPlayButton},
-#line 340 "CSSValueKeywords.gperf"
+#line 341 "CSSValueKeywords.gperf"
       {"media-rewind-button", CSSValueMediaRewindButton},
 #line 117 "CSSValueKeywords.gperf"
       {"threedhighlight", CSSValueThreedhighlight},
 #line 67 "CSSValueKeywords.gperf"
       {"extra-expanded", CSSValueExtraExpanded},
-#line 470 "CSSValueKeywords.gperf"
+#line 474 "CSSValueKeywords.gperf"
       {"lightslategrey", CSSValueLightslategrey},
-#line 469 "CSSValueKeywords.gperf"
+#line 473 "CSSValueKeywords.gperf"
       {"lightslategray", CSSValueLightslategray},
 #line 214 "CSSValueKeywords.gperf"
       {"-webkit-zoom-in", CSSValueWebkitZoomIn},
 #line 193 "CSSValueKeywords.gperf"
       {"table-footer-group", CSSValueTableFooterGroup},
-#line 353 "CSSValueKeywords.gperf"
+#line 354 "CSSValueKeywords.gperf"
       {"menulist-textfield", CSSValueMenulistTextfield},
 #line 158 "CSSValueKeywords.gperf"
       {"-webkit-left", CSSValueWebkitLeft},
-#line 344 "CSSValueKeywords.gperf"
+#line 345 "CSSValueKeywords.gperf"
       {"media-volume-slider-container", CSSValueMediaVolumeSliderContainer},
 #line 105 "CSSValueKeywords.gperf"
       {"highlight", CSSValueHighlight},
@@ -1234,7 +1236,7 @@ findValue (register const char *str, register unsigned int len)
       {"table-header-group", CSSValueTableHeaderGroup},
 #line 266 "CSSValueKeywords.gperf"
       {"-webkit-marquee", CSSValueWebkitMarquee},
-#line 347 "CSSValueKeywords.gperf"
+#line 348 "CSSValueKeywords.gperf"
       {"media-controls-background", CSSValueMediaControlsBackground},
 #line 234 "CSSValueKeywords.gperf"
       {"-webkit-grab", CSSValueWebkitGrab},
@@ -1244,7 +1246,7 @@ findValue (register const char *str, register unsigned int len)
       {"-webkit-text", CSSValueWebkitText},
 #line 28 "CSSValueKeywords.gperf"
       {"-webkit-mini-control", CSSValueWebkitMiniControl},
-#line 335 "CSSValueKeywords.gperf"
+#line 336 "CSSValueKeywords.gperf"
       {"media-fullscreen-button", CSSValueMediaFullscreenButton},
 #line 215 "CSSValueKeywords.gperf"
       {"-webkit-zoom-out", CSSValueWebkitZoomOut},
@@ -1252,43 +1254,43 @@ findValue (register const char *str, register unsigned int len)
       {"buttonhighlight", CSSValueButtonhighlight},
 #line 199 "CSSValueKeywords.gperf"
       {"-webkit-box", CSSValueWebkitBox},
-#line 356 "CSSValueKeywords.gperf"
+#line 357 "CSSValueKeywords.gperf"
       {"sliderthumb-horizontal", CSSValueSliderthumbHorizontal},
-#line 360 "CSSValueKeywords.gperf"
+#line 361 "CSSValueKeywords.gperf"
       {"searchfield-decoration", CSSValueSearchfieldDecoration},
 #line 152 "CSSValueKeywords.gperf"
       {"-webkit-baseline-middle", CSSValueWebkitBaselineMiddle},
-#line 346 "CSSValueKeywords.gperf"
+#line 347 "CSSValueKeywords.gperf"
       {"media-volume-sliderthumb", CSSValueMediaVolumeSliderthumb},
 #line 74 "CSSValueKeywords.gperf"
       {"-webkit-body", CSSValueWebkitBody},
-#line 461 "CSSValueKeywords.gperf"
+#line 465 "CSSValueKeywords.gperf"
       {"lightgoldenrodyellow", CSSValueLightgoldenrodyellow},
-#line 545 "CSSValueKeywords.gperf"
+#line 546 "CSSValueKeywords.gperf"
       {"text-after-edge", CSSValueTextAfterEdge},
-#line 349 "CSSValueKeywords.gperf"
+#line 350 "CSSValueKeywords.gperf"
       {"media-time-remaining-display", CSSValueMediaTimeRemainingDisplay},
 #line 159 "CSSValueKeywords.gperf"
       {"-webkit-right", CSSValueWebkitRight},
-#line 544 "CSSValueKeywords.gperf"
+#line 545 "CSSValueKeywords.gperf"
       {"text-before-edge", CSSValueTextBeforeEdge},
 #line 235 "CSSValueKeywords.gperf"
       {"-webkit-grabbing", CSSValueWebkitGrabbing},
 #line 200 "CSSValueKeywords.gperf"
       {"-webkit-inline-box", CSSValueWebkitInlineBox},
-#line 348 "CSSValueKeywords.gperf"
+#line 349 "CSSValueKeywords.gperf"
       {"media-current-time-display", CSSValueMediaCurrentTimeDisplay},
 #line 106 "CSSValueKeywords.gperf"
       {"highlighttext", CSSValueHighlighttext},
-#line 363 "CSSValueKeywords.gperf"
+#line 364 "CSSValueKeywords.gperf"
       {"searchfield-cancel-button", CSSValueSearchfieldCancelButton},
-#line 339 "CSSValueKeywords.gperf"
+#line 340 "CSSValueKeywords.gperf"
       {"media-seek-forward-button", CSSValueMediaSeekForwardButton},
-#line 341 "CSSValueKeywords.gperf"
+#line 342 "CSSValueKeywords.gperf"
       {"media-return-to-realtime-button", CSSValueMediaReturnToRealtimeButton},
-#line 361 "CSSValueKeywords.gperf"
-      {"searchfield-results-decoration", CSSValueSearchfieldResultsDecoration},
 #line 362 "CSSValueKeywords.gperf"
+      {"searchfield-results-decoration", CSSValueSearchfieldResultsDecoration},
+#line 363 "CSSValueKeywords.gperf"
       {"searchfield-results-button", CSSValueSearchfieldResultsButton},
 #line 309 "CSSValueKeywords.gperf"
       {"read-write-plaintext-only", CSSValueReadWritePlaintextOnly},
@@ -1470,223 +1472,223 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1, 317,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1, 318,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      319,  -1,  -1,  -1,  -1,  -1, 320,  -1,  -1,  -1,
-       -1, 321, 322,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 323,  -1,  -1, 324,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 325, 326,  -1, 327,
-       -1,  -1, 328,  -1,  -1, 329,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 330, 331,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 332,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 333,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 334,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 335,  -1,  -1,  -1,  -1, 336,  -1,  -1,  -1,
-       -1, 337,  -1,  -1,  -1,  -1,  -1, 338,  -1,  -1,
-       -1, 339,  -1,  -1,  -1, 340,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 341,  -1,  -1,  -1,  -1,
-      342,  -1,  -1,  -1,  -1, 343,  -1,  -1,  -1,  -1,
-      344,  -1,  -1,  -1,  -1, 345, 346,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 347,  -1,  -1,  -1,
-       -1,  -1, 348,  -1,  -1,  -1, 349,  -1,  -1,  -1,
-       -1,  -1, 350,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 319,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      320,  -1,  -1,  -1,  -1,  -1, 321,  -1,  -1,  -1,
+       -1, 322, 323,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 324,  -1,  -1, 325,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 326, 327,  -1, 328,
+       -1,  -1, 329,  -1,  -1, 330,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 331, 332,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 333,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 334,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 335,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 336,  -1,  -1,  -1,  -1, 337,  -1,  -1,  -1,
+       -1, 338,  -1,  -1,  -1,  -1,  -1, 339,  -1,  -1,
+       -1, 340,  -1,  -1,  -1, 341,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 342,  -1,  -1,  -1,  -1,
+      343,  -1,  -1,  -1,  -1, 344,  -1,  -1,  -1,  -1,
+      345,  -1,  -1,  -1,  -1, 346, 347,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 348,  -1,  -1,  -1,
+       -1,  -1, 349,  -1,  -1,  -1, 350,  -1,  -1,  -1,
        -1,  -1, 351,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      352,  -1,  -1,  -1,  -1, 353, 354, 355,  -1,  -1,
-      356,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 357,  -1,  -1,
-       -1, 358,  -1,  -1,  -1,  -1, 359, 360, 361,  -1,
-       -1,  -1, 362,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 352,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      353,  -1,  -1,  -1,  -1, 354, 355, 356,  -1,  -1,
+      357,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 358,  -1,  -1,
+       -1, 359,  -1,  -1,  -1,  -1, 360, 361, 362,  -1,
        -1,  -1, 363,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 364, 365,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 366,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 367, 368,  -1, 369, 370,  -1,  -1,  -1, 371,
-       -1, 372,  -1,  -1,  -1,  -1,  -1, 373,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 374,  -1,
-       -1, 375, 376,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 377,  -1, 378,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 379,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 364,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 365, 366,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 367,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 368, 369,  -1, 370, 371,  -1,  -1,  -1, 372,
+       -1, 373,  -1,  -1,  -1,  -1,  -1, 374,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 375,  -1,
+       -1, 376, 377,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 378,  -1, 379,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 380,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 380, 381,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 381, 382,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      382,  -1, 383,  -1,  -1,  -1, 384, 385,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 386,  -1,
-       -1, 387,  -1, 388,  -1,  -1, 389,  -1,  -1,  -1,
+      383,  -1, 384,  -1,  -1,  -1, 385, 386,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 387,  -1,
+       -1, 388,  -1, 389,  -1,  -1, 390,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 390,  -1,  -1,  -1,
-       -1,  -1, 391,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 391,  -1,  -1,  -1,
+       -1,  -1, 392,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      392,  -1, 393,  -1,  -1,  -1, 394, 395,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 396,  -1,  -1,  -1,
+      393,  -1, 394,  -1,  -1,  -1, 395, 396,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1, 397,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 398, 399, 400,  -1,
-       -1, 401,  -1,  -1,  -1, 402,  -1,  -1, 403,  -1,
-       -1,  -1,  -1,  -1,  -1, 404, 405,  -1,  -1,  -1,
-       -1,  -1, 406, 407,  -1,  -1, 408,  -1,  -1,  -1,
-       -1, 409,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 410,  -1,  -1,
-      411,  -1,  -1,  -1,  -1,  -1,  -1, 412, 413,  -1,
-       -1,  -1,  -1, 414,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 415,  -1,  -1,  -1,  -1, 416,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 417, 418,  -1, 419,  -1,
-       -1, 420,  -1,  -1, 421,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 398,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 399, 400, 401,  -1,
+       -1, 402,  -1,  -1,  -1, 403,  -1,  -1, 404,  -1,
+       -1,  -1,  -1,  -1,  -1, 405, 406,  -1,  -1,  -1,
+       -1,  -1, 407, 408,  -1,  -1, 409,  -1,  -1,  -1,
+       -1, 410,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 411,  -1,  -1,
+      412,  -1,  -1,  -1,  -1,  -1,  -1, 413, 414,  -1,
+       -1,  -1,  -1, 415,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 416,  -1,  -1,  -1,  -1, 417,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 418, 419,  -1, 420,  -1,
+       -1, 421,  -1,  -1, 422,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 422,  -1,
-       -1,  -1,  -1, 423,  -1,  -1, 424,  -1,  -1,  -1,
-       -1,  -1, 425,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 423,  -1,
+       -1,  -1,  -1, 424,  -1,  -1, 425,  -1,  -1,  -1,
+       -1,  -1, 426,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 426,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 427,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 428,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 427,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 428,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 429,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      429,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 430,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      430,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 431,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 431,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 432,  -1,  -1,  -1, 433, 434,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 435,  -1,  -1,
-       -1,  -1, 436,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 437,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 438,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 432,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 433,  -1,  -1,  -1, 434, 435,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 436,  -1,  -1,
+       -1,  -1, 437,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 438,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 439,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 439,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 440,  -1,
-       -1,  -1,  -1,  -1, 441,  -1,  -1, 442,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 443,  -1,  -1,
-       -1,  -1, 444,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 445, 446, 447,  -1,  -1,
-       -1, 448,  -1,  -1,  -1,  -1,  -1, 449,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 440,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 441,  -1,
+       -1,  -1,  -1,  -1, 442,  -1,  -1, 443,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 444,  -1,  -1,
+       -1,  -1, 445,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 446, 447, 448,  -1,  -1,
+       -1, 449,  -1,  -1,  -1,  -1,  -1, 450,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      450, 451,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 452,  -1,  -1,  -1,  -1, 453,  -1,
+      451, 452,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 453,  -1,  -1,  -1,  -1, 454,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 454,  -1,  -1,
-       -1, 455,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      456,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 457,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 455,  -1,  -1,
+       -1, 456,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      457,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 458,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 458,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 459,
-       -1,  -1,  -1,  -1,  -1,  -1, 460,  -1,  -1,  -1,
-       -1, 461, 462,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 463,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 459,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 460,
+       -1,  -1,  -1,  -1,  -1,  -1, 461,  -1,  -1,  -1,
+       -1, 462, 463,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1, 464,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1, 465,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 466,  -1,  -1,
-       -1, 467,  -1,  -1,  -1,  -1,  -1, 468,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 466,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 467,  -1,  -1,
+       -1, 468,  -1,  -1,  -1,  -1,  -1, 469,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 469,  -1,  -1,
-       -1, 470,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 470,  -1,  -1,
        -1, 471,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 472,  -1,  -1,  -1,  -1,  -1,  -1,
-      473,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 472,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 473,  -1,  -1,  -1,  -1,  -1,  -1,
+      474,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      474, 475,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 476,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      475, 476,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 477,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 477,  -1,  -1,
-       -1, 478,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 479,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 480,  -1,
-      481,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 482,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 483,  -1, 484,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 478,  -1,  -1,
+       -1, 479,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 480,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 481,  -1,
+      482,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 483,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 484,  -1, 485,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 485,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 486,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 486,  -1,  -1,
-       -1,  -1,  -1,  -1, 487,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 488,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 487,  -1,  -1,
+       -1,  -1,  -1,  -1, 488,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 489,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 489,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 490,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 491,  -1,  -1,  -1,  -1,
+       -1,  -1, 490,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 491,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 492,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 492,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1, 493,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1, 494,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 495,  -1,  -1,
-       -1,  -1, 496,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 495,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 496,  -1,  -1,
+       -1,  -1, 497,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 497,  -1,
-       -1,  -1,  -1, 498,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 498,  -1,
+       -1,  -1,  -1, 499,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 499, 500,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 500, 501,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      501,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      502,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 502,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1, 503,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 504,  -1,  -1,
-       -1,  -1, 505,  -1,  -1,  -1,  -1,  -1, 506,  -1,
-       -1,  -1,  -1, 507,  -1,  -1,  -1, 508,  -1,  -1,
+       -1, 504,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 505,  -1,  -1,
+       -1,  -1, 506,  -1,  -1,  -1,  -1,  -1, 507,  -1,
+       -1,  -1,  -1, 508,  -1,  -1,  -1, 509,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 509,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 510,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 510,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 511,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 511,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 512,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1694,50 +1696,50 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 512,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 513,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 513,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 514,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 514,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 515,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 515,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 516,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 516,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 517,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 517, 518,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 518, 519,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 519,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 520,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 520,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 521,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 521,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 522,  -1,  -1,  -1,  -1,
+       -1,  -1, 522,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 523,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 523, 524,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 525,  -1,
+       -1,  -1, 524, 525,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 526,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 526,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 527,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      527,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      528,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 528,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 529,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1748,22 +1750,22 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 529,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 530,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 530,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 531,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 531,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 532,  -1,  -1,
+       -1,  -1,  -1,  -1, 532,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1, 533,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 534,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1778,9 +1780,9 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 534,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 535,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 536,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 535,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 536,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 537,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1790,7 +1792,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 537,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 538,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1802,11 +1804,11 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 538,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 539,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 539,  -1,
-       -1,  -1,  -1,  -1,  -1, 540,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 540,  -1,
+       -1,  -1,  -1,  -1,  -1, 541,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1834,7 +1836,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 541,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 542,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1856,7 +1858,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      542,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      543,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1877,7 +1879,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      543,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      544,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1891,7 +1893,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      544,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      545,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1924,7 +1926,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 545,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 546,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1950,7 +1952,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 546,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 547,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -2017,7 +2019,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 547
+       -1, 548
     };
 
   if (len <= MAX_WORD_LENGTH && len >= MIN_WORD_LENGTH)
@@ -2039,7 +2041,7 @@ findValue (register const char *str, register unsigned int len)
     }
   return 0;
 }
-#line 559 "CSSValueKeywords.gperf"
+#line 560 "CSSValueKeywords.gperf"
 
 static const char * const valueList[] = {
 "",
@@ -2365,6 +2367,7 @@ static const char * const valueList[] = {
 "button", 
 "button-bevel", 
 "default-button", 
+"list-button", 
 "listbox", 
 "listitem", 
 "media-fullscreen-button", 
@@ -2430,6 +2433,9 @@ static const char * const valueList[] = {
 "stroke", 
 "antialiased", 
 "subpixel-antialiased", 
+"optimizespeed", 
+"optimizelegibility", 
+"geometricprecision", 
 "aliceblue", 
 "antiquewhite", 
 "aquamarine", 
@@ -2565,14 +2571,11 @@ static const char * const valueList[] = {
 "new", 
 "srgb", 
 "linearrgb", 
-"optimizespeed", 
 "optimizequality", 
 "crispedges", 
-"geometricprecision", 
 "butt", 
 "miter", 
 "bevel", 
-"optimizelegibility", 
 "before-edge", 
 "after-edge", 
 "central", 
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
index d3b22e4a25..e05d7ed4fc 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
@@ -326,233 +326,234 @@ const int CSSValueSquareButton = 319;
 const int CSSValueButton = 320;
 const int CSSValueButtonBevel = 321;
 const int CSSValueDefaultButton = 322;
-const int CSSValueListbox = 323;
-const int CSSValueListitem = 324;
-const int CSSValueMediaFullscreenButton = 325;
-const int CSSValueMediaMuteButton = 326;
-const int CSSValueMediaPlayButton = 327;
-const int CSSValueMediaSeekBackButton = 328;
-const int CSSValueMediaSeekForwardButton = 329;
-const int CSSValueMediaRewindButton = 330;
-const int CSSValueMediaReturnToRealtimeButton = 331;
-const int CSSValueMediaSlider = 332;
-const int CSSValueMediaSliderthumb = 333;
-const int CSSValueMediaVolumeSliderContainer = 334;
-const int CSSValueMediaVolumeSlider = 335;
-const int CSSValueMediaVolumeSliderthumb = 336;
-const int CSSValueMediaControlsBackground = 337;
-const int CSSValueMediaCurrentTimeDisplay = 338;
-const int CSSValueMediaTimeRemainingDisplay = 339;
-const int CSSValueMenulist = 340;
-const int CSSValueMenulistButton = 341;
-const int CSSValueMenulistText = 342;
-const int CSSValueMenulistTextfield = 343;
-const int CSSValueSliderHorizontal = 344;
-const int CSSValueSliderVertical = 345;
-const int CSSValueSliderthumbHorizontal = 346;
-const int CSSValueSliderthumbVertical = 347;
-const int CSSValueCaret = 348;
-const int CSSValueSearchfield = 349;
-const int CSSValueSearchfieldDecoration = 350;
-const int CSSValueSearchfieldResultsDecoration = 351;
-const int CSSValueSearchfieldResultsButton = 352;
-const int CSSValueSearchfieldCancelButton = 353;
-const int CSSValueTextfield = 354;
-const int CSSValueTextarea = 355;
-const int CSSValueCapsLockIndicator = 356;
-const int CSSValueRound = 357;
-const int CSSValueBorder = 358;
-const int CSSValueBorderBox = 359;
-const int CSSValueContent = 360;
-const int CSSValueContentBox = 361;
-const int CSSValuePadding = 362;
-const int CSSValuePaddingBox = 363;
-const int CSSValueContain = 364;
-const int CSSValueCover = 365;
-const int CSSValueLogical = 366;
-const int CSSValueVisual = 367;
-const int CSSValueLines = 368;
-const int CSSValueRunning = 369;
-const int CSSValuePaused = 370;
-const int CSSValueFlat = 371;
-const int CSSValuePreserve3d = 372;
-const int CSSValueEase = 373;
-const int CSSValueLinear = 374;
-const int CSSValueEaseIn = 375;
-const int CSSValueEaseOut = 376;
-const int CSSValueEaseInOut = 377;
-const int CSSValueDocument = 378;
-const int CSSValueReset = 379;
-const int CSSValueVisiblepainted = 380;
-const int CSSValueVisiblefill = 381;
-const int CSSValueVisiblestroke = 382;
-const int CSSValuePainted = 383;
-const int CSSValueFill = 384;
-const int CSSValueStroke = 385;
-const int CSSValueAntialiased = 386;
-const int CSSValueSubpixelAntialiased = 387;
-const int CSSValueAliceblue = 388;
-const int CSSValueAntiquewhite = 389;
-const int CSSValueAquamarine = 390;
-const int CSSValueAzure = 391;
-const int CSSValueBeige = 392;
-const int CSSValueBisque = 393;
-const int CSSValueBlanchedalmond = 394;
-const int CSSValueBlueviolet = 395;
-const int CSSValueBrown = 396;
-const int CSSValueBurlywood = 397;
-const int CSSValueCadetblue = 398;
-const int CSSValueChartreuse = 399;
-const int CSSValueChocolate = 400;
-const int CSSValueCoral = 401;
-const int CSSValueCornflowerblue = 402;
-const int CSSValueCornsilk = 403;
-const int CSSValueCrimson = 404;
-const int CSSValueCyan = 405;
-const int CSSValueDarkblue = 406;
-const int CSSValueDarkcyan = 407;
-const int CSSValueDarkgoldenrod = 408;
-const int CSSValueDarkgray = 409;
-const int CSSValueDarkgreen = 410;
-const int CSSValueDarkgrey = 411;
-const int CSSValueDarkkhaki = 412;
-const int CSSValueDarkmagenta = 413;
-const int CSSValueDarkolivegreen = 414;
-const int CSSValueDarkorange = 415;
-const int CSSValueDarkorchid = 416;
-const int CSSValueDarkred = 417;
-const int CSSValueDarksalmon = 418;
-const int CSSValueDarkseagreen = 419;
-const int CSSValueDarkslateblue = 420;
-const int CSSValueDarkslategray = 421;
-const int CSSValueDarkslategrey = 422;
-const int CSSValueDarkturquoise = 423;
-const int CSSValueDarkviolet = 424;
-const int CSSValueDeeppink = 425;
-const int CSSValueDeepskyblue = 426;
-const int CSSValueDimgray = 427;
-const int CSSValueDimgrey = 428;
-const int CSSValueDodgerblue = 429;
-const int CSSValueFirebrick = 430;
-const int CSSValueFloralwhite = 431;
-const int CSSValueForestgreen = 432;
-const int CSSValueGainsboro = 433;
-const int CSSValueGhostwhite = 434;
-const int CSSValueGold = 435;
-const int CSSValueGoldenrod = 436;
-const int CSSValueGreenyellow = 437;
-const int CSSValueHoneydew = 438;
-const int CSSValueHotpink = 439;
-const int CSSValueIndianred = 440;
-const int CSSValueIndigo = 441;
-const int CSSValueIvory = 442;
-const int CSSValueKhaki = 443;
-const int CSSValueLavender = 444;
-const int CSSValueLavenderblush = 445;
-const int CSSValueLawngreen = 446;
-const int CSSValueLemonchiffon = 447;
-const int CSSValueLightblue = 448;
-const int CSSValueLightcoral = 449;
-const int CSSValueLightcyan = 450;
-const int CSSValueLightgoldenrodyellow = 451;
-const int CSSValueLightgray = 452;
-const int CSSValueLightgreen = 453;
-const int CSSValueLightgrey = 454;
-const int CSSValueLightpink = 455;
-const int CSSValueLightsalmon = 456;
-const int CSSValueLightseagreen = 457;
-const int CSSValueLightskyblue = 458;
-const int CSSValueLightslategray = 459;
-const int CSSValueLightslategrey = 460;
-const int CSSValueLightsteelblue = 461;
-const int CSSValueLightyellow = 462;
-const int CSSValueLimegreen = 463;
-const int CSSValueLinen = 464;
-const int CSSValueMagenta = 465;
-const int CSSValueMediumaquamarine = 466;
-const int CSSValueMediumblue = 467;
-const int CSSValueMediumorchid = 468;
-const int CSSValueMediumpurple = 469;
-const int CSSValueMediumseagreen = 470;
-const int CSSValueMediumslateblue = 471;
-const int CSSValueMediumspringgreen = 472;
-const int CSSValueMediumturquoise = 473;
-const int CSSValueMediumvioletred = 474;
-const int CSSValueMidnightblue = 475;
-const int CSSValueMintcream = 476;
-const int CSSValueMistyrose = 477;
-const int CSSValueMoccasin = 478;
-const int CSSValueNavajowhite = 479;
-const int CSSValueOldlace = 480;
-const int CSSValueOlivedrab = 481;
-const int CSSValueOrangered = 482;
-const int CSSValueOrchid = 483;
-const int CSSValuePalegoldenrod = 484;
-const int CSSValuePalegreen = 485;
-const int CSSValuePaleturquoise = 486;
-const int CSSValuePalevioletred = 487;
-const int CSSValuePapayawhip = 488;
-const int CSSValuePeachpuff = 489;
-const int CSSValuePeru = 490;
-const int CSSValuePink = 491;
-const int CSSValuePlum = 492;
-const int CSSValuePowderblue = 493;
-const int CSSValueRosybrown = 494;
-const int CSSValueRoyalblue = 495;
-const int CSSValueSaddlebrown = 496;
-const int CSSValueSalmon = 497;
-const int CSSValueSandybrown = 498;
-const int CSSValueSeagreen = 499;
-const int CSSValueSeashell = 500;
-const int CSSValueSienna = 501;
-const int CSSValueSkyblue = 502;
-const int CSSValueSlateblue = 503;
-const int CSSValueSlategray = 504;
-const int CSSValueSlategrey = 505;
-const int CSSValueSnow = 506;
-const int CSSValueSpringgreen = 507;
-const int CSSValueSteelblue = 508;
-const int CSSValueTan = 509;
-const int CSSValueThistle = 510;
-const int CSSValueTomato = 511;
-const int CSSValueTurquoise = 512;
-const int CSSValueViolet = 513;
-const int CSSValueWheat = 514;
-const int CSSValueWhitesmoke = 515;
-const int CSSValueYellowgreen = 516;
-const int CSSValueNonzero = 517;
-const int CSSValueEvenodd = 518;
-const int CSSValueAccumulate = 519;
-const int CSSValueNew = 520;
-const int CSSValueSrgb = 521;
-const int CSSValueLinearrgb = 522;
-const int CSSValueOptimizespeed = 523;
-const int CSSValueOptimizequality = 524;
-const int CSSValueCrispedges = 525;
-const int CSSValueGeometricprecision = 526;
-const int CSSValueButt = 527;
-const int CSSValueMiter = 528;
-const int CSSValueBevel = 529;
-const int CSSValueOptimizelegibility = 530;
-const int CSSValueBeforeEdge = 531;
-const int CSSValueAfterEdge = 532;
-const int CSSValueCentral = 533;
-const int CSSValueTextBeforeEdge = 534;
-const int CSSValueTextAfterEdge = 535;
-const int CSSValueIdeographic = 536;
-const int CSSValueAlphabetic = 537;
-const int CSSValueHanging = 538;
-const int CSSValueMathematical = 539;
-const int CSSValueUseScript = 540;
-const int CSSValueNoChange = 541;
-const int CSSValueResetSize = 542;
-const int CSSValueLrTb = 543;
-const int CSSValueRlTb = 544;
-const int CSSValueTbRl = 545;
-const int CSSValueLr = 546;
-const int CSSValueRl = 547;
-const int CSSValueTb = 548;
-const int numCSSValueKeywords = 549;
+const int CSSValueListButton = 323;
+const int CSSValueListbox = 324;
+const int CSSValueListitem = 325;
+const int CSSValueMediaFullscreenButton = 326;
+const int CSSValueMediaMuteButton = 327;
+const int CSSValueMediaPlayButton = 328;
+const int CSSValueMediaSeekBackButton = 329;
+const int CSSValueMediaSeekForwardButton = 330;
+const int CSSValueMediaRewindButton = 331;
+const int CSSValueMediaReturnToRealtimeButton = 332;
+const int CSSValueMediaSlider = 333;
+const int CSSValueMediaSliderthumb = 334;
+const int CSSValueMediaVolumeSliderContainer = 335;
+const int CSSValueMediaVolumeSlider = 336;
+const int CSSValueMediaVolumeSliderthumb = 337;
+const int CSSValueMediaControlsBackground = 338;
+const int CSSValueMediaCurrentTimeDisplay = 339;
+const int CSSValueMediaTimeRemainingDisplay = 340;
+const int CSSValueMenulist = 341;
+const int CSSValueMenulistButton = 342;
+const int CSSValueMenulistText = 343;
+const int CSSValueMenulistTextfield = 344;
+const int CSSValueSliderHorizontal = 345;
+const int CSSValueSliderVertical = 346;
+const int CSSValueSliderthumbHorizontal = 347;
+const int CSSValueSliderthumbVertical = 348;
+const int CSSValueCaret = 349;
+const int CSSValueSearchfield = 350;
+const int CSSValueSearchfieldDecoration = 351;
+const int CSSValueSearchfieldResultsDecoration = 352;
+const int CSSValueSearchfieldResultsButton = 353;
+const int CSSValueSearchfieldCancelButton = 354;
+const int CSSValueTextfield = 355;
+const int CSSValueTextarea = 356;
+const int CSSValueCapsLockIndicator = 357;
+const int CSSValueRound = 358;
+const int CSSValueBorder = 359;
+const int CSSValueBorderBox = 360;
+const int CSSValueContent = 361;
+const int CSSValueContentBox = 362;
+const int CSSValuePadding = 363;
+const int CSSValuePaddingBox = 364;
+const int CSSValueContain = 365;
+const int CSSValueCover = 366;
+const int CSSValueLogical = 367;
+const int CSSValueVisual = 368;
+const int CSSValueLines = 369;
+const int CSSValueRunning = 370;
+const int CSSValuePaused = 371;
+const int CSSValueFlat = 372;
+const int CSSValuePreserve3d = 373;
+const int CSSValueEase = 374;
+const int CSSValueLinear = 375;
+const int CSSValueEaseIn = 376;
+const int CSSValueEaseOut = 377;
+const int CSSValueEaseInOut = 378;
+const int CSSValueDocument = 379;
+const int CSSValueReset = 380;
+const int CSSValueVisiblepainted = 381;
+const int CSSValueVisiblefill = 382;
+const int CSSValueVisiblestroke = 383;
+const int CSSValuePainted = 384;
+const int CSSValueFill = 385;
+const int CSSValueStroke = 386;
+const int CSSValueAntialiased = 387;
+const int CSSValueSubpixelAntialiased = 388;
+const int CSSValueOptimizespeed = 389;
+const int CSSValueOptimizelegibility = 390;
+const int CSSValueGeometricprecision = 391;
+const int CSSValueAliceblue = 392;
+const int CSSValueAntiquewhite = 393;
+const int CSSValueAquamarine = 394;
+const int CSSValueAzure = 395;
+const int CSSValueBeige = 396;
+const int CSSValueBisque = 397;
+const int CSSValueBlanchedalmond = 398;
+const int CSSValueBlueviolet = 399;
+const int CSSValueBrown = 400;
+const int CSSValueBurlywood = 401;
+const int CSSValueCadetblue = 402;
+const int CSSValueChartreuse = 403;
+const int CSSValueChocolate = 404;
+const int CSSValueCoral = 405;
+const int CSSValueCornflowerblue = 406;
+const int CSSValueCornsilk = 407;
+const int CSSValueCrimson = 408;
+const int CSSValueCyan = 409;
+const int CSSValueDarkblue = 410;
+const int CSSValueDarkcyan = 411;
+const int CSSValueDarkgoldenrod = 412;
+const int CSSValueDarkgray = 413;
+const int CSSValueDarkgreen = 414;
+const int CSSValueDarkgrey = 415;
+const int CSSValueDarkkhaki = 416;
+const int CSSValueDarkmagenta = 417;
+const int CSSValueDarkolivegreen = 418;
+const int CSSValueDarkorange = 419;
+const int CSSValueDarkorchid = 420;
+const int CSSValueDarkred = 421;
+const int CSSValueDarksalmon = 422;
+const int CSSValueDarkseagreen = 423;
+const int CSSValueDarkslateblue = 424;
+const int CSSValueDarkslategray = 425;
+const int CSSValueDarkslategrey = 426;
+const int CSSValueDarkturquoise = 427;
+const int CSSValueDarkviolet = 428;
+const int CSSValueDeeppink = 429;
+const int CSSValueDeepskyblue = 430;
+const int CSSValueDimgray = 431;
+const int CSSValueDimgrey = 432;
+const int CSSValueDodgerblue = 433;
+const int CSSValueFirebrick = 434;
+const int CSSValueFloralwhite = 435;
+const int CSSValueForestgreen = 436;
+const int CSSValueGainsboro = 437;
+const int CSSValueGhostwhite = 438;
+const int CSSValueGold = 439;
+const int CSSValueGoldenrod = 440;
+const int CSSValueGreenyellow = 441;
+const int CSSValueHoneydew = 442;
+const int CSSValueHotpink = 443;
+const int CSSValueIndianred = 444;
+const int CSSValueIndigo = 445;
+const int CSSValueIvory = 446;
+const int CSSValueKhaki = 447;
+const int CSSValueLavender = 448;
+const int CSSValueLavenderblush = 449;
+const int CSSValueLawngreen = 450;
+const int CSSValueLemonchiffon = 451;
+const int CSSValueLightblue = 452;
+const int CSSValueLightcoral = 453;
+const int CSSValueLightcyan = 454;
+const int CSSValueLightgoldenrodyellow = 455;
+const int CSSValueLightgray = 456;
+const int CSSValueLightgreen = 457;
+const int CSSValueLightgrey = 458;
+const int CSSValueLightpink = 459;
+const int CSSValueLightsalmon = 460;
+const int CSSValueLightseagreen = 461;
+const int CSSValueLightskyblue = 462;
+const int CSSValueLightslategray = 463;
+const int CSSValueLightslategrey = 464;
+const int CSSValueLightsteelblue = 465;
+const int CSSValueLightyellow = 466;
+const int CSSValueLimegreen = 467;
+const int CSSValueLinen = 468;
+const int CSSValueMagenta = 469;
+const int CSSValueMediumaquamarine = 470;
+const int CSSValueMediumblue = 471;
+const int CSSValueMediumorchid = 472;
+const int CSSValueMediumpurple = 473;
+const int CSSValueMediumseagreen = 474;
+const int CSSValueMediumslateblue = 475;
+const int CSSValueMediumspringgreen = 476;
+const int CSSValueMediumturquoise = 477;
+const int CSSValueMediumvioletred = 478;
+const int CSSValueMidnightblue = 479;
+const int CSSValueMintcream = 480;
+const int CSSValueMistyrose = 481;
+const int CSSValueMoccasin = 482;
+const int CSSValueNavajowhite = 483;
+const int CSSValueOldlace = 484;
+const int CSSValueOlivedrab = 485;
+const int CSSValueOrangered = 486;
+const int CSSValueOrchid = 487;
+const int CSSValuePalegoldenrod = 488;
+const int CSSValuePalegreen = 489;
+const int CSSValuePaleturquoise = 490;
+const int CSSValuePalevioletred = 491;
+const int CSSValuePapayawhip = 492;
+const int CSSValuePeachpuff = 493;
+const int CSSValuePeru = 494;
+const int CSSValuePink = 495;
+const int CSSValuePlum = 496;
+const int CSSValuePowderblue = 497;
+const int CSSValueRosybrown = 498;
+const int CSSValueRoyalblue = 499;
+const int CSSValueSaddlebrown = 500;
+const int CSSValueSalmon = 501;
+const int CSSValueSandybrown = 502;
+const int CSSValueSeagreen = 503;
+const int CSSValueSeashell = 504;
+const int CSSValueSienna = 505;
+const int CSSValueSkyblue = 506;
+const int CSSValueSlateblue = 507;
+const int CSSValueSlategray = 508;
+const int CSSValueSlategrey = 509;
+const int CSSValueSnow = 510;
+const int CSSValueSpringgreen = 511;
+const int CSSValueSteelblue = 512;
+const int CSSValueTan = 513;
+const int CSSValueThistle = 514;
+const int CSSValueTomato = 515;
+const int CSSValueTurquoise = 516;
+const int CSSValueViolet = 517;
+const int CSSValueWheat = 518;
+const int CSSValueWhitesmoke = 519;
+const int CSSValueYellowgreen = 520;
+const int CSSValueNonzero = 521;
+const int CSSValueEvenodd = 522;
+const int CSSValueAccumulate = 523;
+const int CSSValueNew = 524;
+const int CSSValueSrgb = 525;
+const int CSSValueLinearrgb = 526;
+const int CSSValueOptimizequality = 527;
+const int CSSValueCrispedges = 528;
+const int CSSValueButt = 529;
+const int CSSValueMiter = 530;
+const int CSSValueBevel = 531;
+const int CSSValueBeforeEdge = 532;
+const int CSSValueAfterEdge = 533;
+const int CSSValueCentral = 534;
+const int CSSValueTextBeforeEdge = 535;
+const int CSSValueTextAfterEdge = 536;
+const int CSSValueIdeographic = 537;
+const int CSSValueAlphabetic = 538;
+const int CSSValueHanging = 539;
+const int CSSValueMathematical = 540;
+const int CSSValueUseScript = 541;
+const int CSSValueNoChange = 542;
+const int CSSValueResetSize = 543;
+const int CSSValueLrTb = 544;
+const int CSSValueRlTb = 545;
+const int CSSValueTbRl = 546;
+const int CSSValueLr = 547;
+const int CSSValueRl = 548;
+const int CSSValueTb = 549;
+const int numCSSValueKeywords = 550;
 const size_t maxCSSValueKeywordLength = 31;
 
 const char* getValueName(unsigned short id);
diff --git a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
index 973f104b4f..ee402fce25 100644
--- a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
@@ -236,6 +236,7 @@
 
 #include "JSObject.h"
 #include "JSString.h"
+#include "Lexer.h"
 #include "NodeConstructors.h"
 #include "NodeInfo.h"
 #include <stdlib.h>
@@ -257,7 +258,6 @@
 #define YYERROR_VERBOSE
 #endif
 
-int jscyylex(void* lvalp, void* llocp, void* globalPtr);
 int jscyyerror(const char*);
 
 static inline bool allowAutomaticSemicolon(JSC::Lexer&, int);
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
index 4e51f5488c..06d1f1fb8d 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
@@ -409,6 +409,7 @@ DEFINE_GLOBAL(QualifiedName, objectAttr, nullAtom, "object", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onabortAttr, nullAtom, "onabort", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onbeforecopyAttr, nullAtom, "onbeforecopy", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onbeforecutAttr, nullAtom, "onbeforecut", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onbeforeloadAttr, nullAtom, "onbeforeload", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onbeforepasteAttr, nullAtom, "onbeforepaste", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onbeforeunloadAttr, nullAtom, "onbeforeunload", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onblurAttr, nullAtom, "onblur", xhtmlNamespaceURI);
@@ -441,7 +442,6 @@ DEFINE_GLOBAL(QualifiedName, onkeyupAttr, nullAtom, "onkeyup", xhtmlNamespaceURI
 DEFINE_GLOBAL(QualifiedName, onloadAttr, nullAtom, "onload", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onloadeddataAttr, nullAtom, "onloadeddata", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onloadedmetadataAttr, nullAtom, "onloadedmetadata", xhtmlNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, onloadendAttr, nullAtom, "onloadend", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onloadstartAttr, nullAtom, "onloadstart", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onmousedownAttr, nullAtom, "onmousedown", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onmousemoveAttr, nullAtom, "onmousemove", xhtmlNamespaceURI);
@@ -661,6 +661,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onabortAttr,
         (WebCore::QualifiedName*)&onbeforecopyAttr,
         (WebCore::QualifiedName*)&onbeforecutAttr,
+        (WebCore::QualifiedName*)&onbeforeloadAttr,
         (WebCore::QualifiedName*)&onbeforepasteAttr,
         (WebCore::QualifiedName*)&onbeforeunloadAttr,
         (WebCore::QualifiedName*)&onblurAttr,
@@ -693,7 +694,6 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onloadAttr,
         (WebCore::QualifiedName*)&onloadeddataAttr,
         (WebCore::QualifiedName*)&onloadedmetadataAttr,
-        (WebCore::QualifiedName*)&onloadendAttr,
         (WebCore::QualifiedName*)&onloadstartAttr,
         (WebCore::QualifiedName*)&onmousedownAttr,
         (WebCore::QualifiedName*)&onmousemoveAttr,
@@ -1166,6 +1166,7 @@ void init()
     const char *onabortAttrString = "onabort";
     const char *onbeforecopyAttrString = "onbeforecopy";
     const char *onbeforecutAttrString = "onbeforecut";
+    const char *onbeforeloadAttrString = "onbeforeload";
     const char *onbeforepasteAttrString = "onbeforepaste";
     const char *onbeforeunloadAttrString = "onbeforeunload";
     const char *onblurAttrString = "onblur";
@@ -1198,7 +1199,6 @@ void init()
     const char *onloadAttrString = "onload";
     const char *onloadeddataAttrString = "onloadeddata";
     const char *onloadedmetadataAttrString = "onloadedmetadata";
-    const char *onloadendAttrString = "onloadend";
     const char *onloadstartAttrString = "onloadstart";
     const char *onmousedownAttrString = "onmousedown";
     const char *onmousemoveAttrString = "onmousemove";
@@ -1413,6 +1413,7 @@ void init()
     new ((void*)&onabortAttr) QualifiedName(nullAtom, onabortAttrString, nullAtom);
     new ((void*)&onbeforecopyAttr) QualifiedName(nullAtom, onbeforecopyAttrString, nullAtom);
     new ((void*)&onbeforecutAttr) QualifiedName(nullAtom, onbeforecutAttrString, nullAtom);
+    new ((void*)&onbeforeloadAttr) QualifiedName(nullAtom, onbeforeloadAttrString, nullAtom);
     new ((void*)&onbeforepasteAttr) QualifiedName(nullAtom, onbeforepasteAttrString, nullAtom);
     new ((void*)&onbeforeunloadAttr) QualifiedName(nullAtom, onbeforeunloadAttrString, nullAtom);
     new ((void*)&onblurAttr) QualifiedName(nullAtom, onblurAttrString, nullAtom);
@@ -1445,7 +1446,6 @@ void init()
     new ((void*)&onloadAttr) QualifiedName(nullAtom, onloadAttrString, nullAtom);
     new ((void*)&onloadeddataAttr) QualifiedName(nullAtom, onloadeddataAttrString, nullAtom);
     new ((void*)&onloadedmetadataAttr) QualifiedName(nullAtom, onloadedmetadataAttrString, nullAtom);
-    new ((void*)&onloadendAttr) QualifiedName(nullAtom, onloadendAttrString, nullAtom);
     new ((void*)&onloadstartAttr) QualifiedName(nullAtom, onloadstartAttrString, nullAtom);
     new ((void*)&onmousedownAttr) QualifiedName(nullAtom, onmousedownAttrString, nullAtom);
     new ((void*)&onmousemoveAttr) QualifiedName(nullAtom, onmousemoveAttrString, nullAtom);
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
index d7d327f447..6fd108e31f 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
@@ -280,6 +280,7 @@ extern const WebCore::QualifiedName objectAttr;
 extern const WebCore::QualifiedName onabortAttr;
 extern const WebCore::QualifiedName onbeforecopyAttr;
 extern const WebCore::QualifiedName onbeforecutAttr;
+extern const WebCore::QualifiedName onbeforeloadAttr;
 extern const WebCore::QualifiedName onbeforepasteAttr;
 extern const WebCore::QualifiedName onbeforeunloadAttr;
 extern const WebCore::QualifiedName onblurAttr;
@@ -312,7 +313,6 @@ extern const WebCore::QualifiedName onkeyupAttr;
 extern const WebCore::QualifiedName onloadAttr;
 extern const WebCore::QualifiedName onloadeddataAttr;
 extern const WebCore::QualifiedName onloadedmetadataAttr;
-extern const WebCore::QualifiedName onloadendAttr;
 extern const WebCore::QualifiedName onloadstartAttr;
 extern const WebCore::QualifiedName onmousedownAttr;
 extern const WebCore::QualifiedName onmousemoveAttr;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
index 1bc76c7407..d4723406c5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
@@ -85,8 +85,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSAbstractWorkerConstructor::s_info = { "AbstractWorkerConstructor", 0, &JSAbstractWorkerConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h
index a4232c5f1d..882c091a0c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -60,6 +60,8 @@ public:
 
 private:
     RefPtr<AbstractWorker> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, AbstractWorker*);
@@ -75,9 +77,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSAbstractWorkerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
index b8a69a585c..89cfed1e28 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
@@ -84,8 +84,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSAttrConstructor::s_info = { "AttrConstructor", 0, &JSAttrConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.h b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
index f1aa7af9b9..1562011af2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -54,6 +54,8 @@ public:
     {
         return static_cast<Attr*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 Attr* toAttr(JSC::JSValue);
@@ -66,9 +68,11 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSAttrPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
index 7f118019d9..9c389a1010 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
@@ -43,13 +43,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     BarInfo* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<BarInfo> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, BarInfo*);
@@ -61,7 +63,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSBarInfoPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.cpp
new file mode 100644
index 0000000000..a7ec5771b7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.cpp
@@ -0,0 +1,188 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSBeforeLoadEvent.h"
+
+#include "BeforeLoadEvent.h"
+#include "KURL.h"
+#include <runtime/Error.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSBeforeLoadEvent);
+
+/* Hash table */
+
+static const HashTableValue JSBeforeLoadEventTableValues[3] =
+{
+    { "url", DontDelete|ReadOnly, (intptr_t)jsBeforeLoadEventUrl, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsBeforeLoadEventConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSBeforeLoadEventTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 1, JSBeforeLoadEventTableValues, 0 };
+#else
+    { 4, 3, JSBeforeLoadEventTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSBeforeLoadEventConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSBeforeLoadEventConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSBeforeLoadEventConstructorTableValues, 0 };
+#else
+    { 1, 0, JSBeforeLoadEventConstructorTableValues, 0 };
+#endif
+
+class JSBeforeLoadEventConstructor : public DOMConstructorObject {
+public:
+    JSBeforeLoadEventConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSBeforeLoadEventConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSBeforeLoadEventPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSBeforeLoadEventConstructor::s_info = { "BeforeLoadEventConstructor", 0, &JSBeforeLoadEventConstructorTable, 0 };
+
+bool JSBeforeLoadEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSBeforeLoadEventConstructor, DOMObject>(exec, &JSBeforeLoadEventConstructorTable, this, propertyName, slot);
+}
+
+bool JSBeforeLoadEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSBeforeLoadEventConstructor, DOMObject>(exec, &JSBeforeLoadEventConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSBeforeLoadEventPrototypeTableValues[2] =
+{
+    { "initBeforeLoadEvent", DontDelete|Function, (intptr_t)jsBeforeLoadEventPrototypeFunctionInitBeforeLoadEvent, (intptr_t)4 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSBeforeLoadEventPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSBeforeLoadEventPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSBeforeLoadEventPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSBeforeLoadEventPrototype::s_info = { "BeforeLoadEventPrototype", 0, &JSBeforeLoadEventPrototypeTable, 0 };
+
+JSObject* JSBeforeLoadEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSBeforeLoadEvent>(exec, globalObject);
+}
+
+bool JSBeforeLoadEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSBeforeLoadEventPrototypeTable, this, propertyName, slot);
+}
+
+bool JSBeforeLoadEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSBeforeLoadEventPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSBeforeLoadEvent::s_info = { "BeforeLoadEvent", &JSEvent::s_info, &JSBeforeLoadEventTable, 0 };
+
+JSBeforeLoadEvent::JSBeforeLoadEvent(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<BeforeLoadEvent> impl)
+    : JSEvent(structure, globalObject, impl)
+{
+}
+
+JSObject* JSBeforeLoadEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSBeforeLoadEventPrototype(JSBeforeLoadEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
+}
+
+bool JSBeforeLoadEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSBeforeLoadEvent, Base>(exec, &JSBeforeLoadEventTable, this, propertyName, slot);
+}
+
+bool JSBeforeLoadEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSBeforeLoadEvent, Base>(exec, &JSBeforeLoadEventTable, this, propertyName, descriptor);
+}
+
+JSValue jsBeforeLoadEventUrl(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSBeforeLoadEvent* castedThis = static_cast<JSBeforeLoadEvent*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    BeforeLoadEvent* imp = static_cast<BeforeLoadEvent*>(castedThis->impl());
+    return jsString(exec, imp->url());
+}
+
+JSValue jsBeforeLoadEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSBeforeLoadEvent* domObject = static_cast<JSBeforeLoadEvent*>(asObject(slot.slotBase()));
+    return JSBeforeLoadEvent::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSBeforeLoadEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSBeforeLoadEventConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsBeforeLoadEventPrototypeFunctionInitBeforeLoadEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSBeforeLoadEvent::s_info))
+        return throwError(exec, TypeError);
+    JSBeforeLoadEvent* castedThisObj = static_cast<JSBeforeLoadEvent*>(asObject(thisValue));
+    BeforeLoadEvent* imp = static_cast<BeforeLoadEvent*>(castedThisObj->impl());
+    const UString& type = args.at(0).toString(exec);
+    bool canBubble = args.at(1).toBoolean(exec);
+    bool cancelable = args.at(2).toBoolean(exec);
+    const UString& url = args.at(3).toString(exec);
+
+    imp->initBeforeLoadEvent(type, canBubble, cancelable, url);
+    return jsUndefined();
+}
+
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.h b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.h
new file mode 100644
index 0000000000..e5751927f5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.h
@@ -0,0 +1,78 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSBeforeLoadEvent_h
+#define JSBeforeLoadEvent_h
+
+#include "JSEvent.h"
+
+namespace WebCore {
+
+class BeforeLoadEvent;
+
+class JSBeforeLoadEvent : public JSEvent {
+    typedef JSEvent Base;
+public:
+    JSBeforeLoadEvent(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<BeforeLoadEvent>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+
+class JSBeforeLoadEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+    JSBeforeLoadEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsBeforeLoadEventPrototypeFunctionInitBeforeLoadEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsBeforeLoadEventUrl(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsBeforeLoadEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
index 01b4c117eb..bdc4a93a50 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
@@ -73,8 +73,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCDATASectionConstructor::s_info = { "CDATASectionConstructor", 0, &JSCDATASectionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
index 8d1352c93a..80b824c22f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJSNewlyCreated(JSC::ExecState*, JSDOMGlobalObject*, CDATASection*);
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCDATASectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
index 83f4a64a20..52c01c7e8d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
@@ -75,8 +75,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSCharsetRuleConstructor::s_info = { "CSSCharsetRuleConstructor", 0, &JSCSSCharsetRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
index 9ad4e9c414..971cfb1218 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCSSCharsetRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
index 38b6fce52e..012e437d57 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSFontFaceRuleConstructor::s_info = { "CSSFontFaceRuleConstructor", 0, &JSCSSFontFaceRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
index c99c45d564..6a6acb2066 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCSSFontFaceRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
index c23f7fe8f0..e3ae98324a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSImportRuleConstructor::s_info = { "CSSImportRuleConstructor", 0, &JSCSSImportRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
index 5e73495856..14e289a503 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCSSImportRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
index e0c713bc30..fbb26e899c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSMediaRuleConstructor::s_info = { "CSSMediaRuleConstructor", 0, &JSCSSMediaRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
index 3751a8e3a1..225e70a475 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSMediaRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
index 1d94046cbb..b1da3b9994 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSPageRuleConstructor::s_info = { "CSSPageRuleConstructor", 0, &JSCSSPageRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
index d62bc6762c..8ba0942d62 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCSSPageRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
index ee2288dff5..ea0517cd8a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
@@ -110,8 +110,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSPrimitiveValueConstructor::s_info = { "CSSPrimitiveValueConstructor", 0, &JSCSSPrimitiveValueConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
index a2cec7cd39..c015d4cdd6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSPrimitiveValuePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
index 02231b7f11..307b17ae9d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
@@ -92,8 +92,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSRuleConstructor::s_info = { "CSSRuleConstructor", 0, &JSCSSRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
index 4df85dae53..afc609c0a5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -52,6 +52,8 @@ public:
 
 private:
     RefPtr<CSSRule> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CSSRule*);
@@ -67,9 +69,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
index 3c7bb931f7..e02a6ce88a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSRuleListConstructor::s_info = { "CSSRuleListConstructor", 0, &JSCSSRuleListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
index 5f61961242..8b4a59d370 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<CSSRuleList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
@@ -71,9 +73,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSRuleListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
index 63cd7a585b..6292b6461e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSStyleDeclarationConstructor::s_info = { "CSSStyleDeclarationConstructor", 0, &JSCSSStyleDeclarationConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
index bf9f943c08..48c6a9b8d9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -57,6 +57,8 @@ public:
 
 private:
     RefPtr<CSSStyleDeclaration> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, CSSStyleDeclaration*, const JSC::Identifier&);
@@ -76,9 +78,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSStyleDeclarationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
index aa27d944e9..d44bb5c383 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSStyleRuleConstructor::s_info = { "CSSStyleRuleConstructor", 0, &JSCSSStyleRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
index 9955974640..fc72cbfcaf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCSSStyleRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
index 4073c6f86c..e2d45bc6e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSStyleSheetConstructor::s_info = { "CSSStyleSheetConstructor", 0, &JSCSSStyleSheetConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
index a807b47d4d..4df8ea3a81 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSStyleSheetPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
index 6f61adba9c..22f6c30c83 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSValueConstructor::s_info = { "CSSValueConstructor", 0, &JSCSSValueConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
index ceec3aab59..cd54be1b29 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -52,6 +52,8 @@ public:
 
 private:
     RefPtr<CSSValue> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CSSValue*);
@@ -67,9 +69,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSValuePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
index 56afec2a5f..3e78786db2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSValueListConstructor::s_info = { "CSSValueListConstructor", 0, &JSCSSValueListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
index 8603e871d4..c57887e9c0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
@@ -40,11 +40,13 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSValueListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
index 65f225fb62..ef1d726e74 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
@@ -83,8 +83,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSVariablesDeclarationConstructor::s_info = { "CSSVariablesDeclarationConstructor", 0, &JSCSSVariablesDeclarationConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
index dff45a3598..1eee675ea2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<CSSVariablesDeclaration> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
@@ -70,9 +72,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSVariablesDeclarationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
index 2c61ec7425..488812350b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSVariablesRuleConstructor::s_info = { "CSSVariablesRuleConstructor", 0, &JSCSSVariablesRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
index 6248363efe..f3bee08b1e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCSSVariablesRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
index 26409c8568..aeeeb4f403 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
@@ -145,10 +145,6 @@ JSValue JSC_HOST_CALL jsCanvasArrayPrototypeFunctionAlignedSizeInBytes(ExecState
     return result;
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasArray>(exec, globalObject, object);
-}
 CanvasArray* toCanvasArray(JSC::JSValue value)
 {
     return value.inherits(&JSCanvasArray::s_info) ? static_cast<JSCanvasArray*>(asObject(value))->impl() : 0;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h
index 0a12328b8a..0d67612e93 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     CanvasArray* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CanvasArray> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasArray*);
@@ -67,9 +69,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCanvasArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h
index 16a3945080..eff168f944 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     CanvasArrayBuffer* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CanvasArrayBuffer> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasArrayBuffer*);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasArrayBufferPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h
index 0c30bfd57d..c76c67954b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<CanvasByteArray*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -66,7 +68,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasByteArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h
index 347e334071..c96508e70f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<CanvasFloatArray*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -66,7 +68,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasFloatArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
index 6d5c822a07..bd7aa3d852 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
@@ -39,10 +39,17 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
     CanvasGradient* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CanvasGradient> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasGradient*);
@@ -58,9 +65,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCanvasGradientPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h
index e0358dd705..f4deadfc5e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<CanvasIntArray*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -66,7 +68,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasIntArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
index e7d0a9c45f..7574813f2e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
@@ -39,10 +39,17 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
     CanvasPattern* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CanvasPattern> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasPattern*);
@@ -54,7 +61,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasPatternPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
index ad807c6e51..1d06dfeaed 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCanvasRenderingContextConstructor::s_info = { "CanvasRenderingContextConstructor", 0, &JSCanvasRenderingContextConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h
index 7b6ca921ad..a8b56a4c41 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<CanvasRenderingContext> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasRenderingContext*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasRenderingContextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
index dc8d58f902..97b4d7250a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
@@ -101,8 +101,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCanvasRenderingContext2DConstructor::s_info = { "CanvasRenderingContext2DConstructor", 0, &JSCanvasRenderingContext2DConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
index 03008b6c4c..5637651a1d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -62,6 +62,8 @@ public:
     JSC::JSValue setShadow(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue createPattern(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue putImageData(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -75,9 +77,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCanvasRenderingContext2DPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp
index ff9f7b6ec2..7ed7f058cf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp
@@ -24,6 +24,8 @@
 
 #include "JSCanvasRenderingContext3D.h"
 
+#include "CanvasActiveInfo.h"
+#include "CanvasArray.h"
 #include "CanvasBuffer.h"
 #include "CanvasFloatArray.h"
 #include "CanvasFramebuffer.h"
@@ -34,6 +36,8 @@
 #include "CanvasShader.h"
 #include "CanvasTexture.h"
 #include "CanvasUnsignedByteArray.h"
+#include "JSCanvasActiveInfo.h"
+#include "JSCanvasArray.h"
 #include "JSCanvasBuffer.h"
 #include "JSCanvasFloatArray.h"
 #include "JSCanvasFramebuffer.h"
@@ -400,8 +404,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCanvasRenderingContext3DConstructor::s_info = { "CanvasRenderingContext3DConstructor", 0, &JSCanvasRenderingContext3DConstructorTable, 0 };
@@ -418,7 +425,7 @@ bool JSCanvasRenderingContext3DConstructor::getOwnPropertyDescriptor(ExecState*
 
 /* Hash table for prototype */
 
-static const HashTableValue JSCanvasRenderingContext3DPrototypeTableValues[450] =
+static const HashTableValue JSCanvasRenderingContext3DPrototypeTableValues[453] =
 {
     { "DEPTH_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_BUFFER_BIT, (intptr_t)0 },
     { "STENCIL_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BUFFER_BIT, (intptr_t)0 },
@@ -775,6 +782,8 @@ static const HashTableValue JSCanvasRenderingContext3DPrototypeTableValues[450]
     { "framebufferTexture2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFramebufferTexture2D, (intptr_t)5 },
     { "frontFace", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFrontFace, (intptr_t)1 },
     { "generateMipmap", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGenerateMipmap, (intptr_t)1 },
+    { "getActiveAttrib", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetActiveAttrib, (intptr_t)2 },
+    { "getActiveUniform", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetActiveUniform, (intptr_t)2 },
     { "getAttribLocation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetAttribLocation, (intptr_t)2 },
     { "getBoolean", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBoolean, (intptr_t)1 },
     { "getBooleanv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBooleanv, (intptr_t)1 },
@@ -823,6 +832,7 @@ static const HashTableValue JSCanvasRenderingContext3DPrototypeTableValues[450]
     { "linkProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionLinkProgram, (intptr_t)1 },
     { "pixelStorei", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionPixelStorei, (intptr_t)2 },
     { "polygonOffset", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionPolygonOffset, (intptr_t)2 },
+    { "readPixels", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionReadPixels, (intptr_t)6 },
     { "releaseShaderCompiler", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionReleaseShaderCompiler, (intptr_t)0 },
     { "renderbufferStorage", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionRenderbufferStorage, (intptr_t)4 },
     { "sampleCoverage", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionSampleCoverage, (intptr_t)2 },
@@ -876,7 +886,7 @@ static JSC_CONST_HASHTABLE HashTable JSCanvasRenderingContext3DPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 65535, JSCanvasRenderingContext3DPrototypeTableValues, 0 };
 #else
-    { 1103, 1023, JSCanvasRenderingContext3DPrototypeTableValues, 0 };
+    { 1104, 1023, JSCanvasRenderingContext3DPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSCanvasRenderingContext3DPrototype::s_info = { "CanvasRenderingContext3DPrototype", 0, &JSCanvasRenderingContext3DPrototypeTable, 0 };
@@ -1661,6 +1671,40 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGenerateMipmap(
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveAttrib(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+    unsigned index = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getActiveAttrib(program, index, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveUniform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+    unsigned index = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getActiveUniform(program, index, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
 JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetAttribLocation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -2357,6 +2401,25 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPolygonOffset(E
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReadPixels(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
+    unsigned width = args.at(2).toInt32(exec);
+    unsigned height = args.at(3).toInt32(exec);
+    unsigned format = args.at(4).toInt32(exec);
+    unsigned type = args.at(5).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->readPixels(x, y, width, height, format, type)));
+    return result;
+}
+
 JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReleaseShaderCompiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h
index 6833836008..75ad4d16f1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -66,6 +66,8 @@ public:
     JSC::JSValue vertexAttrib2fv(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue vertexAttrib3fv(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue vertexAttrib4fv(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -79,9 +81,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCanvasRenderingContext3DPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -139,6 +143,8 @@ JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebuffe
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebufferTexture2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFrontFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGenerateMipmap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveAttrib(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveUniform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetAttribLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBoolean(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBooleanv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
@@ -187,6 +193,7 @@ JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLineWidth(
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLinkProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPixelStorei(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPolygonOffset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReadPixels(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReleaseShaderCompiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionRenderbufferStorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionSampleCoverage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h
index b5b4aa5315..688ca0c01d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<CanvasShortArray*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -66,7 +68,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasShortArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h
index 9e9b643078..ccfaef6264 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<CanvasUnsignedByteArray*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -66,7 +68,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasUnsignedByteArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h
index 916f08fba0..c53c7efa54 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<CanvasUnsignedIntArray*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -66,7 +68,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasUnsignedIntArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h
index c2d3efbb22..e9e512787e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<CanvasUnsignedShortArray*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -66,7 +68,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasUnsignedShortArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
index 2e261cd8ab..214888830f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCharacterDataConstructor::s_info = { "CharacterDataConstructor", 0, &JSCharacterDataConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
index 11d2aab4a7..f06e22b715 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -57,9 +59,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCharacterDataPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
index e871f45db8..175d6604b0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSClientRectConstructor::s_info = { "ClientRectConstructor", 0, &JSClientRectConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.h b/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
index 2ed96dde11..18962f259c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<ClientRect> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, ClientRect*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSClientRectPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
index 2dd60ccaf7..143ee8cd68 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSClientRectListConstructor::s_info = { "ClientRectListConstructor", 0, &JSClientRectListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
index 61490180b9..ce8cb3f209 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<ClientRectList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSClientRectListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
index 22ff1377a6..f72e341b77 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSClipboardConstructor::s_info = { "ClipboardConstructor", 0, &JSClipboardConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
index d4a5532741..e4458a7a6e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,6 +61,8 @@ public:
 
 private:
     RefPtr<Clipboard> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Clipboard*);
@@ -76,9 +78,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSClipboardPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSComment.cpp b/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
index 323c771249..770a3f2494 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
@@ -73,8 +73,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCommentConstructor::s_info = { "CommentConstructor", 0, &JSCommentConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSComment.h b/src/3rdparty/webkit/WebCore/generated/JSComment.h
index 79c47c4dde..e88ddf42c7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSComment.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSComment.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCommentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSConsole.h b/src/3rdparty/webkit/WebCore/generated/JSConsole.h
index c933ca9c7b..c55cc0ef21 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSConsole.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSConsole.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<Console> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Console*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSConsolePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
index 3de9a5b4c2..be0408b24f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -56,6 +56,8 @@ public:
 
 private:
     RefPtr<Coordinates> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Coordinates*);
@@ -67,7 +69,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCoordinatesPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
index c8ba9f9201..d17a3683f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCounterConstructor::s_info = { "CounterConstructor", 0, &JSCounterConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.h b/src/3rdparty/webkit/WebCore/generated/JSCounter.h
index ffc98ba29d..9827a48870 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<Counter> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Counter*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCounterPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
index d306322365..2ee87d4c9d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -59,6 +59,8 @@ public:
 
 private:
     RefPtr<DOMApplicationCache> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DOMApplicationCache*);
@@ -74,9 +76,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDOMApplicationCachePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
index c909c0296d..d625e2b6bf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
@@ -102,8 +102,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSDOMCoreExceptionConstructor::s_info = { "DOMExceptionConstructor", 0, &JSDOMCoreExceptionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
index 116ac2e393..0d99c15e4e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<DOMCoreException> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DOMCoreException*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDOMCoreExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
index 588e21bda1..62eef6c463 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
@@ -83,8 +83,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSDOMImplementationConstructor::s_info = { "DOMImplementationConstructor", 0, &JSDOMImplementationConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
index 755f035e59..8dc907fa8b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<DOMImplementation> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DOMImplementation*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDOMImplementationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
index ff99782787..4af88cb62a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
     static JSObject* constructDOMParser(ExecState* exec, JSObject* constructor, const ArgList&)
     {
         return asObject(toJS(exec, static_cast<JSDOMParserConstructor*>(constructor)->globalObject(), DOMParser::create()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
index ff7f3958e3..8788ff2fbf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<DOMParser> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DOMParser*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDOMParserPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
index e26b627d63..863723fdc4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
@@ -43,13 +43,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     DOMSelection* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<DOMSelection> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DOMSelection*);
@@ -65,9 +67,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDOMSelectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
index 24fc1def85..dc53217992 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
@@ -36,6 +36,7 @@
 #include "EventListener.h"
 #include "JSAttr.h"
 #include "JSBarInfo.h"
+#include "JSBeforeLoadEvent.h"
 #include "JSCDATASection.h"
 #include "JSCSSCharsetRule.h"
 #include "JSCSSFontFaceRule.h"
@@ -245,7 +246,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindow);
 
 /* Hash table */
 
-static const HashTableValue JSDOMWindowTableValues[295] =
+static const HashTableValue JSDOMWindowTableValues[296] =
 {
     { "screen", DontDelete|ReadOnly, (intptr_t)jsDOMWindowScreen, (intptr_t)0 },
     { "history", DontDelete|ReadOnly, (intptr_t)jsDOMWindowHistory, (intptr_t)0 },
@@ -499,6 +500,7 @@ static const HashTableValue JSDOMWindowTableValues[295] =
     { "CanvasFloatArray", DontDelete, (intptr_t)jsDOMWindowCanvasFloatArrayConstructor, (intptr_t)setJSDOMWindowCanvasFloatArrayConstructor },
 #endif
     { "Event", DontDelete, (intptr_t)jsDOMWindowEventConstructor, (intptr_t)setJSDOMWindowEventConstructor },
+    { "BeforeLoadEvent", DontDelete, (intptr_t)jsDOMWindowBeforeLoadEventConstructor, (intptr_t)setJSDOMWindowBeforeLoadEventConstructor },
     { "KeyboardEvent", DontDelete, (intptr_t)jsDOMWindowKeyboardEventConstructor, (intptr_t)setJSDOMWindowKeyboardEventConstructor },
     { "MouseEvent", DontDelete, (intptr_t)jsDOMWindowMouseEventConstructor, (intptr_t)setJSDOMWindowMouseEventConstructor },
     { "MutationEvent", DontDelete, (intptr_t)jsDOMWindowMutationEventConstructor, (intptr_t)setJSDOMWindowMutationEventConstructor },
@@ -2974,6 +2976,14 @@ JSValue jsDOMWindowEventConstructor(ExecState* exec, const Identifier&, const Pr
     return JSEvent::getConstructor(exec, castedThis);
 }
 
+JSValue jsDOMWindowBeforeLoadEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSBeforeLoadEvent::getConstructor(exec, castedThis);
+}
+
 JSValue jsDOMWindowKeyboardEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
@@ -5363,6 +5373,14 @@ void setJSDOMWindowEventConstructor(ExecState* exec, JSObject* thisObject, JSVal
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Event"), value);
 }
 
+void setJSDOMWindowBeforeLoadEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "BeforeLoadEvent"), value);
+}
+
 void setJSDOMWindowKeyboardEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
index 75a1e50fe1..232c8eb81e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::NeedsThisConversion));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -99,6 +99,8 @@ public:
     {
         return static_cast<DOMWindow*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::ImplementsHasInstance | JSC::NeedsThisConversion | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 DOMWindow* toDOMWindow(JSC::JSValue);
@@ -113,9 +115,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDOMWindowPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -601,6 +605,8 @@ JSC::JSValue jsDOMWindowCanvasFloatArrayConstructor(JSC::ExecState*, const JSC::
 void setJSDOMWindowCanvasFloatArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowBeforeLoadEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowBeforeLoadEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowKeyboardEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowKeyboardEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowMouseEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
index 15ae6c343e..586edd1b77 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
@@ -91,8 +91,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSDataGridColumnConstructor::s_info = { "DataGridColumnConstructor", 0, &JSDataGridColumnConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
index 515b54992b..c53c99ded5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<DataGridColumn> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DataGridColumn*);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDataGridColumnPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
index dc8e05f7f1..08585fed18 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSDataGridColumnListConstructor::s_info = { "DataGridColumnListConstructor", 0, &JSDataGridColumnListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
index 0c3f10f9ef..ac4d33e56a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<DataGridColumnList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, DataGridColumnList*, const JSC::Identifier&);
@@ -74,9 +76,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDataGridColumnListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDatabase.h b/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
index d902ced2bf..03534275f9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -57,6 +57,8 @@ public:
 
 private:
     RefPtr<Database> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Database*);
@@ -72,9 +74,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDatabasePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
index b3591bff39..2e658425c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -52,6 +52,8 @@ public:
     {
         return static_cast<DedicatedWorkerContext*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 DedicatedWorkerContext* toDedicatedWorkerContext(JSC::JSValue);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDedicatedWorkerContextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
index 5017f309c0..47a2936855 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
@@ -39,6 +39,7 @@
 #include "Frame.h"
 #include "HTMLCollection.h"
 #include "HTMLElement.h"
+#include "HTMLHeadElement.h"
 #include "JSAttr.h"
 #include "JSCDATASection.h"
 #include "JSCSSStyleDeclaration.h"
@@ -57,6 +58,7 @@
 #include "JSEventListener.h"
 #include "JSHTMLCollection.h"
 #include "JSHTMLElement.h"
+#include "JSHTMLHeadElement.h"
 #include "JSNode.h"
 #include "JSNodeFilter.h"
 #include "JSNodeIterator.h"
@@ -96,7 +98,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDocument);
 
 /* Hash table */
 
-static const HashTableValue JSDocumentTableValues[70] =
+static const HashTableValue JSDocumentTableValues[71] =
 {
     { "doctype", DontDelete|ReadOnly, (intptr_t)jsDocumentDoctype, (intptr_t)0 },
     { "implementation", DontDelete|ReadOnly, (intptr_t)jsDocumentImplementation, (intptr_t)0 },
@@ -114,6 +116,7 @@ static const HashTableValue JSDocumentTableValues[70] =
     { "URL", DontDelete|ReadOnly, (intptr_t)jsDocumentURL, (intptr_t)0 },
     { "cookie", DontDelete, (intptr_t)jsDocumentCookie, (intptr_t)setJSDocumentCookie },
     { "body", DontDelete, (intptr_t)jsDocumentBody, (intptr_t)setJSDocumentBody },
+    { "head", DontDelete|ReadOnly, (intptr_t)jsDocumentHead, (intptr_t)0 },
     { "images", DontDelete|ReadOnly, (intptr_t)jsDocumentImages, (intptr_t)0 },
     { "applets", DontDelete|ReadOnly, (intptr_t)jsDocumentApplets, (intptr_t)0 },
     { "links", DontDelete|ReadOnly, (intptr_t)jsDocumentLinks, (intptr_t)0 },
@@ -205,8 +208,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSDocumentConstructor::s_info = { "DocumentConstructor", 0, &JSDocumentConstructorTable, 0 };
@@ -434,6 +440,14 @@ JSValue jsDocumentBody(ExecState* exec, const Identifier&, const PropertySlot& s
     return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->body()));
 }
 
+JSValue jsDocumentHead(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(castedThis->impl());
+    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->head()));
+}
+
 JSValue jsDocumentImages(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.h b/src/3rdparty/webkit/WebCore/generated/JSDocument.h
index 7cdbcbb170..7b72b9b145 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -58,6 +58,8 @@ public:
     {
         return static_cast<Document*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 ALWAYS_INLINE bool JSDocument::getOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
@@ -83,9 +85,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDocumentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -152,6 +156,7 @@ JSC::JSValue jsDocumentCookie(JSC::ExecState*, const JSC::Identifier&, const JSC
 void setJSDocumentCookie(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDocumentBody(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDocumentBody(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentHead(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsDocumentImages(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsDocumentApplets(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsDocumentLinks(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
index f8480403d5..19a132e21e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSDocumentFragmentConstructor::s_info = { "DocumentFragmentConstructor", 0, &JSDocumentFragmentConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
index e532ca9257..83120bf7e6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDocumentFragmentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
index 69e3fc6bc9..3ca49ddc02 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
@@ -83,8 +83,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSDocumentTypeConstructor::s_info = { "DocumentTypeConstructor", 0, &JSDocumentTypeConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
index c80a70109e..72da9be7dc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -48,6 +48,8 @@ public:
     {
         return static_cast<DocumentType*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 DocumentType* toDocumentType(JSC::JSValue);
@@ -58,7 +60,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSDocumentTypePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
index 3844cb7940..869c23f5ed 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
@@ -153,8 +153,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSElementConstructor::s_info = { "ElementConstructor", 0, &JSElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.h b/src/3rdparty/webkit/WebCore/generated/JSElement.h
index 39998c0427..141d115067 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -59,6 +59,8 @@ public:
     {
         return static_cast<Element*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 ALWAYS_INLINE bool JSElement::getOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
@@ -84,9 +86,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp b/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
index 20d9cbad4f..6f870e4edf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSEntityConstructor::s_info = { "EntityConstructor", 0, &JSEntityConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntity.h b/src/3rdparty/webkit/WebCore/generated/JSEntity.h
index 3f79f68da7..6ea4fe5b0d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntity.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntity.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSEntityPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
index e33b91fde4..505374aa5b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
@@ -73,8 +73,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSEntityReferenceConstructor::s_info = { "EntityReferenceConstructor", 0, &JSEntityReferenceConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
index 5d05523ede..bec01e657a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSEntityReferencePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp
index d1cad0b268..ef9a080c7d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp
@@ -83,8 +83,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSErrorEventConstructor::s_info = { "ErrorEventConstructor", 0, &JSErrorEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h
index 9046f11c25..080b573573 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h
@@ -41,10 +41,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSErrorEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
index a7a089494b..acd952f7c3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
@@ -109,8 +109,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSEventConstructor::s_info = { "EventConstructor", 0, &JSEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.h b/src/3rdparty/webkit/WebCore/generated/JSEvent.h
index d338302519..0249fe1eee 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<Event> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Event*);
@@ -70,9 +72,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
index 326e79215d..2246c8fa84 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSEventExceptionConstructor::s_info = { "EventExceptionConstructor", 0, &JSEventExceptionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.h b/src/3rdparty/webkit/WebCore/generated/JSEventException.h
index 093aa6a50f..694cbad65a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<EventException> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, EventException*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSEventExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventSource.h b/src/3rdparty/webkit/WebCore/generated/JSEventSource.h
index dbaa492979..4d5803b421 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventSource.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventSource.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -59,6 +59,8 @@ public:
 
 private:
     RefPtr<EventSource> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, EventSource*);
@@ -74,9 +76,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSEventSourcePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
index 962f1f5e5b..2ee62aef1c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSFileConstructor::s_info = { "FileConstructor", 0, &JSFileConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.h b/src/3rdparty/webkit/WebCore/generated/JSFile.h
index d47f2869fa..3a5ed41ae5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFile.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSFile.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<File> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, File*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSFilePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
index 228615aed4..931aae4e83 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSFileListConstructor::s_info = { "FileListConstructor", 0, &JSFileListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFileList.h b/src/3rdparty/webkit/WebCore/generated/JSFileList.h
index 21bed9953a..495f47a2b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFileList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSFileList.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<FileList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSFileListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
index 6b3453b377..e948667880 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<Geolocation> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Geolocation*);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSGeolocationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
index 7406bb2023..a58a41e676 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
@@ -43,13 +43,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     Geoposition* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Geoposition> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Geoposition*);
@@ -61,7 +63,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSGeopositionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
index 2b59fd0ddc..3ba82017e0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
@@ -96,8 +96,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLAnchorElementConstructor::s_info = { "HTMLAnchorElementConstructor", 0, &JSHTMLAnchorElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
index 6bfc3d62b1..db460ea494 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -57,9 +59,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLAnchorElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
index c822a44010..df39815510 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
@@ -89,8 +89,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLAppletElementConstructor::s_info = { "HTMLAppletElementConstructor", 0, &JSHTMLAppletElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
index 5390216555..68eee1af26 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
@@ -44,12 +44,14 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLAppletElement*, const JSC::Identifier&);
     static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLAppletElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
index c5fc1d6905..50ca8804e8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
@@ -90,8 +90,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLAreaElementConstructor::s_info = { "HTMLAreaElementConstructor", 0, &JSHTMLAreaElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
index 6d9cb859d5..e2edf7b4c9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLAreaElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
index d537dd8f8d..991a0b55c0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLAudioElementConstructor::s_info = { "HTMLAudioElementConstructor", 0, &JSHTMLAudioElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
index 2710178426..b8cd9addaf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
@@ -41,10 +41,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLAudioElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
index a806ac13c5..23e43af769 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLBRElementConstructor::s_info = { "HTMLBRElementConstructor", 0, &JSHTMLBRElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
index 71069f1469..6e6a691f30 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLBRElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
index 125f8f8ff4..fe57b25c09 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLBaseElementConstructor::s_info = { "HTMLBaseElementConstructor", 0, &JSHTMLBaseElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
index 9af935ab4e..6e86fb6407 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLBaseElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
index 507e7c39eb..806680fa23 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLBaseFontElementConstructor::s_info = { "HTMLBaseFontElementConstructor", 0, &JSHTMLBaseFontElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
index c1da1406f6..02a5ece11c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLBaseFontElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
index 1d33ea35e5..1d65349877 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLBlockquoteElementConstructor::s_info = { "HTMLBlockquoteElementConstructor", 0, &JSHTMLBlockquoteElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
index 0ac17ba9e2..acead7b4d3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLBlockquoteElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
index 80db063afc..920f152760 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
@@ -94,8 +94,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLBodyElementConstructor::s_info = { "HTMLBodyElementConstructor", 0, &JSHTMLBodyElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
index 8ce19c0a3b..8f4e94026d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLBodyElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
index 3f9655e8a2..1874cb7915 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
@@ -90,8 +90,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLButtonElementConstructor::s_info = { "HTMLButtonElementConstructor", 0, &JSHTMLButtonElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
index 21c3e809b0..3b8204b83d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -57,9 +59,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLButtonElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
index ce41e88f4a..5c7e058f54 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLCanvasElementConstructor::s_info = { "HTMLCanvasElementConstructor", 0, &JSHTMLCanvasElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
index b0dedfe4a8..012b6dfb2b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
@@ -40,12 +40,14 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLCanvasElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
index a4644e2bce..63c0d93f54 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
@@ -83,8 +83,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLCollectionConstructor::s_info = { "HTMLCollectionConstructor", 0, &JSHTMLCollectionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
index edffe1d281..447f620843 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
@@ -60,6 +60,8 @@ public:
 
 private:
     RefPtr<HTMLCollection> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLCollection*, const JSC::Identifier&);
@@ -79,9 +81,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLCollectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
index ab9f86deac..bd1f70366b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
@@ -74,8 +74,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDListElementConstructor::s_info = { "HTMLDListElementConstructor", 0, &JSHTMLDListElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
index 852fe011c6..4d602c98ee 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDListElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp
index 7654d1aaaf..089228dffc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp
@@ -84,8 +84,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDataGridCellElementConstructor::s_info = { "HTMLDataGridCellElementConstructor", 0, &JSHTMLDataGridCellElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h
index 7b778bd9d0..5bdeff2a86 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDataGridCellElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
index b39dddf5d0..9a85c51f83 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
@@ -84,8 +84,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDataGridColElementConstructor::s_info = { "HTMLDataGridColElementConstructor", 0, &JSHTMLDataGridColElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h
index 3e09036718..473a1fc8da 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDataGridColElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
index 8400732ad5..217df53238 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
@@ -83,8 +83,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDataGridElementConstructor::s_info = { "HTMLDataGridElementConstructor", 0, &JSHTMLDataGridElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
index e466ebdddc..eedca14cc0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -50,6 +50,8 @@ public:
     // Custom attributes
     JSC::JSValue dataSource(JSC::ExecState*) const;
     void setDataSource(JSC::ExecState*, JSC::JSValue);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,7 +61,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDataGridElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp
index 2225c9813e..c9ca32614a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDataGridRowElementConstructor::s_info = { "HTMLDataGridRowElementConstructor", 0, &JSHTMLDataGridRowElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h
index 749cf0ccc2..23163184b9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDataGridRowElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.cpp
index a7dcd91651..4f88a2bdf6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDataListElementConstructor::s_info = { "HTMLDataListElementConstructor", 0, &JSHTMLDataListElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.h
index 32d34bc620..79c6274a80 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.h
@@ -41,10 +41,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDataListElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
index 838dc83c0d..6c1a334d98 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
@@ -74,8 +74,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDirectoryElementConstructor::s_info = { "HTMLDirectoryElementConstructor", 0, &JSHTMLDirectoryElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
index a0c1aa1b80..71661a36f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDirectoryElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
index 5fa429cece..78da25f695 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDivElementConstructor::s_info = { "HTMLDivElementConstructor", 0, &JSHTMLDivElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
index 7751ffe5c2..7806e45f00 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDivElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
index 5e1cd6c53c..e45c9ec6e2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
@@ -97,8 +97,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDocumentConstructor::s_info = { "HTMLDocumentConstructor", 0, &JSHTMLDocumentConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
index f19fb41853..feb5b8856d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -53,6 +53,8 @@ public:
     JSC::JSValue open(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue write(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue writeln(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLDocument*, const JSC::Identifier&);
     static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLDocumentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
index dc08b3da95..86d32d2615 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
@@ -96,8 +96,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLElementConstructor::s_info = { "HTMLElementConstructor", 0, &JSHTMLElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
index aef78d21d2..6928db7093 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;
@@ -51,6 +51,8 @@ public:
     {
         return static_cast<HTMLElement*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 HTMLElement* toHTMLElement(JSC::JSValue);
@@ -65,9 +67,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
index d4333cc23d..1d43b5ef68 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
@@ -88,8 +88,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLEmbedElementConstructor::s_info = { "HTMLEmbedElementConstructor", 0, &JSHTMLEmbedElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
index 8a1d7bb89d..e7c27cc5a8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
@@ -44,12 +44,14 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLEmbedElement*, const JSC::Identifier&);
     static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLEmbedElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
index 2bec961aee..d161eae85a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLFieldSetElementConstructor::s_info = { "HTMLFieldSetElementConstructor", 0, &JSHTMLFieldSetElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
index 38edfb224b..f23e5fac44 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLFieldSetElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
index 794640f3be..720a0b9bd4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLFontElementConstructor::s_info = { "HTMLFontElementConstructor", 0, &JSHTMLFontElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
index 61a0b7858d..cb4670c688 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLFontElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
index bdd60b8cf0..bd11b4074f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
@@ -91,8 +91,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLFormElementConstructor::s_info = { "HTMLFormElementConstructor", 0, &JSHTMLFormElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
index a28742e14b..b022fd6ad1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -48,6 +48,8 @@ public:
 
     // Custom functions
     JSC::JSValue submit(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLFormElement*, const JSC::Identifier&);
@@ -65,9 +67,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLFormElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
index 03a071e704..4ddb621a90 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
@@ -98,8 +98,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLFrameElementConstructor::s_info = { "HTMLFrameElementConstructor", 0, &JSHTMLFrameElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
index fe0b2fae31..7894c4f7e0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -48,6 +48,8 @@ public:
     // Custom attributes
     void setSrc(JSC::ExecState*, JSC::JSValue);
     void setLocation(JSC::ExecState*, JSC::JSValue);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -61,9 +63,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLFrameElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
index 8c69079b5b..f336c76066 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
@@ -90,8 +90,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLFrameSetElementConstructor::s_info = { "HTMLFrameSetElementConstructor", 0, &JSHTMLFrameSetElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
index e9aa3f9b90..216fa594fd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLFrameSetElement*, const JSC::Identifier&);
     static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -56,7 +58,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLFrameSetElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
index 72ac50096d..e58b90d5b0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLHRElementConstructor::s_info = { "HTMLHRElementConstructor", 0, &JSHTMLHRElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
index c69d61b180..4472820053 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLHRElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
index 7bcb6443ff..ab10942173 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLHeadElementConstructor::s_info = { "HTMLHeadElementConstructor", 0, &JSHTMLHeadElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
index c3b4d502e7..585eb601f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLHeadElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
index 7e0f680749..5409279bae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLHeadingElementConstructor::s_info = { "HTMLHeadingElementConstructor", 0, &JSHTMLHeadingElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
index 512e05b59d..a33f6f61ea 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLHeadingElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
index 932a96c970..f9c9b3ea91 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLHtmlElementConstructor::s_info = { "HTMLHtmlElementConstructor", 0, &JSHTMLHtmlElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
index a46605cde4..37b9bdd73d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLHtmlElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
index 360665216b..ea1d18c5a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
@@ -96,8 +96,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLIFrameElementConstructor::s_info = { "HTMLIFrameElementConstructor", 0, &JSHTMLIFrameElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
index 22ed2766f3..6153f7986e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
@@ -40,13 +40,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom attributes
     void setSrc(JSC::ExecState*, JSC::JSValue);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -60,9 +62,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLIFrameElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
index 029933c525..7a6e0f7046 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
@@ -95,8 +95,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLImageElementConstructor::s_info = { "HTMLImageElementConstructor", 0, &JSHTMLImageElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
index 2ec34dcee7..403a98b2f0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLImageElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
index ea6e7cb621..5b65ab8ed7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
@@ -43,7 +43,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLInputElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLInputElementTableValues[31] =
+static const HashTableValue JSHTMLInputElementTableValues[33] =
 {
     { "defaultValue", DontDelete, (intptr_t)jsHTMLInputElementDefaultValue, (intptr_t)setJSHTMLInputElementDefaultValue },
     { "defaultChecked", DontDelete, (intptr_t)jsHTMLInputElementDefaultChecked, (intptr_t)setJSHTMLInputElementDefaultChecked },
@@ -57,7 +57,9 @@ static const HashTableValue JSHTMLInputElementTableValues[31] =
     { "checked", DontDelete, (intptr_t)jsHTMLInputElementChecked, (intptr_t)setJSHTMLInputElementChecked },
     { "disabled", DontDelete, (intptr_t)jsHTMLInputElementDisabled, (intptr_t)setJSHTMLInputElementDisabled },
     { "autofocus", DontDelete, (intptr_t)jsHTMLInputElementAutofocus, (intptr_t)setJSHTMLInputElementAutofocus },
+    { "max", DontDelete, (intptr_t)jsHTMLInputElementMax, (intptr_t)setJSHTMLInputElementMax },
     { "maxLength", DontDelete, (intptr_t)jsHTMLInputElementMaxLength, (intptr_t)setJSHTMLInputElementMaxLength },
+    { "min", DontDelete, (intptr_t)jsHTMLInputElementMin, (intptr_t)setJSHTMLInputElementMin },
     { "multiple", DontDelete, (intptr_t)jsHTMLInputElementMultiple, (intptr_t)setJSHTMLInputElementMultiple },
     { "name", DontDelete, (intptr_t)jsHTMLInputElementName, (intptr_t)setJSHTMLInputElementName },
     { "pattern", DontDelete, (intptr_t)jsHTMLInputElementPattern, (intptr_t)setJSHTMLInputElementPattern },
@@ -82,7 +84,7 @@ static JSC_CONST_HASHTABLE HashTable JSHTMLInputElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 2047, JSHTMLInputElementTableValues, 0 };
 #else
-    { 72, 63, JSHTMLInputElementTableValues, 0 };
+    { 73, 63, JSHTMLInputElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -113,8 +115,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLInputElementConstructor::s_info = { "HTMLInputElementConstructor", 0, &JSHTMLInputElementConstructorTable, 0 };
@@ -283,6 +288,14 @@ JSValue jsHTMLInputElementAutofocus(ExecState* exec, const Identifier&, const Pr
     return jsBoolean(imp->autofocus());
 }
 
+JSValue jsHTMLInputElementMax(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
+    return jsString(exec, imp->getAttribute(HTMLNames::maxAttr));
+}
+
 JSValue jsHTMLInputElementMaxLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
@@ -291,6 +304,14 @@ JSValue jsHTMLInputElementMaxLength(ExecState* exec, const Identifier&, const Pr
     return jsNumber(exec, imp->maxLength());
 }
 
+JSValue jsHTMLInputElementMin(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
+    return jsString(exec, imp->getAttribute(HTMLNames::minAttr));
+}
+
 JSValue jsHTMLInputElementMultiple(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
@@ -483,6 +504,12 @@ void setJSHTMLInputElementAutofocus(ExecState* exec, JSObject* thisObject, JSVal
     imp->setAutofocus(value.toBoolean(exec));
 }
 
+void setJSHTMLInputElementMax(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    imp->setAttribute(HTMLNames::maxAttr, value.toString(exec));
+}
+
 void setJSHTMLInputElementMaxLength(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
@@ -491,6 +518,12 @@ void setJSHTMLInputElementMaxLength(ExecState* exec, JSObject* thisObject, JSVal
     setDOMException(exec, ec);
 }
 
+void setJSHTMLInputElementMin(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    imp->setAttribute(HTMLNames::minAttr, value.toString(exec));
+}
+
 void setJSHTMLInputElementMultiple(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
index e26b2817c7..5ed72b60a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -54,6 +54,8 @@ public:
 
     // Custom functions
     JSC::JSValue setSelectionRange(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -67,9 +69,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLInputElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -103,8 +107,12 @@ JSC::JSValue jsHTMLInputElementDisabled(JSC::ExecState*, const JSC::Identifier&,
 void setJSHTMLInputElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLInputElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLInputElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementMax(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementMax(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLInputElementMaxLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLInputElementMaxLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementMin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementMin(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLInputElementMultiple(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLInputElementMultiple(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLInputElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
index 2ae43a7206..41814f42fc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLIsIndexElementConstructor::s_info = { "HTMLIsIndexElementConstructor", 0, &JSHTMLIsIndexElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
index 9ac79cb31c..8f21361e63 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLIsIndexElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
index f27b58e0e1..2cc828c8cf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLLIElementConstructor::s_info = { "HTMLLIElementConstructor", 0, &JSHTMLLIElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
index 09d6ffbbcd..948746cd60 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLLIElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
index 7409c70748..214ed4f427 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLLabelElementConstructor::s_info = { "HTMLLabelElementConstructor", 0, &JSHTMLLabelElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
index 19913010f5..3577f5fa5b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLLabelElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
index 5efaebb981..000b301c0c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLLegendElementConstructor::s_info = { "HTMLLegendElementConstructor", 0, &JSHTMLLegendElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
index c766306224..420e05d0c7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLLegendElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
index 56920476fa..3283d26b96 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
@@ -87,8 +87,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLLinkElementConstructor::s_info = { "HTMLLinkElementConstructor", 0, &JSHTMLLinkElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
index 5d46062af5..5ea21470f0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLLinkElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
index e3e9ef1b3d..d4fc27d519 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLMapElementConstructor::s_info = { "HTMLMapElementConstructor", 0, &JSHTMLMapElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
index f17deaef10..231209421e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLMapElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
index a5e3697c9e..9db661af8a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
@@ -74,8 +74,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLMarqueeElementConstructor::s_info = { "HTMLMarqueeElementConstructor", 0, &JSHTMLMarqueeElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
index 64d552f173..de9770a410 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLMarqueeElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
index 8fc5aa6272..f3f3a8d741 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
@@ -117,8 +117,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLMediaElementConstructor::s_info = { "HTMLMediaElementConstructor", 0, &JSHTMLMediaElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
index 2eee952f9f..66ea4cf2bf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLMediaElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
index d6439e07d1..67daa6ede6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
@@ -74,8 +74,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLMenuElementConstructor::s_info = { "HTMLMenuElementConstructor", 0, &JSHTMLMenuElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
index 88c816d8f8..d778342787 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLMenuElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
index 494076c42d..b32b1d1bdd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLMetaElementConstructor::s_info = { "HTMLMetaElementConstructor", 0, &JSHTMLMetaElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
index 2bb93a3e7d..4ff2b8eabf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLMetaElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
index 259618ff00..d4405769a8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLModElementConstructor::s_info = { "HTMLModElementConstructor", 0, &JSHTMLModElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
index 6f920e4542..a2aed451bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLModElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
index 1bf8256d9f..105c49e636 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLOListElementConstructor::s_info = { "HTMLOListElementConstructor", 0, &JSHTMLOListElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
index a2d095e853..9ecb940949 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLOListElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
index 57f2fa6335..7203ff1f5d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
@@ -106,8 +106,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLObjectElementConstructor::s_info = { "HTMLObjectElementConstructor", 0, &JSHTMLObjectElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
index d4ad4847a6..4dd52adc56 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
@@ -44,12 +44,14 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLObjectElement*, const JSC::Identifier&);
     static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLObjectElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
index 2772290ec9..340f910375 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLOptGroupElementConstructor::s_info = { "HTMLOptGroupElementConstructor", 0, &JSHTMLOptGroupElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
index a7cd4d938e..1d57815b75 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLOptGroupElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
index 4b32c87450..b10d41cadc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLOptionElementConstructor::s_info = { "HTMLOptionElementConstructor", 0, &JSHTMLOptionElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
index 232be18f05..44a2d3e76b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -49,6 +49,8 @@ public:
     {
         return static_cast<HTMLOptionElement*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 HTMLOptionElement* toHTMLOptionElement(JSC::JSValue);
@@ -59,7 +61,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLOptionElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
index 800b0a8229..034fa1b27e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -57,6 +57,8 @@ public:
     {
         return static_cast<HTMLOptionsCollection*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
 
@@ -72,9 +74,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLOptionsCollectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
index a065d163ec..098d111c0b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLParagraphElementConstructor::s_info = { "HTMLParagraphElementConstructor", 0, &JSHTMLParagraphElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
index f7b5e375f9..fc15b12b89 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLParagraphElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
index bec35a7739..51eb728b63 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLParamElementConstructor::s_info = { "HTMLParamElementConstructor", 0, &JSHTMLParamElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
index 1dde72da35..be8f7b8f51 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLParamElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
index 4d5fb9cf0b..d06b203b86 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLPreElementConstructor::s_info = { "HTMLPreElementConstructor", 0, &JSHTMLPreElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
index 92c86fa1e1..ef78b720a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLPreElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
index 18642452f9..c1b9957a2e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLQuoteElementConstructor::s_info = { "HTMLQuoteElementConstructor", 0, &JSHTMLQuoteElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
index 03edf4e131..f0f1248950 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLQuoteElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
index 5867c87707..4e396986d8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLScriptElementConstructor::s_info = { "HTMLScriptElementConstructor", 0, &JSHTMLScriptElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
index 9cb3874214..93f4dba079 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLScriptElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
index 1edfb8cfc4..5feda47605 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
@@ -101,8 +101,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLSelectElementConstructor::s_info = { "HTMLSelectElementConstructor", 0, &JSHTMLSelectElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
index 12141cde05..32066cdf95 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -50,6 +50,8 @@ public:
 
     // Custom functions
     JSC::JSValue remove(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -65,9 +67,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLSelectElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
index f6ce1144b4..377c409539 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLSourceElementConstructor::s_info = { "HTMLSourceElementConstructor", 0, &JSHTMLSourceElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
index d33d1a251e..f66761e09c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLSourceElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
index 7fb2ddb141..5137a97d32 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLStyleElementConstructor::s_info = { "HTMLStyleElementConstructor", 0, &JSHTMLStyleElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
index efa49f659a..c05261ce64 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLStyleElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
index 1668c039e1..4b81e96df1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTableCaptionElementConstructor::s_info = { "HTMLTableCaptionElementConstructor", 0, &JSHTMLTableCaptionElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
index fa4f77d98d..4dafac523e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -49,6 +49,8 @@ public:
     {
         return static_cast<HTMLTableCaptionElement*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 HTMLTableCaptionElement* toHTMLTableCaptionElement(JSC::JSValue);
@@ -59,7 +61,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLTableCaptionElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
index 2d3c63c711..5ff1e49cfc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
@@ -91,8 +91,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTableCellElementConstructor::s_info = { "HTMLTableCellElementConstructor", 0, &JSHTMLTableCellElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
index d5f5ad0673..baa70fc131 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLTableCellElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
index e3bcbef1ff..8bfb70a671 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTableColElementConstructor::s_info = { "HTMLTableColElementConstructor", 0, &JSHTMLTableColElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
index 95aebe4546..f761d518d0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLTableColElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
index 70f45a2fff..1cafa0048b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
@@ -98,8 +98,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTableElementConstructor::s_info = { "HTMLTableElementConstructor", 0, &JSHTMLTableElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
index 08ef645e03..9bc9dc7c77 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -57,9 +59,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLTableElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
index 29dbcf6aec..6dd162288b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
@@ -89,8 +89,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTableRowElementConstructor::s_info = { "HTMLTableRowElementConstructor", 0, &JSHTMLTableRowElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
index 3adbb0131e..a997475bc4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -57,9 +59,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLTableRowElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
index ad10c4967e..b00b883d91 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
@@ -85,8 +85,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTableSectionElementConstructor::s_info = { "HTMLTableSectionElementConstructor", 0, &JSHTMLTableSectionElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
index 85c54c136a..6760be581a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -49,6 +49,8 @@ public:
     {
         return static_cast<HTMLTableSectionElement*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 HTMLTableSectionElement* toHTMLTableSectionElement(JSC::JSValue);
@@ -63,9 +65,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLTableSectionElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
index 8d43a633c7..fdd60b4908 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
@@ -101,8 +101,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTextAreaElementConstructor::s_info = { "HTMLTextAreaElementConstructor", 0, &JSHTMLTextAreaElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
index 3b28ae9756..3b36f3a2cc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -57,9 +59,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLTextAreaElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
index 51bffa4251..fe642d3e35 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTitleElementConstructor::s_info = { "HTMLTitleElementConstructor", 0, &JSHTMLTitleElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
index 8f88dacfa1..8cc7ecac3d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLTitleElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
index 5a541b48b4..58bc2094a7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLUListElementConstructor::s_info = { "HTMLUListElementConstructor", 0, &JSHTMLUListElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
index 9f7f7173bd..d65d7cbcb8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLUListElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
index 4331798ef0..b8f2da34e0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
@@ -84,8 +84,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLVideoElementConstructor::s_info = { "HTMLVideoElementConstructor", 0, &JSHTMLVideoElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
index e74590f1d7..7a6010967f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLVideoElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHistory.h b/src/3rdparty/webkit/WebCore/generated/JSHistory.h
index 9ea7e91bda..a08fc19c34 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHistory.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHistory.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
@@ -56,6 +56,8 @@ public:
 
 private:
     RefPtr<History> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, History*);
@@ -71,9 +73,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHistoryPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
index 973ec260ce..a21fb876fd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSImageDataConstructor::s_info = { "ImageDataConstructor", 0, &JSImageDataConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSImageData.h b/src/3rdparty/webkit/WebCore/generated/JSImageData.h
index d84357c235..0c42e5b972 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSImageData.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSImageData.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<ImageData> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, ImageData*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSImageDataPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
index f770cf2d3b..8da82ccbd7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSInspectorBackendConstructor::s_info = { "InspectorBackendConstructor", 0, &JSInspectorBackendConstructorTable, 0 };
@@ -96,7 +99,7 @@ bool JSInspectorBackendConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 /* Hash table for prototype */
 
-static const HashTableValue JSInspectorBackendPrototypeTableValues[71] =
+static const HashTableValue JSInspectorBackendPrototypeTableValues[77] =
 {
     { "hideDOMNodeHighlight", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHideDOMNodeHighlight, (intptr_t)0 },
     { "highlightDOMNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHighlightDOMNode, (intptr_t)1 },
@@ -112,16 +115,16 @@ static const HashTableValue JSInspectorBackendPrototypeTableValues[71] =
     { "addResourceSourceToFrame", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAddResourceSourceToFrame, (intptr_t)2 },
     { "addSourceToFrame", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAddSourceToFrame, (intptr_t)3 },
     { "search", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSearch, (intptr_t)2 },
-    { "databaseTableNames", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDatabaseTableNames, (intptr_t)1 },
+    { "getDatabaseTableNames", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetDatabaseTableNames, (intptr_t)2 },
     { "setting", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetting, (intptr_t)1 },
     { "setSetting", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetSetting, (intptr_t)2 },
     { "inspectedWindow", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionInspectedWindow, (intptr_t)0 },
     { "localizedStringsURL", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionLocalizedStringsURL, (intptr_t)0 },
     { "hiddenPanels", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHiddenPanels, (intptr_t)0 },
     { "platform", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionPlatform, (intptr_t)0 },
-    { "enableTimeline", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionEnableTimeline, (intptr_t)1 },
-    { "disableTimeline", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDisableTimeline, (intptr_t)1 },
-    { "timelineEnabled", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionTimelineEnabled, (intptr_t)0 },
+    { "startTimelineProfiler", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStartTimelineProfiler, (intptr_t)0 },
+    { "stopTimelineProfiler", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStopTimelineProfiler, (intptr_t)0 },
+    { "timelineProfilerEnabled", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionTimelineProfilerEnabled, (intptr_t)0 },
     { "moveByUnrestricted", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionMoveByUnrestricted, (intptr_t)2 },
     { "setAttachedWindowHeight", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetAttachedWindowHeight, (intptr_t)1 },
     { "wrapCallback", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionWrapCallback, (intptr_t)1 },
@@ -148,26 +151,32 @@ static const HashTableValue JSInspectorBackendPrototypeTableValues[71] =
     { "disableProfiler", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDisableProfiler, (intptr_t)1 },
     { "startProfiling", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStartProfiling, (intptr_t)0 },
     { "stopProfiling", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStopProfiling, (intptr_t)0 },
-    { "profiles", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionProfiles, (intptr_t)0 },
-    { "dispatchOnInjectedScript", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript, (intptr_t)3 },
+    { "getProfileHeaders", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetProfileHeaders, (intptr_t)1 },
+    { "getProfile", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetProfile, (intptr_t)2 },
+    { "dispatchOnInjectedScript", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript, (intptr_t)4 },
     { "getChildNodes", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetChildNodes, (intptr_t)2 },
     { "setAttribute", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetAttribute, (intptr_t)4 },
     { "removeAttribute", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionRemoveAttribute, (intptr_t)3 },
     { "setTextNodeValue", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetTextNodeValue, (intptr_t)3 },
     { "getEventListenersForNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetEventListenersForNode, (intptr_t)2 },
     { "copyNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionCopyNode, (intptr_t)1 },
-    { "getCookies", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetCookies, (intptr_t)1 },
-    { "deleteCookie", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDeleteCookie, (intptr_t)1 },
+    { "removeNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionRemoveNode, (intptr_t)2 },
+    { "getCookies", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetCookies, (intptr_t)2 },
+    { "deleteCookie", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDeleteCookie, (intptr_t)2 },
     { "nodeForId", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionNodeForId, (intptr_t)1 },
-    { "wrapObject", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionWrapObject, (intptr_t)1 },
+    { "wrapObject", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionWrapObject, (intptr_t)2 },
     { "unwrapObject", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionUnwrapObject, (intptr_t)1 },
+    { "releaseWrapperObjectGroup", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionReleaseWrapperObjectGroup, (intptr_t)1 },
     { "pushNodePathToFrontend", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionPushNodePathToFrontend, (intptr_t)2 },
     { "addNodesToSearchResult", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAddNodesToSearchResult, (intptr_t)1 },
     { "selectDatabase", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSelectDatabase, (intptr_t)1 },
+    { "databaseForId", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDatabaseForId, (intptr_t)1 },
     { "selectDOMStorage", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSelectDOMStorage, (intptr_t)1 },
     { "getDOMStorageEntries", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetDOMStorageEntries, (intptr_t)2 },
     { "setDOMStorageItem", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetDOMStorageItem, (intptr_t)4 },
     { "removeDOMStorageItem", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionRemoveDOMStorageItem, (intptr_t)3 },
+    { "reportDidDispatchOnInjectedScript", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionReportDidDispatchOnInjectedScript, (intptr_t)3 },
+    { "didEvaluateForTestInFrontend", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDidEvaluateForTestInFrontend, (intptr_t)2 },
     { 0, 0, 0, 0 }
 };
 
@@ -175,7 +184,7 @@ static JSC_CONST_HASHTABLE HashTable JSInspectorBackendPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 4095, JSInspectorBackendPrototypeTableValues, 0 };
 #else
-    { 262, 255, JSInspectorBackendPrototypeTableValues, 0 };
+    { 267, 255, JSInspectorBackendPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSInspectorBackendPrototype::s_info = { "InspectorBackendPrototype", 0, &JSInspectorBackendPrototypeTable, 0 };
@@ -404,13 +413,18 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSearch(ExecState* exec,
     return castedThisObj->search(exec, args);
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDatabaseTableNames(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetDatabaseTableNames(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->databaseTableNames(exec, args);
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int databaseId = args.at(1).toInt32(exec);
+
+    imp->getDatabaseTableNames(callId, databaseId);
+    return jsUndefined();
 }
 
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetting(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -479,33 +493,31 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPlatform(ExecState* exe
     return result;
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableTimeline(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartTimelineProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    bool always = args.at(0).toBoolean(exec);
 
-    imp->enableTimeline(always);
+    imp->startTimelineProfiler();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableTimeline(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopTimelineProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    bool always = args.at(0).toBoolean(exec);
 
-    imp->disableTimeline(always);
+    imp->stopTimelineProfiler();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionTimelineEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionTimelineProfilerEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -514,7 +526,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionTimelineEnabled(ExecSta
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = jsBoolean(imp->timelineEnabled());
+    JSC::JSValue result = jsBoolean(imp->timelineProfilerEnabled());
     return result;
 }
 
@@ -847,13 +859,31 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopProfiling(ExecState
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionProfiles(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfileHeaders(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+
+    imp->getProfileHeaders(callId);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfile(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->profiles(exec, args);
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    unsigned uid = args.at(1).toInt32(exec);
+
+    imp->getProfile(callId, uid);
+    return jsUndefined();
 }
 
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -866,8 +896,9 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDispatchOnInjectedScrip
     int callId = args.at(0).toInt32(exec);
     const UString& methodName = args.at(1).toString(exec);
     const UString& arguments = args.at(2).toString(exec);
+    bool async = args.at(3).toBoolean(exec);
 
-    imp->dispatchOnInjectedScript(callId, methodName, arguments);
+    imp->dispatchOnInjectedScript(callId, methodName, arguments, async);
     return jsUndefined();
 }
 
@@ -958,6 +989,20 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCopyNode(ExecState* exe
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int nodeId = args.at(1).toInt32(exec);
+
+    imp->removeNode(callId, nodeId);
+    return jsUndefined();
+}
+
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetCookies(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -966,8 +1011,9 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetCookies(ExecState* e
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     int callId = args.at(0).toInt32(exec);
+    const UString& domain = args.at(1).toString(exec);
 
-    imp->getCookies(callId);
+    imp->getCookies(callId, domain);
     return jsUndefined();
 }
 
@@ -979,8 +1025,9 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDeleteCookie(ExecState*
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     const UString& cookieName = args.at(0).toString(exec);
+    const UString& domain = args.at(1).toString(exec);
 
-    imp->deleteCookie(cookieName);
+    imp->deleteCookie(cookieName, domain);
     return jsUndefined();
 }
 
@@ -1011,6 +1058,19 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionUnwrapObject(ExecState*
     return castedThisObj->unwrapObject(exec, args);
 }
 
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionReleaseWrapperObjectGroup(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    const UString& objectGroup = args.at(0).toString(exec);
+
+    imp->releaseWrapperObjectGroup(objectGroup);
+    return jsUndefined();
+}
+
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPushNodePathToFrontend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -1042,6 +1102,15 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDatabase(ExecStat
     return castedThisObj->selectDatabase(exec, args);
 }
 
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDatabaseForId(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    return castedThisObj->databaseForId(exec, args);
+}
+
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDOMStorage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -1096,6 +1165,35 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveDOMStorageItem(Ex
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionReportDidDispatchOnInjectedScript(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    const UString& result = args.at(1).toString(exec);
+    bool isException = args.at(2).toBoolean(exec);
+
+    imp->reportDidDispatchOnInjectedScript(callId, result, isException);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDidEvaluateForTestInFrontend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    const UString& jsonResult = args.at(1).toString(exec);
+
+    imp->didEvaluateForTestInFrontend(callId, jsonResult);
+    return jsUndefined();
+}
+
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, InspectorBackend* object)
 {
     return getDOMObjectWrapper<JSInspectorBackend>(exec, globalObject, object);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
index 5e2239f8fa..f4a19259e1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,23 +51,24 @@ public:
     // Custom functions
     JSC::JSValue highlightDOMNode(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue search(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue databaseTableNames(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue setting(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue setSetting(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue inspectedWindow(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue wrapCallback(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue currentCallFrame(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue profiles(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue nodeForId(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue wrapObject(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue unwrapObject(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue pushNodePathToFrontend(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue selectDatabase(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue databaseForId(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue selectDOMStorage(JSC::ExecState*, const JSC::ArgList&);
     InspectorBackend* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<InspectorBackend> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, InspectorBackend*);
@@ -83,9 +84,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSInspectorBackendPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -104,16 +107,16 @@ JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSearchingForNode(J
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddResourceSourceToFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddSourceToFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDatabaseTableNames(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetDatabaseTableNames(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetting(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetSetting(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionInspectedWindow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionLocalizedStringsURL(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHiddenPanels(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPlatform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableTimeline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableTimeline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionTimelineEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartTimelineProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopTimelineProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionTimelineProfilerEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionMoveByUnrestricted(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttachedWindowHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWrapCallback(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
@@ -140,7 +143,8 @@ JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableProfiler(JSC
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartProfiling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopProfiling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionProfiles(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfileHeaders(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfile(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetChildNodes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
@@ -148,18 +152,23 @@ JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveAttribute(JS
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetTextNodeValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetEventListenersForNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCopyNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetCookies(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDeleteCookie(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionNodeForId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWrapObject(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionUnwrapObject(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionReleaseWrapperObjectGroup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPushNodePathToFrontend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddNodesToSearchResult(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDatabase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDatabaseForId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDOMStorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetDOMStorageEntries(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetDOMStorageItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveDOMStorageItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionReportDidDispatchOnInjectedScript(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDidEvaluateForTestInFrontend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
 JSC::JSValue jsInspectorBackendConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
index c958ee0685..a209147b50 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -60,6 +60,8 @@ public:
 
 private:
     RefPtr<JavaScriptCallFrame> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JavaScriptCallFrame*);
@@ -75,9 +77,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSJavaScriptCallFramePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
index 90d964db30..4beaa591f2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
@@ -85,8 +85,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSKeyboardEventConstructor::s_info = { "KeyboardEventConstructor", 0, &JSKeyboardEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
index c1567b8492..7d6093323f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSKeyboardEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSLocation.h b/src/3rdparty/webkit/WebCore/generated/JSLocation.h
index ecdeffc9a5..2948ce6bbe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSLocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSLocation.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
@@ -73,6 +73,8 @@ public:
 
 private:
     RefPtr<Location> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Location*);
@@ -88,12 +90,14 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
     JSLocationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp b/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
index 6f18ed0789..b7d4c19d72 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMediaConstructor::s_info = { "MediaConstructor", 0, &JSMediaConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMedia.h b/src/3rdparty/webkit/WebCore/generated/JSMedia.h
index 5a08af2fbd..fec492b05a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMedia.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMedia.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<Media> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Media*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMediaPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
index a1bc33e2b7..97e35e0195 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMediaErrorConstructor::s_info = { "MediaErrorConstructor", 0, &JSMediaErrorConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaError.h b/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
index 9dfecd3f99..847dd0e967 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<MediaError> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, MediaError*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMediaErrorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
index 1167ae5255..93a17b494d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMediaListConstructor::s_info = { "MediaListConstructor", 0, &JSMediaListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaList.h b/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
index a37501d9a3..30853dfc76 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<MediaList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
@@ -70,9 +72,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMediaListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
index 63503fc518..8b8b1271a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -52,6 +52,8 @@ public:
 
 private:
     RefPtr<MessageChannel> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, MessageChannel*);
@@ -65,9 +67,11 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMessageChannelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
index 2867a1750d..f308150dda 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
@@ -25,6 +25,7 @@
 #include "JSDOMWindow.h"
 #include "KURL.h"
 #include "MessageEvent.h"
+#include "SerializedScriptValue.h"
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
 #include <wtf/GetPtr.h>
@@ -83,8 +84,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMessageEventConstructor::s_info = { "MessageEventConstructor", 0, &JSMessageEventConstructorTable, 0 };
@@ -166,7 +170,7 @@ JSValue jsMessageEventData(ExecState* exec, const Identifier&, const PropertySlo
     JSMessageEvent* castedThis = static_cast<JSMessageEvent*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     MessageEvent* imp = static_cast<MessageEvent*>(castedThis->impl());
-    return jsString(exec, imp->data());
+    return imp->data()->deserialize(exec);
 }
 
 JSValue jsMessageEventOrigin(ExecState* exec, const Identifier&, const PropertySlot& slot)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
index 1cb35623a1..d109987307 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -49,6 +49,8 @@ public:
 
     // Custom functions
     JSC::JSValue initMessageEvent(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -62,9 +64,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMessageEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
index 2f84364a7f..28e1492d6e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
@@ -83,8 +83,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMessagePortConstructor::s_info = { "MessagePortConstructor", 0, &JSMessagePortConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
index 6c6e94e224..6d3aa6147d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -59,6 +59,8 @@ public:
 
 private:
     RefPtr<MessagePort> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, MessagePort*);
@@ -74,9 +76,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMessagePortPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
index 1f97845585..f797df23c5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMimeTypeConstructor::s_info = { "MimeTypeConstructor", 0, &JSMimeTypeConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeType.h b/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
index 9c4d1e3ec2..e3ee635536 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<MimeType> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, MimeType*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSMimeTypePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
index 1a7f06b820..0384539580 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMimeTypeArrayConstructor::s_info = { "MimeTypeArrayConstructor", 0, &JSMimeTypeArrayConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
index 1fe01bb768..87b74382de 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<MimeTypeArray> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, MimeTypeArray*, const JSC::Identifier&);
@@ -72,9 +74,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMimeTypeArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
index 9b2220b1d8..47c4b14b32 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
@@ -99,8 +99,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMouseEventConstructor::s_info = { "MouseEventConstructor", 0, &JSMouseEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
index b13d5e60d5..c7a6e9e37a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMouseEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
index cb47db7345..6565d4069f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
@@ -87,8 +87,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMutationEventConstructor::s_info = { "MutationEventConstructor", 0, &JSMutationEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
index 4a063158d7..2fbd82bc27 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMutationEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
index eafaee157f..e3cc8d2998 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSNamedNodeMapConstructor::s_info = { "NamedNodeMapConstructor", 0, &JSNamedNodeMapConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
index 6ea0e2f09e..305877b71c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<NamedNodeMap> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, NamedNodeMap*, const JSC::Identifier&);
@@ -74,9 +76,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSNamedNodeMapPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNavigator.h b/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
index ec1405557f..5847e96d1f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -52,6 +52,8 @@ public:
 
 private:
     RefPtr<Navigator> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Navigator*);
@@ -67,9 +69,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSNavigatorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
index 8ae675c6c7..e1328292ea 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
@@ -124,8 +124,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSNodeConstructor::s_info = { "NodeConstructor", 0, &JSNodeConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.h b/src/3rdparty/webkit/WebCore/generated/JSNode.h
index 2275f3908b..0398122458 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -66,6 +66,8 @@ public:
 
 private:
     RefPtr<Node> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 ALWAYS_INLINE bool JSNode::getOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
@@ -92,9 +94,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSNodePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
index c50caf8ab4..141a060741 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
@@ -90,8 +90,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSNodeFilterConstructor::s_info = { "NodeFilterConstructor", 0, &JSNodeFilterConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
index 48eb6b47f0..c59011a0e0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -56,6 +56,8 @@ public:
 
 private:
     RefPtr<NodeFilter> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, NodeFilter*);
@@ -71,9 +73,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSNodeFilterPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
index 89ea643260..cf85e40073 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
@@ -85,8 +85,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSNodeIteratorConstructor::s_info = { "NodeIteratorConstructor", 0, &JSNodeIteratorConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
index 21902e5e88..64bf10f93e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -57,6 +57,8 @@ public:
 
 private:
     RefPtr<NodeIterator> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, NodeIterator*);
@@ -72,9 +74,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSNodeIteratorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
index be3bf916b0..01ee9acff8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSNodeListConstructor::s_info = { "NodeListConstructor", 0, &JSNodeListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeList.h b/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
index 82e1cb6317..76840f061f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
@@ -56,6 +56,8 @@ public:
 
 private:
     RefPtr<NodeList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, NodeList*, const JSC::Identifier&);
@@ -75,9 +77,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSNodeListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp b/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
index 60a04fae6c..bf91e7cafc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSNotationConstructor::s_info = { "NotationConstructor", 0, &JSNotationConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNotation.h b/src/3rdparty/webkit/WebCore/generated/JSNotation.h
index 71fd2d8d0d..79656a23f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNotation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNotation.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSNotationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
index 26bd08ee1d..fdc3a64c8b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSOverflowEventConstructor::s_info = { "OverflowEventConstructor", 0, &JSOverflowEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
index 8e2fb7f3ac..e9e10d345c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSOverflowEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.cpp
index 254d0e925f..55d5a5430b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.cpp
@@ -75,8 +75,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSPageTransitionEventConstructor::s_info = { "PageTransitionEventConstructor", 0, &JSPageTransitionEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.h b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.h
index 5829b8d650..6e385580f3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSPageTransitionEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
index 1c4b9a60d1..035a352f54 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
@@ -85,8 +85,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSPluginConstructor::s_info = { "PluginConstructor", 0, &JSPluginConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPlugin.h b/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
index 98de1de499..03da3df267 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<Plugin> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, Plugin*, const JSC::Identifier&);
@@ -72,9 +74,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSPluginPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
index 0e8eec08e1..bd0b579891 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSPluginArrayConstructor::s_info = { "PluginArrayConstructor", 0, &JSPluginArrayConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
index 859aefb30c..9c2e6ef093 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<PluginArray> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, PluginArray*, const JSC::Identifier&);
@@ -72,9 +74,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSPluginArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
index 557c029038..e178bd9b9a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSPositionErrorConstructor::s_info = { "PositionErrorConstructor", 0, &JSPositionErrorConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPositionError.h b/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
index 7e680ae788..01ba3e77cc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<PositionError> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, PositionError*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSPositionErrorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
index 267a2690a9..8c8de3ad3e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSProcessingInstructionConstructor::s_info = { "ProcessingInstructionConstructor", 0, &JSProcessingInstructionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
index 6780d2e81e..b3c239b4fb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSProcessingInstructionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
index 3b1caaa006..c74e80d540 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSProgressEventConstructor::s_info = { "ProgressEventConstructor", 0, &JSProgressEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
index c2c4877ef8..34e1985612 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSProgressEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
index 51445437c4..0dff99a114 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSRGBColorConstructor::s_info = { "RGBColorConstructor", 0, &JSRGBColorConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h
index d1425e46d7..2e6c715c82 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<RGBColor> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, RGBColor*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSRGBColorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
index d6d4d9367b..cc59119bb9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
@@ -100,8 +100,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSRangeConstructor::s_info = { "RangeConstructor", 0, &JSRangeConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.h b/src/3rdparty/webkit/WebCore/generated/JSRange.h
index b58a4bfbb4..8b45a3f1e7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<Range> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Range*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSRangePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
index 5a975ccf21..2f8e618b50 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSRangeExceptionConstructor::s_info = { "RangeExceptionConstructor", 0, &JSRangeExceptionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRangeException.h b/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
index 162acb8b7d..1a9e2ae414 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<RangeException> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, RangeException*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSRangeExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
index 84d20e41d1..37c4669407 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSRectConstructor::s_info = { "RectConstructor", 0, &JSRectConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRect.h b/src/3rdparty/webkit/WebCore/generated/JSRect.h
index cefef58d07..476a5a2900 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRect.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<Rect> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Rect*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSRectPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLError.h b/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
index 917413083a..536845262d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SQLError* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SQLError> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SQLError*);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSQLErrorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
index f463380207..b1551f240c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SQLResultSet* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SQLResultSet> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SQLResultSet*);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSQLResultSetPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
index 83df584a27..67b8fd2cd3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<SQLResultSetRowList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SQLResultSetRowList*);
@@ -70,9 +72,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSQLResultSetRowListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
index a3886d3d46..7438597812 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
@@ -41,6 +41,11 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
 
     // Custom functions
     JSC::JSValue executeSql(JSC::ExecState*, const JSC::ArgList&);
@@ -48,6 +53,8 @@ public:
 
 private:
     RefPtr<SQLTransaction> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SQLTransaction*);
@@ -63,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSQLTransactionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
index f7d3cf9fc6..f54337b402 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGAElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
index ac03bb418c..050f980cdd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAltGlyphElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
index 6c8277953c..220f4a6846 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
@@ -89,8 +89,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGAngleConstructor::s_info = { "SVGAngleConstructor", 0, &JSSVGAngleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
index 2630c3dabd..42fdbbda6d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<SVGAngle> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAngle*, SVGElement* context);
@@ -70,9 +72,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGAnglePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h
index 48cf5f7e2c..52ab586e15 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimateColorElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h
index e94048a08c..0ffe6decef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimateElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h
index 0628bee241..3a99234598 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimateTransformElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
index 8b1be0b7f1..c822dc770f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedAngle* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedAngle> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedAngle*, SVGElement* context);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedAnglePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
index 14f3208426..c6690a269f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedBoolean* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedBoolean> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedBoolean*, SVGElement* context);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedBooleanPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
index b2a40c2c9d..6f036d5857 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedEnumeration* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedEnumeration> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedEnumeration*, SVGElement* context);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedEnumerationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
index 4484335c7c..113f0b2f68 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedInteger* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedInteger> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedInteger*, SVGElement* context);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedIntegerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
index 7016f60ccb..671eed8bf7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedLength* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedLength> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedLength*, SVGElement* context);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedLengthPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
index e95fb9268f..aa32b122e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedLengthList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedLengthList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedLengthList*, SVGElement* context);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedLengthListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
index e33b50d078..4c49a920bd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedNumber* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedNumber> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedNumber*, SVGElement* context);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedNumberPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
index 3729b0a64f..4b61561e96 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedNumberList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedNumberList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedNumberList*, SVGElement* context);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedNumberListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
index 5a1feb61d0..eca4cb650c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedPreserveAspectRatio* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedPreserveAspectRatio> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedPreserveAspectRatio*, SVGElement* context);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedPreserveAspectRatioPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
index 7f9e25d601..904a78c320 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedRect* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedRect> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedRect*, SVGElement* context);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedRectPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
index b7d35e1e42..216e643d71 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedString* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedString> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedString*, SVGElement* context);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedStringPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
index 9917280ecb..3c7b0a2557 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedTransformList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedTransformList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedTransformList*, SVGElement* context);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedTransformListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
index f0d421d1fe..e36dc3a15c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGAnimationElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
index 8c609b5886..0633d2ec91 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGCircleElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
index 2dcb7f26b0..881825409a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGClipPathElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
index d60e65d2cf..7a89671104 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGColorConstructor::s_info = { "SVGColorConstructor", 0, &JSSVGColorConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
index 03f5c31dac..220f73e09d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGColorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
index e37e52ee70..f346d07687 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
@@ -92,8 +92,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGComponentTransferFunctionElementConstructor::s_info = { "SVGComponentTransferFunctionElementConstructor", 0, &JSSVGComponentTransferFunctionElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
index bda411971a..b7cf7c418f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGComponentTransferFunctionElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
index 137803a34f..ef61751652 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGCursorElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
index 522d278f18..da6470b8de 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGDefsElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
index 920127b2ef..1f43e7a85b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGDescElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
index 830952b272..47c6b157cd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGDocumentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
index 22780434c1..c4cc3a48ac 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
@@ -24,6 +24,7 @@
 
 #include "JSSVGElement.h"
 
+#include "HTMLNames.h"
 #include "JSSVGElement.h"
 #include "JSSVGSVGElement.h"
 #include "KURL.h"
@@ -104,7 +105,7 @@ JSValue jsSVGElementId(ExecState* exec, const Identifier&, const PropertySlot& s
     JSSVGElement* castedThis = static_cast<JSSVGElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     SVGElement* imp = static_cast<SVGElement*>(castedThis->impl());
-    return jsString(exec, imp->id());
+    return jsString(exec, imp->getAttribute(HTMLNames::idAttr));
 }
 
 JSValue jsSVGElementXmlbase(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -140,7 +141,7 @@ void setJSSVGElementId(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setId(valueToStringWithNullCheck(exec, value), ec);
+    imp->setAttribute(HTMLNames::idAttr, valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
index 39b1660220..111f9b90d5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
@@ -43,13 +43,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGElement* impl() const
     {
         return static_cast<SVGElement*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 SVGElement* toSVGElement(JSC::JSValue);
@@ -60,7 +62,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
index 2ed2f728f1..57a150fb0e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -62,6 +62,8 @@ public:
 
 private:
     RefPtr<SVGElementInstance> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGElementInstance*);
@@ -77,9 +79,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGElementInstancePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
index bfbebedad8..257f405323 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
@@ -46,13 +46,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGElementInstanceList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGElementInstanceList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGElementInstanceList*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGElementInstanceListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
index 477b0375df..100dfa12d9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGEllipseElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
index 0b4118823b..039182f4bf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGExceptionConstructor::s_info = { "SVGExceptionConstructor", 0, &JSSVGExceptionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGException.h b/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
index 646f003e0e..21f4221f71 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<SVGException> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGException*, SVGElement* context);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
index e7aebf934e..d32f27638a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
@@ -101,8 +101,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGFEBlendElementConstructor::s_info = { "SVGFEBlendElementConstructor", 0, &JSSVGFEBlendElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
index 41cc90ad2a..910f9b80b4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEBlendElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
index 34252d9588..0f1d439d1a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
@@ -101,8 +101,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGFEColorMatrixElementConstructor::s_info = { "SVGFEColorMatrixElementConstructor", 0, &JSSVGFEColorMatrixElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
index 65b8b2ae1f..5c9305ec80 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEColorMatrixElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
index 71ca39c2ca..265d70ce68 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEComponentTransferElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
index 782be78df3..c0de8f71d2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
@@ -49,7 +49,7 @@ static const HashTableValue JSSVGFECompositeElementTableValues[16] =
 {
     { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementIn1, (intptr_t)0 },
     { "in2", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementIn2, (intptr_t)0 },
-    { "_operator", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElement_operator, (intptr_t)0 },
+    { "operator", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementOperator, (intptr_t)0 },
     { "k1", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementK1, (intptr_t)0 },
     { "k2", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementK2, (intptr_t)0 },
     { "k3", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementK3, (intptr_t)0 },
@@ -107,8 +107,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGFECompositeElementConstructor::s_info = { "SVGFECompositeElementConstructor", 0, &JSSVGFECompositeElementConstructorTable, 0 };
@@ -202,7 +205,7 @@ JSValue jsSVGFECompositeElementIn2(ExecState* exec, const Identifier&, const Pro
     return toJS(exec, castedThis->globalObject(), obj.get(), imp);
 }
 
-JSValue jsSVGFECompositeElement_operator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementOperator(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
index ef165b95dd..70cb296578 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFECompositeElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -71,7 +75,7 @@ JSC::JSValue JSC_HOST_CALL jsSVGFECompositeElementPrototypeFunctionGetPresentati
 
 JSC::JSValue jsSVGFECompositeElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsSVGFECompositeElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElement_operator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementOperator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsSVGFECompositeElementK1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsSVGFECompositeElementK2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsSVGFECompositeElementK3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
index 87eac3da03..442cb7118d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEDiffuseLightingElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
index c5f7fbb4b9..6bdd56e34d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
@@ -103,8 +103,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGFEDisplacementMapElementConstructor::s_info = { "SVGFEDisplacementMapElementConstructor", 0, &JSSVGFEDisplacementMapElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
index 39098b8cab..d5eafcea00 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEDisplacementMapElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
index 810f1cd40d..becbe95dd8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFEDistantLightElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
index 2c331e3e6c..3ee186ce46 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
@@ -43,9 +43,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFloodElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFEFloodElementTableValues[10] =
+static const HashTableValue JSSVGFEFloodElementTableValues[9] =
 {
-    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementIn1, (intptr_t)0 },
     { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementX, (intptr_t)0 },
     { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementY, (intptr_t)0 },
     { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementWidth, (intptr_t)0 },
@@ -61,7 +60,7 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFEFloodElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 255, JSSVGFEFloodElementTableValues, 0 };
 #else
-    { 34, 31, JSSVGFEFloodElementTableValues, 0 };
+    { 18, 15, JSSVGFEFloodElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -92,8 +91,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGFEFloodElementConstructor::s_info = { "SVGFEFloodElementConstructor", 0, &JSSVGFEFloodElementConstructorTable, 0 };
@@ -162,15 +164,6 @@ bool JSSVGFEFloodElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSSVGFEFloodElement, Base>(exec, &JSSVGFEFloodElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEFloodElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()));
-    UNUSED_PARAM(exec);
-    SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(castedThis->impl());
-    RefPtr<SVGAnimatedString> obj = imp->in1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
-}
-
 JSValue jsSVGFEFloodElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
index a87b884789..2dccbf8bdd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEFloodElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -69,7 +73,6 @@ public:
 JSC::JSValue JSC_HOST_CALL jsSVGFEFloodElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFEFloodElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsSVGFEFloodElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsSVGFEFloodElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsSVGFEFloodElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h
index 79566569c2..91657332d6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFEFuncAElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h
index d6c8c74259..712f096901 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFEFuncBElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h
index d9e1767f6d..ecb6430a8f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFEFuncGElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h
index 179a254127..f338fae5b0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFEFuncRElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
index 1227008068..77157260c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEGaussianBlurElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
index a21a67bc5c..616d7e5896 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEImageElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
index 501ce85678..112f064629 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEMergeElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
index 5f055ee2a3..966eacf6fe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFEMergeNodeElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.cpp
new file mode 100644
index 0000000000..b8b7ae5ff5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.cpp
@@ -0,0 +1,336 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+
+#include "JSSVGFEMorphologyElement.h"
+
+#include "CSSMutableStyleDeclaration.h"
+#include "CSSStyleDeclaration.h"
+#include "CSSValue.h"
+#include "JSCSSStyleDeclaration.h"
+#include "JSCSSValue.h"
+#include "JSSVGAnimatedEnumeration.h"
+#include "JSSVGAnimatedLength.h"
+#include "JSSVGAnimatedNumber.h"
+#include "JSSVGAnimatedString.h"
+#include "SVGFEMorphologyElement.h"
+#include <runtime/Error.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEMorphologyElement);
+
+/* Hash table */
+
+static const HashTableValue JSSVGFEMorphologyElementTableValues[13] =
+{
+    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementIn1, (intptr_t)0 },
+    { "operator", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementOperator, (intptr_t)0 },
+    { "radiusX", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementRadiusX, (intptr_t)0 },
+    { "radiusY", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementRadiusY, (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementX, (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementY, (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementWidth, (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementHeight, (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementResult, (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementClassName, (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementStyle, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGFEMorphologyElementConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEMorphologyElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 255, JSSVGFEMorphologyElementTableValues, 0 };
+#else
+    { 34, 31, JSSVGFEMorphologyElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEMorphologyElementConstructorTableValues[4] =
+{
+    { "SVG_MORPHOLOGY_OPERATOR_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN, (intptr_t)0 },
+    { "SVG_MORPHOLOGY_OPERATOR_ERODE", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE, (intptr_t)0 },
+    { "SVG_MORPHOLOGY_OPERATOR_DILATE", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEMorphologyElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 3, JSSVGFEMorphologyElementConstructorTableValues, 0 };
+#else
+    { 8, 7, JSSVGFEMorphologyElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFEMorphologyElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFEMorphologyElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFEMorphologyElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEMorphologyElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFEMorphologyElementConstructor::s_info = { "SVGFEMorphologyElementConstructor", 0, &JSSVGFEMorphologyElementConstructorTable, 0 };
+
+bool JSSVGFEMorphologyElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEMorphologyElementConstructor, DOMObject>(exec, &JSSVGFEMorphologyElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFEMorphologyElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEMorphologyElementConstructor, DOMObject>(exec, &JSSVGFEMorphologyElementConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSSVGFEMorphologyElementPrototypeTableValues[6] =
+{
+    { "SVG_MORPHOLOGY_OPERATOR_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN, (intptr_t)0 },
+    { "SVG_MORPHOLOGY_OPERATOR_ERODE", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE, (intptr_t)0 },
+    { "SVG_MORPHOLOGY_OPERATOR_DILATE", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE, (intptr_t)0 },
+    { "setRadius", DontDelete|Function, (intptr_t)jsSVGFEMorphologyElementPrototypeFunctionSetRadius, (intptr_t)2 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFEMorphologyElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEMorphologyElementPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 63, JSSVGFEMorphologyElementPrototypeTableValues, 0 };
+#else
+    { 17, 15, JSSVGFEMorphologyElementPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSSVGFEMorphologyElementPrototype::s_info = { "SVGFEMorphologyElementPrototype", 0, &JSSVGFEMorphologyElementPrototypeTable, 0 };
+
+JSObject* JSSVGFEMorphologyElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSSVGFEMorphologyElement>(exec, globalObject);
+}
+
+bool JSSVGFEMorphologyElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticPropertySlot<JSSVGFEMorphologyElementPrototype, JSObject>(exec, &JSSVGFEMorphologyElementPrototypeTable, this, propertyName, slot);
+}
+
+bool JSSVGFEMorphologyElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGFEMorphologyElementPrototype, JSObject>(exec, &JSSVGFEMorphologyElementPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSSVGFEMorphologyElement::s_info = { "SVGFEMorphologyElement", &JSSVGElement::s_info, &JSSVGFEMorphologyElementTable, 0 };
+
+JSSVGFEMorphologyElement::JSSVGFEMorphologyElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEMorphologyElement> impl)
+    : JSSVGElement(structure, globalObject, impl)
+{
+}
+
+JSObject* JSSVGFEMorphologyElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSSVGFEMorphologyElementPrototype(JSSVGFEMorphologyElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
+}
+
+bool JSSVGFEMorphologyElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEMorphologyElement, Base>(exec, &JSSVGFEMorphologyElementTable, this, propertyName, slot);
+}
+
+bool JSSVGFEMorphologyElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEMorphologyElement, Base>(exec, &JSSVGFEMorphologyElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGFEMorphologyElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedString> obj = imp->in1Animated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementOperator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedEnumeration> obj = imp->_operatorAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementRadiusX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedNumber> obj = imp->radiusXAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementRadiusY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedNumber> obj = imp->radiusYAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+}
+
+JSValue jsSVGFEMorphologyElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* domObject = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    return JSSVGFEMorphologyElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFEMorphologyElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFEMorphologyElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsSVGFEMorphologyElementPrototypeFunctionSetRadius(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSSVGFEMorphologyElement::s_info))
+        return throwError(exec, TypeError);
+    JSSVGFEMorphologyElement* castedThisObj = static_cast<JSSVGFEMorphologyElement*>(asObject(thisValue));
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThisObj->impl());
+    float radiusX = args.at(0).toFloat(exec);
+    float radiusY = args.at(1).toFloat(exec);
+
+    imp->setRadius(radiusX, radiusY);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsSVGFEMorphologyElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSSVGFEMorphologyElement::s_info))
+        return throwError(exec, TypeError);
+    JSSVGFEMorphologyElement* castedThisObj = static_cast<JSSVGFEMorphologyElement*>(asObject(thisValue));
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThisObj->impl());
+    const UString& name = args.at(0).toString(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getPresentationAttribute(name)));
+    return result;
+}
+
+// Constant getters
+
+JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(1));
+}
+
+JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(2));
+}
+
+
+}
+
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.h
new file mode 100644
index 0000000000..8db6463811
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.h
@@ -0,0 +1,99 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSSVGFEMorphologyElement_h
+#define JSSVGFEMorphologyElement_h
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+
+#include "JSSVGElement.h"
+#include "SVGElement.h"
+
+namespace WebCore {
+
+class SVGFEMorphologyElement;
+
+class JSSVGFEMorphologyElement : public JSSVGElement {
+    typedef JSSVGElement Base;
+public:
+    JSSVGFEMorphologyElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEMorphologyElement>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+
+class JSSVGFEMorphologyElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+    JSSVGFEMorphologyElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsSVGFEMorphologyElementPrototypeFunctionSetRadius(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEMorphologyElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsSVGFEMorphologyElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementOperator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementRadiusX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementRadiusY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+// Constants
+
+JSC::JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
index 0128ea8c65..3d7387e701 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEOffsetElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
index 89b64e931c..fa8fe77489 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFEPointLightElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
index 7ee5759056..09c903f914 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFESpecularLightingElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
index aae0f884fa..8a3a4ab325 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFESpotLightElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
index ed9d87ba45..f1e489e062 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFETileElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
index a302215017..845cdb6a3c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
@@ -106,8 +106,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGFETurbulenceElementConstructor::s_info = { "SVGFETurbulenceElementConstructor", 0, &JSSVGFETurbulenceElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
index f8c35f2f46..7d100b68eb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFETurbulenceElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
index 343c406166..9e0b45fad6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFilterElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h
index 289dc623a8..e6ce8a21d8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFontElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h
index 84cda770fa..87d2243ad8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFontFaceElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h
index 36f0094133..9ffb7b41f0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFontFaceFormatElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h
index 8504888280..1abfcbb181 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFontFaceNameElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h
index 2fb29717a8..1a154abc3d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFontFaceSrcElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h
index e58cf9d8f8..eede5c0f16 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFontFaceUriElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
index fa75e423dd..6e8121a8d2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGForeignObjectElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
index b4885f976b..7c6aa85fd2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGGElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h
index 38834f029e..05f62df802 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGGlyphElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
index 7c9b33b7a9..428601646a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
@@ -97,8 +97,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGGradientElementConstructor::s_info = { "SVGGradientElementConstructor", 0, &JSSVGGradientElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
index dbfd6e0cf0..3207003770 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGGradientElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h
index 17394ba22a..aeab2d136b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGHKernElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
index 731971881e..97bc1e1868 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGImageElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
index 0f545f8dc7..f97df8939c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
@@ -95,8 +95,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGLengthConstructor::s_info = { "SVGLengthConstructor", 0, &JSSVGLengthConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
index 25f5729410..e6c66f435b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,6 +61,8 @@ public:
 
 private:
     RefPtr<JSSVGPODTypeWrapper<SVGLength> > m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<SVGLength>*, SVGElement* context);
@@ -76,9 +78,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGLengthPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
index 7ed12cafec..bd9adda011 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
@@ -46,13 +46,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGLengthList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGLengthList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGLengthList*, SVGElement* context);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGLengthListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
index b9eeb3db32..1089b3797b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGLineElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
index e71ffe3cc2..ea2f85d6c3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGLinearGradientElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
index c712ba830b..add8265ae6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
@@ -112,8 +112,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGMarkerElementConstructor::s_info = { "SVGMarkerElementConstructor", 0, &JSSVGMarkerElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
index b70410d5cd..ca04951987 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
@@ -43,10 +43,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -60,9 +62,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGMarkerElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
index b391d02b06..042ba89f5f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGMaskElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
index 9c9ece7fec..6a9d2afc4d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -58,6 +58,8 @@ public:
 
 private:
     RefPtr<JSSVGPODTypeWrapper<TransformationMatrix> > m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<TransformationMatrix>*, SVGElement* context);
@@ -73,9 +75,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGMatrixPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h
index 0195ff634c..462b52d778 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGMetadataElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h
index d891881316..d3584bd595 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGMissingGlyphElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
index 4aaeaf96eb..cf3bc5c51e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
@@ -46,13 +46,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     JSSVGPODTypeWrapper<float> * impl() const { return m_impl.get(); }
 
 private:
     RefPtr<JSSVGPODTypeWrapper<float> > m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<float>*, SVGElement* context);
@@ -64,7 +66,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGNumberPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
index 9dd4cb2244..4a2cbfe24f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
@@ -46,13 +46,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGNumberList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGNumberList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGNumberList*, SVGElement* context);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGNumberListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
index 1f86378791..c523ddda51 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
@@ -92,8 +92,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGPaintConstructor::s_info = { "SVGPaintConstructor", 0, &JSSVGPaintConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
index 7ef72ed62f..deaa5405b7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPaintPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
index 64b0504f6d..b02974b88c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPathElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
index f31f795fff..2f1ecbd61f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
@@ -101,8 +101,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGPathSegConstructor::s_info = { "SVGPathSegConstructor", 0, &JSSVGPathSegConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
index d648d643ff..d5da3179c2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<SVGPathSeg> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGPathSeg*, SVGElement* context);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPathSegPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
index 6c99037eaa..9b7eeeca7c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegArcAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
index d6af11b287..819d791503 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegArcRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h
index a20af24a38..bccce459b9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegClosePathPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
index ac4640fd67..b1c676fc1f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoCubicAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
index 848cce154f..0e5cba95c9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoCubicRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
index a54e1669cd..478a81de9d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoCubicSmoothAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
index 8b0463fdd3..799df239e2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoCubicSmoothRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
index edb17bdddc..e29bb762ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoQuadraticAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
index 8286761fcd..d348b02d76 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoQuadraticRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
index 9ffcea7ac5..9cf156280c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
index 199fad76a7..9b2d888cdd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoQuadraticSmoothRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
index 1cdc6ffbff..bcd5ee1e29 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegLinetoAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
index b4aa488213..314570b5f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegLinetoHorizontalAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
index 004a444929..8df3aba01f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegLinetoHorizontalRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
index 8b8faa6911..f9a1c1eaf3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegLinetoRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
index 45b5ee2346..6258a0c474 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegLinetoVerticalAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
index 95230b1150..7355926a42 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegLinetoVerticalRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
index d9d7040833..120fc968c5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -62,6 +62,8 @@ public:
 
 private:
     RefPtr<SVGPathSegList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGPathSegList*, SVGElement* context);
@@ -77,9 +79,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPathSegListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
index f7781ac8b1..b81a6444ea 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegMovetoAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
index 93cec0e98c..57b606bb9a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegMovetoRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
index d1ce76a3fa..6cd8a731f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPatternElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
index 93cb8e0a1b..97ec466767 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
@@ -47,13 +47,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     JSSVGPODTypeWrapper<FloatPoint> * impl() const { return m_impl.get(); }
 
 private:
     RefPtr<JSSVGPODTypeWrapper<FloatPoint> > m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<FloatPoint>*, SVGElement* context);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPointPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
index e8b783faf1..c029a46280 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -62,6 +62,8 @@ public:
 
 private:
     RefPtr<SVGPointList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGPointList*, SVGElement* context);
@@ -77,9 +79,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPointListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
index e1cbd06e91..0eeac84a66 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPolygonElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
index 3a654d31a6..bd58c78a98 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPolylineElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
index 034531939d..0f3329c24e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
@@ -93,8 +93,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGPreserveAspectRatioConstructor::s_info = { "SVGPreserveAspectRatioConstructor", 0, &JSSVGPreserveAspectRatioConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
index 26ed465324..32f1661ea9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<SVGPreserveAspectRatio> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGPreserveAspectRatio*, SVGElement* context);
@@ -70,9 +72,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPreserveAspectRatioPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
index a284b03edd..a4c3b87639 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGRadialGradientElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
index 0a99542fba..209e365339 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
@@ -47,13 +47,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     JSSVGPODTypeWrapper<FloatRect> * impl() const { return m_impl.get(); }
 
 private:
     RefPtr<JSSVGPODTypeWrapper<FloatRect> > m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<FloatRect>*, SVGElement* context);
@@ -65,7 +67,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGRectPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
index 94b753a7e8..7572ac1a09 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGRectElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
index 7d645fd72c..b484fbfe92 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGRenderingIntentConstructor::s_info = { "SVGRenderingIntentConstructor", 0, &JSSVGRenderingIntentConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
index 4a0f363c3b..16fcff28b4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<SVGRenderingIntent> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGRenderingIntent*, SVGElement* context);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGRenderingIntentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
index 9ef7c3fe7c..91ec122dc8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGSVGElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
index 5ddcded0f5..bc4a7eb4ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGScriptElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h
index 39c660dbef..1dee3f083c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGSetElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
index 22692496fd..9dc52b24e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGStopElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
index 5299968481..b328bac095 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
@@ -46,13 +46,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGStringList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGStringList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGStringList*, SVGElement* context);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGStringListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
index 1cf73b200e..608c27831e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGStyleElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
index c1a6099bab..a91244f2ed 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGSwitchElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
index c4dc23b31e..c430257431 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGSymbolElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
index 6d24e8355b..74ab8c40f1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGTRefElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h
index 6529758bd9..cb9df9d8a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGTSpanElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
index dc8dfae4f7..31a570f792 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
@@ -108,8 +108,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGTextContentElementConstructor::s_info = { "SVGTextContentElementConstructor", 0, &JSSVGTextContentElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
index 35db44b5c8..5bbe15f3e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
@@ -43,10 +43,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -60,9 +62,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGTextContentElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
index 0f0959da4c..d605de3e1f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGTextElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
index b4f0c20be8..d9520729f9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
@@ -89,8 +89,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGTextPathElementConstructor::s_info = { "SVGTextPathElementConstructor", 0, &JSSVGTextPathElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
index ada62bfe6d..cf883be256 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGTextPathElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
index f861e89233..04d1db3765 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGTextPositioningElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
index 9972b69314..67a353d562 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGTitleElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
index 4a67764a76..82cddb625f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
@@ -89,8 +89,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGTransformConstructor::s_info = { "SVGTransformConstructor", 0, &JSSVGTransformConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
index bce97e54d8..592af87d0c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<JSSVGPODTypeWrapper<SVGTransform> > m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<SVGTransform>*, SVGElement* context);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGTransformPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
index 36ff356ca9..a8fe9e4651 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -62,6 +62,8 @@ public:
 
 private:
     RefPtr<SVGTransformList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGTransformList*, SVGElement* context);
@@ -77,9 +79,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGTransformListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
index 683398f92e..452fc9cd1b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGUnitTypesConstructor::s_info = { "SVGUnitTypesConstructor", 0, &JSSVGUnitTypesConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
index 4d92f84e89..0c20046462 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<SVGUnitTypes> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGUnitTypes*, SVGElement* context);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGUnitTypesPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
index 2c9f142d1a..c5665c0c03 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGUseElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
index bfeda85fcc..db1533f101 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGViewElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
index b3a34c608a..19bd2e74e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGZoomEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSScreen.h b/src/3rdparty/webkit/WebCore/generated/JSScreen.h
index 7a54e9c571..01a45453df 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSScreen.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSScreen.h
@@ -43,13 +43,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     Screen* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Screen> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Screen*);
@@ -61,7 +63,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSScreenPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.h b/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.h
index a622e8349e..55d5f4faa7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -51,6 +51,8 @@ public:
     {
         return static_cast<SharedWorker*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SharedWorker*);
@@ -64,9 +66,11 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSharedWorkerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.h
index 21543e5d4d..65cfadab64 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.h
@@ -42,13 +42,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SharedWorkerContext* impl() const
     {
         return static_cast<SharedWorkerContext*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 SharedWorkerContext* toSharedWorkerContext(JSC::JSValue);
@@ -59,7 +61,13 @@ public:
     void* operator new(size_t, JSC::JSGlobalData*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSharedWorkerContextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp b/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
index 54f6c7d529..998b8cf979 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSStorageConstructor::s_info = { "StorageConstructor", 0, &JSStorageConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorage.h b/src/3rdparty/webkit/WebCore/generated/JSStorage.h
index 1d15472feb..e2dea63c56 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorage.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorage.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
@@ -57,6 +57,8 @@ public:
 
 private:
     RefPtr<Storage> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
     static bool canGetItemsForName(JSC::ExecState*, Storage*, const JSC::Identifier&);
     static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -75,9 +77,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSStoragePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
index f467736937..bc8468ca2f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
@@ -24,8 +24,6 @@
 
 #include "JSStorageEvent.h"
 
-#include "DOMWindow.h"
-#include "JSDOMWindow.h"
 #include "JSStorage.h"
 #include "KURL.h"
 #include "Storage.h"
@@ -42,13 +40,12 @@ ASSERT_CLASS_FITS_IN_CELL(JSStorageEvent);
 
 /* Hash table */
 
-static const HashTableValue JSStorageEventTableValues[8] =
+static const HashTableValue JSStorageEventTableValues[7] =
 {
     { "key", DontDelete|ReadOnly, (intptr_t)jsStorageEventKey, (intptr_t)0 },
     { "oldValue", DontDelete|ReadOnly, (intptr_t)jsStorageEventOldValue, (intptr_t)0 },
     { "newValue", DontDelete|ReadOnly, (intptr_t)jsStorageEventNewValue, (intptr_t)0 },
     { "uri", DontDelete|ReadOnly, (intptr_t)jsStorageEventUri, (intptr_t)0 },
-    { "source", DontDelete|ReadOnly, (intptr_t)jsStorageEventSource, (intptr_t)0 },
     { "storageArea", DontDelete|ReadOnly, (intptr_t)jsStorageEventStorageArea, (intptr_t)0 },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsStorageEventConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
@@ -89,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSStorageEventConstructor::s_info = { "StorageEventConstructor", 0, &JSStorageEventConstructorTable, 0 };
@@ -109,7 +109,7 @@ bool JSStorageEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSStorageEventPrototypeTableValues[2] =
 {
-    { "initStorageEvent", DontDelete|Function, (intptr_t)jsStorageEventPrototypeFunctionInitStorageEvent, (intptr_t)9 },
+    { "initStorageEvent", DontDelete|Function, (intptr_t)jsStorageEventPrototypeFunctionInitStorageEvent, (intptr_t)8 },
     { 0, 0, 0, 0 }
 };
 
@@ -191,14 +191,6 @@ JSValue jsStorageEventUri(ExecState* exec, const Identifier&, const PropertySlot
     return jsString(exec, imp->uri());
 }
 
-JSValue jsStorageEventSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSStorageEvent* castedThis = static_cast<JSStorageEvent*>(asObject(slot.slotBase()));
-    UNUSED_PARAM(exec);
-    StorageEvent* imp = static_cast<StorageEvent*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->source()));
-}
-
 JSValue jsStorageEventStorageArea(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSStorageEvent* castedThis = static_cast<JSStorageEvent*>(asObject(slot.slotBase()));
@@ -231,10 +223,9 @@ JSValue JSC_HOST_CALL jsStorageEventPrototypeFunctionInitStorageEvent(ExecState*
     const UString& oldValueArg = valueToStringWithNullCheck(exec, args.at(4));
     const UString& newValueArg = valueToStringWithNullCheck(exec, args.at(5));
     const UString& uriArg = args.at(6).toString(exec);
-    DOMWindow* sourceArg = toDOMWindow(args.at(7));
-    Storage* storageAreaArg = toStorage(args.at(8));
+    Storage* storageAreaArg = toStorage(args.at(7));
 
-    imp->initStorageEvent(typeArg, canBubbleArg, cancelableArg, keyArg, oldValueArg, newValueArg, uriArg, sourceArg, storageAreaArg);
+    imp->initStorageEvent(typeArg, canBubbleArg, cancelableArg, keyArg, oldValueArg, newValueArg, uriArg, storageAreaArg);
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
index bfd8a6789e..a9552c1ac8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
@@ -41,10 +41,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSStorageEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -72,7 +76,6 @@ JSC::JSValue jsStorageEventKey(JSC::ExecState*, const JSC::Identifier&, const JS
 JSC::JSValue jsStorageEventOldValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsStorageEventNewValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsStorageEventUri(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsStorageEventSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsStorageEventStorageArea(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsStorageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
index bfa30f45c1..ae7011dd70 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSStyleSheetConstructor::s_info = { "StyleSheetConstructor", 0, &JSStyleSheetConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
index 6c679552ea..cfdd964912 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<StyleSheet> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, StyleSheet*);
@@ -67,9 +69,11 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSStyleSheetPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
index aa1d6bd937..5d07cc13a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSStyleSheetListConstructor::s_info = { "StyleSheetListConstructor", 0, &JSStyleSheetListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
index 757b8ad1dd..7b518aaf54 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<StyleSheetList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, StyleSheetList*, const JSC::Identifier&);
@@ -74,9 +76,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSStyleSheetListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSText.cpp b/src/3rdparty/webkit/WebCore/generated/JSText.cpp
index d90e3f2e64..62ba04b552 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSText.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSText.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSTextConstructor::s_info = { "TextConstructor", 0, &JSTextConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSText.h b/src/3rdparty/webkit/WebCore/generated/JSText.h
index dc31f61481..2c53691201 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSText.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSText.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJSNewlyCreated(JSC::ExecState*, JSDOMGlobalObject*, Text*);
@@ -57,9 +59,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSTextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
index 3ddab29c7c..3a5c4d9a46 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSTextEventConstructor::s_info = { "TextEventConstructor", 0, &JSTextEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
index 19e77ce5c9..576d55eba1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSTextEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
index b267f765c6..627ad3b8d0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
@@ -75,8 +75,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSTextMetricsConstructor::s_info = { "TextMetricsConstructor", 0, &JSTextMetricsConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
index 9e3968a2dd..9cf013f856 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<TextMetrics> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, TextMetrics*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSTextMetricsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
index 0db2dffd61..201df069d7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     TimeRanges* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<TimeRanges> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, TimeRanges*);
@@ -67,9 +69,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSTimeRangesPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
index fe72cad9f5..a26425efe5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
@@ -84,8 +84,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSTreeWalkerConstructor::s_info = { "TreeWalkerConstructor", 0, &JSTreeWalkerConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
index 091bdd0329..3daf9e8dfc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -63,6 +63,8 @@ public:
 
 private:
     RefPtr<TreeWalker> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, TreeWalker*);
@@ -78,9 +80,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSTreeWalkerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
index 236845ef38..1aa2963071 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSUIEventConstructor::s_info = { "UIEventConstructor", 0, &JSUIEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
index b9658a4418..19f8ed280c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSUIEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSValidityState.h b/src/3rdparty/webkit/WebCore/generated/JSValidityState.h
index 760480cac4..ece04591f1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSValidityState.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSValidityState.h
@@ -43,13 +43,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     ValidityState* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<ValidityState> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, ValidityState*);
@@ -61,7 +63,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSValidityStatePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
index 9b82bb24b0..da043af47f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
@@ -39,10 +39,17 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
     VoidCallback* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<VoidCallback> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, VoidCallback*);
@@ -58,9 +65,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSVoidCallbackPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
index 9dbd39616c..e5a38924d2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSWebKitAnimationEventConstructor::s_info = { "WebKitAnimationEventConstructor", 0, &JSWebKitAnimationEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
index 1631bad33b..e4e622a0a6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWebKitAnimationEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
index cb7a615fac..e801d631c4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSWebKitCSSKeyframeRuleConstructor::s_info = { "WebKitCSSKeyframeRuleConstructor", 0, &JSWebKitCSSKeyframeRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
index 5fea55dcca..98289d4af6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSWebKitCSSKeyframeRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
index 5538ba7ac7..6ea3237c44 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSWebKitCSSKeyframesRuleConstructor::s_info = { "WebKitCSSKeyframesRuleConstructor", 0, &JSWebKitCSSKeyframesRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
index 73d10cf1f5..e76ba2a4d6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
@@ -41,11 +41,13 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
@@ -60,9 +62,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWebKitCSSKeyframesRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
index 83c2c3d4fe..3823098703 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     WebKitCSSMatrix* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<WebKitCSSMatrix> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebKitCSSMatrix*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWebKitCSSMatrixPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
index 0c2fa6c1df..b62daea4d1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
@@ -96,8 +96,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSWebKitCSSTransformValueConstructor::s_info = { "WebKitCSSTransformValueConstructor", 0, &JSWebKitCSSTransformValueConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
index 6fc7d2aec8..bb819bbd58 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWebKitCSSTransformValuePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
index 885040d64c..319980d602 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     WebKitPoint* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<WebKitPoint> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebKitPoint*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSWebKitPointPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
index b4c83b476a..20066f7927 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSWebKitTransitionEventConstructor::s_info = { "WebKitTransitionEventConstructor", 0, &JSWebKitTransitionEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
index e649dc42a0..015574c92f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWebKitTransitionEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp
index 44fa9607fd..ea8ff3d05d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp
@@ -24,9 +24,11 @@
 
 #include "JSWebSocket.h"
 
+#include "Event.h"
 #include "EventListener.h"
 #include "Frame.h"
 #include "JSDOMGlobalObject.h"
+#include "JSEvent.h"
 #include "JSEventListener.h"
 #include "KURL.h"
 #include "RegisteredEventListener.h"
@@ -64,13 +66,16 @@ static JSC_CONST_HASHTABLE HashTable JSWebSocketTable =
 
 /* Hash table for prototype */
 
-static const HashTableValue JSWebSocketPrototypeTableValues[6] =
+static const HashTableValue JSWebSocketPrototypeTableValues[9] =
 {
     { "CONNECTING", DontDelete|ReadOnly, (intptr_t)jsWebSocketCONNECTING, (intptr_t)0 },
     { "OPEN", DontDelete|ReadOnly, (intptr_t)jsWebSocketOPEN, (intptr_t)0 },
     { "CLOSED", DontDelete|ReadOnly, (intptr_t)jsWebSocketCLOSED, (intptr_t)0 },
     { "send", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionSend, (intptr_t)1 },
     { "close", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionClose, (intptr_t)0 },
+    { "addEventListener", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionAddEventListener, (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionRemoveEventListener, (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionDispatchEvent, (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -257,6 +262,40 @@ JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionClose(ExecState* exec, JSObjec
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebSocket::s_info))
+        return throwError(exec, TypeError);
+    JSWebSocket* castedThisObj = static_cast<JSWebSocket*>(asObject(thisValue));
+    return castedThisObj->addEventListener(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebSocket::s_info))
+        return throwError(exec, TypeError);
+    JSWebSocket* castedThisObj = static_cast<JSWebSocket*>(asObject(thisValue));
+    return castedThisObj->removeEventListener(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebSocket::s_info))
+        return throwError(exec, TypeError);
+    JSWebSocket* castedThisObj = static_cast<JSWebSocket*>(asObject(thisValue));
+    WebSocket* imp = static_cast<WebSocket*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    Event* evt = toEvent(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
+    setDOMException(exec, ec);
+    return result;
+}
+
 // Constant getters
 
 JSValue jsWebSocketCONNECTING(ExecState* exec, const Identifier&, const PropertySlot&)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.h b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.h
index 0632872d96..942821269a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -54,10 +54,14 @@ public:
 
     // Custom functions
     JSC::JSValue send(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     WebSocket* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<WebSocket> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebSocket*);
@@ -73,15 +77,20 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWebSocketPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
 
 JSC::JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionSend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
 JSC::JSValue jsWebSocketURL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
index e60e32cc2b..589f570787 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
@@ -89,8 +89,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSWheelEventConstructor::s_info = { "WheelEventConstructor", 0, &JSWheelEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
index ae8aa6a790..6901d9379b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSWheelEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorker.h b/src/3rdparty/webkit/WebCore/generated/JSWorker.h
index 3aa7221bf3..28f2e38996 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorker.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<Worker*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Worker*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWorkerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
index 37d6c87435..f44ba01594 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -61,6 +61,8 @@ public:
     JSC::JSValue setInterval(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -74,9 +76,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWorkerContextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
index 7b634ae853..e24d0d6c87 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
@@ -87,8 +87,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSWorkerLocationConstructor::s_info = { "WorkerLocationConstructor", 0, &JSWorkerLocationConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
index 0002c4c9cb..e7d8062a94 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<WorkerLocation> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WorkerLocation*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWorkerLocationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
index 92e009490e..f459679e64 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     WorkerNavigator* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<WorkerNavigator> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WorkerNavigator*);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSWorkerNavigatorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
index 0582f1e37c..5c05753ef1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -65,6 +65,8 @@ public:
 
 private:
     RefPtr<XMLHttpRequest> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XMLHttpRequest*);
@@ -80,9 +82,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXMLHttpRequestPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
index 45908b30f9..30e0d726cf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSXMLHttpRequestExceptionConstructor::s_info = { "XMLHttpRequestExceptionConstructor", 0, &JSXMLHttpRequestExceptionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
index f04fdf5865..54dcfde319 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<XMLHttpRequestException> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XMLHttpRequestException*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXMLHttpRequestExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
index 4baf3f1573..6343a1b7ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSXMLHttpRequestProgressEventConstructor::s_info = { "XMLHttpRequestProgressEventConstructor", 0, &JSXMLHttpRequestProgressEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
index f12a9066cf..6486dd7591 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSXMLHttpRequestProgressEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
index 8c447091a6..bc5fff94a3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSXMLHttpRequestUploadConstructor::s_info = { "XMLHttpRequestUploadConstructor", 0, &JSXMLHttpRequestUploadConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
index fdf98acead..a613e6d487 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -58,6 +58,8 @@ public:
 
 private:
     RefPtr<XMLHttpRequestUpload> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XMLHttpRequestUpload*);
@@ -73,9 +75,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXMLHttpRequestUploadPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
index 1dcfc94bff..e6cdd6bcda 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
     static JSObject* constructXMLSerializer(ExecState* exec, JSObject* constructor, const ArgList&)
     {
         return asObject(toJS(exec, static_cast<JSXMLSerializerConstructor*>(constructor)->globalObject(), XMLSerializer::create()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
index e8b08c8d82..fd50d5d18e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<XMLSerializer> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XMLSerializer*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXMLSerializerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
index 4ce95caa16..e25be26a44 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
     static JSObject* constructXPathEvaluator(ExecState* exec, JSObject* constructor, const ArgList&)
     {
         return asObject(toJS(exec, static_cast<JSXPathEvaluatorConstructor*>(constructor)->globalObject(), XPathEvaluator::create()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
index 997f06672f..9b374658c5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<XPathEvaluator> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XPathEvaluator*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXPathEvaluatorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
index 7911fad567..3894ac2795 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
@@ -85,8 +85,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSXPathExceptionConstructor::s_info = { "XPathExceptionConstructor", 0, &JSXPathExceptionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathException.h b/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
index a33d9a10a6..f73ba8853a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<XPathException> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XPathException*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXPathExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
index d5531e5d61..9464146e6b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSXPathExpressionConstructor::s_info = { "XPathExpressionConstructor", 0, &JSXPathExpressionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
index a3b2bd1880..f5fd0dcac3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<XPathExpression> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XPathExpression*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXPathExpressionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
index 3e28973791..86ce543a86 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
@@ -41,10 +41,17 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
     XPathNSResolver* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XPathNSResolver> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XPathNSResolver*);
@@ -60,9 +67,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXPathNSResolverPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
index 82387c6e62..337f473f80 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
@@ -99,8 +99,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSXPathResultConstructor::s_info = { "XPathResultConstructor", 0, &JSXPathResultConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
index 4c5a4672cf..a8db49eb7e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<XPathResult> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XPathResult*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXPathResultPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h
index b9c061c6cc..821dca796f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h
@@ -41,6 +41,11 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
 
     // Custom functions
     JSC::JSValue importStylesheet(JSC::ExecState*, const JSC::ArgList&);
@@ -53,6 +58,8 @@ public:
 
 private:
     RefPtr<XSLTProcessor> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XSLTProcessor*);
@@ -68,9 +75,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXSLTProcessorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h b/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h
index bbbd75e348..2d411d2fd6 100644
--- a/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h
@@ -4,7 +4,7 @@
 
 namespace JSC {
 
-static const struct HashTableValue stringTableValues[33] = {
+static const struct HashTableValue stringTableValues[36] = {
    { "toString", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
    { "valueOf", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
    { "charAt", DontEnum|Function, (intptr_t)stringProtoFuncCharAt, (intptr_t)1 },
@@ -37,9 +37,12 @@ static const struct HashTableValue stringTableValues[33] = {
    { "fontsize", DontEnum|Function, (intptr_t)stringProtoFuncFontsize, (intptr_t)1 },
    { "anchor", DontEnum|Function, (intptr_t)stringProtoFuncAnchor, (intptr_t)1 },
    { "link", DontEnum|Function, (intptr_t)stringProtoFuncLink, (intptr_t)1 },
+   { "trim", DontEnum|Function, (intptr_t)stringProtoFuncTrim, (intptr_t)0 },
+   { "trimLeft", DontEnum|Function, (intptr_t)stringProtoFuncTrimLeft, (intptr_t)0 },
+   { "trimRight", DontEnum|Function, (intptr_t)stringProtoFuncTrimRight, (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
 extern JSC_CONST_HASHTABLE HashTable stringTable =
-    { 71, 63, stringTableValues, 0 };
+    { 133, 127, stringTableValues, 0 };
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
index 6f0af232d9..d7f1f85386 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
@@ -1,8 +1,9 @@
 namespace WebCore {
-extern const char htmlUserAgentStyleSheet[8636];
+extern const char htmlUserAgentStyleSheet[8729];
 extern const char quirksUserAgentStyleSheet[359];
 extern const char svgUserAgentStyleSheet[358];
 extern const char sourceUserAgentStyleSheet[2004];
 extern const char wmlUserAgentStyleSheet[3039];
 extern const char mediaControlsUserAgentStyleSheet[2582];
+extern const char mediaControlsQtUserAgentStyleSheet[2249];
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
index 8b8d7f3678..7a18470677 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
@@ -1,5 +1,5 @@
 namespace WebCore {
-extern const char htmlUserAgentStyleSheet[8636] = {
+extern const char htmlUserAgentStyleSheet[8729] = {
     110, 97, 109, 101, 115, 112, 97, 99, 101, 32, 34, 104, 116, 116, 112, 58,
     47, 47, 119, 119, 119, 46, 119, 51, 46, 111, 114, 103, 47, 49, 57, 57,
     57, 47, 120, 104, 116, 109, 108, 34, 59, 32, 104, 116, 109, 108, 32, 123,
@@ -244,302 +244,308 @@ extern const char htmlUserAgentStyleSheet[8636] = {
     101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102,
     105, 101, 108, 100, 45, 114, 101, 115, 117, 108, 116, 115, 45, 98, 117, 116,
     116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110,
-    108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 116, 101,
-    120, 116, 97, 114, 101, 97, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 116, 101, 120,
-    116, 97, 114, 101, 97, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110,
-    100, 45, 99, 111, 108, 111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32,
-    98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105,
-    100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111,
-    114, 100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108,
-    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115,
-    101, 108, 101, 99, 116, 58, 32, 116, 101, 120, 116, 59, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 98, 111, 120, 45, 111, 114, 105, 101, 110, 116, 58,
-    32, 118, 101, 114, 116, 105, 99, 97, 108, 59, 32, 114, 101, 115, 105, 122,
-    101, 58, 32, 97, 117, 116, 111, 59, 32, 99, 117, 114, 115, 111, 114, 58,
-    32, 97, 117, 116, 111, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32,
-    50, 112, 120, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101,
-    58, 32, 112, 114, 101, 45, 119, 114, 97, 112, 59, 32, 119, 111, 114, 100,
-    45, 119, 114, 97, 112, 58, 32, 98, 114, 101, 97, 107, 45, 119, 111, 114,
-    100, 59, 32, 125, 32, 105, 110, 112, 117, 116, 58, 58, 45, 119, 101, 98,
-    107, 105, 116, 45, 105, 110, 112, 117, 116, 45, 112, 108, 97, 99, 101, 104,
-    111, 108, 100, 101, 114, 44, 32, 105, 115, 105, 110, 100, 101, 120, 58, 58,
-    45, 119, 101, 98, 107, 105, 116, 45, 105, 110, 112, 117, 116, 45, 112, 108,
-    97, 99, 101, 104, 111, 108, 100, 101, 114, 44, 32, 116, 101, 120, 116, 97,
-    114, 101, 97, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 105, 110, 112,
-    117, 116, 45, 112, 108, 97, 99, 101, 104, 111, 108, 100, 101, 114, 32, 123,
-    32, 99, 111, 108, 111, 114, 58, 32, 100, 97, 114, 107, 71, 114, 97, 121,
-    59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    112, 97, 115, 115, 119, 111, 114, 100, 34, 93, 32, 123, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 116, 101, 120, 116, 45, 115, 101, 99, 117, 114, 105,
-    116, 121, 58, 32, 100, 105, 115, 99, 32, 33, 105, 109, 112, 111, 114, 116,
-    97, 110, 116, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 104, 105, 100, 100, 101, 110, 34, 93, 44, 32, 105, 110, 112,
-    117, 116, 91, 116, 121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93,
-    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105,
-    108, 101, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
-    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 105, 110, 105, 116, 105,
-    97, 108, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105,
-    116, 105, 97, 108, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100,
-    45, 99, 111, 108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59,
-    32, 98, 111, 114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108,
+    108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 105, 110,
+    112, 117, 116, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 105, 110, 112,
+    117, 116, 45, 108, 105, 115, 116, 45, 98, 117, 116, 116, 111, 110, 32, 123,
+    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
+    110, 99, 101, 58, 32, 108, 105, 115, 116, 45, 98, 117, 116, 116, 111, 110,
+    59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110,
+    101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 116, 101, 120, 116, 97,
+    114, 101, 97, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112,
+    112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 116, 101, 120, 116, 97, 114,
+    101, 97, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99,
+    111, 108, 111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32, 98, 111, 114,
+    100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32,
+    45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101,
+    114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108, 101,
+    99, 116, 58, 32, 116, 101, 120, 116, 59, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 98, 111, 120, 45, 111, 114, 105, 101, 110, 116, 58, 32, 118, 101,
+    114, 116, 105, 99, 97, 108, 59, 32, 114, 101, 115, 105, 122, 101, 58, 32,
+    97, 117, 116, 111, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117,
+    116, 111, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 50, 112, 120,
+    59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112,
+    114, 101, 45, 119, 114, 97, 112, 59, 32, 119, 111, 114, 100, 45, 119, 114,
+    97, 112, 58, 32, 98, 114, 101, 97, 107, 45, 119, 111, 114, 100, 59, 32,
+    125, 32, 105, 110, 112, 117, 116, 58, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 105, 110, 112, 117, 116, 45, 112, 108, 97, 99, 101, 104, 111, 108, 100,
+    101, 114, 44, 32, 105, 115, 105, 110, 100, 101, 120, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 105, 110, 112, 117, 116, 45, 112, 108, 97, 99, 101,
+    104, 111, 108, 100, 101, 114, 44, 32, 116, 101, 120, 116, 97, 114, 101, 97,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 105, 110, 112, 117, 116, 45,
+    112, 108, 97, 99, 101, 104, 111, 108, 100, 101, 114, 32, 123, 32, 99, 111,
+    108, 111, 114, 58, 32, 100, 97, 114, 107, 71, 114, 97, 121, 59, 32, 125,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 112, 97, 115,
+    115, 119, 111, 114, 100, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 116, 101, 120, 116, 45, 115, 101, 99, 117, 114, 105, 116, 121, 58,
+    32, 100, 105, 115, 99, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116,
     59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    102, 105, 108, 101, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 98, 97, 115, 101,
-    108, 105, 110, 101, 59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110,
-    58, 32, 115, 116, 97, 114, 116, 32, 33, 105, 109, 112, 111, 114, 116, 97,
-    110, 116, 59, 32, 125, 32, 105, 110, 112, 117, 116, 58, 45, 119, 101, 98,
-    107, 105, 116, 45, 97, 117, 116, 111, 102, 105, 108, 108, 32, 123, 32, 98,
+    104, 105, 100, 100, 101, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93, 44, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34,
+    93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59,
+    32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116, 105, 97,
+    108, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111,
+    108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 111,
+    114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 125,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108,
+    101, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
+    120, 45, 97, 108, 105, 103, 110, 58, 32, 98, 97, 115, 101, 108, 105, 110,
+    101, 59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 115,
+    116, 97, 114, 116, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59,
+    32, 125, 32, 105, 110, 112, 117, 116, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 97, 117, 116, 111, 102, 105, 108, 108, 32, 123, 32, 98, 97, 99, 107,
+    103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 98, 97,
+    99, 107, 103, 114, 111, 117, 110, 100, 45, 105, 109, 97, 103, 101, 58, 110,
+    111, 110, 101, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32,
+    125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97,
+    100, 105, 111, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 32, 123, 32,
+    109, 97, 114, 103, 105, 110, 58, 32, 51, 112, 120, 32, 48, 46, 53, 101,
+    120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116,
+    105, 97, 108, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45,
+    99, 111, 108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32,
+    98, 111, 114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59,
+    32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98,
+    117, 116, 116, 111, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116,
+    121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 44, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116,
+    34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    102, 105, 108, 101, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
+    102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116,
+    111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112,
+    101, 97, 114, 97, 110, 99, 101, 58, 32, 112, 117, 115, 104, 45, 98, 117,
+    116, 116, 111, 110, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99,
+    101, 58, 32, 112, 114, 101, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116,
+    121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 44, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105,
+    116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
+    34, 114, 101, 115, 101, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 58, 45, 119,
+    101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97,
+    100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110,
+    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97,
+    108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 116, 101,
+    120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114,
+    59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97, 117, 108,
+    116, 59, 32, 99, 111, 108, 111, 114, 58, 32, 66, 117, 116, 116, 111, 110,
+    84, 101, 120, 116, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 50,
+    112, 120, 32, 54, 112, 120, 32, 51, 112, 120, 32, 54, 112, 120, 59, 32,
+    98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 111, 117, 116, 115,
+    101, 116, 32, 66, 117, 116, 116, 111, 110, 70, 97, 99, 101, 59, 32, 98,
     97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58,
-    32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 105, 109, 97, 103,
-    101, 58, 110, 111, 110, 101, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110,
-    116, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
-    34, 114, 97, 100, 105, 111, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93,
-    32, 123, 32, 109, 97, 114, 103, 105, 110, 58, 32, 51, 112, 120, 32, 48,
-    46, 53, 101, 120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105,
-    110, 105, 116, 105, 97, 108, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117,
-    110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97,
-    108, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105,
-    97, 108, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 44, 32, 105, 110, 112, 117,
-    116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93,
-    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101,
-    115, 101, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 58, 45, 119, 101, 98, 107,
-    105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98,
-    117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45,
-    97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 112, 117, 115, 104,
-    45, 98, 117, 116, 116, 111, 110, 59, 32, 119, 104, 105, 116, 101, 45, 115,
-    112, 97, 99, 101, 58, 32, 112, 114, 101, 32, 125, 32, 105, 110, 112, 117,
+    32, 66, 117, 116, 116, 111, 110, 70, 97, 99, 101, 59, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58,
+    32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 32, 125, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 110, 103, 101, 34,
+    93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 115, 108, 105, 100, 101, 114, 45, 104,
+    111, 114, 105, 122, 111, 110, 116, 97, 108, 59, 32, 112, 97, 100, 100, 105,
+    110, 103, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 111, 114,
+    100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 109, 97,
+    114, 103, 105, 110, 58, 32, 50, 112, 120, 59, 32, 125, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 110, 103, 101, 34, 93,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115, 108, 105, 100, 101, 114,
+    45, 116, 104, 117, 109, 98, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 108, 105,
+    100, 101, 114, 116, 104, 117, 109, 98, 45, 104, 111, 114, 105, 122, 111, 110,
+    116, 97, 108, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 100, 105, 115, 97,
+    98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
+    61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 100, 105, 115, 97, 98,
+    108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
+    34, 114, 101, 115, 101, 116, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101,
+    100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102,
+    105, 108, 101, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108,
+    111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116,
+    111, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 115, 101, 108,
+    101, 99, 116, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 107, 101,
+    121, 103, 101, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 111,
+    112, 116, 103, 114, 111, 117, 112, 58, 100, 105, 115, 97, 98, 108, 101, 100,
+    44, 32, 111, 112, 116, 105, 111, 110, 58, 100, 105, 115, 97, 98, 108, 101,
+    100, 44, 32, 100, 97, 116, 97, 103, 114, 105, 100, 58, 100, 105, 115, 97,
+    98, 108, 101, 100, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 71, 114,
+    97, 121, 84, 101, 120, 116, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116,
+    121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 97, 99,
+    116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
+    61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 97, 99, 116, 105, 118,
+    101, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114,
+    101, 115, 101, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34,
+    93, 58, 97, 99, 116, 105, 118, 101, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117,
+    116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58, 97, 99, 116,
+    105, 118, 101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 115, 116, 121,
+    108, 101, 58, 32, 105, 110, 115, 101, 116, 32, 125, 32, 105, 110, 112, 117,
     116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93,
+    58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100,
     44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117,
-    98, 109, 105, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
-    112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 44, 32, 105, 110, 112,
+    98, 109, 105, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105,
+    115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 58, 97, 99, 116, 105,
+    118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112,
     117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58,
+    97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 58,
     58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112,
     108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116,
-    116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
-    120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59,
-    32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110,
-    116, 101, 114, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102,
-    97, 117, 108, 116, 59, 32, 99, 111, 108, 111, 114, 58, 32, 66, 117, 116,
-    116, 111, 110, 84, 101, 120, 116, 59, 32, 112, 97, 100, 100, 105, 110, 103,
-    58, 32, 50, 112, 120, 32, 54, 112, 120, 32, 51, 112, 120, 32, 54, 112,
-    120, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 111,
-    117, 116, 115, 101, 116, 32, 66, 117, 116, 116, 111, 110, 70, 97, 99, 101,
-    59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108,
-    111, 114, 58, 32, 66, 117, 116, 116, 111, 110, 70, 97, 99, 101, 59, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105,
-    110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 32, 125,
-    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 110,
-    103, 101, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
-    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 108, 105, 100, 101,
-    114, 45, 104, 111, 114, 105, 122, 111, 110, 116, 97, 108, 59, 32, 112, 97,
-    100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32,
-    98, 111, 114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59,
-    32, 109, 97, 114, 103, 105, 110, 58, 32, 50, 112, 120, 59, 32, 125, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 110, 103,
-    101, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115, 108, 105,
-    100, 101, 114, 45, 116, 104, 117, 109, 98, 32, 123, 32, 45, 119, 101, 98,
-    107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32,
-    115, 108, 105, 100, 101, 114, 116, 104, 117, 109, 98, 45, 104, 111, 114, 105,
-    122, 111, 110, 116, 97, 108, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 100,
-    105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 100, 105,
-    115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
-    112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 58, 100, 105, 115, 97,
-    98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 102, 105, 108, 101, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101,
-    100, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45,
-    117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98,
-    117, 116, 116, 111, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32,
-    115, 101, 108, 101, 99, 116, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44,
-    32, 107, 101, 121, 103, 101, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100,
-    44, 32, 111, 112, 116, 103, 114, 111, 117, 112, 58, 100, 105, 115, 97, 98,
-    108, 101, 100, 44, 32, 111, 112, 116, 105, 111, 110, 58, 100, 105, 115, 97,
-    98, 108, 101, 100, 44, 32, 100, 97, 116, 97, 103, 114, 105, 100, 58, 100,
-    105, 115, 97, 98, 108, 101, 100, 32, 123, 32, 99, 111, 108, 111, 114, 58,
-    32, 71, 114, 97, 121, 84, 101, 120, 116, 32, 125, 32, 105, 110, 112, 117,
-    116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93,
-    58, 97, 99, 116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 97, 99,
-    116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 114, 101, 115, 101, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101,
-    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105,
-    108, 101, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 58, 45, 119, 101,
-    98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100,
-    45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58,
-    97, 99, 116, 105, 118, 101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45,
-    115, 116, 121, 108, 101, 58, 32, 105, 110, 115, 101, 116, 32, 125, 32, 105,
-    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111,
-    110, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98,
-    108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
-    34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101,
-    58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116,
-    91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 58, 97,
-    99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101,
-    34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108,
-    101, 100, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101,
-    45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32,
-    98, 117, 116, 116, 111, 110, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105,
-    115, 97, 98, 108, 101, 100, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45,
-    115, 116, 121, 108, 101, 58, 32, 111, 117, 116, 115, 101, 116, 32, 125, 32,
-    97, 114, 101, 97, 44, 32, 112, 97, 114, 97, 109, 32, 123, 32, 100, 105,
-    115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 99, 104, 101, 99, 107, 98,
-    111, 120, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
-    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 99, 104, 101, 99, 107,
-    98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120,
+    116, 111, 110, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98,
+    108, 101, 100, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 115, 116, 121,
+    108, 101, 58, 32, 111, 117, 116, 115, 101, 116, 32, 125, 32, 97, 114, 101,
+    97, 44, 32, 112, 97, 114, 97, 109, 32, 123, 32, 100, 105, 115, 112, 108,
+    97, 121, 58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34,
+    93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 99, 104, 101, 99, 107, 98, 111, 120,
+    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105,
+    122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120,
+    59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    114, 97, 100, 105, 111, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 114, 97,
+    100, 105, 111, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120,
     45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45,
-    98, 111, 120, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 114, 97, 100, 105, 111, 34, 93, 32, 123, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58,
-    32, 114, 97, 100, 105, 111, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45,
-    98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100,
-    101, 114, 45, 98, 111, 120, 59, 32, 125, 32, 107, 101, 121, 103, 101, 110,
-    44, 32, 115, 101, 108, 101, 99, 116, 32, 123, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109,
-    101, 110, 117, 108, 105, 115, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114,
-    100, 101, 114, 45, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116,
-    101, 114, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32,
-    115, 111, 108, 105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98,
-    111, 114, 100, 101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 53, 112,
-    120, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32,
-    112, 114, 101, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108,
-    45, 111, 114, 100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99,
-    97, 108, 59, 32, 99, 111, 108, 111, 114, 58, 32, 98, 108, 97, 99, 107,
-    59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108,
-    111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32, 99, 117, 114, 115, 111,
-    114, 58, 32, 100, 101, 102, 97, 117, 108, 116, 59, 32, 125, 32, 115, 101,
-    108, 101, 99, 116, 91, 115, 105, 122, 101, 93, 44, 32, 115, 101, 108, 101,
-    99, 116, 91, 109, 117, 108, 116, 105, 112, 108, 101, 93, 44, 32, 115, 101,
-    108, 101, 99, 116, 91, 115, 105, 122, 101, 93, 91, 109, 117, 108, 116, 105,
-    112, 108, 101, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
-    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 108, 105, 115, 116, 98,
-    111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45,
-    97, 108, 105, 103, 110, 58, 32, 115, 116, 97, 114, 116, 59, 32, 98, 111,
-    114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 105, 110, 115, 101, 116, 32,
-    103, 114, 97, 121, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
-    114, 100, 101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 105, 110, 105,
-    116, 105, 97, 108, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99,
-    101, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 115, 101,
-    108, 101, 99, 116, 91, 115, 105, 122, 101, 61, 34, 48, 34, 93, 44, 32,
-    115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101, 61, 34, 49, 34, 93,
-    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97,
-    114, 97, 110, 99, 101, 58, 32, 109, 101, 110, 117, 108, 105, 115, 116, 59,
+    98, 111, 120, 59, 32, 125, 32, 107, 101, 121, 103, 101, 110, 44, 32, 115,
+    101, 108, 101, 99, 116, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45,
+    97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 110, 117,
+    108, 105, 115, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
+    120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114,
+    45, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
+    120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59,
+    32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108,
+    105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 114, 100,
+    101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 53, 112, 120, 59, 32,
+    119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101,
+    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114,
+    100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59,
+    32, 99, 111, 108, 111, 114, 58, 32, 98, 108, 97, 99, 107, 59, 32, 98,
+    97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58,
+    32, 119, 104, 105, 116, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32,
+    100, 101, 102, 97, 117, 108, 116, 59, 32, 125, 32, 115, 101, 108, 101, 99,
+    116, 91, 115, 105, 122, 101, 93, 44, 32, 115, 101, 108, 101, 99, 116, 91,
+    109, 117, 108, 116, 105, 112, 108, 101, 93, 44, 32, 115, 101, 108, 101, 99,
+    116, 91, 115, 105, 122, 101, 93, 91, 109, 117, 108, 116, 105, 112, 108, 101,
+    93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 108, 105, 115, 116, 98, 111, 120, 59,
     32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105,
-    103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 98, 111, 114, 100,
-    101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32, 45,
-    119, 101, 98, 107, 105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97,
-    100, 105, 117, 115, 58, 32, 53, 112, 120, 59, 32, 119, 104, 105, 116, 101,
-    45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 125, 32, 100,
-    97, 116, 97, 108, 105, 115, 116, 32, 123, 32, 100, 105, 115, 112, 108, 97,
-    121, 58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 111, 112, 116, 103, 114,
-    111, 117, 112, 32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104,
-    116, 58, 32, 98, 111, 108, 100, 101, 114, 59, 32, 125, 32, 111, 112, 116,
-    105, 111, 110, 32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104,
-    116, 58, 32, 110, 111, 114, 109, 97, 108, 59, 32, 125, 32, 100, 97, 116,
-    97, 103, 114, 105, 100, 32, 123, 32, 104, 101, 105, 103, 104, 116, 58, 32,
-    49, 53, 48, 112, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
-    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 100, 97, 116, 97, 103,
-    114, 105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120,
-    45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45,
-    98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108,
-    45, 111, 114, 100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99,
-    97, 108, 59, 32, 99, 111, 108, 111, 114, 58, 32, 98, 108, 97, 99, 107,
-    59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108,
-    111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32, 99, 117, 114, 115, 111,
-    114, 58, 32, 100, 101, 102, 97, 117, 108, 116, 59, 32, 98, 111, 114, 100,
-    101, 114, 58, 32, 49, 112, 120, 32, 105, 110, 115, 101, 116, 32, 103, 114,
-    97, 121, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58,
-    32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 117, 44, 32, 105,
-    110, 115, 32, 123, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97,
-    116, 105, 111, 110, 58, 32, 117, 110, 100, 101, 114, 108, 105, 110, 101, 32,
-    125, 32, 115, 116, 114, 111, 110, 103, 44, 32, 98, 32, 123, 32, 102, 111,
-    110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 101,
-    114, 32, 125, 32, 105, 44, 32, 99, 105, 116, 101, 44, 32, 101, 109, 44,
-    32, 118, 97, 114, 44, 32, 97, 100, 100, 114, 101, 115, 115, 32, 123, 32,
-    102, 111, 110, 116, 45, 115, 116, 121, 108, 101, 58, 32, 105, 116, 97, 108,
-    105, 99, 32, 125, 32, 116, 116, 44, 32, 99, 111, 100, 101, 44, 32, 107,
-    98, 100, 44, 32, 115, 97, 109, 112, 32, 123, 32, 102, 111, 110, 116, 45,
-    102, 97, 109, 105, 108, 121, 58, 32, 109, 111, 110, 111, 115, 112, 97, 99,
-    101, 32, 125, 32, 112, 114, 101, 44, 32, 120, 109, 112, 44, 32, 112, 108,
-    97, 105, 110, 116, 101, 120, 116, 44, 32, 108, 105, 115, 116, 105, 110, 103,
-    32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99,
-    107, 59, 32, 102, 111, 110, 116, 45, 102, 97, 109, 105, 108, 121, 58, 32,
-    109, 111, 110, 111, 115, 112, 97, 99, 101, 59, 32, 119, 104, 105, 116, 101,
-    45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 109, 97, 114,
-    103, 105, 110, 58, 32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 125, 32,
-    98, 105, 103, 32, 123, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58,
-    32, 108, 97, 114, 103, 101, 114, 32, 125, 32, 115, 109, 97, 108, 108, 32,
-    123, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97,
-    108, 108, 101, 114, 32, 125, 32, 115, 44, 32, 115, 116, 114, 105, 107, 101,
-    44, 32, 100, 101, 108, 32, 123, 32, 116, 101, 120, 116, 45, 100, 101, 99,
-    111, 114, 97, 116, 105, 111, 110, 58, 32, 108, 105, 110, 101, 45, 116, 104,
-    114, 111, 117, 103, 104, 32, 125, 32, 115, 117, 98, 32, 123, 32, 118, 101,
-    114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117,
-    98, 59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109,
-    97, 108, 108, 101, 114, 32, 125, 32, 115, 117, 112, 32, 123, 32, 118, 101,
-    114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117,
-    112, 101, 114, 59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32,
-    115, 109, 97, 108, 108, 101, 114, 32, 125, 32, 110, 111, 98, 114, 32, 123,
-    32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 110, 111,
-    119, 114, 97, 112, 32, 125, 32, 58, 102, 111, 99, 117, 115, 32, 123, 32,
-    111, 117, 116, 108, 105, 110, 101, 58, 32, 97, 117, 116, 111, 32, 53, 112,
-    120, 32, 45, 119, 101, 98, 107, 105, 116, 45, 102, 111, 99, 117, 115, 45,
-    114, 105, 110, 103, 45, 99, 111, 108, 111, 114, 32, 125, 32, 104, 116, 109,
-    108, 58, 102, 111, 99, 117, 115, 44, 32, 98, 111, 100, 121, 58, 102, 111,
-    99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 114, 101, 97, 100, 111,
-    110, 108, 121, 93, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116,
-    108, 105, 110, 101, 58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110, 112,
-    117, 116, 58, 102, 111, 99, 117, 115, 44, 32, 116, 101, 120, 116, 97, 114,
-    101, 97, 58, 102, 111, 99, 117, 115, 44, 32, 105, 115, 105, 110, 100, 101,
-    120, 58, 102, 111, 99, 117, 115, 44, 32, 107, 101, 121, 103, 101, 110, 58,
-    102, 111, 99, 117, 115, 44, 32, 115, 101, 108, 101, 99, 116, 58, 102, 111,
-    99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 45, 111, 102,
-    102, 115, 101, 116, 58, 32, 45, 50, 112, 120, 32, 125, 32, 105, 110, 112,
-    117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34,
-    93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 58,
-    102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 44,
-    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100,
-    100, 101, 110, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112,
-    117, 116, 91, 116, 121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93,
-    58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
-    112, 101, 61, 34, 114, 97, 100, 105, 111, 34, 93, 58, 102, 111, 99, 117,
-    115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114,
-    101, 115, 101, 116, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104,
-    34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 102,
+    103, 110, 58, 32, 115, 116, 97, 114, 116, 59, 32, 98, 111, 114, 100, 101,
+    114, 58, 32, 49, 112, 120, 32, 105, 110, 115, 101, 116, 32, 103, 114, 97,
+    121, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 114, 100, 101,
+    114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 105, 110, 105, 116, 105, 97,
+    108, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32,
+    105, 110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 115, 101, 108, 101, 99,
+    116, 91, 115, 105, 122, 101, 61, 34, 48, 34, 93, 44, 32, 115, 101, 108,
+    101, 99, 116, 91, 115, 105, 122, 101, 61, 34, 49, 34, 93, 32, 123, 32,
+    45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110,
+    99, 101, 58, 32, 109, 101, 110, 117, 108, 105, 115, 116, 59, 32, 45, 119,
+    101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58,
+    32, 99, 101, 110, 116, 101, 114, 59, 32, 98, 111, 114, 100, 101, 114, 58,
+    32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97, 100, 105, 117,
+    115, 58, 32, 53, 112, 120, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112,
+    97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 125, 32, 100, 97, 116, 97,
+    108, 105, 115, 116, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    110, 111, 110, 101, 59, 32, 125, 32, 111, 112, 116, 103, 114, 111, 117, 112,
+    32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32,
+    98, 111, 108, 100, 101, 114, 59, 32, 125, 32, 111, 112, 116, 105, 111, 110,
+    32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32,
+    110, 111, 114, 109, 97, 108, 59, 32, 125, 32, 100, 97, 116, 97, 103, 114,
+    105, 100, 32, 123, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 53, 48,
+    112, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 100, 97, 116, 97, 103, 114, 105, 100,
+    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105,
+    122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120,
+    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114,
+    100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59,
+    32, 99, 111, 108, 111, 114, 58, 32, 98, 108, 97, 99, 107, 59, 32, 98,
+    97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58,
+    32, 119, 104, 105, 116, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32,
+    100, 101, 102, 97, 117, 108, 116, 59, 32, 98, 111, 114, 100, 101, 114, 58,
+    32, 49, 112, 120, 32, 105, 110, 115, 101, 116, 32, 103, 114, 97, 121, 59,
+    32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 105, 110,
+    105, 116, 105, 97, 108, 59, 32, 125, 32, 117, 44, 32, 105, 110, 115, 32,
+    123, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111,
+    110, 58, 32, 117, 110, 100, 101, 114, 108, 105, 110, 101, 32, 125, 32, 115,
+    116, 114, 111, 110, 103, 44, 32, 98, 32, 123, 32, 102, 111, 110, 116, 45,
+    119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 101, 114, 32, 125,
+    32, 105, 44, 32, 99, 105, 116, 101, 44, 32, 101, 109, 44, 32, 118, 97,
+    114, 44, 32, 97, 100, 100, 114, 101, 115, 115, 32, 123, 32, 102, 111, 110,
+    116, 45, 115, 116, 121, 108, 101, 58, 32, 105, 116, 97, 108, 105, 99, 32,
+    125, 32, 116, 116, 44, 32, 99, 111, 100, 101, 44, 32, 107, 98, 100, 44,
+    32, 115, 97, 109, 112, 32, 123, 32, 102, 111, 110, 116, 45, 102, 97, 109,
+    105, 108, 121, 58, 32, 109, 111, 110, 111, 115, 112, 97, 99, 101, 32, 125,
+    32, 112, 114, 101, 44, 32, 120, 109, 112, 44, 32, 112, 108, 97, 105, 110,
+    116, 101, 120, 116, 44, 32, 108, 105, 115, 116, 105, 110, 103, 32, 123, 32,
+    100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32,
+    102, 111, 110, 116, 45, 102, 97, 109, 105, 108, 121, 58, 32, 109, 111, 110,
+    111, 115, 112, 97, 99, 101, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112,
+    97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 109, 97, 114, 103, 105, 110,
+    58, 32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 125, 32, 98, 105, 103,
+    32, 123, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 108, 97,
+    114, 103, 101, 114, 32, 125, 32, 115, 109, 97, 108, 108, 32, 123, 32, 102,
+    111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108, 101,
+    114, 32, 125, 32, 115, 44, 32, 115, 116, 114, 105, 107, 101, 44, 32, 100,
+    101, 108, 32, 123, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97,
+    116, 105, 111, 110, 58, 32, 108, 105, 110, 101, 45, 116, 104, 114, 111, 117,
+    103, 104, 32, 125, 32, 115, 117, 98, 32, 123, 32, 118, 101, 114, 116, 105,
+    99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 98, 59, 32,
+    102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108,
+    101, 114, 32, 125, 32, 115, 117, 112, 32, 123, 32, 118, 101, 114, 116, 105,
+    99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 112, 101, 114,
+    59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97,
+    108, 108, 101, 114, 32, 125, 32, 110, 111, 98, 114, 32, 123, 32, 119, 104,
+    105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 110, 111, 119, 114, 97,
+    112, 32, 125, 32, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116,
+    108, 105, 110, 101, 58, 32, 97, 117, 116, 111, 32, 53, 112, 120, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 102, 111, 99, 117, 115, 45, 114, 105, 110,
+    103, 45, 99, 111, 108, 111, 114, 32, 125, 32, 104, 116, 109, 108, 58, 102,
+    111, 99, 117, 115, 44, 32, 98, 111, 100, 121, 58, 102, 111, 99, 117, 115,
+    44, 32, 105, 110, 112, 117, 116, 91, 114, 101, 97, 100, 111, 110, 108, 121,
+    93, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110,
+    101, 58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 58,
+    102, 111, 99, 117, 115, 44, 32, 116, 101, 120, 116, 97, 114, 101, 97, 58,
+    102, 111, 99, 117, 115, 44, 32, 105, 115, 105, 110, 100, 101, 120, 58, 102,
+    111, 99, 117, 115, 44, 32, 107, 101, 121, 103, 101, 110, 58, 102, 111, 99,
+    117, 115, 44, 32, 115, 101, 108, 101, 99, 116, 58, 102, 111, 99, 117, 115,
+    32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 45, 111, 102, 102, 115, 101,
+    116, 58, 32, 45, 50, 112, 120, 32, 125, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 102,
     111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 102, 105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 58, 58,
-    45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108,
-    111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 111, 117, 116,
-    108, 105, 110, 101, 45, 111, 102, 102, 115, 101, 116, 58, 32, 48, 32, 125,
-    32, 97, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 110, 121, 45, 108,
-    105, 110, 107, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 108, 105, 110, 107, 59, 32, 116, 101, 120, 116, 45,
-    100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 58, 32, 117, 110, 100, 101,
-    114, 108, 105, 110, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97,
-    117, 116, 111, 59, 32, 125, 32, 97, 58, 45, 119, 101, 98, 107, 105, 116,
-    45, 97, 110, 121, 45, 108, 105, 110, 107, 58, 97, 99, 116, 105, 118, 101,
+    61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 58, 102, 111, 99,
+    117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    102, 105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100, 100, 101, 110,
+    34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93, 58, 102, 111,
+    99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
+    34, 114, 97, 100, 105, 111, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101,
+    116, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 58,
+    102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 102, 111, 99, 117,
+    115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102,
+    105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100,
+    45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 111, 117, 116, 108, 105, 110,
+    101, 45, 111, 102, 102, 115, 101, 116, 58, 32, 48, 32, 125, 32, 97, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 97, 110, 121, 45, 108, 105, 110, 107,
     32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 97, 99, 116, 105, 118, 101, 108, 105, 110, 107, 32, 125, 32, 110,
-    111, 102, 114, 97, 109, 101, 115, 32, 123, 32, 100, 105, 115, 112, 108, 97,
-    121, 58, 32, 110, 111, 110, 101, 32, 125, 32, 102, 114, 97, 109, 101, 115,
-    101, 116, 44, 32, 102, 114, 97, 109, 101, 32, 123, 32, 100, 105, 115, 112,
-    108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 32, 125, 32, 102, 114, 97,
-    109, 101, 115, 101, 116, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 99,
-    111, 108, 111, 114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32,
-    105, 102, 114, 97, 109, 101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 58,
-    32, 50, 112, 120, 32, 105, 110, 115, 101, 116, 32, 125
+    116, 45, 108, 105, 110, 107, 59, 32, 116, 101, 120, 116, 45, 100, 101, 99,
+    111, 114, 97, 116, 105, 111, 110, 58, 32, 117, 110, 100, 101, 114, 108, 105,
+    110, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117, 116, 111,
+    59, 32, 125, 32, 97, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 110,
+    121, 45, 108, 105, 110, 107, 58, 97, 99, 116, 105, 118, 101, 32, 123, 32,
+    99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
+    99, 116, 105, 118, 101, 108, 105, 110, 107, 32, 125, 32, 110, 111, 102, 114,
+    97, 109, 101, 115, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    110, 111, 110, 101, 32, 125, 32, 102, 114, 97, 109, 101, 115, 101, 116, 44,
+    32, 102, 114, 97, 109, 101, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 98, 108, 111, 99, 107, 32, 125, 32, 102, 114, 97, 109, 101, 115,
+    101, 116, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108, 111,
+    114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32, 105, 102, 114,
+    97, 109, 101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112,
+    120, 32, 105, 110, 115, 101, 116, 32, 125
 };
 extern const char quirksUserAgentStyleSheet[359] = {
     105, 109, 103, 91, 97, 108, 105, 103, 110, 61, 34, 108, 101, 102, 116, 34,
@@ -1075,4 +1081,147 @@ extern const char mediaControlsUserAgentStyleSheet[2582] = {
     116, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110,
     111, 110, 101, 59, 32, 125
 };
+extern const char mediaControlsQtUserAgentStyleSheet[2249] = {
+    97, 117, 100, 105, 111, 32, 123, 32, 104, 101, 105, 103, 104, 116, 58, 32,
+    51, 52, 112, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 52, 48, 48,
+    112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
+    111, 108, 115, 45, 112, 97, 110, 101, 108, 44, 32, 118, 105, 100, 101, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 97, 110, 101, 108, 32, 123,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98,
+    111, 120, 45, 111, 114, 105, 101, 110, 116, 58, 32, 104, 111, 114, 105, 122,
+    111, 110, 116, 97, 108, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98,
+    111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 101, 110, 100, 59, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108, 101,
+    99, 116, 58, 32, 110, 111, 110, 101, 59, 32, 112, 111, 115, 105, 116, 105,
+    111, 110, 58, 32, 97, 98, 115, 111, 108, 117, 116, 101, 59, 32, 98, 111,
+    116, 116, 111, 109, 58, 32, 48, 59, 32, 119, 105, 100, 116, 104, 58, 32,
+    49, 48, 48, 37, 59, 32, 122, 45, 105, 110, 100, 101, 120, 58, 32, 48,
+    59, 32, 111, 118, 101, 114, 102, 108, 111, 119, 58, 32, 104, 105, 100, 100,
+    101, 110, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 48, 48, 37,
+    59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 114, 105,
+    103, 104, 116, 59, 32, 125, 32, 118, 105, 100, 101, 111, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 102, 117, 108, 108, 45, 112, 97, 103, 101, 45, 109,
+    101, 100, 105, 97, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 97, 110,
+    101, 108, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111,
+    110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
+    111, 108, 115, 45, 109, 117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 44,
+    32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
+    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 109,
+    117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 108, 101, 102,
+    116, 58, 32, 97, 117, 116, 111, 59, 32, 114, 105, 103, 104, 116, 58, 32,
+    53, 112, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 50, 112, 120,
+    59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 50, 112, 120, 59, 32,
+    112, 97, 100, 100, 105, 110, 103, 58, 32, 54, 112, 120, 59, 32, 109, 97,
+    114, 103, 105, 110, 58, 32, 53, 112, 120, 32, 53, 112, 120, 32, 53, 112,
+    120, 32, 51, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
+    110, 116, 114, 111, 108, 115, 45, 112, 108, 97, 121, 45, 98, 117, 116, 116,
+    111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108,
+    115, 45, 112, 108, 97, 121, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32,
+    108, 101, 102, 116, 58, 32, 53, 112, 120, 59, 32, 119, 105, 100, 116, 104,
+    58, 32, 57, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49,
+    50, 112, 120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 54, 112,
+    120, 32, 49, 50, 112, 120, 32, 54, 112, 120, 32, 49, 49, 112, 120, 59,
+    32, 109, 97, 114, 103, 105, 110, 58, 32, 53, 112, 120, 32, 51, 112, 120,
+    32, 53, 112, 120, 32, 53, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105,
+    111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
+    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105,
+    110, 101, 45, 99, 111, 110, 116, 97, 105, 110, 101, 114, 44, 32, 118, 105,
+    100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
+    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101,
+    108, 105, 110, 101, 45, 99, 111, 110, 116, 97, 105, 110, 101, 114, 32, 123,
+    32, 104, 101, 105, 103, 104, 116, 58, 32, 51, 52, 112, 120, 59, 32, 125,
+    32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
+    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 99,
+    117, 114, 114, 101, 110, 116, 45, 116, 105, 109, 101, 45, 100, 105, 115, 112,
+    108, 97, 121, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98,
+    107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111,
+    108, 115, 45, 99, 117, 114, 114, 101, 110, 116, 45, 116, 105, 109, 101, 45,
+    100, 105, 115, 112, 108, 97, 121, 32, 123, 32, 100, 105, 115, 112, 108, 97,
+    121, 58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 45, 114, 101,
+    109, 97, 105, 110, 105, 110, 103, 45, 100, 105, 115, 112, 108, 97, 121, 44,
+    32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
+    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116,
+    105, 109, 101, 45, 114, 101, 109, 97, 105, 110, 105, 110, 103, 45, 100, 105,
+    115, 112, 108, 97, 121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58,
+    32, 110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
+    110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105, 110, 101, 44,
+    32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
+    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116,
+    105, 109, 101, 108, 105, 110, 101, 32, 123, 32, 108, 101, 102, 116, 58, 32,
+    52, 50, 112, 120, 59, 32, 114, 105, 103, 104, 116, 58, 32, 51, 52, 112,
+    120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 50, 112, 120, 59,
+    32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 54, 112, 120, 32, 56, 112,
+    120, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 53, 112, 120, 32, 48,
+    112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
+    111, 108, 115, 45, 118, 111, 108, 117, 109, 101, 45, 115, 108, 105, 100, 101,
+    114, 45, 99, 111, 110, 116, 97, 105, 110, 101, 114, 44, 32, 118, 105, 100,
+    101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105,
+    97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 118, 111, 108, 117, 109,
+    101, 45, 115, 108, 105, 100, 101, 114, 45, 99, 111, 110, 116, 97, 105, 110,
+    101, 114, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111,
+    110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
+    111, 108, 115, 45, 118, 111, 108, 117, 109, 101, 45, 115, 108, 105, 100, 101,
+    114, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 118, 111, 108, 117, 109, 101, 45, 115, 108, 105, 100, 101, 114, 32, 123,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32,
+    125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
+    115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110,
+    44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
+    115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110,
+    32, 123, 32, 108, 101, 102, 116, 58, 32, 48, 112, 120, 59, 32, 116, 111,
+    112, 58, 32, 48, 112, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 48,
+    112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 48, 112, 120, 59,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32,
+    125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
+    115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116,
+    116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98,
+    107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111,
+    108, 115, 45, 115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45,
+    98, 117, 116, 116, 111, 110, 32, 123, 32, 108, 101, 102, 116, 58, 32, 48,
+    112, 120, 59, 32, 116, 111, 112, 58, 32, 48, 112, 120, 59, 32, 119, 105,
+    100, 116, 104, 58, 32, 48, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116,
+    58, 32, 48, 112, 120, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45,
+    119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110,
+    116, 114, 111, 108, 115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101, 110,
+    45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
+    110, 116, 114, 111, 108, 115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101,
+    110, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 108, 101, 102, 116, 58,
+    32, 48, 112, 120, 59, 32, 116, 111, 112, 58, 32, 48, 112, 120, 59, 32,
+    119, 105, 100, 116, 104, 58, 32, 48, 112, 120, 59, 32, 104, 101, 105, 103,
+    104, 116, 58, 32, 48, 112, 120, 59, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58,
+    58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99,
+    111, 110, 116, 114, 111, 108, 115, 45, 114, 101, 119, 105, 110, 100, 45, 98,
+    117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119,
+    101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116,
+    114, 111, 108, 115, 45, 114, 101, 119, 105, 110, 100, 45, 98, 117, 116, 116,
+    111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111,
+    110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
+    111, 108, 115, 45, 114, 101, 116, 117, 114, 110, 45, 116, 111, 45, 114, 101,
+    97, 108, 116, 105, 109, 101, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118,
+    105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 114, 101, 116,
+    117, 114, 110, 45, 116, 111, 45, 114, 101, 97, 108, 116, 105, 109, 101, 45,
+    98, 117, 116, 116, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 110, 111, 110, 101, 59, 32, 125
+};
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h b/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h
index 5dede20d25..11e6af241b 100644
--- a/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h
+++ b/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h
@@ -31,6 +31,6 @@
 #define WebKitVersion_h
 
 #define WEBKIT_MAJOR_VERSION 532
-#define WEBKIT_MINOR_VERSION 1
+#define WEBKIT_MINOR_VERSION 3
 
 #endif //WebKitVersion_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
index daa7919d06..968f144848 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
@@ -27,6 +27,7 @@
 #include "DNS.h"
 #include "EventNames.h"
 #include "Frame.h"
+#include "FrameLoaderTypes.h"
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
 #include "KeyboardEvent.h"
@@ -43,6 +44,7 @@ using namespace HTMLNames;
 HTMLAnchorElement::HTMLAnchorElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document, CreateElement)
     , m_wasShiftKeyDownOnMouseDown(false)
+    , m_linkRelations(0)
 {
 }
 
@@ -67,7 +69,7 @@ bool HTMLAnchorElement::supportsFocus() const
 bool HTMLAnchorElement::isMouseFocusable() const
 {
     // Anchor elements should be mouse focusable, https://bugs.webkit.org/show_bug.cgi?id=26856
-#if !PLATFORM(GTK)
+#if PLATFORM(MAC)
     if (isLink())
         return false;
 #endif
@@ -200,7 +202,7 @@ void HTMLAnchorElement::defaultEventHandler(Event* evt)
         }
 
         if (!evt->defaultPrevented() && document()->frame())
-            document()->frame()->loader()->urlSelected(document()->completeURL(url), getAttribute(targetAttr), evt, false, false, true);
+            document()->frame()->loader()->urlSelected(document()->completeURL(url), getAttribute(targetAttr), evt, false, false, true, hasRel(RelationNoReferrer) ? NoReferrer : SendReferrer);
 
         evt->setDefaultHandled();
     } else if (isLink() && isContentEditable()) {
@@ -274,10 +276,11 @@ void HTMLAnchorElement::parseMappedAttribute(MappedAttribute *attr)
             }
         }
     } else if (attr->name() == nameAttr ||
-             attr->name() == titleAttr ||
-             attr->name() == relAttr) {
+             attr->name() == titleAttr) {
         // Do nothing.
-    } else
+    } else if (attr->name() == relAttr)
+        setRel(attr->value());
+    else
         HTMLElement::parseMappedAttribute(attr);
 }
 
@@ -321,6 +324,20 @@ void HTMLAnchorElement::setHref(const AtomicString& value)
     setAttribute(hrefAttr, value);
 }
 
+bool HTMLAnchorElement::hasRel(uint32_t relation) const
+{
+    return m_linkRelations & relation;
+}
+
+void HTMLAnchorElement::setRel(const String& value)
+{
+    m_linkRelations = 0;
+    ClassNames newLinkRelations(value, true);
+    // FIXME: Add link relations as they are implemented
+    if (newLinkRelations.contains("noreferrer"))
+        m_linkRelations |= RelationNoReferrer;
+}
+
 const AtomicString& HTMLAnchorElement::name() const
 {
     return getAttribute(nameAttr);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h
index f538be2910..e47ea99cb1 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h
@@ -28,6 +28,29 @@
 
 namespace WebCore {
 
+// Link relation bitmask values.
+// FIXME: Uncomment as the various link relations are implemented.
+enum {
+//     RelationAlternate   = 0x00000001,
+//     RelationArchives    = 0x00000002,
+//     RelationAuthor      = 0x00000004,
+//     RelationBoomark     = 0x00000008,
+//     RelationExternal    = 0x00000010,
+//     RelationFirst       = 0x00000020,
+//     RelationHelp        = 0x00000040,
+//     RelationIndex       = 0x00000080,
+//     RelationLast        = 0x00000100,
+//     RelationLicense     = 0x00000200,
+//     RelationNext        = 0x00000400,
+//     RelationNoFolow    = 0x00000800,
+    RelationNoReferrer     = 0x00001000,
+//     RelationPrev        = 0x00002000,
+//     RelationSearch      = 0x00004000,
+//     RelationSidebar     = 0x00008000,
+//     RelationTag         = 0x00010000,
+//     RelationUp          = 0x00020000,
+};
+
 class HTMLAnchorElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLAnchorElement> create(Document*);
@@ -51,6 +74,9 @@ public:
 
     bool isLiveLink() const;
 
+    bool hasRel(uint32_t relation) const;
+    void setRel(const String&);
+
 protected:
     HTMLAnchorElement(const QualifiedName&, Document*);
 
@@ -73,6 +99,7 @@ private:
 
     RefPtr<Element> m_rootEditableElementForSelectionOnMouseDown;
     bool m_wasShiftKeyDownOnMouseDown;
+    uint32_t m_linkRelations;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
index 63a5c2107c..340779e126 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
@@ -125,6 +125,7 @@ object
 onabort
 onbeforecopy
 onbeforecut
+onbeforeload
 onbeforepaste
 onbeforeunload
 onblur
@@ -157,7 +158,6 @@ onkeyup
 onload
 onloadeddata
 onloadedmetadata
-onloadend
 onloadstart
 onmousedown
 onmousemove
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
index 9b2f70c352..335b20ff00 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
@@ -138,7 +138,7 @@ String HTMLCanvasElement::toDataURL(const String& mimeType, ExceptionCode& ec)
         return String();
     }
 
-    if (m_size.isEmpty())
+    if (m_size.isEmpty() || !buffer())
         return String("data:,");
 
     if (mimeType.isNull() || !MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType))
@@ -166,7 +166,7 @@ CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type)
     }
 #if ENABLE(3D_CANVAS)    
     Settings* settings = document()->settings();
-    if (settings && settings->experimentalWebGLEnabled()) {
+    if (settings && settings->webGLEnabled()) {
         if ((type == "webkit-3d") ||
             (type == "GL")) {
             if (m_context && !m_context->is3d())
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
index fd939c8f92..0d1cb19bac 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
@@ -307,8 +307,7 @@ PassRefPtr<Element> HTMLDocument::createElement(const AtomicString& name, Except
         ec = INVALID_CHARACTER_ERR;
         return 0;
     }
-    AtomicString lowerName = name.string().impl()->isLower() ? name : AtomicString(name.string().lower());
-    return HTMLElementFactory::createHTMLElement(QualifiedName(nullAtom, lowerName, xhtmlNamespaceURI), this, 0, false);
+    return HTMLElementFactory::createHTMLElement(QualifiedName(nullAtom, name.lower(), xhtmlNamespaceURI), this, 0, false);
 }
 
 static void addItemToMap(HashCountedSet<AtomicStringImpl*>& map, const AtomicString& name)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
index 967a8e0d15..df3cb7db14 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
@@ -67,7 +67,7 @@ String HTMLElement::nodeName() const
     // the string on a hit in the hash.
     // FIXME: We should have a way to detect XHTML elements and replace the hasPrefix() check with it.
     if (document()->isHTMLDocument() && !tagQName().hasPrefix())
-        return tagQName().localName().string().upper();
+        return tagQName().localNameUpper();
     return Element::nodeName();
 }
     
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
index 8e66fe0101..ea46980cb6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
@@ -41,6 +41,7 @@
 #include "RenderBox.h"
 #include "RenderTextControl.h"
 #include "RenderTheme.h"
+#include "ScriptEventListener.h"
 #include "ValidityState.h"
 
 namespace WebCore {
@@ -52,6 +53,7 @@ HTMLFormControlElement::HTMLFormControlElement(const QualifiedName& tagName, Doc
     , m_form(f)
     , m_disabled(false)
     , m_readOnly(false)
+    , m_required(false)
     , m_valueMatchesRenderer(false)
 {
     if (!m_form)
@@ -86,9 +88,9 @@ ValidityState* HTMLFormControlElement::validity()
 
 void HTMLFormControlElement::parseMappedAttribute(MappedAttribute *attr)
 {
-    if (attr->name() == nameAttr) {
-        // Do nothing.
-    } else if (attr->name() == disabledAttr) {
+    if (attr->name() == nameAttr)
+        setNeedsStyleRecalc();
+    else if (attr->name() == disabledAttr) {
         bool oldDisabled = m_disabled;
         m_disabled = !attr->isNull();
         if (oldDisabled != m_disabled) {
@@ -104,6 +106,11 @@ void HTMLFormControlElement::parseMappedAttribute(MappedAttribute *attr)
             if (renderer() && renderer()->style()->hasAppearance())
                 renderer()->theme()->stateChanged(renderer(), ReadOnlyState);
         }
+    } else if (attr->name() == requiredAttr) {
+        bool oldRequired = m_required;
+        m_required = !attr->isNull();
+        if (oldRequired != m_required)
+            setNeedsStyleRecalc();
     } else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -218,7 +225,7 @@ void HTMLFormControlElement::setAutofocus(bool b)
 
 bool HTMLFormControlElement::required() const
 {
-    return hasAttribute(requiredAttr);
+    return m_required;
 }
 
 void HTMLFormControlElement::setRequired(bool b)
@@ -291,6 +298,14 @@ bool HTMLFormControlElement::checkValidity()
     return true;
 }
 
+void HTMLFormControlElement::updateValidity()
+{
+    if (willValidate()) {
+        // Update style for pseudo classes such as :valid :invalid.
+        setNeedsStyleRecalc();
+    }
+}
+
 void HTMLFormControlElement::setCustomValidity(const String& error)
 {
     validity()->setCustomErrorMessage(error);
@@ -408,4 +423,81 @@ void HTMLTextFormControlElement::updatePlaceholderVisibility(bool placeholderVal
         toRenderTextControl(renderer())->updatePlaceholderVisibility(placeholderShouldBeVisible(), placeholderValueChanged);
 }
 
+RenderTextControl* HTMLTextFormControlElement::textRendererAfterUpdateLayout()
+{
+    if (!isTextFormControl())
+        return 0;
+    document()->updateLayoutIgnorePendingStylesheets();
+    return toRenderTextControl(renderer());
+}
+
+void HTMLTextFormControlElement::setSelectionStart(int start)
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->setSelectionStart(start);
+}
+
+void HTMLTextFormControlElement::setSelectionEnd(int end)
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->setSelectionEnd(end);
+}
+
+void HTMLTextFormControlElement::select()
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->select();
+}
+
+void HTMLTextFormControlElement::setSelectionRange(int start, int end)
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->setSelectionRange(start, end);
+}
+
+int HTMLTextFormControlElement::selectionStart()
+{
+    if (!isTextFormControl())
+        return 0;
+    if (document()->focusedNode() != this && cachedSelectionStart() >= 0)
+        return cachedSelectionStart();
+    if (!renderer())
+        return 0;
+    return toRenderTextControl(renderer())->selectionStart();
+}
+
+int HTMLTextFormControlElement::selectionEnd()
+{
+    if (!isTextFormControl())
+        return 0;
+    if (document()->focusedNode() != this && cachedSelectionEnd() >= 0)
+        return cachedSelectionEnd();
+    if (!renderer())
+        return 0;
+    return toRenderTextControl(renderer())->selectionEnd();
+}
+
+VisibleSelection HTMLTextFormControlElement::selection() const
+{
+    if (!renderer() || !isTextFormControl() || cachedSelectionStart() < 0 || cachedSelectionEnd() < 0)
+        return VisibleSelection();
+    return toRenderTextControl(renderer())->selection(cachedSelectionStart(), cachedSelectionEnd());
+}
+
+void HTMLTextFormControlElement::parseMappedAttribute(MappedAttribute* attr)
+{
+    if (attr->name() == placeholderAttr)
+        updatePlaceholderVisibility(true);
+    else if (attr->name() == onfocusAttr)
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onblurAttr)
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onselectAttr)
+        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onchangeAttr)
+        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
+    else
+        HTMLFormControlElementWithState::parseMappedAttribute(attr);
+}
+
 } // namespace Webcore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
index 7b3cfbdc68..b5dc7ceda6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
@@ -30,7 +30,9 @@ namespace WebCore {
 
 class FormDataList;
 class HTMLFormElement;
+class RenderTextControl;
 class ValidityState;
+class VisibleSelection;
 
 class HTMLFormControlElement : public HTMLElement {
 public:
@@ -106,10 +108,11 @@ public:
 
     virtual bool willValidate() const;
     bool checkValidity();
+    void updateValidity();
     void setCustomValidity(const String&);
-
     virtual bool valueMissing() const { return false; }
     virtual bool patternMismatch() const { return false; }
+    virtual bool tooLong() const { return false; }
 
     void formDestroyed() { m_form = 0; }
 
@@ -126,9 +129,10 @@ private:
 
     HTMLFormElement* m_form;
     RefPtr<ValidityState> m_validityState;
-    bool m_disabled;
-    bool m_readOnly;
-    bool m_valueMatchesRenderer;
+    bool m_disabled : 1;
+    bool m_readOnly : 1;
+    bool m_required : 1;
+    bool m_valueMatchesRenderer : 1;
 };
 
 class HTMLFormControlElementWithState : public HTMLFormControlElement {
@@ -150,9 +154,20 @@ public:
     virtual void dispatchFocusEvent();
     virtual void dispatchBlurEvent();
 
+    int selectionStart();
+    int selectionEnd();
+    void setSelectionStart(int);
+    void setSelectionEnd(int);
+    void select();
+    void setSelectionRange(int start, int end);
+    VisibleSelection selection() const;
+
 protected:
     bool placeholderShouldBeVisible() const;
     void updatePlaceholderVisibility(bool);
+    virtual int cachedSelectionStart() const = 0;
+    virtual int cachedSelectionEnd() const = 0;
+    virtual void parseMappedAttribute(MappedAttribute*);
 
 private:
     // A subclass should return true if placeholder processing is needed.
@@ -163,6 +178,7 @@ private:
     virtual void handleFocusEvent() { }
     // Called in dispatchBlurEvent(), after placeholder process, before calling parent's dispatchBlurEvent().
     virtual void handleBlurEvent() { }
+    RenderTextControl* textRendererAfterUpdateLayout();
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
index 1bc49950f3..80df8294b6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
@@ -137,9 +137,11 @@ void HTMLFrameElementBase::parseMappedAttribute(MappedAttribute *attr)
         m_viewSource = !attr->isNull();
         if (contentFrame())
             contentFrame()->setInViewSourceMode(viewSourceMode());
-    } else if (attr->name() == onloadAttr) {
+    } else if (attr->name() == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onbeforeunloadAttr) {
+    else if (attr->name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onbeforeunloadAttr) {
         // FIXME: should <frame> elements have beforeunload handlers?
         setAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(this, attr));
     } else
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
index 932e718398..d3530733b5 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
@@ -118,6 +118,8 @@ void HTMLImageElement::parseMappedAttribute(MappedAttribute* attr)
         setAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
     else if (attrName == compositeAttr) {
         if (!parseCompositeOperator(attr->value(), m_compositeOperator))
             m_compositeOperator = CompositeSourceOver;
@@ -167,7 +169,7 @@ void HTMLImageElement::attach()
 {
     HTMLElement::attach();
 
-    if (renderer() && renderer()->isImage()) {
+    if (renderer() && renderer()->isImage() && m_imageLoader.haveFiredBeforeLoadEvent()) {
         RenderImage* imageObj = toRenderImage(renderer());
         if (imageObj->hasImage())
             return;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
index e6b8228c3d..ed3405a040 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
@@ -196,6 +196,98 @@ bool HTMLInputElement::patternMismatch() const
     return false;
 }
 
+bool HTMLInputElement::tooLong() const
+{
+    switch (inputType()) {
+    case EMAIL:
+    case PASSWORD:
+    case SEARCH:
+    case TELEPHONE:
+    case TEXT:
+    case URL: {
+        int max = maxLength();
+        if (max < 0)
+            return false;
+        // Return false for the default value even if it is longer than maxLength.
+        bool userEdited = !m_data.value().isNull();
+        if (!userEdited)
+            return false;
+        return value().length() > static_cast<unsigned>(max);
+    }
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case NUMBER:
+    case RADIO:
+    case RANGE:
+    case RESET:
+    case SUBMIT:
+        return false;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool HTMLInputElement::rangeUnderflow() const
+{
+    if (inputType() == NUMBER) {
+        double min = 0.0;
+        double doubleValue = 0.0;
+        if (formStringToDouble(getAttribute(minAttr), &min) && formStringToDouble(value(), &doubleValue))
+            return doubleValue < min;
+    } else if (inputType() == RANGE) {
+        double doubleValue;
+        if (formStringToDouble(value(), &doubleValue))
+            return doubleValue < rangeMinimum();
+    }
+    return false;
+}
+
+bool HTMLInputElement::rangeOverflow() const
+{
+    if (inputType() == NUMBER) {
+        double max = 0.0;
+        double doubleValue = 0.0;
+        if (formStringToDouble(getAttribute(maxAttr), &max) && formStringToDouble(value(), &doubleValue))
+            return doubleValue > max;
+    } else if (inputType() == RANGE) {
+        double doubleValue;
+        if (formStringToDouble(value(), &doubleValue))
+            return doubleValue > rangeMaximum();
+    }
+    return false;
+}
+
+double HTMLInputElement::rangeMinimum() const
+{
+    ASSERT(inputType() == RANGE);
+    // The range type's "default minimum" is 0.
+    double min = 0.0;
+    formStringToDouble(getAttribute(minAttr), &min);
+    return min;
+}
+
+double HTMLInputElement::rangeMaximum() const
+{
+    ASSERT(inputType() == RANGE);
+    // The range type's "default maximum" is 100.
+    static const double defaultMaximum = 100.0;
+    double max = defaultMaximum;
+    formStringToDouble(getAttribute(maxAttr), &max);
+    const double min = rangeMinimum();
+
+    if (max < min) {
+        // A remedy for the inconsistent min/max values.
+        // Sets the maxmimum to the default (100.0) or the minimum value.
+        max = min < defaultMaximum ? defaultMaximum : min;
+    }
+    return max;
+}
+
 static inline CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement *element)
 {
     if (HTMLFormElement* form = element->form())
@@ -382,6 +474,7 @@ void HTMLInputElement::setInputType(const String& t)
         }
 
         InputElement::notifyFormStateChanged(this);
+        updateValidity();
     }
     m_haveType = true;
 
@@ -543,63 +636,6 @@ bool HTMLInputElement::canHaveSelection() const
     return isTextField();
 }
 
-int HTMLInputElement::selectionStart() const
-{
-    if (!isTextField())
-        return 0;
-    if (document()->focusedNode() != this && m_data.cachedSelectionStart() != -1)
-        return m_data.cachedSelectionStart();
-    if (!renderer())
-        return 0;
-    return toRenderTextControl(renderer())->selectionStart();
-}
-
-int HTMLInputElement::selectionEnd() const
-{
-    if (!isTextField())
-        return 0;
-    if (document()->focusedNode() != this && m_data.cachedSelectionEnd() != -1)
-        return m_data.cachedSelectionEnd();
-    if (!renderer())
-        return 0;
-    return toRenderTextControl(renderer())->selectionEnd();
-}
-
-static bool isTextFieldWithRenderer(HTMLInputElement* element)
-{
-    if (!element->isTextField())
-        return false;
-
-    element->document()->updateLayoutIgnorePendingStylesheets();
-    if (!element->renderer())
-        return false;
-
-    return true;
-}
-
-void HTMLInputElement::setSelectionStart(int start)
-{
-    if (isTextFieldWithRenderer(this))
-        toRenderTextControl(renderer())->setSelectionStart(start);
-}
-
-void HTMLInputElement::setSelectionEnd(int end)
-{
-    if (isTextFieldWithRenderer(this))
-        toRenderTextControl(renderer())->setSelectionEnd(end);
-}
-
-void HTMLInputElement::select()
-{
-    if (isTextFieldWithRenderer(this))
-        toRenderTextControl(renderer())->select();
-}
-
-void HTMLInputElement::setSelectionRange(int start, int end)
-{
-    InputElement::updateSelectionRange(this, this, start, end);
-}
-
 void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
 {
     switch (inputType()) {
@@ -659,6 +695,7 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         checkedRadioButtons(this).removeButton(this);
         m_data.setName(attr->value());
         checkedRadioButtons(this).addButton(this);
+        HTMLFormControlElementWithState::parseMappedAttribute(attr);
     } else if (attr->name() == autocompleteAttr) {
         if (equalIgnoringCase(attr->value(), "off")) {
             m_autocomplete = Off;
@@ -678,12 +715,14 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         if (m_data.value().isNull())
             setNeedsStyleRecalc();
         setFormControlValueMatchesRenderer(false);
+        updateValidity();
     } else if (attr->name() == checkedAttr) {
         m_defaultChecked = !attr->isNull();
         if (m_useDefaultChecked) {
             setChecked(m_defaultChecked);
             m_useDefaultChecked = true;
         }
+        updateValidity();
     } else if (attr->name() == maxlengthAttr)
         InputElement::parseMaxLengthAttribute(m_data, this, this, attr);
     else if (attr->name() == sizeAttr)
@@ -715,14 +754,6 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
     } else if (attr->name() == heightAttr) {
         if (respectHeightAndWidthAttrs())
             addCSSLength(attr, CSSPropertyHeight, attr->value());
-    } else if (attr->name() == onfocusAttr) {
-        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onblurAttr) {
-        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onselectAttr) {
-        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onchangeAttr) {
-        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     }
     // Search field and slider attributes all just cause updateFromElement to be called through style
     // recalcing.
@@ -730,7 +761,7 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         setAttributeEventListener(eventNames().searchEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == resultsAttr) {
         int oldResults = m_maxResults;
-        m_maxResults = !attr->isNull() ? min(attr->value().toInt(), maxSavedResults) : -1;
+        m_maxResults = !attr->isNull() ? std::min(attr->value().toInt(), maxSavedResults) : -1;
         // FIXME: Detaching just for maxResults change is not ideal.  We should figure out the right
         // time to relayout for this change.
         if (m_maxResults != oldResults && (m_maxResults <= 0 || oldResults <= 0) && attached()) {
@@ -738,8 +769,6 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
             attach();
         }
         setNeedsStyleRecalc();
-    } else if (attr->name() == placeholderAttr) {
-        updatePlaceholderVisibility(true);
     } else if (attr->name() == autosaveAttr ||
              attr->name() == incrementalAttr ||
              attr->name() == minAttr ||
@@ -747,13 +776,15 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
              attr->name() == multipleAttr ||
              attr->name() == precisionAttr)
         setNeedsStyleRecalc();
+    else if (attr->name() == patternAttr)
+        updateValidity();
 #if ENABLE(DATALIST)
     else if (attr->name() == listAttr)
         m_hasNonEmptyList = !attr->isEmpty();
         // FIXME: we need to tell this change to a renderer if the attribute affects the appearance.
 #endif
     else
-        HTMLFormControlElementWithState::parseMappedAttribute(attr);
+        HTMLTextFormControlElement::parseMappedAttribute(attr);
 }
 
 bool HTMLInputElement::rendererIsNeeded(RenderStyle *style)
@@ -831,7 +862,7 @@ void HTMLInputElement::attach()
         if (!m_imageLoader)
             m_imageLoader.set(new HTMLImageLoader(this));
         m_imageLoader->updateFromElement();
-        if (renderer()) {
+        if (renderer() && m_imageLoader->haveFiredBeforeLoadEvent()) {
             RenderImage* imageObj = toRenderImage(renderer());
             imageObj->setCachedImage(m_imageLoader->image()); 
             
@@ -1127,6 +1158,7 @@ void HTMLInputElement::setValue(const String& value)
             cacheSelection(max, max);
     }
     InputElement::notifyFormStateChanged(this);
+    updateValidity();
 }
 
 String HTMLInputElement::placeholder() const
@@ -1150,6 +1182,7 @@ void HTMLInputElement::setValueFromRenderer(const String& value)
     ASSERT(inputType() != FILE);
     updatePlaceholderVisibility(false);
     InputElement::setValueFromRenderer(m_data, this, this, value);
+    updateValidity();
 }
 
 void HTMLInputElement::setFileListFromRenderer(const Vector<String>& paths)
@@ -1161,6 +1194,7 @@ void HTMLInputElement::setFileListFromRenderer(const Vector<String>& paths)
 
     setFormControlValueMatchesRenderer(true);
     InputElement::notifyFormStateChanged(this);
+    updateValidity();
 }
 
 bool HTMLInputElement::storesValueSeparateFromAttribute() const
@@ -1610,12 +1644,12 @@ int HTMLInputElement::maxLength() const
     return m_data.maxLength();
 }
 
-void HTMLInputElement::setMaxLength(int _maxLength, ExceptionCode& exceptionCode)
+void HTMLInputElement::setMaxLength(int maxLength, ExceptionCode& ec)
 {
-    if (_maxLength < 0)
-        exceptionCode = INDEX_SIZE_ERR;
+    if (maxLength < 0)
+        ec = INDEX_SIZE_ERR;
     else
-        setAttribute(maxlengthAttr, String::number(_maxLength));
+        setAttribute(maxlengthAttr, String::number(maxLength));
 }
 
 bool HTMLInputElement::multiple() const
@@ -1746,13 +1780,6 @@ void HTMLInputElement::onSearch()
     dispatchEvent(Event::create(eventNames().searchEvent, true, false));
 }
 
-VisibleSelection HTMLInputElement::selection() const
-{
-    if (!renderer() || !isTextField() || m_data.cachedSelectionStart() == -1 || m_data.cachedSelectionEnd() == -1)
-        return VisibleSelection();
-    return toRenderTextControl(renderer())->selection(m_data.cachedSelectionStart(), m_data.cachedSelectionEnd());
-}
-
 void HTMLInputElement::documentDidBecomeActive()
 {
     ASSERT(needsActivationCallback());
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
index 16e3b58d49..799d92c850 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
@@ -93,6 +93,15 @@ public:
 
     virtual bool valueMissing() const;
     virtual bool patternMismatch() const;
+    virtual bool tooLong() const;
+    // For ValidityState
+    bool rangeUnderflow() const;
+    bool rangeOverflow() const;
+    // Returns the minimum value for type=range.  Don't call this for other types.
+    double rangeMinimum() const;
+    // Returns the maximum value for type=range.  Don't call this for other types.
+    // This always returns a value which is <= rangeMinimum().
+    double rangeMaximum() const;
 
     bool isTextButton() const { return m_type == SUBMIT || m_type == RESET || m_type == BUTTON; }
     virtual bool isRadioButton() const { return m_type == RADIO; }
@@ -128,12 +137,7 @@ public:
     virtual bool canStartSelection() const;
     
     bool canHaveSelection() const;
-    int selectionStart() const;
-    int selectionEnd() const;
-    void setSelectionStart(int);
-    void setSelectionEnd(int);
-    virtual void select();
-    void setSelectionRange(int start, int end);
+    virtual void select() { HTMLTextFormControlElement::select(); }
 
     virtual void accessKeyAction(bool sendToAnyElement);
 
@@ -218,8 +222,6 @@ public:
     void addSearchResult();
     void onSearch();
 
-    VisibleSelection selection() const;
-
     virtual String sanitizeValue(const String&) const;
 
     virtual void documentDidBecomeActive();
@@ -248,6 +250,8 @@ private:
     virtual bool isEmptyValue() const { return value().isEmpty(); }
     virtual void handleFocusEvent();
     virtual void handleBlurEvent();
+    virtual int cachedSelectionStart() const { return m_data.cachedSelectionStart(); }
+    virtual int cachedSelectionEnd() const { return m_data.cachedSelectionEnd(); }
 
     virtual bool isOptionalFormControl() const { return !isRequiredFormControl(); }
     virtual bool isRequiredFormControl() const;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
index 7cdf4871b4..59248f4459 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
@@ -42,8 +42,14 @@ module html {
 #if defined(ENABLE_DATALIST) && ENABLE_DATALIST
         readonly attribute HTMLElement     list;
 #endif
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+                 attribute [Reflect] DOMString max;
+#endif
                  attribute long            maxLength
                      setter raises(DOMException);
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+                 attribute [Reflect] DOMString min;
+#endif
                  attribute boolean         multiple;
                  attribute [ConvertNullToNullString] DOMString name;
                  attribute [Reflect] DOMString       pattern;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
index 0971ef58c3..6b7422121e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
@@ -38,6 +38,7 @@
 #include "MediaList.h"
 #include "MediaQueryEvaluator.h"
 #include "Page.h"
+#include "ScriptEventListener.h"
 #include "Settings.h"
 
 namespace WebCore {
@@ -126,7 +127,9 @@ void HTMLLinkElement::parseMappedAttribute(MappedAttribute *attr)
         process();
     } else if (attr->name() == disabledAttr) {
         setDisabledState(!attr->isNull());
-    } else {
+    } else if (attr->name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
+    else {
         if (attr->name() == titleAttr && m_sheet)
             m_sheet->setTitle(attr->value());
         HTMLElement::parseMappedAttribute(attr);
@@ -187,11 +190,7 @@ void HTMLLinkElement::process()
     // This was buggy and would incorrectly match <link rel="alternate">, which has a different specified meaning. -dwh
     if (m_disabledState != 2 && (m_isStyleSheet || acceptIfTypeContainsTextCSS && type.contains("text/css")) && document()->frame() && m_url.isValid()) {
         // also, don't load style sheets for standalone documents
-        // Add ourselves as a pending sheet, but only if we aren't an alternate 
-        // stylesheet.  Alternate stylesheets don't hold up render tree construction.
-        if (!isAlternate())
-            document()->addPendingSheet();
-
+        
         String charset = getAttribute(charsetAttr);
         if (charset.isEmpty() && document()->frame())
             charset = document()->frame()->loader()->encoding();
@@ -200,14 +199,28 @@ void HTMLLinkElement::process()
             if (m_loading)
                 document()->removePendingSheet();
             m_cachedSheet->removeClient(this);
+            m_cachedSheet = 0;
         }
+
+        if (!dispatchBeforeLoadEvent(m_url))
+            return;
+        
         m_loading = true;
+        
+        // Add ourselves as a pending sheet, but only if we aren't an alternate 
+        // stylesheet.  Alternate stylesheets don't hold up render tree construction.
+        if (!isAlternate())
+            document()->addPendingSheet();
+
         m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(m_url, charset);
+        
         if (m_cachedSheet)
             m_cachedSheet->addClient(this);
-        else if (!isAlternate()) { // The request may have been denied if stylesheet is local and document is remote.
+        else {
+            // The request may have been denied if (for example) the stylesheet is local and the document is remote.
             m_loading = false;
-            document()->removePendingSheet();
+            if (!isAlternate())
+                document()->removePendingSheet();
         }
     } else if (m_sheet) {
         // we no longer contain a stylesheet, e.g. perhaps rel or type was changed
@@ -261,7 +274,7 @@ void HTMLLinkElement::setCSSStyleSheet(const String& url, const String& charset,
         DEFINE_STATIC_LOCAL(const String, mediaWikiKHTMLFixesStyleSheet, ("/* KHTML fix stylesheet */\n/* work around the horizontal scrollbars */\n#column-content { margin-left: 0; }\n\n"));
         // There are two variants of KHTMLFixes.css. One is equal to mediaWikiKHTMLFixesStyleSheet,
         // while the other lacks the second trailing newline.
-        if (url.endsWith(slashKHTMLFixesDotCss) && mediaWikiKHTMLFixesStyleSheet.startsWith(sheetText)
+        if (url.endsWith(slashKHTMLFixesDotCss) && !sheetText.isNull() && mediaWikiKHTMLFixesStyleSheet.startsWith(sheetText)
                 && sheetText.length() >= mediaWikiKHTMLFixesStyleSheet.length() - 1) {
             ASSERT(m_sheet->length() == 1);
             ExceptionCode ec;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
index 2409d3702d..11ca3bad8b 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
@@ -28,6 +28,9 @@
 #if ENABLE(VIDEO)
 #include "HTMLMediaElement.h"
 
+#include "ClientRect.h"
+#include "ClientRectList.h"
+#include "ChromeClient.h"
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
@@ -39,6 +42,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
+#include "FrameView.h"
 #include "HTMLDocument.h"
 #include "HTMLNames.h"
 #include "HTMLSourceElement.h"
@@ -53,6 +57,7 @@
 #include "Page.h"
 #include "ProgressEvent.h"
 #include "RenderVideo.h"
+#include "RenderView.h"
 #include "ScriptEventListener.h"
 #include "TimeRanges.h"
 #include <limits>
@@ -111,6 +116,7 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* doc)
     , m_sentEndEvent(false)
     , m_pausedInternal(false)
     , m_sendProgressEvents(true)
+    , m_isFullscreen(false)
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     , m_needWidgetUpdate(false)
 #endif
@@ -161,6 +167,8 @@ void HTMLMediaElement::parseMappedAttribute(MappedAttribute* attr)
             m_player->setAutobuffer(!attr->isNull());
     } else if (attrName == onabortAttr)
         setAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
     else if (attrName == oncanplayAttr)
         setAttributeEventListener(eventNames().canplayEvent, createAttributeEventListener(this, attr));
     else if (attrName == oncanplaythroughAttr)
@@ -179,8 +187,6 @@ void HTMLMediaElement::parseMappedAttribute(MappedAttribute* attr)
         setAttributeEventListener(eventNames().loadeddataEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadedmetadataAttr)
         setAttributeEventListener(eventNames().loadedmetadataEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onloadendAttr)
-        setAttributeEventListener(eventNames().loadendEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadstartAttr)
         setAttributeEventListener(eventNames().loadstartEvent, createAttributeEventListener(this, attr));
     else if (attrName == onpauseAttr)
@@ -241,6 +247,12 @@ void HTMLMediaElement::insertedIntoDocument()
         scheduleLoad();
 }
 
+void HTMLMediaElement::willRemove()
+{
+    if (m_isFullscreen)
+        exitFullscreen();
+    HTMLElement::willRemove();
+}
 void HTMLMediaElement::removedFromDocument()
 {
     if (m_networkState > NETWORK_EMPTY)
@@ -454,17 +466,15 @@ void HTMLMediaElement::loadInternal()
     // 4 - If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, set
     // the error attribute to a new MediaError object whose code attribute is set to
     // MEDIA_ERR_ABORTED, fire a progress event called abort at the media element, in the
-    // context of the fetching process that is in progress for the element, and fire a progress
-    // event called loadend at the media element, in the context of the same fetching process.
+    // context of the fetching process that is in progress for the element.
     if (m_networkState == NETWORK_LOADING || m_networkState == NETWORK_IDLE) {
         m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
 
-        // fire synchronous 'abort' and 'loadend'
+        // fire synchronous 'abort'
         bool totalKnown = m_player && m_player->totalBytesKnown();
         unsigned loaded = m_player ? m_player->bytesLoaded() : 0;
         unsigned total = m_player ? m_player->totalBytes() : 0;
         dispatchEvent(ProgressEvent::create(eventNames().abortEvent, totalKnown, loaded, total));
-        dispatchEvent(ProgressEvent::create(eventNames().loadendEvent, totalKnown, loaded, total));
     }
 
     // 5
@@ -496,35 +506,34 @@ void HTMLMediaElement::loadInternal()
 
 void HTMLMediaElement::selectMediaResource()
 {
-    // 1 - If the media element has neither a src attribute nor any source element children, run these substeps
+    // 1 - Set the networkState to NETWORK_NO_SOURCE
+    m_networkState = NETWORK_NO_SOURCE;
+
+    // 2 - Asynchronously await a stable state.
+
+    // 3 - If the media element has neither a src attribute nor any source element children, run these substeps
     String mediaSrc = getAttribute(srcAttr);
     if (!mediaSrc && !havePotentialSourceChild()) {
         m_loadState = WaitingForSource;
 
-        // 1 -  Set the networkState to NETWORK_NO_SOURCE
-        m_networkState = NETWORK_NO_SOURCE;
-        
-        // 2 - While the media element has neither a src attribute nor any source element children, 
-        // wait. (This steps might wait forever.)
-
-        m_delayingTheLoadEvent = false;
+        // 1 - Set the networkState to NETWORK_EMPTY and abort these steps
+        m_networkState = NETWORK_EMPTY;
+        ASSERT(!m_delayingTheLoadEvent);
         return;
     }
 
-    // 2
+    // 4
     m_delayingTheLoadEvent = true;
-
-    // 3
     m_networkState = NETWORK_LOADING;
 
-    // 4
+    // 5
     scheduleProgressEvent(eventNames().loadstartEvent);
 
-    // 5 - If the media element has a src attribute, then run these substeps
+    // 6 - If the media element has a src attribute, then run these substeps
     ContentType contentType("");
-    if (!mediaSrc.isEmpty()) {
+    if (!mediaSrc.isNull()) {
         KURL mediaURL = document()->completeURL(mediaSrc);
-        if (isSafeToLoadURL(mediaURL, Complain)) {
+        if (isSafeToLoadURL(mediaURL, Complain) && dispatchBeforeLoadEvent(mediaURL.string())) {
             m_loadState = LoadingFromSrcAttr;
             loadResource(mediaURL, contentType);
         } else 
@@ -553,9 +562,20 @@ void HTMLMediaElement::loadNextSourceChild()
     loadResource(mediaURL, contentType);
 }
 
-void HTMLMediaElement::loadResource(const KURL& url, ContentType& contentType)
+void HTMLMediaElement::loadResource(const KURL& initialURL, ContentType& contentType)
 {
-    ASSERT(isSafeToLoadURL(url, Complain));
+    ASSERT(isSafeToLoadURL(initialURL, Complain));
+
+    Frame* frame = document()->frame();
+    if (!frame)
+        return;
+    FrameLoader* loader = frame->loader();
+    if (!loader)
+        return;
+
+    KURL url(initialURL);
+    if (!loader->willLoadMediaElementURL(url))
+        return;
 
     // The resource fetch algorithm 
     m_networkState = NETWORK_LOADING;
@@ -577,7 +597,13 @@ void HTMLMediaElement::loadResource(const KURL& url, ContentType& contentType)
     updateVolume();
 
     m_player->load(m_currentSrc, contentType);
-    
+
+    if (isVideo() && m_player->canLoadPoster()) {
+        KURL posterUrl = static_cast<HTMLVideoElement*>(this)->poster();
+        if (!posterUrl.isEmpty())
+            m_player->setPoster(posterUrl);
+    }
+
     if (renderer())
         renderer()->updateFromElement();
 }
@@ -588,7 +614,7 @@ bool HTMLMediaElement::isSafeToLoadURL(const KURL& url, InvalidSourceAction acti
     FrameLoader* loader = frame ? frame->loader() : 0;
 
     // don't allow remote to local urls, and check with the frame loader client.
-    if (!loader || !loader->canLoad(url, String(), document()) || !loader->client()->shouldLoadMediaElementURL(url)) {
+    if (!loader || !SecurityOrigin::canLoad(url, String(), document())) {
         if (actionIfInvalid == Complain)
             FrameLoader::reportLocalLoadFailed(frame, url.string());
         return false;
@@ -614,24 +640,19 @@ void HTMLMediaElement::noneSupported()
     m_loadState = WaitingForSource;
     m_currentSourceNode = 0;
 
-    // 4 - Reaching this step indicates that either the URL failed to resolve, or the media
+    // 5 - Reaching this step indicates that either the URL failed to resolve, or the media
     // resource failed to load. Set the error attribute to a new MediaError object whose
     // code attribute is set to MEDIA_ERR_SRC_NOT_SUPPORTED.
     m_error = MediaError::create(MediaError::MEDIA_ERR_SRC_NOT_SUPPORTED);
 
-    // 5 - Set the element's networkState attribute to the NETWORK_NO_SOURCE value.
+    // 6 - Set the element's networkState attribute to the NETWORK_NO_SOURCE value.
     m_networkState = NETWORK_NO_SOURCE;
 
-    // 6 - Queue a task to fire a progress event called error at the media element, in
+    // 7 - Queue a task to fire a progress event called error at the media element, in
     // the context of the fetching process that was used to try to obtain the media
     // resource in the resource fetch algorithm.
     scheduleProgressEvent(eventNames().errorEvent);
 
-    // 7 - Queue a task to fire a progress event called loadend at the media element, in
-    // the context of the fetching process that was used to try to obtain the media
-    // resource in the resource fetch algorithm.
-    scheduleProgressEvent(eventNames().loadendEvent);
-
     // 8 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
     m_delayingTheLoadEvent = false;
 
@@ -657,19 +678,15 @@ void HTMLMediaElement::mediaEngineError(PassRefPtr<MediaError> err)
     // the context of the fetching process started by this instance of this algorithm.
     scheduleProgressEvent(eventNames().errorEvent);
 
-    // 4 - Queue a task to fire a progress event called loadend at the media element, in
-    // the context of the fetching process started by this instance of this algorithm.
-    scheduleProgressEvent(eventNames().loadendEvent);
-
-    // 5 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a
+    // 4 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a
     // task to fire a simple event called emptied at the element.
     m_networkState = NETWORK_EMPTY;
     scheduleEvent(eventNames().emptiedEvent);
 
-    // 6 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    // 5 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
     m_delayingTheLoadEvent = false;
 
-    // 7 - Abort the overall resource selection algorithm.
+    // 6 - Abort the overall resource selection algorithm.
     m_currentSourceNode = 0;
 }
 
@@ -756,7 +773,6 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
                 setReadyState(currentState);
 
             scheduleProgressEvent(eventNames().loadEvent);
-            scheduleProgressEvent(eventNames().loadendEvent);
         }
     }
 }
@@ -1355,7 +1371,7 @@ KURL HTMLMediaElement::selectNextSourceChild(ContentType *contentType, InvalidSo
 
         // Is it safe to load this url?
         mediaURL = source->src();
-        if (!mediaURL.isValid() || !isSafeToLoadURL(mediaURL, actionIfInvalid))
+        if (!mediaURL.isValid() || !isSafeToLoadURL(mediaURL, actionIfInvalid) || !dispatchBeforeLoadEvent(mediaURL.string()))
             goto check_again;
 
         // Making it this far means the <source> looks reasonable
@@ -1514,7 +1530,12 @@ PassRefPtr<TimeRanges> HTMLMediaElement::seekable() const
 
 bool HTMLMediaElement::potentiallyPlaying() const
 {
-    return !paused() && m_readyState >= HAVE_FUTURE_DATA && !endedPlayback() && !stoppedDueToErrors() && !pausedForUserInteraction();
+    return m_readyState >= HAVE_FUTURE_DATA && couldPlayIfEnoughData();
+}
+
+bool HTMLMediaElement::couldPlayIfEnoughData() const
+{
+    return !paused() && !endedPlayback() && !stoppedDueToErrors() && !pausedForUserInteraction();
 }
 
 bool HTMLMediaElement::endedPlayback() const
@@ -1598,7 +1619,8 @@ void HTMLMediaElement::updatePlayState()
         float time = currentTime();
         if (time > m_lastSeekTime)
             addPlayedRange(m_lastSeekTime, time);
-    }
+    } else if (couldPlayIfEnoughData() && playerPaused)
+        m_player->prepareToPlay();
     
     if (renderer())
         renderer()->updateFromElement();
@@ -1629,17 +1651,13 @@ void HTMLMediaElement::userCancelledLoad()
 #endif
     stopPeriodicTimers();
 
-    // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORT.
+    // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORTED.
     m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
 
     // 3 - Queue a task to fire a progress event called abort at the media element, in the context
     // of the fetching process started by this instance of this algorithm.
     scheduleProgressEvent(eventNames().abortEvent);
 
-    // 4 - Queue a task to fire a progress event called loadend at the media element, in the context
-    // of the fetching process started by this instance of this algorithm.
-    scheduleProgressEvent(eventNames().loadendEvent);
-
     // 5 - If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the
     // element's networkState attribute to the NETWORK_EMPTY value and queue a task to fire a
     // simple event called emptied at the element. Otherwise, set set the element's networkState
@@ -1696,6 +1714,14 @@ void HTMLMediaElement::mediaVolumeDidChange()
     updateVolume();
 }
 
+const IntRect HTMLMediaElement::screenRect()
+{
+    IntRect elementRect;
+    if (renderer())
+        elementRect = renderer()->view()->frameView()->contentsToScreen(renderer()->absoluteBoundingBoxRect());
+    return elementRect;
+}
+    
 void HTMLMediaElement::defaultEventHandler(Event* event)
 {
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
@@ -1768,6 +1794,28 @@ void HTMLMediaElement::finishParsingChildren()
 
 #endif
 
+void HTMLMediaElement::enterFullscreen()
+{
+    ASSERT(!m_isFullscreen);
+    if (!renderer())
+        return;
+    if (document() && document()->page())
+        document()->page()->chrome()->client()->enterFullscreenForNode(this);
+    m_isFullscreen = true;
+}
+
+void HTMLMediaElement::exitFullscreen()
+{
+    ASSERT(m_isFullscreen);
+    if (document() && document()->page())
+        document()->page()->chrome()->client()->exitFullscreenForNode(this);
+    m_isFullscreen = false;
+}
+
+PlatformMedia HTMLMediaElement::platformMedia() const
+{
+    return m_player ? m_player->platformMedia() : NoPlatformMedia;
+}        
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
index aa8d5f72a9..0005e07dcd 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
@@ -43,7 +43,7 @@ class HTMLSourceElement;
 class MediaError;
 class KURL;
 class TimeRanges;
-    
+
 class HTMLMediaElement : public HTMLElement, public MediaPlayerClient {
 public:
     HTMLMediaElement(const QualifiedName&, Document*);
@@ -57,6 +57,7 @@ public:
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void insertedIntoDocument();
+    virtual void willRemove();
     virtual void removedFromDocument();
     virtual void attach();
     virtual void recalcStyle(StyleChange);
@@ -73,6 +74,8 @@ public:
     // Eventually overloaded in HTMLVideoElement
     virtual bool supportsFullscreen() const { return false; };
     virtual bool supportsSave() const;
+    
+    PlatformMedia platformMedia() const;
 
     void scheduleLoad();
     
@@ -141,6 +144,8 @@ public:
     void beginScrubbing();
     void endScrubbing();
 
+    const IntRect screenRect();
+
     bool canPlay() const;
 
     float percentLoaded() const;
@@ -154,6 +159,9 @@ public:
 #endif
 
     bool hasSingleSecurityOrigin() const { return !m_player || m_player->hasSingleSecurityOrigin(); }
+    
+    void enterFullscreen();
+    void exitFullscreen();
 
 protected:
     float getTimeOffsetAttribute(const QualifiedName&, float valueOnError) const;
@@ -233,6 +241,7 @@ private:
     bool endedPlayback() const;
     bool stoppedDueToErrors() const;
     bool pausedForUserInteraction() const;
+    bool couldPlayIfEnoughData() const;
 
     float minTimeSeekable() const;
     float maxTimeSeekable() const;
@@ -310,6 +319,8 @@ protected:
     // support progress events so setting m_sendProgressEvents disables them 
     bool m_sendProgressEvents : 1;
 
+    bool m_isFullscreen : 1;
+
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     bool m_needWidgetUpdate : 1;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
index 9765c43398..d3ccfa4b8a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
@@ -95,9 +95,11 @@ void HTMLObjectElement::parseMappedAttribute(MappedAttribute *attr)
         m_classId = val;
         if (renderer())
           m_needWidgetUpdate = true;
-    } else if (attr->name() == onloadAttr) {
+    } else if (attr->name() == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == nameAttr) {
+    else if (attr->name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == nameAttr) {
         const AtomicString& newName = attr->value();
         if (isDocNamedItem() && inDocument() && document()->isHTMLDocument()) {
             HTMLDocument* document = static_cast<HTMLDocument*>(this->document());
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp
index ce7fee6d88..636c579d27 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp
@@ -71,6 +71,8 @@ void HTMLScriptElement::parseMappedAttribute(MappedAttribute* attr)
         handleSourceAttribute(m_data, attr->value());
     else if (attrName == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
     else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -217,7 +219,7 @@ String HTMLScriptElement::forAttributeValue() const
 {
     return getAttribute(forAttr).string();
 }
- 
+
 void HTMLScriptElement::dispatchLoadEvent()
 {
     ASSERT(!m_data.haveFiredLoadEvent());
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
index b5e4ced56b..3030018609 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
@@ -70,6 +70,7 @@ HTMLTextAreaElement::HTMLTextAreaElement(const QualifiedName& tagName, Document*
     , m_wrap(SoftWrap)
     , m_cachedSelectionStart(-1)
     , m_cachedSelectionEnd(-1)
+    , m_isDirty(false)
 {
     ASSERT(hasTagName(textareaTag));
     setFormControlValueMatchesRenderer(true);
@@ -93,54 +94,6 @@ void HTMLTextAreaElement::restoreFormControlState(const String& state)
     setDefaultValue(state);
 }
 
-int HTMLTextAreaElement::selectionStart()
-{
-    if (!renderer())
-        return 0;
-    if (document()->focusedNode() != this && m_cachedSelectionStart >= 0)
-        return m_cachedSelectionStart;
-    return toRenderTextControl(renderer())->selectionStart();
-}
-
-int HTMLTextAreaElement::selectionEnd()
-{
-    if (!renderer())
-        return 0;
-    if (document()->focusedNode() != this && m_cachedSelectionEnd >= 0)
-        return m_cachedSelectionEnd;
-    return toRenderTextControl(renderer())->selectionEnd();
-}
-
-static RenderTextControl* rendererAfterUpdateLayout(HTMLTextAreaElement* element)
-{
-    element->document()->updateLayoutIgnorePendingStylesheets();
-    return toRenderTextControl(element->renderer());
-}
-
-void HTMLTextAreaElement::setSelectionStart(int start)
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->setSelectionStart(start);
-}
-
-void HTMLTextAreaElement::setSelectionEnd(int end)
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->setSelectionEnd(end);
-}
-
-void HTMLTextAreaElement::select()
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->select();
-}
-
-void HTMLTextAreaElement::setSelectionRange(int start, int end)
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->setSelectionRange(start, end);
-}
-
 void HTMLTextAreaElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     setValue(defaultValue());
@@ -196,18 +149,8 @@ void HTMLTextAreaElement::parseMappedAttribute(MappedAttribute* attr)
     } else if (attr->name() == alignAttr) {
         // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=7075
-    } else if (attr->name() == placeholderAttr) {
-        updatePlaceholderVisibility(true);
-    } else if (attr->name() == onfocusAttr)
-        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onblurAttr)
-        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onselectAttr)
-        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onchangeAttr)
-        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
-    else
-        HTMLFormControlElementWithState::parseMappedAttribute(attr);
+    } else
+        HTMLTextFormControlElement::parseMappedAttribute(attr);
 }
 
 RenderObject* HTMLTextAreaElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -231,6 +174,7 @@ bool HTMLTextAreaElement::appendFormData(FormDataList& encoding, bool)
 void HTMLTextAreaElement::reset()
 {
     setValue(defaultValue());
+    m_isDirty = false;
 }
 
 bool HTMLTextAreaElement::isKeyboardFocusable(KeyboardEvent*) const
@@ -316,6 +260,7 @@ void HTMLTextAreaElement::updateValue() const
     m_value = toRenderTextControl(renderer())->text();
     const_cast<HTMLTextAreaElement*>(this)->setFormControlValueMatchesRenderer(true);
     notifyFormStateChanged(this);
+    m_isDirty = true;
 }
 
 String HTMLTextAreaElement::value() const
@@ -353,6 +298,7 @@ void HTMLTextAreaElement::setValue(const String& value)
 
     setNeedsStyleRecalc();
     notifyFormStateChanged(this);
+    updateValidity();
 }
 
 String HTMLTextAreaElement::defaultValue() const
@@ -409,14 +355,26 @@ int HTMLTextAreaElement::maxLength() const
     return ok && value >= 0 ? value : -1;
 }
 
-void HTMLTextAreaElement::setMaxLength(int newValue, ExceptionCode& exceptionCode)
+void HTMLTextAreaElement::setMaxLength(int newValue, ExceptionCode& ec)
 {
     if (newValue < 0)
-        exceptionCode = INDEX_SIZE_ERR;
+        ec = INDEX_SIZE_ERR;
     else
         setAttribute(maxlengthAttr, String::number(newValue));
 }
 
+bool HTMLTextAreaElement::tooLong() const
+{
+    // Return false for the default value even if it is longer than maxLength.
+    if (!m_isDirty)
+        return false;
+
+    int max = maxLength();
+    if (max < 0)
+        return false;
+    return value().length() > static_cast<unsigned>(max);
+}
+
 void HTMLTextAreaElement::accessKeyAction(bool)
 {
     focus();
@@ -442,13 +400,6 @@ void HTMLTextAreaElement::setRows(int rows)
     setAttribute(rowsAttr, String::number(rows));
 }
 
-VisibleSelection HTMLTextAreaElement::selection() const
-{
-    if (!renderer() || m_cachedSelectionStart < 0 || m_cachedSelectionEnd < 0)
-        return VisibleSelection();
-    return toRenderTextControl(renderer())->selection(m_cachedSelectionStart, m_cachedSelectionEnd);
-}
-
 bool HTMLTextAreaElement::shouldUseInputMethod() const
 {
     return true;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
index cfd471a63d..23f61d3ef6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
@@ -55,15 +55,6 @@ public:
 
     virtual bool valueMissing() const { return isRequiredFormControl() && !disabled() && !readOnly() && value().isEmpty(); }
 
-    int selectionStart();
-    int selectionEnd();
-
-    void setSelectionStart(int);
-    void setSelectionEnd(int);
-
-    void select();
-    void setSelectionRange(int, int);
-
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
@@ -81,6 +72,7 @@ public:
     int textLength() const { return value().length(); }
     int maxLength() const;
     void setMaxLength(int, ExceptionCode&);
+    virtual bool tooLong() const;
     
     void rendererWillBeDestroyed();
     
@@ -93,7 +85,6 @@ public:
     void setRows(int);
     
     void cacheSelection(int s, int e) { m_cachedSelectionStart = s; m_cachedSelectionEnd = e; };
-    VisibleSelection selection() const;
 
     virtual bool shouldUseInputMethod() const;
 
@@ -106,6 +97,8 @@ private:
 
     virtual bool supportsPlaceholder() const { return true; }
     virtual bool isEmptyValue() const { return value().isEmpty(); }
+    virtual int cachedSelectionStart() const { return m_cachedSelectionStart; }
+    virtual int cachedSelectionEnd() const { return m_cachedSelectionEnd; }
 
     virtual bool isOptionalFormControl() const { return !isRequiredFormControl(); }
     virtual bool isRequiredFormControl() const { return required(); }
@@ -116,6 +109,7 @@ private:
     mutable String m_value;
     int m_cachedSelectionStart;
     int m_cachedSelectionEnd;
+    mutable bool m_isDirty;
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
index fa681512dd..33af9971b0 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
@@ -43,6 +43,7 @@
 #include "HTMLParser.h"
 #include "HTMLScriptElement.h"
 #include "HTMLViewSourceDocument.h"
+#include "ImageLoader.h"
 #include "InspectorTimelineAgent.h"
 #include "MappedAttribute.h"
 #include "Page.h"
@@ -441,7 +442,8 @@ HTMLTokenizer::State HTMLTokenizer::scriptHandler(State state)
 #endif
                 // The parser might have been stopped by for example a window.close call in an earlier script.
                 // If so, we don't want to load scripts.
-                if (!m_parserStopped && (cs = m_doc->docLoader()->requestScript(m_scriptTagSrcAttrValue, m_scriptTagCharsetAttrValue)))
+                if (!m_parserStopped && m_scriptNode->dispatchBeforeLoadEvent(m_scriptTagSrcAttrValue) &&
+                    (cs = m_doc->docLoader()->requestScript(m_scriptTagSrcAttrValue, m_scriptTagCharsetAttrValue)))
                     m_pendingScripts.append(cs);
                 else
                     m_scriptNode = 0;
@@ -560,7 +562,7 @@ HTMLTokenizer::State HTMLTokenizer::scriptExecution(const ScriptSourceCode& sour
 #endif
 
     m_state = state;
-    m_doc->frame()->loader()->executeScript(sourceCode);
+    m_doc->frame()->script()->executeScript(sourceCode);
     state = m_state;
 
     state.setAllowYield(true);
@@ -1673,7 +1675,7 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 
     State state = m_state;
 
-    while (!m_src.isEmpty() && (!frame || !frame->loader()->isScheduledLocationChangePending())) {
+    while (!m_src.isEmpty() && (!frame || !frame->redirectScheduler()->locationChangePending())) {
         if (!continueProcessing(processedCount, startTime, state))
             break;
 
@@ -1801,6 +1803,9 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 
     if (m_noMoreData && !m_inWrite && !state.loadingExtScript() && !m_executingScript && !m_timer.isActive())
         end(); // this actually causes us to be deleted
+    
+    // After parsing, go ahead and dispatch image beforeload/load events.
+    ImageLoader::dispatchPendingEvents();
 }
 
 void HTMLTokenizer::stopParsing()
@@ -1981,6 +1986,14 @@ void HTMLTokenizer::enlargeScriptBuffer(int len)
         CRASH();
 
     int newSize = m_scriptCodeCapacity + delta;
+    // If we allow fastRealloc(ptr, 0), it will call CRASH(). We run into this
+    // case if the HTML being parsed begins with "<!--" and there's more data
+    // coming.
+    if (!newSize) {
+        ASSERT(!m_scriptCode);
+        return;
+    }
+
     m_scriptCode = static_cast<UChar*>(fastRealloc(m_scriptCode, newSize * sizeof(UChar)));
     m_scriptCodeCapacity = newSize;
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp
index ecd74e7482..5bbc16747e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp
@@ -28,6 +28,7 @@
 #if ENABLE(VIDEO)
 #include "HTMLVideoElement.h"
 
+#include "ChromeClient.h"
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "Document.h"
@@ -112,6 +113,18 @@ void HTMLVideoElement::parseMappedAttribute(MappedAttribute* attr)
         HTMLMediaElement::parseMappedAttribute(attr);
 }
 
+bool HTMLVideoElement::supportsFullscreen() const
+{
+    Page* page = document() ? document()->page() : 0;
+    if (!page) 
+        return false;
+
+    if (!m_player || !m_player->supportsFullscreen())
+        return false;
+    
+    return page->chrome()->client()->supportsFullscreenForNode(this);
+}
+
 unsigned HTMLVideoElement::videoWidth() const
 {
     if (!m_player)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
index dc9714a3df..096eb539ad 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
@@ -49,7 +49,7 @@ public:
     virtual void parseMappedAttribute(MappedAttribute* attr);
     virtual bool isVideo() const { return true; }
     virtual bool hasVideo() const { return player() && player()->hasVideo(); }
-    virtual bool supportsFullscreen() const { return player() && player()->supportsFullscreen(); }
+    virtual bool supportsFullscreen() const;
     virtual bool isURLAttribute(Attribute*) const;
     virtual const QualifiedName& imageSourceAttributeName() const;
 
diff --git a/src/3rdparty/webkit/WebCore/html/ValidityState.cpp b/src/3rdparty/webkit/WebCore/html/ValidityState.cpp
index df8933da42..6b0a0b4a08 100644
--- a/src/3rdparty/webkit/WebCore/html/ValidityState.cpp
+++ b/src/3rdparty/webkit/WebCore/html/ValidityState.cpp
@@ -26,6 +26,12 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "KURL.h"
+#include "RegularExpression.h"
+#include <wtf/StdLibExtras.h>
+
+#define EMAIL_LOCALPART "[a-z0-9!#$%&'*+/=?^_`{|}~.-]+"
+#define EMAIL_DOMAINPART "[a-z0-9-]+(\\.[a-z0-9-]+)+"
+#define EMAIL_PATTERN EMAIL_LOCALPART "@" EMAIL_DOMAINPART
 
 namespace WebCore {
 
@@ -55,11 +61,38 @@ bool ValidityState::typeMismatch()
         return !HTMLInputElement::formStringToDouble(value, 0);
     case HTMLInputElement::URL:
         return !KURL(KURL(), value).isValid();
+    case HTMLInputElement::EMAIL:
+    {
+        if (!input->multiple())
+            return !isValidEmailAddress(value);
+            
+        Vector<String> email_list;
+        value.split(',', email_list);
+        for (unsigned i = 0; i < email_list.size(); ++i)
+            if (!isValidEmailAddress(email_list[i]))
+                return true;
+
+        return false;
+    }
     default:
         return false;
     }
 }
 
+bool ValidityState::rangeUnderflow()
+{
+    if (!control()->hasTagName(inputTag))
+        return false;
+    return static_cast<HTMLInputElement*>(control())->rangeUnderflow();
+}
+
+bool ValidityState::rangeOverflow()
+{
+    if (!control()->hasTagName(inputTag))
+        return false;
+    return static_cast<HTMLInputElement*>(control())->rangeOverflow();
+}
+
 bool ValidityState::valid()
 {
     bool someError = typeMismatch() || stepMismatch() || rangeUnderflow() || rangeOverflow() ||
@@ -81,4 +114,19 @@ bool ValidityState::isValidColorString(const String& value)
     return color.isValid() && !color.hasAlpha();
 }
 
+bool ValidityState::isValidEmailAddress(const String& email)
+{
+    if (email.isEmpty())
+        return false;
+
+    DEFINE_STATIC_LOCAL(AtomicString, emailPattern, (EMAIL_PATTERN));
+    DEFINE_STATIC_LOCAL(RegularExpression, regExp, (emailPattern, TextCaseInsensitive));
+
+    int matchLength = 0;
+    int emailLength = email.length();
+    int matchOffset = regExp.match(email, 0, &matchLength);
+
+    return matchOffset == 0 && matchLength == emailLength;
+}
+
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/html/ValidityState.h b/src/3rdparty/webkit/WebCore/html/ValidityState.h
index 1b87f990bf..1dee306070 100644
--- a/src/3rdparty/webkit/WebCore/html/ValidityState.h
+++ b/src/3rdparty/webkit/WebCore/html/ValidityState.h
@@ -43,9 +43,9 @@ namespace WebCore {
         bool valueMissing() { return control()->valueMissing(); }
         bool typeMismatch();
         bool patternMismatch() { return control()->patternMismatch(); }
-        bool tooLong() { return false; }
-        bool rangeUnderflow() { return false; }
-        bool rangeOverflow() { return false; }
+        bool tooLong() { return control()->tooLong(); }
+        bool rangeUnderflow();
+        bool rangeOverflow();
         bool stepMismatch() { return false; }
         bool customError() { return !m_customErrorMessage.isEmpty(); }
         bool valid();
@@ -56,6 +56,7 @@ namespace WebCore {
         String m_customErrorMessage;
 
         static bool isValidColorString(const String&);
+        bool isValidEmailAddress(const String&);
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.h
new file mode 100644
index 0000000000..b04b0d0ca3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasActiveInfo_h
+#define CanvasActiveInfo_h
+
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class CanvasActiveInfo : public RefCounted<CanvasActiveInfo> {
+public:
+    static PassRefPtr<CanvasActiveInfo> create(const String& name, unsigned type, int size)
+    {
+        return adoptRef(new CanvasActiveInfo(name, type, size));
+    }
+    String name() const { return m_name; }
+    unsigned type() const { return m_type; }
+    int size() const { return m_size; }
+
+private:
+    CanvasActiveInfo(const String& name, unsigned type, int size)
+        : m_name(name)
+        , m_type(type)
+        , m_size(size)
+    {
+        ASSERT(name.length());
+        ASSERT(type);
+        ASSERT(size);
+    }
+    String m_name;
+    unsigned m_type;
+    int m_size;
+};
+
+}
+
+#endif // CanvasActiveInfo_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.idl
new file mode 100644
index 0000000000..6ceae29111
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        Conditional=3D_CANVAS,
+    ] CanvasActiveInfo {
+        readonly attribute int size;
+        readonly attribute unsigned int type;
+        readonly attribute DOMString name;
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.cpp
index 37cc840d89..6b5688ab27 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.cpp
@@ -36,7 +36,7 @@ namespace WebCore {
         : m_offset(offset)
         , m_buffer(buffer)
     {
-        m_baseAddress = static_cast<char*>(m_buffer->data()) + m_offset;
+        m_baseAddress = m_buffer ? (static_cast<char*>(m_buffer->data()) + m_offset) : 0;
     }
 
     CanvasArray::~CanvasArray()
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.h
index e34ad8cb94..8cedbbea21 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.h
@@ -34,6 +34,14 @@
 namespace WebCore {
     class CanvasArray : public RefCounted<CanvasArray> {
     public:
+        virtual bool isByteArray() const { return false; }
+        virtual bool isUnsignedByteArray() const { return false; }
+        virtual bool isShortArray() const { return false; }
+        virtual bool isUnsignedShortArray() const { return false; }
+        virtual bool isIntArray() const { return false; }
+        virtual bool isUnsignedIntArray() const { return false; }
+        virtual bool isFloatArray() const { return false; }
+        
         PassRefPtr<CanvasArrayBuffer> buffer() {
             return m_buffer;
         }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.idl
index 01bb37e0eb..63b2dcd6bc 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.idl
@@ -24,7 +24,7 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasArray {
+    interface [Conditional=3D_CANVAS, CustomToJS] CanvasArray {
         readonly attribute long length;
         int sizeInBytes();
         int alignedSizeInBytes();
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.cpp
index 8375334ac0..0f72ccf537 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.cpp
@@ -48,12 +48,13 @@ PassRefPtr<CanvasByteArray> CanvasByteArray::create(signed char* array, unsigned
 
 PassRefPtr<CanvasByteArray> CanvasByteArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
 {
-    // Check to make sure we are talking about a valid region of
-    // the given CanvasArrayBuffer's storage.
-    if ((offset + (length * sizeof(signed char))) > buffer->byteLength()) {
-        return NULL;
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given CanvasArrayBuffer's storage.
+        if ((offset + (length * sizeof(signed char))) > buffer->byteLength())
+            return NULL;
     }
-
+    
     return adoptRef(new CanvasByteArray(buffer, offset, length));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.h
index 34ae292345..69cadf77f5 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.h
@@ -27,6 +27,7 @@
 #define CanvasByteArray_h
 
 #include "CanvasArray.h"
+#include <limits>
 #include <wtf/MathExtras.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -37,6 +38,8 @@ namespace WebCore {
 
     class CanvasByteArray : public CanvasArray {
     public:
+        virtual bool isByteArray() const { return true; }
+
         static PassRefPtr<CanvasByteArray> create(unsigned length);
         static PassRefPtr<CanvasByteArray> create(signed char* array, unsigned length);
         static PassRefPtr<CanvasByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.cpp
index c78be1a625..09561cb6f5 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.cpp
@@ -48,16 +48,15 @@ namespace WebCore {
     PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
     {
         // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(float)) != 0) {
+        if ((offset % sizeof(float)) != 0)
             return NULL;
-        }
 
-        // Check to make sure we are talking about a valid region of
-        // the given CanvasArrayBuffer's storage.
-        if ((offset + (length * sizeof(float))) > buffer->byteLength()) {
-            return NULL;
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(float))) > buffer->byteLength())
+                return NULL;
         }
-
         return adoptRef(new CanvasFloatArray(buffer, offset, length));
     }
     
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.h
index 49bd8978ae..d2dc4ffbf4 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.h
@@ -35,6 +35,8 @@ namespace WebCore {
     
     class CanvasFloatArray : public CanvasArray {
     public:
+        virtual bool isFloatArray() const { return true; }
+
         static PassRefPtr<CanvasFloatArray> create(unsigned length);
         static PassRefPtr<CanvasFloatArray> create(float* array, unsigned length);
         static PassRefPtr<CanvasFloatArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.cpp
index 9a07b6efff..4716d7bc4d 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.cpp
@@ -51,16 +51,16 @@ namespace WebCore {
                                                       unsigned length)
     {
         // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(int)) != 0) {
+        if ((offset % sizeof(int)) != 0)
             return NULL;
-        }
 
-        // Check to make sure we are talking about a valid region of
-        // the given CanvasArrayBuffer's storage.
-        if ((offset + (length * sizeof(int))) > buffer->byteLength()) {
-            return NULL;
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(int))) > buffer->byteLength())
+                return NULL;
         }
-
+        
         return adoptRef(new CanvasIntArray(buffer, offset, length));
     }
     
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.h
index ace6410c48..4977034c81 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.h
@@ -27,6 +27,7 @@
 #define CanvasIntArray_h
 
 #include "CanvasArray.h"
+#include <limits>
 #include <wtf/MathExtras.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -35,6 +36,8 @@ namespace WebCore {
     
     class CanvasIntArray : public CanvasArray {
     public:
+        virtual bool isIntArray() const { return true; }
+
         static PassRefPtr<CanvasIntArray> create(unsigned length);
         static PassRefPtr<CanvasIntArray> create(int* array, unsigned length);
         static PassRefPtr<CanvasIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.h
index 413da712bb..748278d789 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.h
@@ -48,12 +48,12 @@ namespace WebCore {
             deleteObject();
             m_context = 0;
         }
-        
+
+        CanvasRenderingContext3D* context() const { return m_context; }
+
     protected:
         CanvasObject(CanvasRenderingContext3D*);
         virtual void _deleteObject(Platform3DObject) = 0;
-        
-        CanvasRenderingContext3D* context() const { return m_context; }
     
     private:
         Platform3DObject m_object;
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index ed462fc1a6..5e25b93e61 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -687,7 +687,7 @@ void CanvasRenderingContext2D::clip()
         return;
     if (!state().m_invertibleCTM)
         return;
-    c->clip(m_path);
+    c->canvasClip(m_path);
 #if ENABLE(DASHBOARD_SUPPORT)
     clearPathForDashboardBackwardCompatibilityMode();
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp
index b810500748..9cca57b811 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp
@@ -28,6 +28,8 @@
 #if ENABLE(3D_CANVAS)
 
 #include "CanvasRenderingContext3D.h"
+
+#include "CanvasActiveInfo.h"
 #include "CanvasBuffer.h"
 #include "CanvasFramebuffer.h"
 #include "CanvasProgram.h"
@@ -477,6 +479,26 @@ void CanvasRenderingContext3D::generateMipmap(unsigned long target)
     cleanupAfterGraphicsCall(false);
 }
 
+PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveAttrib(CanvasProgram* program, unsigned long index, ExceptionCode& ec)
+{
+    ActiveInfo info;
+    if (!program || program->context() != this || !m_context.getActiveAttrib(program, index, info)) {
+        ec = INDEX_SIZE_ERR;
+        return 0;
+    }
+    return CanvasActiveInfo::create(info.name, info.type, info.size);
+}
+
+PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveUniform(CanvasProgram* program, unsigned long index, ExceptionCode& ec)
+{
+    ActiveInfo info;
+    if (!program || program->context() != this || !m_context.getActiveUniform(program, index, info)) {
+        ec = INDEX_SIZE_ERR;
+        return 0;
+    }
+    return CanvasActiveInfo::create(info.name, info.type, info.size);
+}
+
 int CanvasRenderingContext3D::getAttribLocation(CanvasProgram* program, const String& name)
 {
     return m_context.getAttribLocation(program, name);
@@ -792,6 +814,13 @@ void CanvasRenderingContext3D::polygonOffset(double factor, double units)
     cleanupAfterGraphicsCall(false);
 }
 
+PassRefPtr<CanvasArray> CanvasRenderingContext3D::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
+{
+    RefPtr<CanvasArray> array = m_context.readPixels(x, y, width, height, format, type);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
 void CanvasRenderingContext3D::releaseShaderCompiler()
 {
     m_context.releaseShaderCompiler();
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h
index a4a68fc5e0..526281bc05 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h
@@ -36,6 +36,7 @@
 
 namespace WebCore {
 
+class CanvasActiveInfo;
 class CanvasBuffer;
 class CanvasFramebuffer;
 class CanvasObject;
@@ -123,7 +124,10 @@ class WebKitCSSMatrix;
         void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture*, long level);
         void frontFace(unsigned long mode);
         void generateMipmap(unsigned long target);
-        
+
+        PassRefPtr<CanvasActiveInfo> getActiveAttrib(CanvasProgram*, unsigned long index, ExceptionCode&);
+        PassRefPtr<CanvasActiveInfo> getActiveUniform(CanvasProgram*, unsigned long index, ExceptionCode&);
+
         int  getAttribLocation(CanvasProgram*, const String& name);
 
         bool getBoolean(unsigned long pname);
@@ -187,8 +191,7 @@ class WebKitCSSMatrix;
         void pixelStorei(unsigned long pname, long param);
         void polygonOffset(double factor, double units);
         
-        // TBD
-        //void readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type, void* pixels);
+        PassRefPtr<CanvasArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
         
         void releaseShaderCompiler();
         void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.idl
index 4b9a8898b0..db0fff34b9 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.idl
@@ -530,8 +530,11 @@ module html {
         void         generateMipmap(in unsigned long target);
         
         // FIXME: these need to be added per the WebGL spec
-        // CanvasActiveInfo getActiveAttrib(GLuint program, GLuint index);
-        // CanvasActiveInfo getActiveUniform(GLuint program, GLuint index);
+        CanvasActiveInfo getActiveAttrib(in CanvasProgram program, in unsigned long index)
+            raises (DOMException);
+        CanvasActiveInfo getActiveUniform(in CanvasProgram program, in unsigned long index)
+            raises (DOMException);
+
         // CanvasShaderArray glGetAttachedShaders(GLuint program);
 
         int          getAttribLocation(in CanvasProgram program, in DOMString name);
@@ -597,8 +600,7 @@ module html {
         void         pixelStorei(in unsigned long pname, in long param);
         void         polygonOffset(in double factor, in double units);
         
-        // FIXME
-        //void         readPixels(in long x, in long y, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long type, void* pixels);
+        CanvasArray readPixels(in long x, in long y, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long type);
         
         void         releaseShaderCompiler();
         void         renderbufferStorage(in unsigned long target, in unsigned long internalformat, in unsigned long width, in unsigned long height);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.cpp
index 44fc18e944..d0cf135e2b 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.cpp
@@ -51,14 +51,14 @@ namespace WebCore {
                                                           unsigned length)
     {
         // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(short)) != 0) {
+        if ((offset % sizeof(short)) != 0)
             return NULL;
-        }
 
-        // Check to make sure we are talking about a valid region of
-        // the given CanvasArrayBuffer's storage.
-        if ((offset + (length * sizeof(short))) > buffer->byteLength()) {
-            return NULL;
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(short))) > buffer->byteLength())
+                return NULL;
         }
 
         return adoptRef(new CanvasShortArray(buffer, offset, length));
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.h
index 2ac86b5432..1eeef0c39a 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.h
@@ -27,6 +27,7 @@
 #define CanvasShortArray_h
 
 #include "CanvasArray.h"
+#include <limits>
 #include <wtf/MathExtras.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -35,6 +36,8 @@ namespace WebCore {
     
     class CanvasShortArray : public CanvasArray {
     public:
+        virtual bool isShortArray() const { return true; }
+
         static PassRefPtr<CanvasShortArray> create(unsigned length);
         static PassRefPtr<CanvasShortArray> create(short* array, unsigned length);
         static PassRefPtr<CanvasShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
index 0ad7b2be61..a75066c6c2 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
@@ -50,10 +50,11 @@ namespace WebCore {
                                                                         int offset,
                                                                         unsigned length)
     {
-        // Check to make sure we are talking about a valid region of
-        // the given CanvasArrayBuffer's storage.
-        if ((offset + (length * sizeof(unsigned char))) > buffer->byteLength()) {
-            return NULL;
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(unsigned char))) > buffer->byteLength())
+                return NULL;
         }
 
         return adoptRef(new CanvasUnsignedByteArray(buffer, offset, length));
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.h
index f1b7348679..d8864e04bd 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.h
@@ -27,6 +27,7 @@
 #define CanvasUnsignedByteArray_h
 
 #include "CanvasArray.h"
+#include <limits>
 #include <wtf/MathExtras.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -35,6 +36,8 @@ namespace WebCore {
     
     class CanvasUnsignedByteArray : public CanvasArray {
     public:
+        virtual bool isUnsignedByteArray() const { return true; }
+
         static PassRefPtr<CanvasUnsignedByteArray> create(unsigned length);
         static PassRefPtr<CanvasUnsignedByteArray> create(unsigned char* array, unsigned length);
         static PassRefPtr<CanvasUnsignedByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
index e00e7834b8..bd26343f33 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
@@ -55,10 +55,11 @@ namespace WebCore {
             return NULL;
         }
 
-        // Check to make sure we are talking about a valid region of
-        // the given CanvasArrayBuffer's storage.
-        if ((offset + (length * sizeof(unsigned int))) > buffer->byteLength()) {
-            return NULL;
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(unsigned int))) > buffer->byteLength())
+                return NULL;
         }
 
         return adoptRef(new CanvasUnsignedIntArray(buffer, offset, length));
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.h
index 21f0d10750..10b8edf154 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.h
@@ -27,6 +27,7 @@
 #define CanvasUnsignedIntArray_h
 
 #include "CanvasArray.h"
+#include <limits>
 #include <wtf/MathExtras.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -35,6 +36,8 @@ namespace WebCore {
     
     class CanvasUnsignedIntArray : public CanvasArray {
     public:
+        virtual bool isUnsignedIntArray() const { return true; }
+
         static PassRefPtr<CanvasUnsignedIntArray> create(unsigned length);
         static PassRefPtr<CanvasUnsignedIntArray> create(unsigned int* array, unsigned length);
         static PassRefPtr<CanvasUnsignedIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
index 03a4ce1c08..45d827b78c 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
@@ -55,10 +55,11 @@ namespace WebCore {
             return NULL;
         }
 
-        // Check to make sure we are talking about a valid region of
-        // the given CanvasArrayBuffer's storage.
-        if ((offset + (length * sizeof(unsigned short))) > buffer->byteLength()) {
-            return NULL;
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(unsigned short))) > buffer->byteLength()) 
+                return NULL;
         }
 
         return adoptRef(new CanvasUnsignedShortArray(buffer, offset, length));
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.h
index 324e868fd2..9e27566bb5 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.h
@@ -27,6 +27,7 @@
 #define CanvasUnsignedShortArray_h
 
 #include "CanvasArray.h"
+#include <limits>
 #include <wtf/MathExtras.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -35,6 +36,8 @@ namespace WebCore {
     
     class CanvasUnsignedShortArray : public CanvasArray {
     public:
+        virtual bool isUnsignedShortArray() const { return true; }
+
         static PassRefPtr<CanvasUnsignedShortArray> create(unsigned length);
         static PassRefPtr<CanvasUnsignedShortArray> create(unsigned short* array, unsigned length);
         static PassRefPtr<CanvasUnsignedShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp
index 752ec0cee5..83a9719437 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp
@@ -46,6 +46,7 @@
 #include "InspectorFrontend.h"
 #include "InspectorResource.h"
 #include "Pasteboard.h"
+#include "ScriptArray.h"
 #include "ScriptFunctionCall.h"
 
 #if ENABLE(DOM_STORAGE)
@@ -257,33 +258,26 @@ const String& InspectorBackend::platform() const
     return platform;
 }
 
-void InspectorBackend::enableTimeline(bool always)
+void InspectorBackend::startTimelineProfiler()
 {
     if (m_inspectorController)
-        m_inspectorController->enableTimeline(always);
+        m_inspectorController->startTimelineProfiler();
 }
 
-void InspectorBackend::disableTimeline(bool always)
+void InspectorBackend::stopTimelineProfiler()
 {
     if (m_inspectorController)
-        m_inspectorController->disableTimeline(always);
+        m_inspectorController->stopTimelineProfiler();
 }
 
-bool InspectorBackend::timelineEnabled() const
+bool InspectorBackend::timelineProfilerEnabled() const
 {
     if (m_inspectorController)
-        return m_inspectorController->timelineEnabled();
+        return m_inspectorController->timelineProfilerEnabled();
     return false;
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-const ProfilesArray& InspectorBackend::profiles() const
-{
-    if (m_inspectorController)
-        return m_inspectorController->profiles();
-    return m_emptyProfiles;
-}
-
 void InspectorBackend::startProfiling()
 {
     if (m_inspectorController)
@@ -315,6 +309,18 @@ bool InspectorBackend::profilerEnabled()
     return false;
 }
 
+void InspectorBackend::getProfileHeaders(long callId)
+{
+    if (m_inspectorController)
+        m_inspectorController->getProfileHeaders(callId);
+}
+
+void InspectorBackend::getProfile(long callId, unsigned uid)
+{
+    if (m_inspectorController)
+        m_inspectorController->getProfile(callId, uid);
+}
+
 void InspectorBackend::enableDebugger(bool always)
 {
     if (m_inspectorController)
@@ -395,7 +401,7 @@ void InspectorBackend::stepOutOfFunctionInDebugger()
 
 #endif
 
-void InspectorBackend::dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments)
+void InspectorBackend::dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments, bool async)
 {
     InspectorFrontend* frontend = inspectorFrontend();
     if (!frontend)
@@ -404,8 +410,12 @@ void InspectorBackend::dispatchOnInjectedScript(long callId, const String& metho
     ScriptFunctionCall function(m_inspectorController->m_scriptState, m_inspectorController->m_injectedScriptObj, "dispatch");
     function.appendArgument(methodName);
     function.appendArgument(arguments);
+    if (async)
+        function.appendArgument(static_cast<int>(callId));
     bool hadException = false;
     ScriptValue result = function.call(hadException);
+    if (async)
+        return;  // InjectedScript will return result asynchronously by means of ::reportDidDispatchOnInjectedScript.
     if (hadException)
         frontend->didDispatchOnInjectedScript(callId, "", true);
     else
@@ -450,18 +460,48 @@ void InspectorBackend::copyNode(long nodeId)
     String markup = createMarkup(node);
     Pasteboard::generalPasteboard()->writePlainText(markup);
 }
+    
+void InspectorBackend::removeNode(long callId, long nodeId)
+{
+    InspectorFrontend* frontend = inspectorFrontend();
+    if (!frontend)
+        return;
+
+    Node* node = nodeForId(nodeId);
+    if (!node) {
+        // Use -1 to denote an error condition.
+        frontend->didRemoveNode(callId, -1);
+        return;
+    }
+
+    Node* parentNode = node->parentNode();
+    if (!parentNode) {
+        frontend->didRemoveNode(callId, -1);
+        return;
+    }
+
+    ExceptionCode code;
+    parentNode->removeChild(node, code);
+    if (code) {
+        frontend->didRemoveNode(callId, -1);
+        return;
+    }
+
+    frontend->didRemoveNode(callId, nodeId);
+}
 
-void InspectorBackend::getCookies(long callId)
+void InspectorBackend::getCookies(long callId, const String& domain)
 {
-    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
-        domAgent->getCookies(callId);
+    if (!m_inspectorController)
+        return;
+    m_inspectorController->getCookies(callId, domain);
 }
 
-void InspectorBackend::deleteCookie(const String& cookieName)
+void InspectorBackend::deleteCookie(const String& cookieName, const String& domain)
 {
     if (!m_inspectorController)
         return;
-    m_inspectorController->deleteCookie(cookieName);
+    m_inspectorController->deleteCookie(cookieName, domain);
 }
 
 void InspectorBackend::highlight(long nodeId)
@@ -477,10 +517,10 @@ Node* InspectorBackend::nodeForId(long nodeId)
     return 0;
 }
 
-ScriptValue InspectorBackend::wrapObject(const ScriptValue& object)
+ScriptValue InspectorBackend::wrapObject(const ScriptValue& object, const String& objectGroup)
 {
     if (m_inspectorController)
-        return m_inspectorController->wrapObject(object);
+        return m_inspectorController->wrapObject(object, objectGroup);
     return ScriptValue();
 }
 
@@ -491,6 +531,12 @@ ScriptValue InspectorBackend::unwrapObject(const String& objectId)
     return ScriptValue();
 }
 
+void InspectorBackend::releaseWrapperObjectGroup(const String& objectGroup)
+{
+    if (m_inspectorController)
+        m_inspectorController->releaseWrapperObjectGroup(objectGroup);
+}
+
 long InspectorBackend::pushNodePathToFrontend(Node* node, bool selectInUI)
 {
     InspectorFrontend* frontend = inspectorFrontend();
@@ -510,10 +556,32 @@ void InspectorBackend::addNodesToSearchResult(const String& nodeIds)
 }
 
 #if ENABLE(DATABASE)
+Database* InspectorBackend::databaseForId(long databaseId)
+{
+    if (m_inspectorController)
+        return m_inspectorController->databaseForId(databaseId);
+    return 0;
+}
+
 void InspectorBackend::selectDatabase(Database* database)
 {
-    if (InspectorFrontend* frontend = inspectorFrontend())
-        frontend->selectDatabase(database);
+    if (m_inspectorController)
+        m_inspectorController->selectDatabase(database);
+}
+
+void InspectorBackend::getDatabaseTableNames(long callId, long databaseId)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend()) {
+        ScriptArray result = frontend->newScriptArray();
+        Database* database = m_inspectorController->databaseForId(databaseId);
+        if (database) {
+            Vector<String> tableNames = database->tableNames();
+            unsigned length = tableNames.size();
+            for (unsigned i = 0; i < length; ++i)
+                result.set(i, tableNames[i]);
+        }
+        frontend->didGetDatabaseTableNames(callId, result);
+    }
 }
 #endif
 
@@ -543,6 +611,18 @@ void InspectorBackend::removeDOMStorageItem(long callId, long storageId, const S
 }
 #endif
 
+void InspectorBackend::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
+{
+    if (m_inspectorController)
+        m_inspectorController->didEvaluateForTestInFrontend(callId, jsonResult);
+}
+
+void InspectorBackend::reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->didDispatchOnInjectedScript(callId, result, isException);
+}
+
 InspectorDOMAgent* InspectorBackend::inspectorDOMAgent()
 {
     if (!m_inspectorController)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h
index 72278a3e81..9d75e2f7a4 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h
@@ -95,13 +95,11 @@ public:
 
     const String& platform() const;
 
-    void enableTimeline(bool always);
-    void disableTimeline(bool always);
-    bool timelineEnabled() const;
+    void startTimelineProfiler();
+    void stopTimelineProfiler();
+    bool timelineProfilerEnabled() const;
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    const ProfilesArray& profiles() const;
-
     void startProfiling();
     void stopProfiling();
 
@@ -109,6 +107,9 @@ public:
     void disableProfiler(bool always);
     bool profilerEnabled();
 
+    void getProfileHeaders(long callId);
+    void getProfile(long callId, unsigned uid);
+
     void enableDebugger(bool always);
     void disableDebugger(bool always);
     bool debuggerEnabled() const;
@@ -130,26 +131,30 @@ public:
     void stepOutOfFunctionInDebugger();
 #endif
 
-    void dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments);
+    void dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments, bool async);
     void getChildNodes(long callId, long nodeId);
     void setAttribute(long callId, long elementId, const String& name, const String& value);
     void removeAttribute(long callId, long elementId, const String& name);
     void setTextNodeValue(long callId, long nodeId, const String& value);
     void getEventListenersForNode(long callId, long nodeId);
     void copyNode(long nodeId);
+    void removeNode(long callId, long nodeId);
 
-    void getCookies(long callId);
-    void deleteCookie(const String& cookieName);
+    void getCookies(long callId, const String& domain);
+    void deleteCookie(const String& cookieName, const String& domain);
 
     // Generic code called from custom implementations.
     void highlight(long nodeId);
     Node* nodeForId(long nodeId);
-    ScriptValue wrapObject(const ScriptValue& object);
+    ScriptValue wrapObject(const ScriptValue& object, const String& objectGroup);
     ScriptValue unwrapObject(const String& objectId);
+    void releaseWrapperObjectGroup(const String& objectGroup);
     long pushNodePathToFrontend(Node* node, bool selectInUI);
     void addNodesToSearchResult(const String& nodeIds);
 #if ENABLE(DATABASE)
+    Database* databaseForId(long databaseId);
     void selectDatabase(Database* database);
+    void getDatabaseTableNames(long callId, long databaseId);
 #endif
 #if ENABLE(DOM_STORAGE)
     void selectDOMStorage(Storage* storage);
@@ -157,6 +162,8 @@ public:
     void setDOMStorageItem(long callId, long storageId, const String& key, const String& value);
     void removeDOMStorageItem(long callId, long storageId, const String& key);
 #endif
+    void reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException);
+    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
 
 private:
     InspectorBackend(InspectorController* inspectorController, InspectorClient* client);
@@ -165,9 +172,6 @@ private:
 
     InspectorController* m_inspectorController;
     InspectorClient* m_client;
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    ProfilesArray m_emptyProfiles;
-#endif
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl
index 5c6babb62c..7a00c6aabd 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl
@@ -52,17 +52,18 @@ module core {
         boolean addSourceToFrame(in DOMString mimeType, in DOMString sourceValue, in Node frame);
         [Custom] void search(in Node node, in DOMString query);
 #if defined(ENABLE_DATABASE) && ENABLE_DATABASE
-        [Custom] DOMObject databaseTableNames(in Database database);
+        void getDatabaseTableNames(in long callId, in long databaseId);
 #endif
+
         [Custom] DOMObject setting(in DOMString key);
         [Custom] void setSetting(in DOMString key, in DOMObject  value);
         [Custom] DOMWindow inspectedWindow();
         DOMString localizedStringsURL();
         DOMString hiddenPanels();
         DOMString platform();
-        void enableTimeline(in boolean always);
-        void disableTimeline(in boolean always);
-        boolean timelineEnabled();
+        void startTimelineProfiler();
+        void stopTimelineProfiler();
+        boolean timelineProfilerEnabled();
         [ImplementationFunction=moveWindowBy] void moveByUnrestricted(in float x, in float y);
         void setAttachedWindowHeight(in unsigned long height);
         [Custom] DOMObject wrapCallback(in DOMObject callback);
@@ -99,27 +100,32 @@ module core {
         void startProfiling();
         void stopProfiling();
 
-        [Custom] Array profiles();
+        void getProfileHeaders(in long callId);
+        void getProfile(in long callId, in unsigned long uid);
 #endif
-        void dispatchOnInjectedScript(in long callId, in DOMString methodName, in DOMString arguments);
+        void dispatchOnInjectedScript(in long callId, in DOMString methodName, in DOMString arguments, in boolean async);
         void getChildNodes(in long callId, in long nodeId);
         void setAttribute(in long callId, in long elementId, in DOMString name, in DOMString value);
         void removeAttribute(in long callId, in long elementId, in DOMString name);
         void setTextNodeValue(in long callId, in long nodeId, in DOMString value);
         void getEventListenersForNode(in long callId, in long nodeId);
         void copyNode(in long nodeId);
+        void removeNode(in long callId, in long nodeId);
 
-        void getCookies(in long callId);
-        void deleteCookie(in DOMString cookieName);
+        void getCookies(in long callId, in DOMString domain);
+        void deleteCookie(in DOMString cookieName, in DOMString domain);
 
         // Called from InjectedScript.
+        // TODO: extract into a separate IDL.
         [Custom] DOMObject nodeForId(in long nodeId);
-        [Custom] long wrapObject(in DOMObject object);
+        [Custom] long wrapObject(in DOMObject object, in DOMString objectGroup);
         [Custom] DOMObject unwrapObject(in long objectId);
+        void releaseWrapperObjectGroup(in DOMString objectGroup);
         [Custom] int pushNodePathToFrontend(in DOMObject node, in boolean selectInUI);
         void addNodesToSearchResult(in DOMString nodeIds);
 #if defined(ENABLE_DATABASE) && ENABLE_DATABASE
         [Custom] void selectDatabase(in DOMObject database);
+        [Custom] DOMObject databaseForId(in long databaseId);
 #endif
 #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
         [Custom] void selectDOMStorage(in DOMObject storage);
@@ -127,5 +133,7 @@ module core {
         void setDOMStorageItem(in long callId, in long storageId, in DOMString key, in DOMString value);
         void removeDOMStorageItem(in long callId, in long storageId, in DOMString key);
 #endif
+        void reportDidDispatchOnInjectedScript(in long callId, in DOMString result, in boolean isException);
+        void didEvaluateForTestInFrontend(in long callId, in DOMString jsonResult);
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
index bb77ebfafe..a5b8cbfe0b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
@@ -36,6 +36,7 @@
 #include "CachedResource.h"
 #include "Console.h"
 #include "ConsoleMessage.h"
+#include "Cookie.h"
 #include "CookieJar.h"
 #include "Document.h"
 #include "DocumentLoader.h"
@@ -76,6 +77,7 @@
 #include "TextEncoding.h"
 #include "TextIterator.h"
 #include <wtf/CurrentTime.h>
+#include <wtf/ListHashSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/StdLibExtras.h>
 
@@ -105,12 +107,12 @@ using namespace std;
 namespace WebCore {
 
 static const char* const UserInitiatedProfileName = "org.webkit.profiles.user-initiated";
+static const char* const CPUProfileType = "CPU";
 static const char* const resourceTrackingEnabledSettingName = "resourceTrackingEnabled";
 static const char* const debuggerEnabledSettingName = "debuggerEnabled";
 static const char* const profilerEnabledSettingName = "profilerEnabled";
 static const char* const inspectorAttachedHeightName = "inspectorAttachedHeight";
 static const char* const lastActivePanelSettingName = "lastActivePanel";
-static const char* const timelineEnabledSettingName = "timelineEnabled";
 
 static const unsigned defaultAttachedHeight = 300;
 static const float minimumAttachedHeight = 250.0f;
@@ -179,11 +181,6 @@ void InspectorController::inspectedPageDestroyed()
     if (m_scriptState)
         ScriptGlobalObject::remove(m_scriptState, "InspectorController");
 
-    if (m_page) {
-        m_page->setParentInspectorController(0);
-        m_page = 0;
-    }
-
     ASSERT(m_inspectedPage);
     m_inspectedPage = 0;
 
@@ -380,7 +377,7 @@ void InspectorController::addConsoleMessage(ScriptState* scriptState, ConsoleMes
         m_consoleMessages.append(consoleMessage);
     }
 
-    if (m_frontend)
+    if (windowVisible())
         m_previousMessage->addToConsole(m_frontend.get());
 }
 
@@ -390,7 +387,7 @@ void InspectorController::clearConsoleMessages(bool clearUI)
     m_consoleMessages.clear();
     m_previousMessage = 0;
     m_groupLevel = 0;
-    m_idToConsoleObject.clear();
+    releaseWrapperObjectGroup("console");
     if (m_domAgent)
         m_domAgent->releaseDanglingNodes();
     if (clearUI && m_frontend)
@@ -556,10 +553,7 @@ void InspectorController::setFrontendProxyObject(ScriptState* scriptState, Scrip
     m_injectedScriptObj = injectedScriptObj;
     m_frontend.set(new InspectorFrontend(this, scriptState, webInspectorObj));
     m_domAgent = new InspectorDOMAgent(m_frontend.get());
-
-    Setting timelineEnabled = setting(timelineEnabledSettingName);
-    if (timelineEnabled.type() == Setting::BooleanType && timelineEnabled.booleanValue())
-        m_timelineAgent = new InspectorTimelineAgent(m_frontend.get());
+    m_timelineAgent = 0;
 }
 
 void InspectorController::show()
@@ -621,6 +615,9 @@ void InspectorController::close()
     m_domAgent = 0;
     m_timelineAgent = 0;
     m_scriptState = 0;
+    if (m_page)
+        m_page->setParentInspectorController(0);
+    m_page = 0;
 }
 
 void InspectorController::showWindow()
@@ -654,25 +651,32 @@ void InspectorController::populateScriptObjects()
     m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
 
     ResourcesMap::iterator resourcesEnd = m_resources.end();
-    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
         it->second->createScriptObject(m_frontend.get());
+        m_frontend->addCookieDomain(it->second->frame()->document()->url().host());
+    }
 
     unsigned messageCount = m_consoleMessages.size();
     for (unsigned i = 0; i < messageCount; ++i)
         m_consoleMessages[i]->addToConsole(m_frontend.get());
 
 #if ENABLE(DATABASE)
-    DatabaseResourcesSet::iterator databasesEnd = m_databaseResources.end();
-    for (DatabaseResourcesSet::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
-        (*it)->bind(m_frontend.get());
+    DatabaseResourcesMap::iterator databasesEnd = m_databaseResources.end();
+    for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
+        it->second->bind(m_frontend.get());
 #endif
 #if ENABLE(DOM_STORAGE)
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        (*it)->bind(m_frontend.get());
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        it->second->bind(m_frontend.get());
 #endif
 
     m_frontend->populateInterface();
+
+    // Dispatch pending frontend commands
+    for (Vector<pair<long, String> >::iterator it = m_pendingEvaluateTestCommands.begin(); it != m_pendingEvaluateTestCommands.end(); ++it)
+        m_frontend->evaluateForTestInFrontend((*it).first, (*it).second);
+    m_pendingEvaluateTestCommands.clear();
 }
 
 void InspectorController::resetScriptObjects()
@@ -685,14 +689,14 @@ void InspectorController::resetScriptObjects()
         it->second->releaseScriptObject(m_frontend.get(), false);
 
 #if ENABLE(DATABASE)
-    DatabaseResourcesSet::iterator databasesEnd = m_databaseResources.end();
-    for (DatabaseResourcesSet::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
-        (*it)->unbind();
+    DatabaseResourcesMap::iterator databasesEnd = m_databaseResources.end();
+    for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
+        it->second->unbind();
 #endif
 #if ENABLE(DOM_STORAGE)
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        (*it)->unbind();
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        it->second->unbind();
 #endif
 
     if (m_timelineAgent)
@@ -700,6 +704,8 @@ void InspectorController::resetScriptObjects()
 
     m_frontend->reset();
     m_domAgent->setDocument(0);
+    m_objectGroups.clear();
+    m_idToWrappedObject.clear();
 }
 
 void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoader* loaderToKeep)
@@ -715,7 +721,7 @@ void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoad
 
         if (!loaderToKeep || !resource->isSameLoader(loaderToKeep)) {
             removeResource(resource);
-            if (m_frontend)
+            if (windowVisible())
                 resource->releaseScriptObject(m_frontend.get(), true);
         }
     }
@@ -756,7 +762,8 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
                 // We don't add the main resource until its load is committed. This is
                 // needed to keep the load for a user-entered URL from showing up in the
                 // list of resources for the page they are navigating away from.
-                m_mainResource->createScriptObject(m_frontend.get());
+                if (windowVisible())
+                    m_mainResource->createScriptObject(m_frontend.get());
             } else {
                 // Pages loaded from the page cache are committed before
                 // m_mainResource is the right resource for this load, so we
@@ -850,7 +857,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
     ensureResourceTrackingSettingsLoaded();
     if (!isMainResource && !m_resourceTrackingEnabled)
         return;
-    
+
     RefPtr<InspectorResource> resource = InspectorResource::createCached(m_nextIdentifier--, loader, cachedResource);
 
     if (isMainResource) {
@@ -860,7 +867,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
 
     addResource(resource.get());
 
-    if (m_frontend)
+    if (windowVisible())
         resource->createScriptObject(m_frontend.get());
 }
 
@@ -886,10 +893,34 @@ void InspectorController::identifierForInitialRequest(unsigned long identifier,
 
     addResource(resource.get());
 
-    if (m_frontend && loader->frameLoader()->isLoadingFromCachedPage() && resource == m_mainResource)
+    if (windowVisible() && loader->frameLoader()->isLoadingFromCachedPage() && resource == m_mainResource)
         resource->createScriptObject(m_frontend.get());
 }
 
+void InspectorController::mainResourceFiredDOMContentEvent(DocumentLoader* loader, const KURL& url)
+{
+    if (!enabled() || !isMainResourceLoader(loader, url))
+        return;
+
+    if (m_mainResource) {
+        m_mainResource->markDOMContentEventTime();
+        if (windowVisible())
+            m_mainResource->updateScriptObject(m_frontend.get());
+    }
+}
+
+void InspectorController::mainResourceFiredLoadEvent(DocumentLoader* loader, const KURL& url)
+{
+    if (!enabled() || !isMainResourceLoader(loader, url))
+        return;
+
+    if (m_mainResource) {
+        m_mainResource->markLoadEventTime();
+        if (windowVisible())
+            m_mainResource->updateScriptObject(m_frontend.get());
+    }
+}
+
 bool InspectorController::isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl)
 {
     return loader->frame() == m_inspectedPage->mainFrame() && requestUrl == loader->requestURL();
@@ -908,7 +939,7 @@ void InspectorController::willSendRequest(DocumentLoader*, unsigned long identif
         resource->updateResponse(redirectResponse);
     }
 
-    if (resource != m_mainResource && m_frontend)
+    if (resource != m_mainResource && windowVisible())
         resource->createScriptObject(m_frontend.get());
 }
 
@@ -921,7 +952,7 @@ void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long iden
     resource->updateResponse(response);
     resource->markResponseReceivedTime();
 
-    if (m_frontend)
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -933,7 +964,7 @@ void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long
 
     resource->addLength(lengthReceived);
 
-    if (m_frontend)
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -949,8 +980,10 @@ void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identi
 
     addResource(resource.get());
 
-    if (m_frontend)
+    if (windowVisible()) {
         resource->updateScriptObject(m_frontend.get());
+        m_frontend->addCookieDomain(resource->frame()->document()->url().host());
+    }
 }
 
 void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError& /*error*/)
@@ -966,7 +999,7 @@ void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifi
 
     addResource(resource.get());
 
-    if (m_frontend)
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -981,7 +1014,7 @@ void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identi
 
     resource->setXMLHttpResponseText(sourceString);
 
-    if (m_frontend)
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -998,7 +1031,7 @@ void InspectorController::scriptImported(unsigned long identifier, const String&
     // thing by the Inspector. They should be made into distinct types.
     resource->setXMLHttpResponseText(ScriptString(sourceString));
     
-    if (m_frontend)
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -1046,47 +1079,62 @@ void InspectorController::ensureResourceTrackingSettingsLoaded()
         m_resourceTrackingEnabled = true;
 }
 
-void InspectorController::enableTimeline(bool always)
+void InspectorController::startTimelineProfiler()
 {
     if (!enabled())
         return;
 
-    if (always)
-        setSetting(timelineEnabledSettingName, Setting(true));
-
-    if (m_timelineAgent.get())
+    if (m_timelineAgent)
         return;
 
     m_timelineAgent = new InspectorTimelineAgent(m_frontend.get());
     if (m_frontend)
-        m_frontend->timelineWasEnabled();
+        m_frontend->timelineProfilerWasStarted();
 }
 
-void InspectorController::disableTimeline(bool always)
+void InspectorController::stopTimelineProfiler()
 {
     if (!enabled())
         return;
 
-    if (always)
-        setSetting(timelineEnabledSettingName, Setting(false));
-
-    if (!m_timelineAgent.get())
+    if (!m_timelineAgent)
         return;
 
-    m_timelineAgent.set(0);
+    m_timelineAgent = 0;
     if (m_frontend)
-        m_frontend->timelineWasDisabled();
+        m_frontend->timelineProfilerWasStopped();
 }
 
-bool InspectorController::timelineEnabled() const
+bool InspectorController::timelineProfilerEnabled() const
 {
     if (!enabled())
         return false;
 
-    return m_timelineAgent.get();
+    return m_timelineAgent;
 }
 
 #if ENABLE(DATABASE)
+void InspectorController::selectDatabase(Database* database)
+{
+    if (!m_frontend)
+        return;
+
+    for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != m_databaseResources.end(); ++it) {
+        if (it->second->database() == database) {
+            m_frontend->selectDatabase(it->first);
+            break;
+        }
+    }
+}
+
+Database* InspectorController::databaseForId(int databaseId)
+{
+    DatabaseResourcesMap::iterator it = m_databaseResources.find(databaseId);
+    if (it == m_databaseResources.end())
+        return 0;
+    return it->second->database();
+}
+
 void InspectorController::didOpenDatabase(Database* database, const String& domain, const String& name, const String& version)
 {
     if (!enabled())
@@ -1094,32 +1142,101 @@ void InspectorController::didOpenDatabase(Database* database, const String& doma
 
     RefPtr<InspectorDatabaseResource> resource = InspectorDatabaseResource::create(database, domain, name, version);
 
-    m_databaseResources.add(resource);
+    m_databaseResources.set(resource->id(), resource);
 
     // Resources are only bound while visible.
-    if (m_frontend && windowVisible())
+    if (windowVisible())
         resource->bind(m_frontend.get());
 }
 #endif
 
+void InspectorController::getCookies(long callId, const String& host)
+{
+    if (!m_frontend)
+        return;
+    
+    // If we can get raw cookies.
+    ListHashSet<Cookie> rawCookiesList;
+    
+    // If we can't get raw cookies - fall back to String representation
+    String stringCookiesList;
+    
+    // Return value to getRawCookies should be the same for every call because
+    // the return value is platform/network backend specific, and the call will
+    // always return the same true/false value.
+    bool rawCookiesImplemented = false;
+    
+    ResourcesMap::iterator resourcesEnd = m_resources.end();
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
+        Document* document = it->second->frame()->document();
+        if (document->url().host() == host) {
+            Vector<Cookie> docCookiesList;
+            rawCookiesImplemented = getRawCookies(document, document->cookieURL(), docCookiesList);
+            
+            if (!rawCookiesImplemented)
+                // FIXME: We need duplication checking for the String representation of cookies.
+                stringCookiesList += document->cookie();
+            else {
+                int cookiesSize = docCookiesList.size();
+                for (int i = 0; i < cookiesSize; i++) {
+                    if (!rawCookiesList.contains(docCookiesList[i]))
+                        rawCookiesList.add(docCookiesList[i]);
+                }
+            }
+        }
+    }
+    
+    if (!rawCookiesImplemented)
+        m_frontend->didGetCookies(callId, m_frontend->newScriptArray(), stringCookiesList);
+    else
+        m_frontend->didGetCookies(callId, buildArrayForCookies(rawCookiesList), String());
+}
+    
+ScriptArray InspectorController::buildArrayForCookies(ListHashSet<Cookie>& cookiesList)
+{
+    ScriptArray cookies = m_frontend->newScriptArray();
+
+    ListHashSet<Cookie>::iterator end = cookiesList.end();
+    ListHashSet<Cookie>::iterator it = cookiesList.begin();
+    for (int i = 0; it != end; ++it, i++)
+        cookies.set(i, buildObjectForCookie(*it));
+
+    return cookies;
+}
+
+ScriptObject InspectorController::buildObjectForCookie(const Cookie& cookie)
+{
+    ScriptObject value = m_frontend->newScriptObject();
+    value.set("name", cookie.name);
+    value.set("value", cookie.value);
+    value.set("domain", cookie.domain);
+    value.set("path", cookie.path);
+    value.set("expires", cookie.expires);
+    value.set("size", (cookie.name.length() + cookie.value.length()));
+    value.set("httpOnly", cookie.httpOnly);
+    value.set("secure", cookie.secure);
+    value.set("session", cookie.session);
+    return value;
+}
+    
 #if ENABLE(DOM_STORAGE)
 void InspectorController::didUseDOMStorage(StorageArea* storageArea, bool isLocalStorage, Frame* frame)
 {
     if (!enabled())
         return;
 
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        if ((*it)->isSameHostAndType(frame, isLocalStorage))
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        if (it->second->isSameHostAndType(frame, isLocalStorage))
             return;
 
     RefPtr<Storage> domStorage = Storage::create(frame, storageArea);
     RefPtr<InspectorDOMStorageResource> resource = InspectorDOMStorageResource::create(domStorage.get(), isLocalStorage, frame);
 
-    m_domStorageResources.add(resource);
+    m_domStorageResources.set(resource->id(), resource);
 
     // Resources are only bound while visible.
-    if (m_frontend && windowVisible())
+    if (windowVisible())
         resource->bind(m_frontend.get());
 }
 
@@ -1132,10 +1249,10 @@ void InspectorController::selectDOMStorage(Storage* storage)
     Frame* frame = storage->frame();
     bool isLocalStorage = (frame->domWindow()->localStorage() == storage);
     int storageResourceId = 0;
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it) {
-        if ((*it)->isSameHostAndType(frame, isLocalStorage)) {
-            storageResourceId = (*it)->id();
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it) {
+        if (it->second->isSameHostAndType(frame, isLocalStorage)) {
+            storageResourceId = it->first;
             break;
         }
     }
@@ -1196,11 +1313,10 @@ void InspectorController::removeDOMStorageItem(long callId, long storageId, cons
 
 InspectorDOMStorageResource* InspectorController::getDOMStorageResourceForId(int storageId)
 {
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        if ((*it)->id() == storageId)
-            return it->get();
-    return 0;
+    DOMStorageResourcesMap::iterator it = m_domStorageResources.find(storageId);
+    if (it == m_domStorageResources.end())
+        return 0;
+    return it->second.get();
 }
 #endif
 
@@ -1221,11 +1337,11 @@ void InspectorController::addProfile(PassRefPtr<Profile> prpProfile, unsigned li
         return;
 
     RefPtr<Profile> profile = prpProfile;
-    m_profiles.append(profile);
+    m_profiles.add(profile->uid(), profile);
 
     if (m_frontend) {
         JSLock lock(SilenceAssertionsOnly);
-        m_frontend->addProfile(toJS(m_scriptState, profile.get()));
+        m_frontend->addProfileHeader(createProfileHeader(*profile));
     }
 
     addProfileFinishedMessageToConsole(profile, lineNumber, sourceURL);
@@ -1236,8 +1352,10 @@ void InspectorController::addProfileFinishedMessageToConsole(PassRefPtr<Profile>
     RefPtr<Profile> profile = prpProfile;
 
     UString message = "Profile \"webkit-profile://";
-    message += encodeWithURLEscapeSequences(profile->title());
+    message += encodeWithURLEscapeSequences(CPUProfileType);
     message += "/";
+    message += encodeWithURLEscapeSequences(profile->title());
+    message += "#";
     message += UString::from(profile->uid());
     message += "\" finished.";
     addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
@@ -1246,11 +1364,42 @@ void InspectorController::addProfileFinishedMessageToConsole(PassRefPtr<Profile>
 void InspectorController::addStartProfilingMessageToConsole(const UString& title, unsigned lineNumber, const UString& sourceURL)
 {
     UString message = "Profile \"webkit-profile://";
+    message += encodeWithURLEscapeSequences(CPUProfileType);
+    message += "/";
     message += encodeWithURLEscapeSequences(title);
-    message += "/0\" started.";
+    message += "#0\" started.";
     addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
 }
 
+void InspectorController::getProfileHeaders(long callId)
+{
+    if (!m_frontend)
+        return;
+    ScriptArray result = m_frontend->newScriptArray();
+    ProfilesMap::iterator profilesEnd = m_profiles.end();
+    int i = 0;
+    for (ProfilesMap::iterator it = m_profiles.begin(); it != profilesEnd; ++it)
+        result.set(i++, createProfileHeader(*it->second));
+    m_frontend->didGetProfileHeaders(callId, result);
+}
+
+void InspectorController::getProfile(long callId, unsigned uid)
+{
+    if (!m_frontend)
+        return;
+    ProfilesMap::iterator it = m_profiles.find(uid);
+    if (it != m_profiles.end())
+        m_frontend->didGetProfile(callId, toJS(m_scriptState, it->second.get()));
+}
+
+ScriptObject InspectorController::createProfileHeader(const JSC::Profile& profile)
+{
+    ScriptObject header = m_frontend->newScriptObject();
+    header.set("title", profile.title());
+    header.set("uid", profile.uid());
+    return header;
+}
+
 UString InspectorController::getCurrentUserInitiatedProfileName(bool incrementProfileNumber = false)
 {
     if (incrementProfileNumber)
@@ -1429,6 +1578,25 @@ void InspectorController::didContinue()
 
 #endif
 
+void InspectorController::evaluateForTestInFrontend(long callId, const String& script)
+{
+    if (m_frontend)
+        m_frontend->evaluateForTestInFrontend(callId, script);
+    else
+        m_pendingEvaluateTestCommands.append(pair<long, String>(callId, script));
+}
+
+void InspectorController::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
+{
+    ScriptState* scriptState = scriptStateFromPage(m_inspectedPage);
+    ScriptObject window;
+    ScriptGlobalObject::get(scriptState, "window", window);
+    ScriptFunctionCall function(scriptState, window, "didEvaluateForTestInFrontend");
+    function.appendArgument(static_cast<int>(callId));
+    function.appendArgument(jsonResult);
+    function.call();
+}
+
 static Path quadToPath(const FloatQuad& quad)
 {
     Path quadPath;
@@ -1623,15 +1791,18 @@ InspectorController::SpecialPanels InspectorController::specialPanelForJSName(co
         return ElementsPanel;
 }
 
-ScriptValue InspectorController::wrapObject(const ScriptValue& quarantinedObject)
+ScriptValue InspectorController::wrapObject(const ScriptValue& quarantinedObject, const String& objectGroup)
 {
     ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "createProxyObject");
     function.appendArgument(quarantinedObject);
     if (quarantinedObject.isObject()) {
         long id = m_lastBoundObjectId++;
         String objectId = String::format("object#%ld", id);
-        m_idToConsoleObject.set(objectId, quarantinedObject);
-
+        m_idToWrappedObject.set(objectId, quarantinedObject);
+        ObjectGroupsMap::iterator it = m_objectGroups.find(objectGroup);
+        if (it == m_objectGroups.end())
+            it = m_objectGroups.set(objectGroup, Vector<String>()).first;
+        it->second.append(objectId);
         function.appendArgument(objectId);
     }
     ScriptValue wrapper = function.call();
@@ -1640,22 +1811,38 @@ ScriptValue InspectorController::wrapObject(const ScriptValue& quarantinedObject
 
 ScriptValue InspectorController::unwrapObject(const String& objectId)
 {
-    HashMap<String, ScriptValue>::iterator it = m_idToConsoleObject.find(objectId);
-    if (it != m_idToConsoleObject.end())
+    HashMap<String, ScriptValue>::iterator it = m_idToWrappedObject.find(objectId);
+    if (it != m_idToWrappedObject.end())
         return it->second;
     return ScriptValue();
 }
 
+void InspectorController::releaseWrapperObjectGroup(const String& objectGroup)
+{
+    ObjectGroupsMap::iterator groupIt = m_objectGroups.find(objectGroup);
+    if (groupIt == m_objectGroups.end())
+        return;
+
+    Vector<String>& groupIds = groupIt->second;
+    for (Vector<String>::iterator it = groupIds.begin(); it != groupIds.end(); ++it)
+        m_idToWrappedObject.remove(*it);
+    m_objectGroups.remove(groupIt);
+}
+
 void InspectorController::resetInjectedScript()
 {
     ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "reset");
     function.call();
 }
 
-void InspectorController::deleteCookie(const String& cookieName)
+void InspectorController::deleteCookie(const String& cookieName, const String& domain)
 {
-    Document* document = m_inspectedPage->mainFrame()->document();
-    WebCore::deleteCookie(document, document->cookieURL(), cookieName);
+    ResourcesMap::iterator resourcesEnd = m_resources.end();
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
+        Document* document = it->second->frame()->document();
+        if (document->url().host() == domain)
+            WebCore::deleteCookie(document, document->cookieURL(), cookieName);
+    }
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
index ff7a5168f5..8c1453200e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
@@ -30,7 +30,9 @@
 #define InspectorController_h
 
 #include "Console.h"
+#include "Cookie.h"
 #include "PlatformString.h"
+#include "ScriptArray.h"
 #include "ScriptObject.h"
 #include "ScriptState.h"
 #include "ScriptValue.h"
@@ -39,6 +41,7 @@
 
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/ListHashSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 
@@ -90,8 +93,9 @@ class InspectorController
 public:
     typedef HashMap<long long, RefPtr<InspectorResource> > ResourcesMap;
     typedef HashMap<RefPtr<Frame>, ResourcesMap*> FrameResourcesMap;
-    typedef HashSet<RefPtr<InspectorDatabaseResource> > DatabaseResourcesSet;
-    typedef HashSet<RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesSet;
+    typedef HashMap<int, RefPtr<InspectorDatabaseResource> > DatabaseResourcesMap;
+    typedef HashMap<int, RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesMap;
+    typedef HashMap<String, Vector<String> > ObjectGroupsMap;
 
     typedef enum {
         CurrentPanel,
@@ -224,11 +228,16 @@ public:
     bool resourceTrackingEnabled() const { return m_resourceTrackingEnabled; }
     void ensureResourceTrackingSettingsLoaded();
 
-    void enableTimeline(bool always = false);
-    void disableTimeline(bool always = false);
-    bool timelineEnabled() const;
+    void startTimelineProfiler();
+    void stopTimelineProfiler();
+    bool timelineProfilerEnabled() const;
     InspectorTimelineAgent* timelineAgent() { return m_timelineAgent.get(); }
 
+    void mainResourceFiredLoadEvent(DocumentLoader*, const KURL&);
+    void mainResourceFiredDOMContentEvent(DocumentLoader*, const KURL&);
+                                                        
+    void getCookies(long callId, const String& url);
+
 #if ENABLE(DATABASE)
     void didOpenDatabase(Database*, const String& domain, const String& name, const String& version);
 #endif
@@ -256,7 +265,6 @@ public:
     void addProfile(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
     void addProfileFinishedMessageToConsole(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
     void addStartProfilingMessageToConsole(const JSC::UString& title, unsigned lineNumber, const JSC::UString& sourceURL);
-    const ProfilesArray& profiles() const { return m_profiles; }
 
     bool isRecordingUserInitiatedProfile() const { return m_recordingUserInitiatedProfile; }
 
@@ -280,6 +288,8 @@ public:
     virtual void didContinue();
 #endif
 
+    void evaluateForTestInFrontend(long callId, const String& script);
+
 private:
     friend class InspectorBackend;
     // Following are used from InspectorBackend and internally.
@@ -295,21 +305,34 @@ private:
     // Following are used from InspectorFrontend only. We don't want to expose them to the
     // rest of the InspectorController clients.
     // TODO: extract these into a separate interface.
-    ScriptValue wrapObject(const ScriptValue& object);
+    ScriptValue wrapObject(const ScriptValue& object, const String& objectGroup);
     ScriptValue unwrapObject(const String& objectId);
+    void releaseWrapperObjectGroup(const String& objectGroup);
     
     void resetInjectedScript();
 
-    void deleteCookie(const String& cookieName);
+    void deleteCookie(const String& cookieName, const String& domain);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+    typedef HashMap<unsigned int, RefPtr<JSC::Profile> > ProfilesMap;
+
     void startUserInitiatedProfilingSoon();
     void toggleRecordButton(bool);
     void enableDebuggerFromFrontend(bool always);
+    void getProfileHeaders(long callId);
+    void getProfile(long callId, unsigned uid);
+    ScriptObject createProfileHeader(const JSC::Profile& profile);
+#endif
+#if ENABLE(DATABASE)
+    void selectDatabase(Database* database);
+    Database* databaseForId(int databaseId);
 #endif
 #if ENABLE(DOM_STORAGE)
     InspectorDOMStorageResource* getDOMStorageResourceForId(int storageId);
 #endif
+                                                        
+    ScriptObject buildObjectForCookie(const Cookie&);
+    ScriptArray buildArrayForCookies(ListHashSet<Cookie>&);
 
     void focusNode();
 
@@ -328,6 +351,8 @@ private:
 
     SpecialPanels specialPanelForJSName(const String& panelName);
 
+    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
+
     Page* m_inspectedPage;
     InspectorClient* m_client;
     OwnPtr<InspectorFrontend> m_frontend;
@@ -344,10 +369,10 @@ private:
     HashMap<String, double> m_times;
     HashMap<String, unsigned> m_counts;
 #if ENABLE(DATABASE)
-    DatabaseResourcesSet m_databaseResources;
+    DatabaseResourcesMap m_databaseResources;
 #endif
 #if ENABLE(DOM_STORAGE)
-    DOMStorageResourcesSet m_domStorageResources;
+    DOMStorageResourcesMap m_domStorageResources;
 #endif
     ScriptState* m_scriptState;
     bool m_windowVisible;
@@ -360,8 +385,11 @@ private:
     bool m_resourceTrackingEnabled;
     bool m_resourceTrackingSettingsLoaded;
     RefPtr<InspectorBackend> m_inspectorBackend;
-    HashMap<String, ScriptValue> m_idToConsoleObject;
+    HashMap<String, ScriptValue> m_idToWrappedObject;
+    ObjectGroupsMap m_objectGroups;
+
     long m_lastBoundObjectId;
+    Vector<pair<long, String> > m_pendingEvaluateTestCommands;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     bool m_debuggerEnabled;
     bool m_attachDebuggerWhenShown;
@@ -370,7 +398,7 @@ private:
     int m_currentUserInitiatedProfileNumber;
     unsigned m_nextUserInitiatedProfileNumber;
     Timer<InspectorController> m_startProfiling;
-    ProfilesArray m_profiles;
+    ProfilesMap m_profiles;
 #endif
 };
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp
index ad8e8b8349..f6c2d468c4 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp
@@ -438,18 +438,6 @@ void InspectorDOMAgent::getEventListenersForNode(long callId, long nodeId)
     m_frontend->didGetEventListenersForNode(callId, nodeId, listenersArray);
 }
 
-void InspectorDOMAgent::getCookies(long callId)
-{
-    Document* doc = mainFrameDocument();
-    Vector<Cookie> cookiesList;
-    bool isImplemented = getRawCookies(doc, doc->cookieURL(), cookiesList);
-
-    if (!isImplemented)
-        m_frontend->didGetCookies(callId, m_frontend->newScriptArray(), doc->cookie());
-    else
-        m_frontend->didGetCookies(callId, buildArrayForCookies(cookiesList), String());
-}
-
 ScriptObject InspectorDOMAgent::buildObjectForNode(Node* node, int depth, NodeToIdMap* nodesMap)
 {
     ScriptObject value = m_frontend->newScriptObject();
@@ -549,32 +537,6 @@ ScriptObject InspectorDOMAgent::buildObjectForEventListener(const RegisteredEven
     return value;
 }
 
-ScriptObject InspectorDOMAgent::buildObjectForCookie(const Cookie& cookie)
-{
-    ScriptObject value = m_frontend->newScriptObject();
-    value.set("name", cookie.name);
-    value.set("value", cookie.value);
-    value.set("domain", cookie.domain);
-    value.set("path", cookie.path);
-    value.set("expires", cookie.expires);
-    value.set("size", static_cast<int>(cookie.name.length() + cookie.value.length()));
-    value.set("httpOnly", cookie.httpOnly);
-    value.set("secure", cookie.secure);
-    value.set("session", cookie.session);
-    return value;
-}
-
-ScriptArray InspectorDOMAgent::buildArrayForCookies(const Vector<Cookie>& cookiesList)
-{
-    ScriptArray cookies = m_frontend->newScriptArray();
-    unsigned length = cookiesList.size();
-    for (unsigned i = 0; i < length; ++i) {
-        const Cookie& cookie = cookiesList[i];
-        cookies.set(i, buildObjectForCookie(cookie));
-    }
-    return cookies;
-}
-
 Node* InspectorDOMAgent::innerFirstChild(Node* node)
 {
     if (node->isFrameOwnerElement()) {
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
index 548e2b2061..b9bdb6b888 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
@@ -53,8 +53,6 @@ namespace WebCore {
     class Node;
     class Page;
 
-    struct Cookie;
-
     struct EventListenerInfo {
         EventListenerInfo(Node* node, const AtomicString& eventType, const EventListenerVector& eventListenerVector)
             : node(node)
@@ -88,7 +86,6 @@ namespace WebCore {
         void removeAttribute(long callId, long elementId, const String& name);
         void setTextNodeValue(long callId, long nodeId, const String& value);
         void getEventListenersForNode(long callId, long nodeId);
-        void getCookies(long callId);
 
         // Methods called from the InspectorController.
         void setDocument(Document* document);
@@ -116,9 +113,6 @@ namespace WebCore {
 
         ScriptObject buildObjectForEventListener(const RegisteredEventListener& registeredEventListener, const AtomicString& eventType, Node* node);
 
-        ScriptObject buildObjectForCookie(const Cookie& cookie);
-        ScriptArray buildArrayForCookies(const Vector<Cookie>& cookiesList);
-
         // We represent embedded doms as a part of the same hierarchy. Hence we treat children of frame owners differently.
         // We also skip whitespace text nodes conditionally. Following methods encapsulate these specifics.
         Node* innerFirstChild(Node* node);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
index 37818e707e..c93e987d40 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
@@ -104,7 +104,7 @@ void InspectorDOMStorageResource::handleEvent(ScriptExecutionContext*, Event* ev
     ASSERT(eventNames().storageEvent == event->type());
     StorageEvent* storageEvent = static_cast<StorageEvent*>(event);
     Storage* storage = storageEvent->storageArea();
-    bool isLocalStorage = storageEvent->source()->localStorage() == storage;
+    bool isLocalStorage = storage->frame()->domWindow()->localStorage() == storage;
     if (isSameHostAndType(storage->frame(), isLocalStorage))
         m_frontend->updateDOMStorage(m_id);
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
index a58968f2bd..c2dc5c615e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
@@ -41,8 +41,11 @@
 
 namespace WebCore {
 
+int InspectorDatabaseResource::s_nextUnusedId = 1;
+
 InspectorDatabaseResource::InspectorDatabaseResource(Database* database, const String& domain, const String& name, const String& version)
     : m_database(database)
+    , m_id(s_nextUnusedId++)
     , m_domain(domain)
     , m_name(name)
     , m_version(version)
@@ -59,7 +62,7 @@ void InspectorDatabaseResource::bind(InspectorFrontend* frontend)
     ScriptObject database;
     if (!getQuarantinedScriptObject(m_database.get(), database))
         return;
-    jsonObject.set("database", database);
+    jsonObject.set("id", m_id);
     jsonObject.set("domain", m_domain);
     jsonObject.set("name", m_name);
     jsonObject.set("version", m_version);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.h b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.h
index 38f9fa1f99..f82d898d0f 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.h
@@ -53,16 +53,19 @@ namespace WebCore {
 
         void bind(InspectorFrontend* frontend);
         void unbind();
-
+        Database* database() { return m_database.get(); }
+        long id() const { return m_id; }
     private:
         InspectorDatabaseResource(Database*, const String& domain, const String& name, const String& version);
         
         RefPtr<Database> m_database;
+        int m_id;
         String m_domain;
         String m_name;
         String m_version;
         bool m_scriptObjectCreated;
 
+        static int s_nextUnusedId;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
index 63bb6e23c8..2e6dc2baf3 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
@@ -87,7 +87,7 @@ void InspectorFrontend::addMessageToConsole(const ScriptObject& messageObj, cons
             function->appendArgument(frames[i]);
     } else if (!wrappedArguments.isEmpty()) {
         for (unsigned i = 0; i < wrappedArguments.size(); ++i)
-            function->appendArgument(m_inspectorController->wrapObject(wrappedArguments[i]));
+            function->appendArgument(m_inspectorController->wrapObject(wrappedArguments[i], "console"));
     } else
         function->appendArgument(message);
     function->call();
@@ -125,6 +125,13 @@ void InspectorFrontend::removeResource(long long identifier)
     function->call();
 }
 
+void InspectorFrontend::addCookieDomain(String domain)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addCookieDomain"));
+    function->appendArgument(domain);
+    function->call();
+}
+
 void InspectorFrontend::updateFocusedNode(long long nodeId)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateFocusedNode"));
@@ -190,14 +197,14 @@ void InspectorFrontend::resourceTrackingWasDisabled()
     callSimpleFunction("resourceTrackingWasDisabled");
 }
 
-void InspectorFrontend::timelineWasEnabled()
+void InspectorFrontend::timelineProfilerWasStarted()
 {
-    callSimpleFunction("timelineWasEnabled");
+    callSimpleFunction("timelineProfilerWasStarted");
 }
 
-void InspectorFrontend::timelineWasDisabled()
+void InspectorFrontend::timelineProfilerWasStopped()
 {
-    callSimpleFunction("timelineWasDisabled");
+    callSimpleFunction("timelineProfilerWasStopped");
 }
 
 void InspectorFrontend::addItemToTimeline(const ScriptObject& itemObj)
@@ -254,9 +261,9 @@ void InspectorFrontend::failedToParseScriptSource(const JSC::SourceCode& source,
     function->call();
 }
 
-void InspectorFrontend::addProfile(const JSC::JSValue& profile)
+void InspectorFrontend::addProfileHeader(const ScriptValue& profile)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addProfile"));
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addProfileHeader"));
     function->appendArgument(profile);
     function->call();
 }
@@ -268,38 +275,32 @@ void InspectorFrontend::setRecordingProfile(bool isProfiling)
     function->call();
 }
 
-void InspectorFrontend::pausedScript(const ScriptValue& callFrames)
+void InspectorFrontend::didGetProfileHeaders(int callId, const ScriptArray& headers)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("pausedScript"));
-    function->appendArgument(callFrames);
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetProfileHeaders"));
+    function->appendArgument(callId);
+    function->appendArgument(headers);
     function->call();
 }
 
-void InspectorFrontend::resumedScript()
+void InspectorFrontend::didGetProfile(int callId, const ScriptValue& profile)
 {
-    callSimpleFunction("resumedScript");
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetProfile"));
+    function->appendArgument(callId);
+    function->appendArgument(profile);
+    function->call();
 }
-#endif
 
-#if ENABLE(DATABASE)
-bool InspectorFrontend::addDatabase(const ScriptObject& dbObject)
+void InspectorFrontend::pausedScript(const ScriptValue& callFrames)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDatabase"));
-    function->appendArgument(dbObject);
-    bool hadException = false;
-    function->call(hadException);
-    return !hadException;
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("pausedScript"));
+    function->appendArgument(callFrames);
+    function->call();
 }
-#endif
 
-#if ENABLE(DOM_STORAGE)
-bool InspectorFrontend::addDOMStorage(const ScriptObject& domStorageObj)
+void InspectorFrontend::resumedScript()
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDOMStorage"));
-    function->appendArgument(domStorageObj);
-    bool hadException = false;
-    function->call(hadException);
-    return !hadException;
+    callSimpleFunction("resumedScript");
 }
 #endif
 
@@ -358,6 +359,14 @@ void InspectorFrontend::attributesUpdated(int id, const ScriptArray& attributes)
     function->call();
 }
 
+void InspectorFrontend::didRemoveNode(int callId, int nodeId)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didRemoveNode"));
+    function->appendArgument(callId);
+    function->appendArgument(nodeId);
+    function->call();
+}
+
 void InspectorFrontend::didGetChildNodes(int callId)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetChildNodes"));
@@ -401,18 +410,40 @@ void InspectorFrontend::didDispatchOnInjectedScript(int callId, const String& re
 }
 
 #if ENABLE(DATABASE)
-void InspectorFrontend::selectDatabase(Database* database)
+bool InspectorFrontend::addDatabase(const ScriptObject& dbObject)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDatabase"));
+    function->appendArgument(dbObject);
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+
+void InspectorFrontend::selectDatabase(int databaseId)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDatabase"));
-    ScriptObject quarantinedObject;
-    if (!getQuarantinedScriptObject(database, quarantinedObject))
-        return;
-    function->appendArgument(quarantinedObject);
+    function->appendArgument(databaseId);
+    function->call();
+}
+void InspectorFrontend::didGetDatabaseTableNames(int callId, const ScriptArray& tableNames)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetDatabaseTableNames"));
+    function->appendArgument(callId);
+    function->appendArgument(tableNames);
     function->call();
 }
 #endif
 
 #if ENABLE(DOM_STORAGE)
+bool InspectorFrontend::addDOMStorage(const ScriptObject& domStorageObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDOMStorage"));
+    function->appendArgument(domStorageObj);
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+
 void InspectorFrontend::selectDOMStorage(int storageId)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDOMStorage"));
@@ -459,6 +490,14 @@ void InspectorFrontend::addNodesToSearchResult(const String& nodeIds)
     function->call();
 }
 
+void InspectorFrontend::evaluateForTestInFrontend(int callId, const String& script)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("evaluateForTestInFrontend"));
+    function->appendArgument(callId);
+    function->appendArgument(script);
+    function->call();
+}
+
 PassOwnPtr<ScriptFunctionCall> InspectorFrontend::newFunctionCall(const String& functionName)
 {
     ScriptFunctionCall* function = new ScriptFunctionCall(m_scriptState, m_webInspector, "dispatch");
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
index 51f17fbdac..0883ac2fff 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
@@ -70,6 +70,8 @@ namespace WebCore {
         bool updateResource(long long identifier, const ScriptObject& resourceObj);
         void removeResource(long long identifier);
 
+        void addCookieDomain(String);
+
         void updateFocusedNode(long long nodeId);
         void setAttachedWindow(bool attached);
         void showPanel(int panel);
@@ -87,15 +89,18 @@ namespace WebCore {
         void profilerWasDisabled();
         void parsedScriptSource(const JSC::SourceCode&);
         void failedToParseScriptSource(const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
-        void addProfile(const JSC::JSValue& profile);
+        void addProfileHeader(const ScriptValue& profile);
         void setRecordingProfile(bool isProfiling);
+        void didGetProfileHeaders(int callId, const ScriptArray& headers);
+        void didGetProfile(int callId, const ScriptValue& profile);
         void pausedScript(const ScriptValue& callFrames);
         void resumedScript();
 #endif
 
 #if ENABLE(DATABASE)
         bool addDatabase(const ScriptObject& dbObj);
-        void selectDatabase(Database* database);
+        void selectDatabase(int databaseId);
+        void didGetDatabaseTableNames(int callId, const ScriptArray& tableNames);
 #endif
         
 #if ENABLE(DOM_STORAGE)
@@ -117,9 +122,10 @@ namespace WebCore {
         void didGetChildNodes(int callId);
         void didApplyDomChange(int callId, bool success);
         void didGetEventListenersForNode(int callId, int nodeId, ScriptArray& listenersArray);
+        void didRemoveNode(int callId, int nodeId);
 
-        void timelineWasEnabled();
-        void timelineWasDisabled();
+        void timelineProfilerWasStarted();
+        void timelineProfilerWasStopped();
         void addItemToTimeline(const ScriptObject& itemObj);
 
         void didGetCookies(int callId, const ScriptArray& cookies, const String& cookiesString);
@@ -129,6 +135,7 @@ namespace WebCore {
 
         ScriptState* scriptState() const { return m_scriptState; }
 
+        void evaluateForTestInFrontend(int callId, const String& script);
     private:
         PassOwnPtr<ScriptFunctionCall> newFunctionCall(const String& functionName);
         void callSimpleFunction(const String& functionName);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
index 484a0bd538..69ab39b755 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
@@ -59,6 +59,8 @@ InspectorResource::InspectorResource(long long identifier, DocumentLoader* loade
     , m_startTime(-1.0)
     , m_responseReceivedTime(-1.0)
     , m_endTime(-1.0)
+    , m_loadEventTime(-1.0)
+    , m_domContentEventTime(-1.0)
     , m_isMainResource(false)
 {
 }
@@ -200,6 +202,10 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
             jsonObject.set("responseReceivedTime", m_responseReceivedTime);
         if (m_endTime > 0)
             jsonObject.set("endTime", m_endTime);
+        if (m_loadEventTime > 0)
+            jsonObject.set("loadEventTime", m_loadEventTime);
+        if (m_domContentEventTime > 0)
+            jsonObject.set("domContentEventTime", m_domContentEventTime);
         jsonObject.set("didTimingChange", true);
     }
     if (!frontend->updateResource(m_identifier, jsonObject))
@@ -320,6 +326,18 @@ void InspectorResource::endTiming()
     m_changes.set(CompletionChange);
 }
 
+void InspectorResource::markDOMContentEventTime()
+{
+    m_domContentEventTime = currentTime();
+    m_changes.set(TimingChange);
+}
+
+void InspectorResource::markLoadEventTime()
+{
+    m_loadEventTime = currentTime();
+    m_changes.set(TimingChange);
+}
+
 void InspectorResource::markFailed()
 {
     m_failed = true;
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
index 5e37e416ac..880eab73f9 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
@@ -103,6 +103,8 @@ namespace WebCore {
 
         void startTiming();
         void markResponseReceivedTime();
+        void markLoadEventTime();
+        void markDOMContentEventTime();
         void endTiming();
 
         void markFailed();
@@ -161,6 +163,8 @@ namespace WebCore {
         double m_startTime;
         double m_responseReceivedTime;
         double m_endTime;
+        double m_loadEventTime;
+        double m_domContentEventTime;
         ScriptString m_xmlHttpResponseText;
         Changes m_changes;
         bool m_isMainResource;
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h
index e86b0ebd34..47cdac2452 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h
@@ -44,7 +44,12 @@ namespace WebCore {
             return adoptRef(new JavaScriptCallFrame(debuggerCallFrame, caller, sourceID, line));
         }
 
-        void invalidate() { m_isValid = false; }
+        void invalidate()
+        {
+            m_isValid = false;
+            m_debuggerCallFrame = 0;
+        }
+
         bool isValid() const { return m_isValid; }
 
         JavaScriptCallFrame* caller();
@@ -56,6 +61,7 @@ namespace WebCore {
             m_debuggerCallFrame = debuggerCallFrame;
             m_line = line;
             m_sourceID = sourceID;
+            m_isValid = true;
         }
 
         String functionName() const;
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp
index 3c3e279783..2d462f626c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp
@@ -104,28 +104,6 @@ static JSValueRef getSelfTime(JSContextRef ctx, JSObjectRef thisObject, JSString
     return JSValueMakeNumber(ctx, profileNode->selfTime());
 }
 
-static JSValueRef getTotalPercent(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    JSC::JSLock lock(SilenceAssertionsOnly);
-
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
-        return JSValueMakeUndefined(ctx);
-
-    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
-    return JSValueMakeNumber(ctx, profileNode->totalPercent());
-}
-
-static JSValueRef getSelfPercent(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    JSC::JSLock lock(SilenceAssertionsOnly);
-
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
-        return JSValueMakeUndefined(ctx);
-
-    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
-    return JSValueMakeNumber(ctx, profileNode->selfPercent());
-}
-
 static JSValueRef getNumberOfCalls(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
 {
     JSC::JSLock lock(SilenceAssertionsOnly);
@@ -184,30 +162,6 @@ static JSValueRef getChildren(JSContextRef ctx, JSObjectRef thisObject, JSString
     return result;
 }
 
-static JSValueRef getParent(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    JSC::JSLock lock(SilenceAssertionsOnly);
-
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
-        return JSValueMakeUndefined(ctx);
-
-    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
-    ExecState* exec = toJS(ctx);
-    return toRef(exec, toJS(exec, profileNode->parent()));
-}
-
-static JSValueRef getHead(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    JSC::JSLock lock(SilenceAssertionsOnly);
-
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
-        return JSValueMakeUndefined(ctx);
-
-    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
-    ExecState* exec = toJS(ctx);
-    return toRef(exec, toJS(exec, profileNode->head()));
-}
-
 static JSValueRef getVisible(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
 {
     JSC::JSLock lock(SilenceAssertionsOnly);
@@ -245,12 +199,8 @@ JSClassRef ProfileNodeClass()
         { "lineNumber", getLineNumber, 0, kJSPropertyAttributeNone },
         { "totalTime", getTotalTime, 0, kJSPropertyAttributeNone },
         { "selfTime", getSelfTime, 0, kJSPropertyAttributeNone },
-        { "totalPercent", getTotalPercent, 0, kJSPropertyAttributeNone },
-        { "selfPercent", getSelfPercent, 0, kJSPropertyAttributeNone },
         { "numberOfCalls", getNumberOfCalls, 0, kJSPropertyAttributeNone },
         { "children", getChildren, 0, kJSPropertyAttributeNone },
-        { "parent", getParent, 0, kJSPropertyAttributeNone },
-        { "head", getHead, 0, kJSClassAttributeNone },
         { "visible", getVisible, 0, kJSPropertyAttributeNone },
         { "callUID", getCallUID, 0, kJSPropertyAttributeNone },
         { 0, 0, 0, 0 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
index 4f50eccdca..aa0e08c407 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
@@ -27,6 +27,8 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+const ExpressionStopCharacters = " =:[({;,!+-*/&|^<>";
+
 WebInspector.ConsoleView = function(drawer)
 {
     WebInspector.View.call(this, document.getElementById("console-view"));
@@ -44,7 +46,7 @@ WebInspector.ConsoleView = function(drawer)
 
     this.promptElement = document.getElementById("console-prompt");
     this.promptElement.handleKeyEvent = this._promptKeyDown.bind(this);
-    this.prompt = new WebInspector.TextPrompt(this.promptElement, this.completions.bind(this), " .=:[({;");
+    this.prompt = new WebInspector.TextPrompt(this.promptElement, this.completions.bind(this), ExpressionStopCharacters + ".");
 
     this.topGroup = new WebInspector.ConsoleGroup(null, 0);
     this.messagesElement.insertBefore(this.topGroup.element, this.promptElement);
@@ -274,8 +276,7 @@ WebInspector.ConsoleView.prototype = {
     completions: function(wordRange, bestMatchOnly, completionsReadyCallback)
     {
         // Pass less stop characters to rangeOfWord so the range will be a more complete expression.
-        const expressionStopCharacters = " =:{;";
-        var expressionRange = wordRange.startContainer.rangeOfWord(wordRange.startOffset, expressionStopCharacters, this.promptElement, "backward");
+        var expressionRange = wordRange.startContainer.rangeOfWord(wordRange.startOffset, ExpressionStopCharacters, this.promptElement, "backward");
         var expressionString = expressionRange.toString();
         var lastIndex = expressionString.length - 1;
 
@@ -292,16 +293,6 @@ WebInspector.ConsoleView.prototype = {
         var reportCompletions = this._reportCompletions.bind(this, bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix);
         // Collect comma separated object properties for the completion.
 
-        if (!expressionString) {
-            if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused) {
-                // Evaluate into properties in scope of the selected call frame.
-                reportCompletions(WebInspector.panels.scripts.variablesInSelectedCallFrame());
-                return;
-            } else {
-                expressionString = "this";
-            }
-        }
-
         var includeInspectorCommandLineAPI = (!dotNotation && !bracketNotation);
         if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused)
             var callFrameId = WebInspector.panels.scripts.selectedCallFrameId();
@@ -343,7 +334,7 @@ WebInspector.ConsoleView.prototype = {
             if (bestMatchOnly)
                 break;
         }
-        setTimeout(completionsReadyCallback, 0, results);
+        completionsReadyCallback(results);
     },
 
     _clearButtonClicked: function()
@@ -391,16 +382,16 @@ WebInspector.ConsoleView.prototype = {
         this.prompt.handleKeyEvent(event);
     },
 
-    evalInInspectedWindow: function(expression, callback)
+    evalInInspectedWindow: function(expression, objectGroup, callback)
     {
         if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused) {
-            WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, callback);
+            WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, objectGroup, callback);
             return;
         }
-        this.doEvalInWindow(expression, callback);
+        this.doEvalInWindow(expression, objectGroup, callback);
     },
 
-    doEvalInWindow: function(expression, callback)
+    doEvalInWindow: function(expression, objectGroup, callback)
     {
         if (!expression) {
             // There is no expression, so the completion should happen against global properties.
@@ -411,7 +402,7 @@ WebInspector.ConsoleView.prototype = {
         {
             callback(result.value, result.isException);
         };
-        InjectedScriptAccess.evaluate(expression, evalCallback);
+        InjectedScriptAccess.evaluate(expression, objectGroup, evalCallback);
     },
 
     _enterKeyPressed: function(event)
@@ -439,7 +430,7 @@ WebInspector.ConsoleView.prototype = {
             self.prompt.text = "";
             self.addMessage(new WebInspector.ConsoleCommandResult(result, exception, commandMessage));
         }
-        this.evalInInspectedWindow(str, printResult);
+        this.evalInInspectedWindow(str, "console", printResult);
     },
 
     _format: function(output, forceObjectFormat)
@@ -514,21 +505,31 @@ WebInspector.ConsoleView.prototype = {
 
     _formatarray: function(arr, elem)
     {
-        var self = this;
-        function printResult(properties)
-        {
-            if (!properties)
-                return;
-            elem.appendChild(document.createTextNode("["));
-            for (var i = 0; i < properties.length; ++i) {
-                var property = properties[i].value;
-                elem.appendChild(self._format(property));
-                if (i < properties.length - 1)
-                    elem.appendChild(document.createTextNode(", "));
-            }
-            elem.appendChild(document.createTextNode("]"));
+        InjectedScriptAccess.getProperties(arr, false, this._printArray.bind(this, elem));
+    },
+
+    _printArray: function(elem, properties)
+    {
+        if (!properties)
+            return;
+        var elements = [];
+        for (var i = 0; i < properties.length; ++i) {
+            var name = properties[i].name;
+            if (name == parseInt(name))
+                elements[name] = this._format(properties[i].value);
+        }
+
+        elem.appendChild(document.createTextNode("["));
+        for (var i = 0; i < elements.length; ++i) {
+            var element = elements[i];
+            if (element)
+                elem.appendChild(element);
+            else
+                elem.appendChild(document.createTextNode("undefined"))
+            if (i < elements.length - 1)
+                elem.appendChild(document.createTextNode(", "));
         }
-        InjectedScriptAccess.getProperties(arr, false, printResult);
+        elem.appendChild(document.createTextNode("]"));
     },
 
     _formatnode: function(object, elem)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/CookieItemsView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/CookieItemsView.js
index f9604a45ae..9f9845c6e4 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/CookieItemsView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/CookieItemsView.js
@@ -27,7 +27,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.CookieItemsView = function()
+WebInspector.CookieItemsView = function(cookieDomain)
 {
     WebInspector.View.call(this);
 
@@ -40,6 +40,8 @@ WebInspector.CookieItemsView = function()
 
     this.refreshButton = new WebInspector.StatusBarButton(WebInspector.UIString("Refresh"), "refresh-storage-status-bar-item");
     this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
+    
+    this._cookieDomain = cookieDomain;
 }
 
 WebInspector.CookieItemsView.prototype = {
@@ -70,6 +72,7 @@ WebInspector.CookieItemsView.prototype = {
             if (dataGrid) {
                 self._dataGrid = dataGrid;
                 self.element.appendChild(dataGrid.element);
+                self._dataGrid.updateWidths();
                 if (isAdvanced)
                     self.deleteButton.visible = true;
             } else {
@@ -82,7 +85,7 @@ WebInspector.CookieItemsView.prototype = {
             }
         }
 
-        WebInspector.Cookies.getCookiesAsync(callback);
+        WebInspector.Cookies.getCookiesAsync(callback, this._cookieDomain);
     },
 
     dataGridForCookies: function(cookies)
@@ -246,6 +249,12 @@ WebInspector.CookieItemsView.prototype = {
 
         return dataGrid;
     },
+    
+    resize: function()
+    {
+        if (this._dataGrid)
+            this._dataGrid.updateWidths();
+    },
 
     _deleteButtonClicked: function(event)
     {
@@ -253,7 +262,7 @@ WebInspector.CookieItemsView.prototype = {
             return;
 
         var cookie = this._dataGrid.selectedNode.cookie;
-        InspectorController.deleteCookie(cookie.name);
+        InspectorController.deleteCookie(cookie.name, this._cookieDomain);
         this.update();
     },
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMAgent.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMAgent.js
index a151c05784..25ffafaec5 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMAgent.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMAgent.js
@@ -307,13 +307,6 @@ WebInspector.DOMAgent = function() {
     this._window = new WebInspector.DOMWindow(this);
     this._idToDOMNode = null;
     this.document = null;
-
-    // TODO: update ElementsPanel to not track embedded iframes - it is already being handled
-    // in the agent backend.
-
-    // Whitespace is ignored in InspectorDOMAgent already -> no need to filter.
-    // TODO: Either remove all of its usages or push value into the agent backend.
-    Preferences.ignoreWhitespace = false;
 }
 
 WebInspector.DOMAgent.prototype = {
@@ -417,10 +410,8 @@ WebInspector.DOMAgent.prototype = {
         node._childNodeCount = newValue;
         var outline = WebInspector.panels.elements.treeOutline;
         var treeElement = outline.findTreeElement(node);
-        if (treeElement) {
+        if (treeElement)
             treeElement.hasChildren = newValue;
-            treeElement.whitespaceIgnored = Preferences.ignoreWhitespace;
-        }
     },
 
     _childNodeInserted: function(parentId, prevId, payload)
@@ -446,7 +437,7 @@ WebInspector.DOMAgent.prototype = {
 
 WebInspector.Cookies = {}
 
-WebInspector.Cookies.getCookiesAsync = function(callback)
+WebInspector.Cookies.getCookiesAsync = function(callback, cookieDomain)
 {
     function mycallback(cookies, cookiesString) {
         if (cookiesString)
@@ -455,7 +446,7 @@ WebInspector.Cookies.getCookiesAsync = function(callback)
             callback(cookies, true);
     }
     var callId = WebInspector.Callback.wrap(mycallback);
-    InspectorController.getCookies(callId);
+    InspectorController.getCookies(callId, cookieDomain);
 }
 
 WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js
index dcab2ab89d..1a348fc3f2 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js
@@ -26,18 +26,18 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Database = function(database, domain, name, version)
+WebInspector.Database = function(id, domain, name, version)
 {
-    this._database = database;
-    this.domain = domain;
-    this.name = name;
-    this.version = version;
+    this._id = id;
+    this._domain = domain;
+    this._name = name;
+    this._version = version;
 }
 
 WebInspector.Database.prototype = {
-    isDatabase: function(db)
+    get id()
     {
-        return this._database === db;
+        return this._id;
     },
 
     get name()
@@ -47,8 +47,6 @@ WebInspector.Database.prototype = {
 
     set name(x)
     {
-        if (this._name === x)
-            return;
         this._name = x;
     },
 
@@ -59,8 +57,6 @@ WebInspector.Database.prototype = {
 
     set version(x)
     {
-        if (this._version === x)
-            return;
         this._version = x;
     },
 
@@ -71,8 +67,6 @@ WebInspector.Database.prototype = {
 
     set domain(x)
     {
-        if (this._domain === x)
-            return;
         this._domain = x;
     },
 
@@ -83,31 +77,26 @@ WebInspector.Database.prototype = {
 
     getTableNames: function(callback)
     {
-        var names = InspectorController.databaseTableNames(this._database);
-        function sortingCallback()
+        function sortingCallback(names)
         {
             callback(names.sort());
         }
-        setTimeout(sortingCallback, 0);
+        var callId = WebInspector.Callback.wrap(sortingCallback);
+        InspectorController.getDatabaseTableNames(callId, this._id);
     },
     
     executeSql: function(query, onSuccess, onError)
     {
-        function successCallback(tx, result)
+        function callback(result)
         {
+            if (!(result instanceof Array)) {
+                onError(result);
+                return;
+            }
             onSuccess(result);
         }
-
-        function errorCallback(tx, error)
-        {
-            onError(error);
-        }
-
-        var self = this;
-        function queryTransaction(tx)
-        {
-            tx.executeSql(query, null, InspectorController.wrapCallback(successCallback.bind(self)), InspectorController.wrapCallback(errorCallback.bind(self)));
-        }
-        this._database.transaction(InspectorController.wrapCallback(queryTransaction.bind(this)), InspectorController.wrapCallback(errorCallback.bind(this)));
+        InjectedScriptAccess.executeSql(this._id, query, callback);
     }
 }
+
+WebInspector.didGetDatabaseTableNames = WebInspector.Callback.processCallback;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
index 1b61a7bb36..5d0e6d70a1 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
@@ -60,7 +60,7 @@ WebInspector.ElementsPanel = function()
 
         if (InspectorController.searchingForNode()) {
             InspectorController.toggleNodeSearch();
-            this.panel.nodeSearchButton.removeStyleClass("toggled-on");
+            this.panel.nodeSearchButton.toggled = false;
         }
         if (this._focusedDOMNode)
             InjectedScriptAccess.addInspectedNode(this._focusedDOMNode.id, function() {});
@@ -479,7 +479,7 @@ WebInspector.ElementsPanel.prototype = {
                 updatedParentTreeElements.push(parentNodeItem);
             }
 
-            if (!updateBreadcrumbs && (this.focusedDOMNode === parent || isAncestor(this.focusedDOMNode, parent)))
+            if (!updateBreadcrumbs && (this.focusedDOMNode === parent || isAncestorNode(this.focusedDOMNode, parent)))
                 updateBreadcrumbs = true;
         }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
index d8c4d89079..c4bd37295c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -115,12 +115,12 @@ WebInspector.ElementsTreeOutline.prototype = {
             this.appendChild(treeElement);
         } else {
             // FIXME: this could use findTreeElement to reuse a tree element if it already exists
-            var node = (Preferences.ignoreWhitespace ? firstChildSkippingWhitespace.call(this.rootDOMNode) : this.rootDOMNode.firstChild);
+            var node = this.rootDOMNode.firstChild;
             while (node) {
                 treeElement = new WebInspector.ElementsTreeElement(node);
                 treeElement.selectable = this.selectEnabled;
                 this.appendChild(treeElement);
-                node = Preferences.ignoreWhitespace ? nextSiblingSkippingWhitespace.call(node) : node.nextSibling;
+                node = node.nextSibling;
             }
         }
 
@@ -184,6 +184,34 @@ WebInspector.ElementsTreeOutline.prototype = {
 
         return element;
     },
+    
+    handleKeyEvent: function(event)
+    {
+        var selectedElement = this.selectedTreeElement;
+        if (!selectedElement)
+            return;
+
+        // Delete or backspace pressed, delete the node.
+        if (event.keyCode === 8 || event.keyCode === 46) {
+            selectedElement.remove();
+            return;
+        }
+
+        // On Enter or Return start editing the first attribute
+        // or create a new attribute on the selected element.
+        if (event.keyIdentifier === "Enter") {
+            if (this._editing)
+                return;
+
+            selectedElement._startEditing();
+
+            // prevent a newline from being immediately inserted
+            event.preventDefault();
+            return;
+        }
+
+        TreeOutline.prototype.handleKeyEvent.call(this, event);
+    },
 
     _onmousedown: function(event)
     {
@@ -197,12 +225,15 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     _onmousemove: function(event)
     {
+        var element = this._treeElementFromEvent(event);
+        if (element && this._previousHoveredElement === element)
+            return;
+
         if (this._previousHoveredElement) {
             this._previousHoveredElement.hovered = false;
             delete this._previousHoveredElement;
         }
 
-        var element = this._treeElementFromEvent(event);
         if (element && !element.elementCloseTag) {
             element.hovered = true;
             this._previousHoveredElement = element;
@@ -230,14 +261,10 @@ WebInspector.ElementsTreeOutline.prototype.__proto__ = TreeOutline.prototype;
 
 WebInspector.ElementsTreeElement = function(node)
 {
-    var hasChildren = Preferences.ignoreWhitespace ? (firstChildSkippingWhitespace.call(node) ? true : false) : node.hasChildNodes();
-    var titleInfo = nodeTitleInfo.call(node, hasChildren, WebInspector.linkifyURL);
-
-    if (titleInfo.hasChildren) 
-        this.whitespaceIgnored = Preferences.ignoreWhitespace;
+    var hasChildrenOverride = node.hasChildNodes() && !this._showInlineText(node);
 
     // The title will be updated in onattach.
-    TreeElement.call(this, "", node, titleInfo.hasChildren);
+    TreeElement.call(this, "", node, hasChildrenOverride);
 
     if (this.representedObject.nodeType == Node.ELEMENT_NODE)
         this._canAddAttributes = true;
@@ -280,36 +307,39 @@ WebInspector.ElementsTreeElement.prototype = {
             if (x) {
                 this.updateSelection();
                 this.listItemElement.addStyleClass("hovered");
-            } else
+                if (this._canAddAttributes)
+                    this._pendingToggleNewAttribute = setTimeout(this.toggleNewAttributeButton.bind(this, true), 500);
+            } else {
                 this.listItemElement.removeStyleClass("hovered");
-            if (this._canAddAttributes)
-                this.toggleNewAttributeButton();
+                if (this._pendingToggleNewAttribute) {
+                    clearTimeout(this._pendingToggleNewAttribute);
+                    delete this._pendingToggleNewAttribute;
+                }
+                this.toggleNewAttributeButton(false);
+            }
         }
     },
 
-    toggleNewAttributeButton: function()
+    toggleNewAttributeButton: function(visible)
     {
-        function removeWhenEditing(event)
+        function removeAddAttributeSpan()
         {
             if (this._addAttributeElement && this._addAttributeElement.parentNode)
                 this._addAttributeElement.parentNode.removeChild(this._addAttributeElement);
             delete this._addAttributeElement;
         }
 
-        if (!this._addAttributeElement && this._hovered && !this._editing) {
+        if (!this._addAttributeElement && visible && !this._editing) {
             var span = document.createElement("span");
-            span.className = "add-attribute";
-            span.textContent = "\u2026";
-            span.addEventListener("dblclick", removeWhenEditing.bind(this), false);
+            span.className = "add-attribute webkit-html-attribute-name";
+            span.textContent = " ?=\"\"";
+            span.addEventListener("dblclick", removeAddAttributeSpan.bind(this), false);
             this._addAttributeElement = span;
 
             var tag = this.listItemElement.getElementsByClassName("webkit-html-tag")[0];
             this._insertInLastAttributePosition(tag, span);
-        } else if (!this._hovered && this._addAttributeElement) {
-            if (this._addAttributeElement.parentNode)
-                this._addAttributeElement.parentNode.removeChild(this._addAttributeElement);
-            delete this._addAttributeElement;
-        }
+        } else if (!visible && this._addAttributeElement)
+            removeAddAttributeSpan.call(this);
     },
     
     updateSelection: function()
@@ -362,11 +392,9 @@ WebInspector.ElementsTreeElement.prototype = {
 
     onpopulate: function()
     {
-        if (this.children.length || this.whitespaceIgnored !== Preferences.ignoreWhitespace)
+        if (this.children.length || this._showInlineText(this.representedObject))
             return;
 
-        this.whitespaceIgnored = Preferences.ignoreWhitespace;
-
         this.updateChildren();
     },
     
@@ -390,7 +418,7 @@ WebInspector.ElementsTreeElement.prototype = {
         function updateChildrenOfNode(node)
         {
             var treeOutline = treeElement.treeOutline;
-            var child = (Preferences.ignoreWhitespace ? firstChildSkippingWhitespace.call(node) : node.firstChild);
+            var child = node.firstChild;
             while (child) {
                 var currentTreeElement = treeElement.children[treeChildIndex];
                 if (!currentTreeElement || currentTreeElement.representedObject !== child) {
@@ -418,7 +446,7 @@ WebInspector.ElementsTreeElement.prototype = {
                     }
                 }
 
-                child = Preferences.ignoreWhitespace ? nextSiblingSkippingWhitespace.call(child) : child.nextSibling;
+                child = child.nextSibling;
                 ++treeChildIndex;
             }
         }
@@ -491,7 +519,7 @@ WebInspector.ElementsTreeElement.prototype = {
         if (this._editing)
             return;
 
-        if (this._startEditing(event, treeElement))
+        if (this._startEditingFromEvent(event, treeElement))
             return;
 
         if (this.treeOutline.panel) {
@@ -516,7 +544,7 @@ WebInspector.ElementsTreeElement.prototype = {
         }
     },
 
-    _startEditing: function(event, treeElement)
+    _startEditingFromEvent: function(event, treeElement)
     {
         if (this.treeOutline.focusedDOMNode != this.representedObject)
             return;
@@ -539,6 +567,30 @@ WebInspector.ElementsTreeElement.prototype = {
         return false;
     },
 
+    _startEditing: function()
+    {
+        if (this.treeOutline.focusedDOMNode !== this.representedObject)
+            return;
+
+        var listItem = this._listItemNode;
+
+        if (this._canAddAttributes) {
+            this.toggleNewAttributeButton(false);
+            var attribute = listItem.getElementsByClassName("webkit-html-attribute")[0];
+            if (attribute)
+                return this._startEditingAttribute(attribute, attribute.getElementsByClassName("webkit-html-attribute-name")[0]);
+
+            return this._addNewAttribute(listItem);
+        }
+
+        if (this.representedObject.nodeType === Node.TEXT_NODE) {
+            var textNode = listItem.getElementsByClassName("webkit-html-text-node")[0];
+            if (textNode)
+                return this._startEditingTextNode(textNode);
+            return;
+        }
+    },
+
     _addNewAttribute: function(listItemElement)
     {
         var attr = document.createElement("span");
@@ -646,7 +698,7 @@ WebInspector.ElementsTreeElement.prototype = {
                 }
             }
 
-            if (!found && moveDirection === "backward")
+            if (!found && moveDirection === "backward" && attributes.length > 0)
                 moveToAttribute = attributes[attributes.length - 1].name;
             else if (!found && moveDirection === "forward" && !/^\s*$/.test(newText))
                 newAttribute = true;
@@ -720,12 +772,138 @@ WebInspector.ElementsTreeElement.prototype = {
 
     _updateTitle: function()
     {
-        var title = nodeTitleInfo.call(this.representedObject, this.hasChildren, WebInspector.linkifyURL).title;
+        var title = this._nodeTitleInfo(this.representedObject, this.hasChildren, WebInspector.linkifyURL).title;
         this.title = "<span class=\"highlight\">" + title + "</span>";
         delete this.selectionElement;
         this.updateSelection();
         this._preventFollowingLinksOnDoubleClick();
     },
+
+    _nodeTitleInfo: function(node, hasChildren, linkify)
+    {
+        var info = {title: "", hasChildren: hasChildren};
+        
+        switch (node.nodeType) {
+            case Node.DOCUMENT_NODE:
+                info.title = "Document";
+                break;
+                
+            case Node.ELEMENT_NODE:
+                info.title = "<span class=\"webkit-html-tag\">&lt;" + node.nodeName.toLowerCase().escapeHTML();
+                
+                if (node.hasAttributes()) {
+                    for (var i = 0; i < node.attributes.length; ++i) {
+                        var attr = node.attributes[i];
+                        info.title += " <span class=\"webkit-html-attribute\"><span class=\"webkit-html-attribute-name\">" + attr.name.escapeHTML() + "</span>=&#8203;\"";
+                        
+                        var value = attr.value;
+                        if (linkify && (attr.name === "src" || attr.name === "href")) {
+                            var value = value.replace(/([\/;:\)\]\}])/g, "$1\u200B");
+                            info.title += linkify(attr.value, value, "webkit-html-attribute-value", node.nodeName.toLowerCase() == "a");
+                        } else {
+                            var value = value.escapeHTML();
+                            value = value.replace(/([\/;:\)\]\}])/g, "$1&#8203;");
+                            info.title += "<span class=\"webkit-html-attribute-value\">" + value + "</span>";
+                        }
+                        info.title += "\"</span>";
+                    }
+                }
+                info.title += "&gt;</span>&#8203;";
+                
+                // If this element only has a single child that is a text node,
+                // just show that text and the closing tag inline rather than
+                // create a subtree for them
+                
+                var textChild = onlyTextChild.call(node);
+                var showInlineText = textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength;
+                
+                if (showInlineText) {
+                    info.title += "<span class=\"webkit-html-text-node\">" + textChild.nodeValue.escapeHTML() + "</span>&#8203;<span class=\"webkit-html-tag\">&lt;/" + node.nodeName.toLowerCase().escapeHTML() + "&gt;</span>";
+                    info.hasChildren = false;
+                }
+                break;
+                
+            case Node.TEXT_NODE:
+                if (isNodeWhitespace.call(node))
+                    info.title = "(whitespace)";
+                else {
+                    if (node.parentNode && node.parentNode.nodeName.toLowerCase() == "script") {
+                        var newNode = document.createElement("span");
+                        newNode.textContent = node.textContent;
+                        
+                        var javascriptSyntaxHighlighter = new WebInspector.JavaScriptSourceSyntaxHighlighter(null, null);
+                        javascriptSyntaxHighlighter.syntaxHighlightLine(newNode, null);
+                        
+                        info.title = "<span class=\"webkit-html-text-node webkit-html-js-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
+                    } else if (node.parentNode && node.parentNode.nodeName.toLowerCase() == "style") {
+                        var newNode = document.createElement("span");
+                        newNode.textContent = node.textContent;
+                        
+                        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighligher(null, null);
+                        cssSyntaxHighlighter.syntaxHighlightLine(newNode, null);
+                        
+                        info.title = "<span class=\"webkit-html-text-node webkit-html-css-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
+                    } else {
+                        info.title = "\"<span class=\"webkit-html-text-node\">" + node.nodeValue.escapeHTML() + "</span>\""; 
+                    }
+                } 
+                break;
+                
+            case Node.COMMENT_NODE:
+                info.title = "<span class=\"webkit-html-comment\">&lt;!--" + node.nodeValue.escapeHTML() + "--&gt;</span>";
+                break;
+                
+            case Node.DOCUMENT_TYPE_NODE:
+                info.title = "<span class=\"webkit-html-doctype\">&lt;!DOCTYPE " + node.nodeName;
+                if (node.publicId) {
+                    info.title += " PUBLIC \"" + node.publicId + "\"";
+                    if (node.systemId)
+                        info.title += " \"" + node.systemId + "\"";
+                } else if (node.systemId)
+                    info.title += " SYSTEM \"" + node.systemId + "\"";
+                if (node.internalSubset)
+                    info.title += " [" + node.internalSubset + "]";
+                info.title += "&gt;</span>";
+                break;
+            default:
+                info.title = node.nodeName.toLowerCase().collapseWhitespace().escapeHTML();
+        }
+        
+        return info;
+    },
+
+    _showInlineText: function(node)
+    {
+        if (node.nodeType === Node.ELEMENT_NODE) {
+            var textChild = onlyTextChild.call(node);
+            if (textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength)
+                return true;
+        }
+        return false;
+    },
+    
+    remove: function()
+    {
+        var parentElement = this.parent;
+        if (!parentElement)
+            return;
+
+        var self = this;
+        function removeNodeCallback(removedNodeId)
+        {
+            // -1 is an error code, which means removing the node from the DOM failed,
+            // so we shouldn't remove it from the tree.
+            if (removedNodeId === -1)
+                return;
+
+            parentElement.removeChild(self);
+        }
+
+        var callId = WebInspector.Callback.wrap(removeNodeCallback);
+        InspectorController.removeNode(callId, this.representedObject.id);
+    }
 }
 
 WebInspector.ElementsTreeElement.prototype.__proto__ = TreeElement.prototype;
+
+WebInspector.didRemoveNode = WebInspector.Callback.processCallback;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
index 87293b8e5a..3ce96d0e1d 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
@@ -41,9 +41,12 @@ InjectedScript.reset = function()
 
 InjectedScript.reset();
 
-InjectedScript.dispatch = function(methodName, args)
+InjectedScript.dispatch = function(methodName, args, callId)
 {
-    var result = InjectedScript[methodName].apply(InjectedScript, JSON.parse(args));
+    var argsArray = JSON.parse(args);
+    if (callId)
+        argsArray.splice(0, 0, callId);  // Methods that run asynchronously have a call back id parameter.
+    var result = InjectedScript[methodName].apply(InjectedScript, argsArray);
     if (typeof result === "undefined") {
         InjectedScript._window().console.error("Web Inspector error: InjectedScript.%s returns undefined", methodName);
         result = null;
@@ -514,12 +517,28 @@ InjectedScript.getCompletions = function(expression, includeInspectorCommandLine
             var callFrame = InjectedScript._callFrameForId(callFrameId);
             if (!callFrame)
                 return props;
-            expressionResult = InjectedScript._evaluateOn(callFrame.evaluate, callFrame, expression);
+            if (expression)
+                expressionResult = InjectedScript._evaluateOn(callFrame.evaluate, callFrame, expression);
+            else {
+                // Evaluate into properties in scope of the selected call frame.
+                var scopeChain = callFrame.scopeChain;
+                for (var i = 0; i < scopeChain.length; ++i) {
+                    var scopeObject = scopeChain[i];
+                    try {
+                        for (var propertyName in scopeObject)
+                            props[propertyName] = true;
+                    } catch (e) {
+                    }
+                }
+            }
         } else {
+            if (!expression)
+                expression = "this";
             expressionResult = InjectedScript._evaluateOn(InjectedScript._window().eval, InjectedScript._window(), expression);
         }
-        for (var prop in expressionResult)
-            props[prop] = true;
+        if (expressionResult)
+            for (var prop in expressionResult)
+                props[prop] = true;
         if (includeInspectorCommandLineAPI)
             for (var prop in InjectedScript._window()._inspectorCommandLineAPI)
                 if (prop.charAt(0) !== '_')
@@ -529,16 +548,16 @@ InjectedScript.getCompletions = function(expression, includeInspectorCommandLine
     return props;
 }
 
-InjectedScript.evaluate = function(expression)
+InjectedScript.evaluate = function(expression, objectGroup)
 {
-    return InjectedScript._evaluateAndWrap(InjectedScript._window().eval, InjectedScript._window(), expression);
+    return InjectedScript._evaluateAndWrap(InjectedScript._window().eval, InjectedScript._window(), expression, objectGroup);
 }
 
-InjectedScript._evaluateAndWrap = function(evalFunction, object, expression)
+InjectedScript._evaluateAndWrap = function(evalFunction, object, expression, objectGroup)
 {
     var result = {};
     try {
-        result.value = InspectorController.wrapObject(InjectedScript._evaluateOn(evalFunction, object, expression));
+        result.value = InspectorController.wrapObject(InjectedScript._evaluateOn(evalFunction, object, expression), objectGroup);
         // Handle error that might have happened while describing result.
         if (result.value.errorText) {
             result.value = result.value.errorText;
@@ -553,7 +572,7 @@ InjectedScript._evaluateAndWrap = function(evalFunction, object, expression)
 
 InjectedScript._evaluateOn = function(evalFunction, object, expression)
 {
-    InjectedScript._ensureCommandLineAPIInstalled();
+    InjectedScript._ensureCommandLineAPIInstalled(evalFunction, object);
     // Surround the expression in with statements to inject our command line API so that
     // the window object properties still take more precedent than our API functions.
     expression = "with (window._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
@@ -572,7 +591,7 @@ InjectedScript.addInspectedNode = function(nodeId)
     if (!node)
         return false;
 
-    InjectedScript._ensureCommandLineAPIInstalled();
+    InjectedScript._ensureCommandLineAPIInstalled(InjectedScript._window().eval, InjectedScript._window());
     var inspectedNodes = InjectedScript._window()._inspectorCommandLineAPI._inspectedNodes;
     inspectedNodes.unshift(node);
     if (inspectedNodes.length >= 5)
@@ -838,12 +857,12 @@ InjectedScript.getCallFrames = function()
     return result;
 }
 
-InjectedScript.evaluateInCallFrame = function(callFrameId, code)
+InjectedScript.evaluateInCallFrame = function(callFrameId, code, objectGroup)
 {
     var callFrame = InjectedScript._callFrameForId(callFrameId);
     if (!callFrame)
         return false;
-    return InjectedScript._evaluateAndWrap(callFrame.evaluate, callFrame, code);
+    return InjectedScript._evaluateAndWrap(callFrame.evaluate, callFrame, code, objectGroup);
 }
 
 InjectedScript._callFrameForId = function(id)
@@ -880,13 +899,11 @@ InjectedScript._inspectObject = function(o)
     }
 }
 
-InjectedScript._ensureCommandLineAPIInstalled = function(inspectedWindow)
+InjectedScript._ensureCommandLineAPIInstalled = function(evalFunction, evalObject)
 {
-    var inspectedWindow = InjectedScript._window();
-    if (inspectedWindow._inspectorCommandLineAPI)
+    if (evalFunction.call(evalObject, "window._inspectorCommandLineAPI"))
         return;
-    
-    inspectedWindow.eval("window._inspectorCommandLineAPI = { \
+    var inspectorCommandLineAPI = evalFunction.call(evalObject, "window._inspectorCommandLineAPI = { \
         $: function() { return document.getElementById.apply(document, arguments) }, \
         $$: function() { return document.querySelectorAll.apply(document, arguments) }, \
         $x: function(xpath, context) { \
@@ -913,8 +930,8 @@ InjectedScript._ensureCommandLineAPIInstalled = function(inspectedWindow)
         get $4() { return _inspectorCommandLineAPI._inspectedNodes[4] } \
     };");
 
-    inspectedWindow._inspectorCommandLineAPI.clear = InspectorController.wrapCallback(InjectedScript._clearConsoleMessages);
-    inspectedWindow._inspectorCommandLineAPI.inspect = InspectorController.wrapCallback(InjectedScript._inspectObject);
+    inspectorCommandLineAPI.clear = InspectorController.wrapCallback(InjectedScript._clearConsoleMessages);
+    inspectorCommandLineAPI.inspect = InspectorController.wrapCallback(InjectedScript._inspectObject);
 }
 
 InjectedScript._resolveObject = function(objectProxy)
@@ -1031,18 +1048,51 @@ InjectedScript.CallFrameProxy.prototype = {
                 scopeObjectProxy.isDocument = true;
             else if (!foundLocalScope)
                 scopeObjectProxy.isWithBlock = true;
-            scopeObjectProxy.properties = [];
-            try {
-                for (var propertyName in scopeObject)
-                    scopeObjectProxy.properties.push(propertyName);
-            } catch (e) {
-            }
             scopeChainProxy.push(scopeObjectProxy);
         }
         return scopeChainProxy;
     }
 }
 
+InjectedScript.executeSql = function(callId, databaseId, query)
+{
+    function successCallback(tx, result)
+    {
+        var rows = result.rows;
+        var result = [];
+        var length = rows.length;
+        for (var i = 0; i < length; ++i) {
+            var data = {};
+            result.push(data);
+            var row = rows.item(i);
+            for (var columnIdentifier in row) {
+                // FIXME: (Bug 19439) We should specially format SQL NULL here
+                // (which is represented by JavaScript null here, and turned
+                // into the string "null" by the String() function).
+                var text = row[columnIdentifier];
+                data[columnIdentifier] = String(text);
+            }
+        }
+        InspectorController.reportDidDispatchOnInjectedScript(callId, JSON.stringify(result), false);
+    }
+
+    function errorCallback(tx, error)
+    {
+        InspectorController.reportDidDispatchOnInjectedScript(callId, JSON.stringify(error), false);
+    }
+
+    function queryTransaction(tx)
+    {
+        tx.executeSql(query, null, InspectorController.wrapCallback(successCallback), InspectorController.wrapCallback(errorCallback));
+    }
+
+    var database = InspectorController.databaseForId(databaseId);
+    if (!database)
+        errorCallback(null, { code : 2 });  // Return as unexpected version.
+    database.transaction(InspectorController.wrapCallback(queryTransaction), InspectorController.wrapCallback(errorCallback));
+    return true;
+}
+
 Object.type = function(obj)
 {
     if (obj === null)
@@ -1068,6 +1118,8 @@ Object.type = function(obj)
         return "date";
     if (obj instanceof win.RegExp)
         return "regexp";
+    if (obj instanceof win.NodeList)
+        return "array";
     if (obj instanceof win.Error)
         return "error";
     return type;
@@ -1090,9 +1142,8 @@ Object.describe = function(obj, abbreviated)
     switch (type1) {
     case "object":
     case "node":
-        return type2;
     case "array":
-        return "[" + obj.toString() + "]";
+        return type2;
     case "string":
         if (!abbreviated)
             return obj;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js
index 67312f7a02..c6d4b65b35 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js
@@ -31,7 +31,7 @@
 
 var InjectedScriptAccess = {};
 
-InjectedScriptAccess._installHandler = function(methodName)
+InjectedScriptAccess._installHandler = function(methodName, async)
 {
     InjectedScriptAccess[methodName] = function()
     {
@@ -47,35 +47,37 @@ InjectedScriptAccess._installHandler = function(methodName)
                 WebInspector.console.addMessage(new WebInspector.ConsoleTextMessage("Error dispatching: " + methodName));
         }
         var callId = WebInspector.Callback.wrap(myCallback);
-        InspectorController.dispatchOnInjectedScript(callId, methodName, argsString);
+        InspectorController.dispatchOnInjectedScript(callId, methodName, argsString, !!async);
     };
 }
 
 // InjectedScriptAccess message forwarding puts some constraints on the way methods are imlpemented and called:
 // - Make sure corresponding methods in InjectedScript return non-null and non-undefined values,
 // - Make sure last parameter of all the InjectedSriptAccess.* calls is a callback function.
-InjectedScriptAccess._installHandler("getStyles");
+// We keep these sorted.
+InjectedScriptAccess._installHandler("addInspectedNode");
+InjectedScriptAccess._installHandler("addStyleSelector");
+InjectedScriptAccess._installHandler("applyStyleRuleText");
+InjectedScriptAccess._installHandler("applyStyleText");
+InjectedScriptAccess._installHandler("evaluate");
+InjectedScriptAccess._installHandler("evaluateInCallFrame");
+InjectedScriptAccess._installHandler("getCompletions");
 InjectedScriptAccess._installHandler("getComputedStyle");
 InjectedScriptAccess._installHandler("getInlineStyle");
-InjectedScriptAccess._installHandler("applyStyleText");
-InjectedScriptAccess._installHandler("setStyleText");
-InjectedScriptAccess._installHandler("toggleStyleEnabled");
-InjectedScriptAccess._installHandler("applyStyleRuleText");
-InjectedScriptAccess._installHandler("addStyleSelector");
-InjectedScriptAccess._installHandler("setStyleProperty");
-InjectedScriptAccess._installHandler("getPrototypes");
 InjectedScriptAccess._installHandler("getProperties");
-InjectedScriptAccess._installHandler("setPropertyValue");
-InjectedScriptAccess._installHandler("getCompletions");
-InjectedScriptAccess._installHandler("evaluate");
-InjectedScriptAccess._installHandler("addInspectedNode");
-InjectedScriptAccess._installHandler("pushNodeToFrontend");
-InjectedScriptAccess._installHandler("evaluate");
-InjectedScriptAccess._installHandler("addInspectedNode");
-InjectedScriptAccess._installHandler("pushNodeToFrontend");
+InjectedScriptAccess._installHandler("getPrototypes");
+InjectedScriptAccess._installHandler("getStyles");
+InjectedScriptAccess._installHandler("openInInspectedWindow");
 InjectedScriptAccess._installHandler("performSearch");
+InjectedScriptAccess._installHandler("pushNodeToFrontend");
 InjectedScriptAccess._installHandler("searchCanceled");
-InjectedScriptAccess._installHandler("openInInspectedWindow");
-InjectedScriptAccess._installHandler("evaluateInCallFrame");
+InjectedScriptAccess._installHandler("setPropertyValue");
+InjectedScriptAccess._installHandler("setStyleProperty");
+InjectedScriptAccess._installHandler("setStyleText");
+InjectedScriptAccess._installHandler("toggleStyleEnabled");
+
+// Some methods can't run synchronously even on the injected script side (such as DB transactions).
+// Mark them as asynchronous here.
+InjectedScriptAccess._installHandler("executeSql", true);
 
 WebInspector.didDispatchOnInjectedScript = WebInspector.Callback.processCallback;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Object.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Object.js
index 80202b094d..74fb56e62a 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Object.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Object.js
@@ -67,10 +67,10 @@ WebInspector.Object.prototype = {
         }
 
         var event = {target: this, type: eventType, defaultPrevented: false};
-        event.stopPropagation = stopPropagation.bind(event);
-        event.preventDefault = preventDefault.bind(event);
+        event.stopPropagation = stopPropagation;
+        event.preventDefault = preventDefault;
 
-        var listeners = this._listeners[eventType];
+        var listeners = this._listeners[eventType].slice(0);
         for (var i = 0; i < listeners.length; ++i) {
             listeners[i].listener.call(listeners[i].thisObject, event);
             if (stoppedPropagation)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
index 2b8c6ce00c..ee96345987 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
@@ -23,7 +23,9 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.ProfileView = function(profile)
+// FIXME: Rename the file.
+
+WebInspector.CPUProfileView = function(profile)
 {
     WebInspector.View.call(this);
 
@@ -78,15 +80,25 @@ WebInspector.ProfileView = function(profile)
 
     this.profile = profile;
 
-    this.profileDataGridTree = this.bottomUpProfileDataGridTree;
-    this.profileDataGridTree.sort(WebInspector.ProfileDataGridTree.propertyComparator("selfTime", false));
-
-    this.refresh();
+    var self = this;
+    function profileCallback(profile)
+    {
+        self.profile.representedObject = profile;
+        self._assignParentsInProfile();
+      
+        self.profileDataGridTree = self.bottomUpProfileDataGridTree;
+        self.profileDataGridTree.sort(WebInspector.ProfileDataGridTree.propertyComparator("selfTime", false));
+     
+        self.refresh();
+     
+        self._updatePercentButton();
+    }
 
-    this._updatePercentButton();
+    var callId = WebInspector.Callback.wrap(profileCallback);
+    InspectorController.getProfile(callId, this.profile.uid);
 }
 
-WebInspector.ProfileView.prototype = {
+WebInspector.CPUProfileView.prototype = {
     get statusBarItems()
     {
         return [this.viewSelectElement, this.percentButton.element, this.focusButton.element, this.excludeButton.element, this.resetButton.element];
@@ -158,7 +170,7 @@ WebInspector.ProfileView.prototype = {
         WebInspector.View.prototype.hide.call(this);
         this._currentSearchResultIndex = -1;
     },
-    
+
     resize: function()
     {
         if (this.dataGrid)
@@ -493,7 +505,7 @@ WebInspector.ProfileView.prototype = {
 
     _sortData: function(event)
     {
-        this._sortProfile(this.profile);
+        this._sortProfile(this.profile.representedObject);
     },
 
     _sortProfile: function()
@@ -533,7 +545,100 @@ WebInspector.ProfileView.prototype = {
 
         event.preventDefault();
         event.stopPropagation();
+    },
+
+    _assignParentsInProfile: function()
+    {
+        var head = this.profile.head;
+        head.parent = null;
+        head.head = null;
+        var nodesToTraverse = [ { parent: head, children: head.children } ];
+        while (nodesToTraverse.length > 0) {
+            var pair = nodesToTraverse.shift();
+            var parent = pair.parent;
+            var children = pair.children;
+            var length = children.length;
+            for (var i = 0; i < length; ++i) {
+                children[i].head = head;
+                children[i].parent = parent;
+                if (children[i].children.length > 0)
+                    nodesToTraverse.push({ parent: children[i], children: children[i].children });
+            }
+        }
+    }
+}
+
+WebInspector.CPUProfileView.prototype.__proto__ = WebInspector.View.prototype;
+
+WebInspector.CPUProfileType = function()
+{
+    WebInspector.ProfileType.call(this, WebInspector.CPUProfileType.TypeId, WebInspector.UIString("CPU PROFILES"));
+    this._recording = false;
+}
+
+WebInspector.CPUProfileType.TypeId = "CPU";
+
+WebInspector.CPUProfileType.prototype = {
+    get buttonTooltip()
+    {
+        return this._recording ? WebInspector.UIString("Stop profiling.") : WebInspector.UIString("Start profiling.");
+    },
+
+    get buttonStyle()
+    {
+        return this._recording ? "record-profile-status-bar-item status-bar-item toggled-on" : "record-profile-status-bar-item status-bar-item";
+    },
+
+    buttonClicked: function()
+    {
+        this._recording = !this._recording;
+
+        if (this._recording)
+            InspectorController.startProfiling();
+        else
+            InspectorController.stopProfiling();
+    },
+
+    setRecordingProfile: function(isProfiling)
+    {
+        this._recording = isProfiling;
     }
 }
 
-WebInspector.ProfileView.prototype.__proto__ = WebInspector.View.prototype;
+WebInspector.CPUProfileType.prototype.__proto__ = WebInspector.ProfileType.prototype;
+
+WebInspector.CPUProfile = function(profile)
+{
+    this.representedObject = profile;
+    this.typeId = WebInspector.CPUProfileType.TypeId;
+}
+
+WebInspector.CPUProfile.prototype = {
+    get title()
+    {
+        return this.representedObject.title;
+    },
+
+    get uid()
+    {
+        return this.representedObject.uid;
+    },
+
+    get head()
+    {
+        return this.representedObject.head;
+    },
+
+    createView: function()
+    {
+        return new WebInspector.CPUProfileView(this);
+    },
+
+    // FIXME: Extract this into a superclass so that createView can be simply overridden by subclasses.
+    viewForProfile: function()
+    {
+        if (!this._profileView)
+            this._profileView = this.createView();
+        return this._profileView;
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
index 3bd4464b8f..55e286e444 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
@@ -25,11 +25,52 @@
 
 const UserInitiatedProfileName = "org.webkit.profiles.user-initiated";
 
+WebInspector.ProfileType = function(id, name)
+{
+    this._id = id;
+    this._name = name;
+}
+
+WebInspector.ProfileType.URLRegExp = /webkit-profile:\/\/(.+)\/(.+)#([0-9]+)/;
+
+WebInspector.ProfileType.prototype = {
+    get buttonTooltip()
+    {
+        return "";
+    },
+
+    get buttonStyle()
+    {
+        return undefined;
+    },
+
+    get buttonCaption()
+    {
+        return this.name;
+    },
+
+    get id()
+    {
+        return this._id;
+    },
+
+    get name()
+    {
+        return this._name;
+    },
+
+    buttonClicked: function()
+    {
+    }
+}
+
 WebInspector.ProfilesPanel = function()
 {
     WebInspector.Panel.call(this);
 
     this.element.addStyleClass("profiles");
+    this._profileTypesByIdMap = {};
+    this._profileTypeButtonsByIdMap = {};
 
     var panelEnablerHeading = WebInspector.UIString("You need to enable profiling before you can use the Profiles panel.");
     var panelEnablerDisclaimer = WebInspector.UIString("Enabling profiling will make scripts run slower.");
@@ -52,19 +93,8 @@ WebInspector.ProfilesPanel = function()
     this.sidebarTreeElement = document.createElement("ol");
     this.sidebarTreeElement.className = "sidebar-tree";
     this.sidebarElement.appendChild(this.sidebarTreeElement);
-
     this.sidebarTree = new TreeOutline(this.sidebarTreeElement);
 
-    this.profilesListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("CPU PROFILES"), null, true);
-    this.sidebarTree.appendChild(this.profilesListTreeElement);
-    this.profilesListTreeElement.expand();
-
-    this.snapshotsListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("HEAP SNAPSHOTS"), null, true);
-    if (Preferences.heapProfilerPresent) {
-        this.sidebarTree.appendChild(this.snapshotsListTreeElement);
-        this.snapshotsListTreeElement.expand();
-    }
-
     this.profileViews = document.createElement("div");
     this.profileViews.id = "profile-views";
     this.element.appendChild(this.profileViews);
@@ -72,18 +102,10 @@ WebInspector.ProfilesPanel = function()
     this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
     this.enableToggleButton.addEventListener("click", this._toggleProfiling.bind(this), false);
 
-    this.recordButton = new WebInspector.StatusBarButton(WebInspector.UIString("Start profiling."), "record-profile-status-bar-item");
-    this.recordButton.addEventListener("click", this._recordClicked.bind(this), false);
-
-    this.recording = false;
-
-    this.snapshotButton = new WebInspector.StatusBarButton(WebInspector.UIString("Take heap snapshot."), "heap-snapshot-status-bar-item");
-    this.snapshotButton.visible = Preferences.heapProfilerPresent;
-    this.snapshotButton.addEventListener("click", this._snapshotClicked.bind(this), false);
-
     this.profileViewStatusBarItemsContainer = document.createElement("div");
     this.profileViewStatusBarItemsContainer.id = "profile-view-status-bar-items";
 
+    this._profiles = [];
     this.reset();
 }
 
@@ -97,7 +119,25 @@ WebInspector.ProfilesPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.enableToggleButton.element, this.recordButton.element, this.snapshotButton.element, this.profileViewStatusBarItemsContainer];
+        function clickHandler(profileType, buttonElement)
+        {
+            profileType.buttonClicked.call(profileType);
+            this.updateProfileTypeButtons();
+        }
+
+        var items = [this.enableToggleButton.element];
+        // FIXME: Generate a single "combo-button".
+        for (var typeId in this._profileTypesByIdMap) {
+            var profileType = this.getProfileType(typeId);
+            if (profileType.buttonStyle) {
+                var button = new WebInspector.StatusBarButton(profileType.buttonTooltip, profileType.buttonStyle, profileType.buttonCaption);
+                this._profileTypeButtonsByIdMap[typeId] = button.element;
+                button.element.addEventListener("click", clickHandler.bind(this, profileType, button.element), false);
+                items.push(button.element);
+            }
+        }
+        items.push(this.profileViewStatusBarItemsContainer);
+        return items;
     },
 
     show: function()
@@ -129,13 +169,8 @@ WebInspector.ProfilesPanel.prototype = {
 
     reset: function()
     {
-        if (this._profiles) {
-            var profiledLength = this._profiles.length;
-            for (var i = 0; i < profiledLength; ++i) {
-                var profile = this._profiles[i];
-                delete profile._profileView;
-            }
-        }
+        for (var i = 0; i < this._profiles.length; ++i)
+            delete this._profiles[i]._profileView;
 
         delete this.currentQuery;
         this.searchCanceled();
@@ -147,8 +182,9 @@ WebInspector.ProfilesPanel.prototype = {
 
         this.sidebarTreeElement.removeStyleClass("some-expandable");
 
-        this.profilesListTreeElement.removeChildren();
-        this.snapshotsListTreeElement.removeChildren();
+        for (var typeId in this._profileTypesByIdMap)
+            this.getProfileType(typeId).treeElement.removeChildren();
+
         this.profileViews.removeChildren();
 
         this.profileViewStatusBarItemsContainer.removeChildren();
@@ -161,20 +197,34 @@ WebInspector.ProfilesPanel.prototype = {
         this.sidebarTree.handleKeyEvent(event);
     },
 
-    addProfile: function(profile)
+    registerProfileType: function(profileType)
     {
-        this._profiles.push(profile);
-        this._profilesIdMap[profile.uid] = profile;
+        this._profileTypesByIdMap[profileType.id] = profileType;
+        profileType.treeElement = new WebInspector.SidebarSectionTreeElement(profileType.name, null, true);
+        this.sidebarTree.appendChild(profileType.treeElement);
+        profileType.treeElement.expand();
+    },
+
+    _makeKey: function(text, profileTypeId)
+    {
+        return escape(text) + '/' + escape(profileTypeId);
+    },
 
-        var sidebarParent = this.profilesListTreeElement;
+    addProfileHeader: function(typeId, profile)
+    {
+        var sidebarParent = this.getProfileType(typeId).treeElement;
         var small = false;
         var alternateTitle;
 
+        this._profiles.push(profile);
+        this._profilesIdMap[this._makeKey(profile.uid, typeId)] = profile;
+
         if (profile.title.indexOf(UserInitiatedProfileName) !== 0) {
-            if (!(profile.title in this._profileGroups))
-                this._profileGroups[profile.title] = [];
+            var profileTitleKey = this._makeKey(profile.title, typeId);
+            if (!(profileTitleKey in this._profileGroups))
+                this._profileGroups[profileTitleKey] = [];
 
-            var group = this._profileGroups[profile.title];
+            var group = this._profileGroups[profileTitleKey];
             group.push(profile);
 
             if (group.length === 2) {
@@ -182,12 +232,12 @@ WebInspector.ProfilesPanel.prototype = {
                 group._profilesTreeElement = new WebInspector.ProfileGroupSidebarTreeElement(profile.title);
 
                 // Insert at the same index for the first profile of the group.
-                var index = this.sidebarTree.children.indexOf(group[0]._profilesTreeElement);
-                this.sidebarTree.insertChild(group._profilesTreeElement, index);
+                var index = sidebarParent.children.indexOf(group[0]._profilesTreeElement);
+                sidebarParent.insertChild(group._profilesTreeElement, index);
 
                 // Move the first profile to the group.
                 var selected = group[0]._profilesTreeElement.selected;
-                this.sidebarTree.removeChild(group[0]._profilesTreeElement);
+                sidebarParent.removeChild(group[0]._profilesTreeElement);
                 group._profilesTreeElement.appendChild(group[0]._profilesTreeElement);
                 if (selected) {
                     group[0]._profilesTreeElement.select();
@@ -214,6 +264,8 @@ WebInspector.ProfilesPanel.prototype = {
         profile._profilesTreeElement = profileTreeElement;
 
         sidebarParent.appendChild(profileTreeElement);
+        if (!this.visibleView)
+            this.showProfile(profile);
     },
 
     showProfile: function(profile)
@@ -224,7 +276,7 @@ WebInspector.ProfilesPanel.prototype = {
         if (this.visibleView)
             this.visibleView.hide();
 
-        var view = this.profileViewForProfile(profile);
+        var view = profile.viewForProfile();
 
         view.show(this.profileViews);
 
@@ -245,18 +297,28 @@ WebInspector.ProfilesPanel.prototype = {
         this.showProfile(view.profile);
     },
 
-    profileViewForProfile: function(profile)
+    getProfileType: function(typeId)
     {
-        if (!profile)
-            return null;
-        if (!profile._profileView)
-            profile._profileView = new WebInspector.ProfileView(profile);
-        return profile._profileView;
+        return this._profileTypesByIdMap[typeId];
     },
 
-    showProfileById: function(uid)
+    showProfileForURL: function(url)
     {
-        this.showProfile(this._profilesIdMap[uid]);
+        var match = url.match(WebInspector.ProfileType.URLRegExp);
+        if (!match)
+            return;
+        this.showProfile(this._profilesIdMap[this._makeKey(match[3], match[1])]);
+    },
+
+    updateProfileTypeButtons: function()
+    {
+        for (var typeId in this._profileTypeButtonsByIdMap) {
+            var buttonElement = this._profileTypeButtonsByIdMap[typeId];
+            var profileType = this.getProfileType(typeId);
+            buttonElement.className = profileType.buttonStyle;
+            buttonElement.title = profileType.buttonTooltip;
+            // FIXME: Apply profileType.buttonCaption once captions are added to button controls.
+        }
     },
 
     closeVisibleView: function()
@@ -266,16 +328,17 @@ WebInspector.ProfilesPanel.prototype = {
         delete this.visibleView;
     },
 
-    displayTitleForProfileLink: function(title)
+    displayTitleForProfileLink: function(title, typeId)
     {
         title = unescape(title);
         if (title.indexOf(UserInitiatedProfileName) === 0) {
             title = WebInspector.UIString("Profile %d", title.substring(UserInitiatedProfileName.length + 1));
         } else {
-            if (!(title in this._profileGroupsForLinks))
-                this._profileGroupsForLinks[title] = 0;
+            var titleKey = this._makeKey(title, typeId);
+            if (!(titleKey in this._profileGroupsForLinks))
+                this._profileGroupsForLinks[titleKey] = 0;
 
-            groupNumber = ++this._profileGroupsForLinks[title];
+            groupNumber = ++this._profileGroupsForLinks[titleKey];
 
             if (groupNumber > 2)
                 // The title is used in the console message announcing that a profile has started so it gets
@@ -296,7 +359,7 @@ WebInspector.ProfilesPanel.prototype = {
 
         var profilesLength = this._profiles.length;
         for (var i = 0; i < profilesLength; ++i) {
-            var view = this.profileViewForProfile(this._profiles[i]);
+            var view = this._profiles[i].viewForProfile();
             if (!view.performSearch || view === visibleView)
                 continue;
             views.push(view);
@@ -323,19 +386,6 @@ WebInspector.ProfilesPanel.prototype = {
         }
     },
 
-    setRecordingProfile: function(isProfiling)
-    {
-        this.recording = isProfiling;
-
-        if (isProfiling) {
-            this.recordButton.toggled = true;
-            this.recordButton.title = WebInspector.UIString("Stop profiling.");
-        } else {
-            this.recordButton.toggled = false;
-            this.recordButton.title = WebInspector.UIString("Start profiling.");
-        }
-    },
-    
     resize: function()
     {
         var visibleView = this.visibleView;
@@ -345,39 +395,24 @@ WebInspector.ProfilesPanel.prototype = {
 
     _updateInterface: function()
     {
+        // FIXME: Replace ProfileType-specific button visibility changes by a single ProfileType-agnostic "combo-button" visibility change.
         if (InspectorController.profilerEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Profiling enabled. Click to disable.");
             this.enableToggleButton.toggled = true;
-            this.recordButton.visible = true;
-            if (Preferences.heapProfilerPresent)
-                this.snapshotButton.visible = true;
+            for (var typeId in this._profileTypeButtonsByIdMap)
+                this._profileTypeButtonsByIdMap[typeId].removeStyleClass("hidden");
             this.profileViewStatusBarItemsContainer.removeStyleClass("hidden");
             this.panelEnablerView.visible = false;
         } else {
             this.enableToggleButton.title = WebInspector.UIString("Profiling disabled. Click to enable.");
             this.enableToggleButton.toggled = false;
-            this.recordButton.visible = false;
-            this.snapshotButton.visible = false;
+            for (var typeId in this._profileTypeButtonsByIdMap)
+                this._profileTypeButtonsByIdMap[typeId].addStyleClass("hidden");
             this.profileViewStatusBarItemsContainer.addStyleClass("hidden");
             this.panelEnablerView.visible = true;
         }
     },
 
-    _recordClicked: function()
-    {
-        this.recording = !this.recording;
-
-        if (this.recording)
-            InspectorController.startProfiling();
-        else
-            InspectorController.stopProfiling();
-    },
-
-    _snapshotClicked: function()
-    {
-        InspectorController.takeHeapSnapshot();
-    },
-
     _enableProfiling: function()
     {
         if (InspectorController.profilerEnabled())
@@ -397,19 +432,19 @@ WebInspector.ProfilesPanel.prototype = {
     {
         // FIXME: This code needs to be adjusted when more profiling types are added.
         // Currently defaults to CPU profiles.
-        var cpuProfiles = this.sidebarTree.children[0];
+        var cpuProfiles = this.getProfileType(WebInspector.CPUProfileType.TypeId).treeElement;
         if (cpuProfiles.children.length)
             return;
 
-        var profiles = InspectorController.profiles();
-        var profilesLength = profiles.length;
-        for (var i = 0; i < profilesLength; ++i) {
-            var profile = profiles[i];
-            this.addProfile(profile);
+        function populateCallback(profileHeaders) {
+            profileHeaders.sort(function(a, b) { return a.uid - b.uid; });
+            var profileHeadersLength = profileHeaders.length;
+            for (var i = 0; i < profileHeadersLength; ++i)
+                WebInspector.addProfileHeader(profileHeaders[i]);
         }
 
-        if (cpuProfiles.children[0])
-            cpuProfiles.children[0].select();
+        var callId = WebInspector.Callback.wrap(populateCallback);
+        InspectorController.getProfileHeaders(callId);
 
         delete this._shouldPopulateProfiles;
     },
@@ -535,3 +570,6 @@ WebInspector.ProfileGroupSidebarTreeElement.prototype = {
 }
 
 WebInspector.ProfileGroupSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
+
+WebInspector.didGetProfileHeaders = WebInspector.Callback.processCallback;
+WebInspector.didGetProfile = WebInspector.Callback.processCallback;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
index 4fcc956136..28586f645c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
@@ -197,6 +197,7 @@ WebInspector.ResourceView.prototype = {
         var title = "<div class=\"header-name\">&nbsp;</div>";
         title += "<div class=\"raw-form-data header-value\">" + formData.escapeHTML() + "</div>";
         var parmTreeElement = new TreeElement(title, null, false);
+        parmTreeElement.selectable = false;
         this.requestPayloadTreeElement.appendChild(parmTreeElement);
     },
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
index 2c96974300..0f873e76fe 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
@@ -71,6 +71,10 @@ WebInspector.ResourcesPanel = function()
     this.dividersElement = document.createElement("div");
     this.dividersElement.id = "resources-dividers";
     this.containerContentElement.appendChild(this.dividersElement);
+    
+    this.eventDividersElement = document.createElement("div");
+    this.eventDividersElement.id = "resources-event-dividers";
+    this.containerContentElement.appendChild(this.eventDividersElement);
 
     this.dividersLabelBarElement = document.createElement("div");
     this.dividersLabelBarElement.id = "resources-dividers-label-bar";
@@ -133,8 +137,12 @@ WebInspector.ResourcesPanel = function()
     this.enableToggleButton.addEventListener("click", this._toggleResourceTracking.bind(this), false);
 
     this.largerResourcesButton = new WebInspector.StatusBarButton(WebInspector.UIString("Use small resource rows."), "resources-larger-resources-status-bar-item");
-    this.largerResourcesButton.toggled = true;
+    this.largerResourcesButton.toggled = Preferences.resourcesLargeRows;
     this.largerResourcesButton.addEventListener("click", this._toggleLargerResources.bind(this), false);
+    if (!Preferences.resourcesLargeRows) {
+        Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
+        this._toggleLargerResources(); // this will toggle the preference back to the original
+    }
 
     this.sortingSelectElement = document.createElement("select");
     this.sortingSelectElement.className = "status-bar-item";
@@ -204,6 +212,37 @@ WebInspector.ResourcesPanel.prototype = {
     {
         return WebInspector.UIString("Resources");
     },
+    
+    get mainResourceLoadTime()
+    {
+        return this._mainResourceLoadTime || -1;
+    },
+    
+    set mainResourceLoadTime(x)
+    {
+        if (this._mainResourceLoadTime === x)
+            return;
+        
+        this._mainResourceLoadTime = x;
+        
+        // Update the dividers to draw the new line
+        this._updateGraphDividersIfNeeded(true);
+    },
+    
+    get mainResourceDOMContentTime()
+    {
+        return this._mainResourceDOMContentTime || -1;
+    },
+    
+    set mainResourceDOMContentTime(x)
+    {
+        if (this._mainResourceDOMContentTime === x)
+            return;
+        
+        this._mainResourceDOMContentTime = x;
+        
+        this._updateGraphDividersIfNeeded(true);
+    },
 
     get statusBarItems()
     {
@@ -451,6 +490,9 @@ WebInspector.ResourcesPanel.prototype = {
 
         this._resources = [];
         this._staleResources = [];
+        
+        this.mainResourceLoadTime = -1;
+        this.mainResourceDOMContentTime = -1;
 
         this.resourcesTreeElement.removeChildren();
         this.viewsContainerElement.removeChildren();
@@ -702,6 +744,7 @@ WebInspector.ResourcesPanel.prototype = {
         this._currentDividerSlice = slice;
 
         this.dividersElement.removeChildren();
+        this.eventDividersElement.removeChildren();
         this.dividersLabelBarElement.removeChildren();
 
         for (var i = 1; i <= dividerCount; ++i) {
@@ -721,6 +764,43 @@ WebInspector.ResourcesPanel.prototype = {
 
             this.dividersLabelBarElement.appendChild(divider);
         }
+
+        if (this.calculator.startAtZero) {
+            // If our current sorting method starts at zero, that means it shows all
+            // resources starting at the same point, and so onLoad event and DOMContent
+            // event lines really wouldn't make much sense here, so don't render them.
+            return;
+        }
+
+        if (this.mainResourceLoadTime !== -1) {
+            var percent = this.calculator.computePercentageFromEventTime(this.mainResourceLoadTime);
+
+            var loadDivider = document.createElement("div");
+            loadDivider.className = "resources-onload-divider";
+
+            var loadDividerPadding = document.createElement("div");
+            loadDividerPadding.className = "resources-event-divider-padding";
+            loadDividerPadding.style.left = percent + "%";
+            loadDividerPadding.title = WebInspector.UIString("Load event fired");
+            loadDividerPadding.appendChild(loadDivider);
+            
+            this.eventDividersElement.appendChild(loadDividerPadding);
+        }
+        
+        if (this.mainResourceDOMContentTime !== -1) {
+            var percent = this.calculator.computePercentageFromEventTime(this.mainResourceDOMContentTime);
+
+            var domContentDivider = document.createElement("div");
+            domContentDivider.className = "resources-ondomcontent-divider";
+            
+            var domContentDividerPadding = document.createElement("div");
+            domContentDividerPadding.className = "resources-event-divider-padding";
+            domContentDividerPadding.style.left = percent + "%";
+            domContentDividerPadding.title = WebInspector.UIString("DOMContent event fired");
+            domContentDividerPadding.appendChild(domContentDivider);
+            
+            this.eventDividersElement.appendChild(domContentDividerPadding);
+        }
     },
 
     _updateSummaryGraph: function()
@@ -733,6 +813,7 @@ WebInspector.ResourcesPanel.prototype = {
         var scrollTop = this.containerElement.scrollTop;
         var dividersTop = (scrollTop < this.summaryBar.element.offsetHeight ? this.summaryBar.element.offsetHeight : scrollTop);
         this.dividersElement.style.top = scrollTop + "px";
+        this.eventDividersElement.style.top = scrollTop + "px";
         this.dividersLabelBarElement.style.top = dividersTop + "px";
     },
 
@@ -766,6 +847,8 @@ WebInspector.ResourcesPanel.prototype = {
             return;
 
         this.resourcesTreeElement.smallChildren = !this.resourcesTreeElement.smallChildren;
+        Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
+        InspectorController.setSetting("resources-large-rows", Preferences.resourcesLargeRows);
 
         if (this.resourcesTreeElement.smallChildren) {
             this.resourcesGraphsElement.addStyleClass("small");
@@ -1048,6 +1131,17 @@ WebInspector.ResourceTimeCalculator.prototype = {
 
         return {start: start, middle: middle, end: end};
     },
+    
+    computePercentageFromEventTime: function(eventTime)
+    {
+        // This function computes a percentage in terms of the total loading time
+        // of a specific event. If startAtZero is set, then this is useless, and we
+        // want to return 0.
+        if (eventTime !== -1 && !this.startAtZero)
+            return ((eventTime - this.minimumBoundary) / this.boundarySpan) * 100;
+
+        return 0;
+    },
 
     computeBarGraphLabels: function(resource)
     {
@@ -1193,13 +1287,12 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
     {
         WebInspector.SidebarTreeElement.prototype.onattach.call(this);
 
-        var link = document.createElement("a");
-        link.href = this.resource.url;
-        link.className = "invisible";
-        while (this._listItemNode.firstChild)
-            link.appendChild(this._listItemNode.firstChild);
-        this._listItemNode.appendChild(link);
         this._listItemNode.addStyleClass("resources-category-" + this.resource.category.name);
+        this._listItemNode.draggable = true;
+        
+        // FIXME: should actually add handler to parent, to be resolved via
+        // https://bugs.webkit.org/show_bug.cgi?id=30227
+        this._listItemNode.addEventListener("dragstart", this.ondragstart.bind(this), false);
     },
 
     onselect: function()
@@ -1212,6 +1305,13 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
         InjectedScriptAccess.openInInspectedWindow(this.resource.url, function() {});
     },
 
+    ondragstart: function(event) {
+        event.dataTransfer.setData("text/plain", this.resource.url);
+        event.dataTransfer.setData("text/uri-list", this.resource.url + "\r\n");
+        event.dataTransfer.effectAllowed = "copy";
+        return true;
+    },
+
     get mainTitle()
     {
         return this.resource.displayName;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ScopeChainSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ScopeChainSidebarPane.js
index 3875324f5e..fdfcd3848c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ScopeChainSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ScopeChainSidebarPane.js
@@ -55,14 +55,16 @@ WebInspector.ScopeChainSidebarPane.prototype = {
             var extraProperties = null;
 
             if (scopeObjectProxy.isLocal) {
-                if (scopeObjectProxy.thisObject) {
+                foundLocalScope = true;
+                title = WebInspector.UIString("Local");
+                emptyPlaceholder = WebInspector.UIString("No Variables");
+                subtitle = null;
+                if (scopeObjectProxy.thisObject)
                     extraProperties = [ new WebInspector.ObjectPropertyProxy("this", scopeObjectProxy.thisObject) ];
-                    title = WebInspector.UIString("Local");
-                } else
-                    title = WebInspector.UIString("Closure");
+            } else if (scopeObjectProxy.isClosure) {
+                title = WebInspector.UIString("Closure");
                 emptyPlaceholder = WebInspector.UIString("No Variables");
                 subtitle = null;
-                foundLocalScope = true;
             } else if (i === (scopeChain.length - 1))
                 title = WebInspector.UIString("Global");
             else if (scopeObjectProxy.isElement)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
index ae918d1b86..4aa0ab2305 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
@@ -359,7 +359,7 @@ WebInspector.ScriptsPanel.prototype = {
         return selectedCallFrame.id;
     },
 
-    evaluateInSelectedCallFrame: function(code, updateInterface, callback)
+    evaluateInSelectedCallFrame: function(code, updateInterface, objectGroup, callback)
     {
         var selectedCallFrame = this.sidebarPanes.callstack.selectedCallFrame;
         if (!this._paused || !selectedCallFrame)
@@ -375,33 +375,17 @@ WebInspector.ScriptsPanel.prototype = {
             if (updateInterface)
                 self.sidebarPanes.scopechain.update(selectedCallFrame);
         }
-        this.doEvalInCallFrame(selectedCallFrame, code, updatingCallbackWrapper);
+        this.doEvalInCallFrame(selectedCallFrame, code, objectGroup, updatingCallbackWrapper);
     },
 
-    doEvalInCallFrame: function(callFrame, code, callback)
+    doEvalInCallFrame: function(callFrame, code, objectGroup, callback)
     {
         function evalCallback(result)
         {
             if (result)
                 callback(result.value, result.isException);
         }
-        InjectedScriptAccess.evaluateInCallFrame(callFrame.id, code, evalCallback);
-    },
-
-    variablesInSelectedCallFrame: function()
-    {
-        var selectedCallFrame = this.sidebarPanes.callstack.selectedCallFrame;
-        if (!this._paused || !selectedCallFrame)
-            return {};
-
-        var result = {};
-        var scopeChain = selectedCallFrame.scopeChain;
-        for (var i = 0; i < scopeChain.length; ++i) {
-            var scopeObjectProperties = scopeChain[i].properties;
-            for (var j = 0; j < scopeObjectProperties.length; ++j)
-                result[scopeObjectProperties[j]] = true;
-        }
-        return result;
+        InjectedScriptAccess.evaluateInCallFrame(callFrame.id, code, objectGroup, evalCallback);
     },
 
     debuggerPaused: function(callFrames)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
index e364cb221c..790055a5ba 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -216,12 +217,18 @@ WebInspector.SourceFrame.prototype = {
             headElement = this.element.contentDocument.createElement("head");
             this.element.contentDocument.documentElement.insertBefore(headElement, this.element.contentDocument.documentElement.firstChild);
         }
+        
+        var linkElement = this.element.contentDocument.createElement("link");
+        linkElement.type = "text/css";
+        linkElement.rel = "stylesheet";
+        linkElement.href = "inspectorSyntaxHighlight.css";
+        headElement.appendChild(linkElement);
 
         var styleElement = this.element.contentDocument.createElement("style");
         headElement.appendChild(styleElement);
 
         // Add these style rules here since they are specific to the Inspector. They also behave oddly and not
-        // all properties apply if added to view-source.css (becuase it is a user agent sheet.)
+        // all properties apply if added to view-source.css (because it is a user agent sheet.)
         var styleText = ".webkit-line-number { background-repeat: no-repeat; background-position: right 1px; }\n";
         styleText += ".webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(program-counter); }\n";
 
@@ -240,10 +247,6 @@ WebInspector.SourceFrame.prototype = {
         styleText += ".webkit-line-content { background-color: white; }\n";
         styleText += "@-webkit-keyframes fadeout {from {background-color: rgb(255, 255, 120);} to { background-color: white;}}\n";
         styleText += ".webkit-highlighted-line .webkit-line-content { background-color: rgb(255, 255, 120); -webkit-animation: 'fadeout' 2s 500ms}\n";
-        styleText += ".webkit-javascript-comment { color: rgb(0, 116, 0); }\n";
-        styleText += ".webkit-javascript-keyword { color: rgb(170, 13, 145); }\n";
-        styleText += ".webkit-javascript-number { color: rgb(28, 0, 207); }\n";
-        styleText += ".webkit-javascript-string, .webkit-javascript-regexp { color: rgb(196, 26, 22); }\n";
 
         // TODO: Move these styles into inspector.css once https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed and popup moved into the top frame.
         styleText += ".popup-content { position: absolute; z-index: 10000; padding: 4px; background-color: rgb(203, 226, 255); -webkit-border-radius: 7px; border: 2px solid rgb(169, 172, 203); }";
@@ -253,7 +256,7 @@ WebInspector.SourceFrame.prototype = {
         styleText += ".popup-content input#bp-condition { font-family: monospace; margin: 0; border: 1px inset rgb(190, 190, 190) !important; width: 100%; box-shadow: none !important; outline: none !important; -webkit-user-modify: read-write; }";
         // This class is already in inspector.css
         styleText += ".hidden { display: none !important; }";
-        
+
         styleElement.textContent = styleText;
 
         this._needsProgramCounterImage = true;
@@ -311,11 +314,11 @@ WebInspector.SourceFrame.prototype = {
         var sourceRow = event.target.enclosingNodeOrSelfWithNodeName("tr");
         if (!sourceRow._breakpointObject && this.addBreakpointDelegate)
             this.addBreakpointDelegate(this.lineNumberForSourceRow(sourceRow));
-        
+
         var breakpoint = sourceRow._breakpointObject;
         if (!breakpoint)
             return;
-        
+
         this._editBreakpointCondition(event.target, sourceRow, breakpoint);
         event.preventDefault();
     },
@@ -340,7 +343,7 @@ WebInspector.SourceFrame.prototype = {
         // TODO: Migrate the popup to the top-level document and remove the blur listener from conditionElement once https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed.
         var popupDocument = this.element.contentDocument;
         this._showBreakpointConditionPopup(eventTarget, breakpoint.line, popupDocument);
-        
+
         function committed(element, newText)
         {
             breakpoint.condition = newText;
@@ -359,7 +362,7 @@ WebInspector.SourceFrame.prototype = {
 
         var dismissedHandler = dismissed.bind(this);
         this._conditionEditorElement.addEventListener("blur", dismissedHandler, false);
-        
+
         WebInspector.startEditing(this._conditionEditorElement, committed.bind(this), dismissedHandler);
         this._conditionEditorElement.value = breakpoint.condition;
         this._conditionEditorElement.select();
@@ -716,191 +719,394 @@ WebInspector.SourceFrame.prototype = {
         if (!table)
             return;
 
-        function deleteContinueFlags(cell)
-        {
-            if (!cell)
-                return;
-            delete cell._commentContinues;
-            delete cell._singleQuoteStringContinues;
-            delete cell._doubleQuoteStringContinues;
-            delete cell._regexpContinues;
-        }
+        var jsSyntaxHighlighter = new WebInspector.JavaScriptSourceSyntaxHighlighter(table, this);
+        jsSyntaxHighlighter.process();
+    },
 
-        function createSpan(content, className)
-        {
-            var span = document.createElement("span");
-            span.className = className;
-            span.appendChild(document.createTextNode(content));
-            return span;
-        }
+    syntaxHighlightCSS: function()
+    {
+        var table = this.element.contentDocument.getElementsByTagName("table")[0];
+        if (!table)
+            return;
 
-        function generateFinder(regex, matchNumber, className)
-        {
-            return function(str) {
-                var match = regex.exec(str);
-                if (!match)
-                    return null;
-                previousMatchLength = match[matchNumber].length;
-                return createSpan(match[matchNumber], className);
-            };
-        }
+        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighligher(table, this);
+        cssSyntaxHighlighter.process();
+    }
+}
 
-        var findNumber = generateFinder(/^(-?(\d+\.?\d*([eE][+-]\d+)?|0[xX]\h+|Infinity)|NaN)(?:\W|$)/, 1, "webkit-javascript-number");
-        var findKeyword = generateFinder(/^(null|true|false|break|case|catch|const|default|finally|for|instanceof|new|var|continue|function|return|void|delete|if|this|do|while|else|in|switch|throw|try|typeof|with|debugger|class|enum|export|extends|import|super|get|set)(?:\W|$)/, 1, "webkit-javascript-keyword");
-        var findSingleLineString = generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-javascript-string"); // " this quote keeps Xcode happy
-        var findMultilineCommentStart = generateFinder(/^\/\*.*$/, 0, "webkit-javascript-comment");
-        var findMultilineCommentEnd = generateFinder(/^.*?\*\//, 0, "webkit-javascript-comment");
-        var findMultilineSingleQuoteStringStart = generateFinder(/^'(?:[^'\\]|\\.)*\\$/, 0, "webkit-javascript-string");
-        var findMultilineSingleQuoteStringEnd = generateFinder(/^(?:[^'\\]|\\.)*?'/, 0, "webkit-javascript-string");
-        var findMultilineDoubleQuoteStringStart = generateFinder(/^"(?:[^"\\]|\\.)*\\$/, 0, "webkit-javascript-string");
-        var findMultilineDoubleQuoteStringEnd = generateFinder(/^(?:[^"\\]|\\.)*?"/, 0, "webkit-javascript-string");
-        var findMultilineRegExpEnd = generateFinder(/^(?:[^\/\\]|\\.)*?\/([gim]{0,3})/, 0, "webkit-javascript-regexp");
-        var findSingleLineComment = generateFinder(/^\/\/.*|^\/\*.*?\*\//, 0, "webkit-javascript-comment");
-
-        function findMultilineRegExpStart(str)
-        {
-            var match = /^\/(?:[^\/\\]|\\.)*\\$/.exec(str);
-            if (!match || !/\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[0]))
+WebInspector.SourceFrame.prototype.__proto__ = WebInspector.Object.prototype;
+
+WebInspector.SourceSyntaxHighligher = function(table, sourceFrame)
+{
+    this.table = table;
+    this.sourceFrame = sourceFrame;
+}
+
+WebInspector.SourceSyntaxHighligher.prototype = {
+    createSpan: function(content, className)
+    {
+        var span = document.createElement("span");
+        span.className = className;
+        span.appendChild(document.createTextNode(content));
+        return span;
+    },
+
+    generateFinder: function(regex, matchNumber, className)
+    {
+        return function(str) {
+            var match = regex.exec(str);
+            if (!match)
                 return null;
-            var node = createSpan(match[0], "webkit-javascript-regexp");
-            previousMatchLength = match[0].length;
-            return node;
-        }
+            this.previousMatchLength = match[matchNumber].length;
+            return this.createSpan(match[matchNumber], className);
+        };
+    },
+
+    process: function()
+    {
+        // Split up the work into chunks so we don't block the
+        // UI thread while processing.
+
+        var i = 0;
+        var rows = this.table.rows;
+        var rowsLength = rows.length;
+        var previousCell = null;
+        const linesPerChunk = 10;
 
-        function findSingleLineRegExp(str)
+        function processChunk()
         {
-            var match = /^(\/(?:[^\/\\]|\\.)*\/([gim]{0,3}))(.?)/.exec(str);
-            if (!match || !(match[2].length > 0 || /\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[1]) || /\.|;|,/.test(match[3])))
-                return null;
-            var node = createSpan(match[1], "webkit-javascript-regexp");
-            previousMatchLength = match[1].length;
-            return node;
+            for (var end = Math.min(i + linesPerChunk, rowsLength); i < end; ++i) {
+                var row = rows[i];
+                if (!row)
+                    continue;
+                var cell = row.cells[1];
+                if (!cell)
+                    continue;
+                this.syntaxHighlightLine(cell, previousCell);
+                if (i < (end - 1))
+                    this.deleteContinueFlags(previousCell);
+                previousCell = cell;
+            }
+
+            if (i >= rowsLength && processChunkInterval) {
+                this.deleteContinueFlags(previousCell);
+                delete this.previousMatchLength;
+                clearInterval(processChunkInterval);
+
+                this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+            }
         }
 
-        function syntaxHighlightJavascriptLine(line, prevLine)
-        {
-            var messageBubble = line.lastChild;
-            if (messageBubble && messageBubble.nodeType === Node.ELEMENT_NODE && messageBubble.hasStyleClass("webkit-html-message-bubble"))
-                line.removeChild(messageBubble);
-            else
-                messageBubble = null;
+        var boundProcessChunk = processChunk.bind(this);
+        var processChunkInterval = setInterval(boundProcessChunk, 25);
+        boundProcessChunk();
+    }
+}
+
+WebInspector.CSSSourceSyntaxHighligher = function(table, sourceFrame) {
+    WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
+
+    this.findNumber = this.generateFinder(/^((-?(\d+|\d*\.\d+))|^(#[a-fA-F0-9]{3,6}))(?:\D|$)/, 1, "webkit-css-number");
+    this.findUnits = this.generateFinder(/^(px|em|pt|in|cm|mm|pc|ex)(?:\W|$)/, 1, "webkit-css-unit");
+    this.findKeyword = this.generateFinder(/^(rgba?|hsla?|var)(?:\W|$)/, 1, "webkit-css-keyword");
+    this.findSingleLineString = this.generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-css-string"); // " this quote keeps Xcode happy
+    this.findSingleLineComment = this.generateFinder(/^\/\*.*?\*\//, 0, "webkit-css-comment");
+    this.findMultilineCommentStart = this.generateFinder(/^\/\*.*$/, 0, "webkit-css-comment");
+    this.findMultilineCommentEnd = this.generateFinder(/^.*?\*\//, 0, "webkit-css-comment");
+    this.findSelector = this.generateFinder(/^([#\.]?[_a-zA-Z].*?)(?:\W|$)/, 1, "webkit-css-selector");
+    this.findProperty = this.generateFinder(/^(-?[_a-z0-9][_a-z0-9-]*\s*)(?:\:)/, 1, "webkit-css-property");
+    this.findGenericIdent = this.generateFinder(/^([@-]?[_a-z0-9][_a-z0-9-]*)(?:\W|$)/, 1, "webkit-css-string");
+}
+
+WebInspector.CSSSourceSyntaxHighligher.prototype = {
+    deleteContinueFlags: function(cell)
+    {
+        if (!cell)
+            return;
+        delete cell._commentContinues;
+        delete cell._inSelector;
+    },
+
+    findPseudoClass: function(str)
+    {
+        var match = /^(::?)([_a-z0-9][_a-z0-9-]*)/.exec(str);
+        if (!match)
+            return null;
+        this.previousMatchLength = match[0].length;
+        var span = document.createElement("span");
+        span.appendChild(document.createTextNode(match[1]));
+        span.appendChild(this.createSpan(match[2], "webkit-css-pseudo-class"));
+        return span;
+    },
+
+    findURL: function(str)
+    {
+        var match = /^(?:local|url)\(([^\)]*?)\)/.exec(str);
+        if (!match)
+            return null;
+        this.previousMatchLength = match[0].length;
+        var innerUrlSpan = this.createSpan(match[1], "webkit-css-url");
+        var outerSpan = document.createElement("span");
+        outerSpan.appendChild(this.createSpan("url", "webkit-css-keyword"));
+        outerSpan.appendChild(document.createTextNode("("));
+        outerSpan.appendChild(innerUrlSpan);
+        outerSpan.appendChild(document.createTextNode(")"));
+        return outerSpan;
+    },
+
+    findAtRule: function(str)
+    {
+        var match = /^@[_a-z0-9][_a-z0-9-]*(?:\W|$)/.exec(str);
+        if (!match)
+            return null;
+        this.previousMatchLength = match[0].length;
+        return this.createSpan(match[0], "webkit-css-at-rule");
+    },
 
-            var code = line.textContent;
+    syntaxHighlightLine: function(line, prevLine)
+    {
+        var code = line.textContent;
+        while (line.firstChild)
+            line.removeChild(line.firstChild);
 
-            while (line.firstChild)
-                line.removeChild(line.firstChild);
+        var token;
+        var tmp = 0;
+        var i = 0;
+        this.previousMatchLength = 0;
 
-            var token;
-            var tmp = 0;
-            var i = 0;
-            previousMatchLength = 0;
+        if (prevLine) {
+            if (prevLine._commentContinues) {
+                if (!(token = this.findMultilineCommentEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-comment");
+                    line._commentContinues = true;
+                }
+            }
+            if (token) {
+                i += this.previousMatchLength ? this.previousMatchLength : code.length;
+                tmp = i;
+                line.appendChild(token);
+            }
+        }
 
-            if (prevLine) {
-                if (prevLine._commentContinues) {
-                    if (!(token = findMultilineCommentEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-comment");
-                        line._commentContinues = true;
+        var inSelector = (prevLine && prevLine._inSelector); // inside a selector, we can now parse properties and values
+        var inAtRuleBlock = (prevLine && prevLine._inAtRuleBlock); // inside an @rule block, but not necessarily inside a selector yet
+        var atRuleStarted = (prevLine && prevLine._atRuleStarted); // we received an @rule, we may stop the @rule at a semicolon or open a block and become inAtRuleBlock
+        var atRuleIsSelector = (prevLine && prevLine._atRuleIsSelector); // when this @rule opens a block it immediately goes into parsing properties and values instead of selectors
+
+        for ( ; i < code.length; ++i) {
+            var codeFragment = code.substr(i);
+            var prevChar = code[i - 1];
+            var currChar = codeFragment[0];
+            token = this.findSingleLineComment(codeFragment);
+            if (!token) {
+                if ((token = this.findMultilineCommentStart(codeFragment)))
+                    line._commentContinues = true;
+                else if (currChar === ";" && !inAtRuleBlock)
+                    atRuleStarted = false;
+                else if (currChar === "}") {
+                    if (inSelector && inAtRuleBlock && atRuleIsSelector) {
+                        inSelector = false;
+                        inAtRuleBlock = false;
+                        atRuleStarted = false;
+                    } else if (inSelector) {
+                        inSelector = false;
+                    } else if (inAtRuleBlock) {
+                        inAtRuleBlock = false;
+                        atRuleStarted = false;
                     }
-                } else if (prevLine._singleQuoteStringContinues) {
-                    if (!(token = findMultilineSingleQuoteStringEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-string");
-                        line._singleQuoteStringContinues = true;
+                } else if (currChar === "{") {
+                    if (!atRuleStarted || inAtRuleBlock) {
+                        inSelector = true;
+                    } else if (!inAtRuleBlock && atRuleIsSelector) {
+                        inAtRuleBlock = true;
+                        inSelector = true;
+                    } else if (!inAtRuleBlock) {
+                        inAtRuleBlock = true;
+                        inSelector = false;
                     }
-                } else if (prevLine._doubleQuoteStringContinues) {
-                    if (!(token = findMultilineDoubleQuoteStringEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-string");
-                        line._doubleQuoteStringContinues = true;
+                } else if (inSelector) {
+                    if (!prevChar || /^\d/.test(prevChar)) {
+                        token = this.findUnits(codeFragment);
+                    } else if (!prevChar || /^\W/.test(prevChar)) {
+                        token = this.findNumber(codeFragment) ||
+                                this.findKeyword(codeFragment) ||
+                                this.findURL(codeFragment) ||
+                                this.findProperty(codeFragment) ||
+                                this.findAtRule(codeFragment) ||
+                                this.findGenericIdent(codeFragment) ||
+                                this.findSingleLineString(codeFragment);
                     }
-                } else if (prevLine._regexpContinues) {
-                    if (!(token = findMultilineRegExpEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-regexp");
-                        line._regexpContinues = true;
+                } else if (!inSelector) {
+                    if (atRuleStarted && !inAtRuleBlock)
+                        token = this.findURL(codeFragment); // for @import
+                    if (!token) {
+                        token = this.findSelector(codeFragment) ||
+                                this.findPseudoClass(codeFragment) ||
+                                this.findAtRule(codeFragment);
                     }
                 }
-                if (token) {
-                    i += previousMatchLength ? previousMatchLength : code.length;
-                    tmp = i;
-                    line.appendChild(token);
-                }
             }
 
-            for ( ; i < code.length; ++i) {
-                var codeFragment = code.substr(i);
-                var prevChar = code[i - 1];
-                token = findSingleLineComment(codeFragment);
-                if (!token) {
-                    if ((token = findMultilineCommentStart(codeFragment)))
-                        line._commentContinues = true;
-                    else if (!prevChar || /^\W/.test(prevChar)) {
-                        token = findNumber(codeFragment, code[i - 1]) ||
-                                findKeyword(codeFragment, code[i - 1]) ||
-                                findSingleLineString(codeFragment) ||
-                                findSingleLineRegExp(codeFragment);
-                        if (!token) {
-                            if (token = findMultilineSingleQuoteStringStart(codeFragment))
-                                line._singleQuoteStringContinues = true;
-                            else if (token = findMultilineDoubleQuoteStringStart(codeFragment))
-                                line._doubleQuoteStringContinues = true;
-                            else if (token = findMultilineRegExpStart(codeFragment))
-                                line._regexpContinues = true;
-                        }
-                    }
-                }
+            if (token) {
+                if (currChar === "@") {
+                    atRuleStarted = true;
 
-                if (token) {
-                    if (tmp !== i)
-                        line.appendChild(document.createTextNode(code.substring(tmp, i)));
-                    line.appendChild(token);
-                    i += previousMatchLength - 1;
-                    tmp = i + 1;
+                    // The @font-face, @page, and @variables at-rules do not contain selectors like other at-rules
+                    // instead it acts as a selector and contains properties and values.
+                    var text = token.textContent;
+                    atRuleIsSelector = /font-face/.test(text) || /page/.test(text) || /variables/.test(text);
                 }
+
+                if (tmp !== i)
+                    line.appendChild(document.createTextNode(code.substring(tmp, i)));
+                line.appendChild(token);
+                i += this.previousMatchLength - 1;
+                tmp = i + 1;
             }
+        }
 
-            if (tmp < code.length)
-                line.appendChild(document.createTextNode(code.substring(tmp, i)));
+        line._inSelector = inSelector;
+        line._inAtRuleBlock = inAtRuleBlock;
+        line._atRuleStarted = atRuleStarted;
+        line._atRuleIsSelector = atRuleIsSelector;
 
-            if (messageBubble)
-                line.appendChild(messageBubble);
-        }
+        if (tmp < code.length)
+            line.appendChild(document.createTextNode(code.substring(tmp, i)));
+    }
+}
 
-        var i = 0;
-        var rows = table.rows;
-        var rowsLength = rows.length;
-        var previousCell = null;
-        var previousMatchLength = 0;
-        var sourceFrame = this;
+WebInspector.CSSSourceSyntaxHighligher.prototype.__proto__ = WebInspector.SourceSyntaxHighligher.prototype;
+
+WebInspector.JavaScriptSourceSyntaxHighlighter = function(table, sourceFrame) {
+    WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
+
+    this.findNumber = this.generateFinder(/^(-?(\d+\.?\d*([eE][+-]\d+)?|0[xX]\h+|Infinity)|NaN)(?:\W|$)/, 1, "webkit-javascript-number");
+    this.findKeyword = this.generateFinder(/^(null|true|false|break|case|catch|const|default|finally|for|instanceof|new|var|continue|function|return|void|delete|if|this|do|while|else|in|switch|throw|try|typeof|with|debugger|class|enum|export|extends|import|super|get|set)(?:\W|$)/, 1, "webkit-javascript-keyword");
+    this.findSingleLineString = this.generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-javascript-string"); // " this quote keeps Xcode happy
+    this.findMultilineCommentStart = this.generateFinder(/^\/\*.*$/, 0, "webkit-javascript-comment");
+    this.findMultilineCommentEnd = this.generateFinder(/^.*?\*\//, 0, "webkit-javascript-comment");
+    this.findMultilineSingleQuoteStringStart = this.generateFinder(/^'(?:[^'\\]|\\.)*\\$/, 0, "webkit-javascript-string");
+    this.findMultilineSingleQuoteStringEnd = this.generateFinder(/^(?:[^'\\]|\\.)*?'/, 0, "webkit-javascript-string");
+    this.findMultilineDoubleQuoteStringStart = this.generateFinder(/^"(?:[^"\\]|\\.)*\\$/, 0, "webkit-javascript-string");
+    this.findMultilineDoubleQuoteStringEnd = this.generateFinder(/^(?:[^"\\]|\\.)*?"/, 0, "webkit-javascript-string");
+    this.findMultilineRegExpEnd = this.generateFinder(/^(?:[^\/\\]|\\.)*?\/([gim]{0,3})/, 0, "webkit-javascript-regexp");
+    this.findSingleLineComment = this.generateFinder(/^\/\/.*|^\/\*.*?\*\//, 0, "webkit-javascript-comment");
+}
 
-        // Split up the work into chunks so we don't block the
-        // UI thread while processing.
+WebInspector.JavaScriptSourceSyntaxHighlighter.prototype = {
+    deleteContinueFlags: function(cell)
+    {
+        if (!cell)
+            return;
+        delete cell._commentContinues;
+        delete cell._singleQuoteStringContinues;
+        delete cell._doubleQuoteStringContinues;
+        delete cell._regexpContinues;
+    },
 
-        function processChunk()
-        {
-            for (var end = Math.min(i + 10, rowsLength); i < end; ++i) {
-                var row = rows[i];
-                if (!row)
-                    continue;
-                var cell = row.cells[1];
-                if (!cell)
-                    continue;
-                syntaxHighlightJavascriptLine(cell, previousCell);
-                if (i < (end - 1))
-                    deleteContinueFlags(previousCell);
-                previousCell = cell;
+    findMultilineRegExpStart: function(str)
+    {
+        var match = /^\/(?:[^\/\\]|\\.)*\\$/.exec(str);
+        if (!match || !/\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[0]))
+            return null;
+        this.previousMatchLength = match[0].length;
+        return this.createSpan(match[0], "webkit-javascript-regexp");
+    },
+
+    findSingleLineRegExp: function(str)
+    {
+        var match = /^(\/(?:[^\/\\]|\\.)*\/([gim]{0,3}))(.?)/.exec(str);
+        if (!match || !(match[2].length > 0 || /\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[1]) || /\.|;|,/.test(match[3])))
+            return null;
+        this.previousMatchLength = match[1].length;
+        return this.createSpan(match[1], "webkit-javascript-regexp");
+    },
+
+    syntaxHighlightLine: function(line, prevLine)
+    {
+        var messageBubble = line.lastChild;
+        if (messageBubble && messageBubble.nodeType === Node.ELEMENT_NODE && messageBubble.hasStyleClass("webkit-html-message-bubble"))
+            line.removeChild(messageBubble);
+        else
+            messageBubble = null;
+
+        var code = line.textContent;
+
+        while (line.firstChild)
+            line.removeChild(line.firstChild);
+
+        var token;
+        var tmp = 0;
+        var i = 0;
+        this.previousMatchLength = 0;
+
+        if (prevLine) {
+            if (prevLine._commentContinues) {
+                if (!(token = this.findMultilineCommentEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-comment");
+                    line._commentContinues = true;
+                }
+            } else if (prevLine._singleQuoteStringContinues) {
+                if (!(token = this.findMultilineSingleQuoteStringEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-string");
+                    line._singleQuoteStringContinues = true;
+                }
+            } else if (prevLine._doubleQuoteStringContinues) {
+                if (!(token = this.findMultilineDoubleQuoteStringEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-string");
+                    line._doubleQuoteStringContinues = true;
+                }
+            } else if (prevLine._regexpContinues) {
+                if (!(token = this.findMultilineRegExpEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-regexp");
+                    line._regexpContinues = true;
+                }
+            }
+            if (token) {
+                i += this.previousMatchLength ? this.previousMatchLength : code.length;
+                tmp = i;
+                line.appendChild(token);
             }
+        }
 
-            if (i >= rowsLength && processChunkInterval) {
-                deleteContinueFlags(previousCell);
-                clearInterval(processChunkInterval);
+        for ( ; i < code.length; ++i) {
+            var codeFragment = code.substr(i);
+            var prevChar = code[i - 1];
+            token = this.findSingleLineComment(codeFragment);
+            if (!token) {
+                if ((token = this.findMultilineCommentStart(codeFragment)))
+                    line._commentContinues = true;
+                else if (!prevChar || /^\W/.test(prevChar)) {
+                    token = this.findNumber(codeFragment) ||
+                            this.findKeyword(codeFragment) ||
+                            this.findSingleLineString(codeFragment) ||
+                            this.findSingleLineRegExp(codeFragment);
+                    if (!token) {
+                        if (token = this.findMultilineSingleQuoteStringStart(codeFragment))
+                            line._singleQuoteStringContinues = true;
+                        else if (token = this.findMultilineDoubleQuoteStringStart(codeFragment))
+                            line._doubleQuoteStringContinues = true;
+                        else if (token = this.findMultilineRegExpStart(codeFragment))
+                            line._regexpContinues = true;
+                    }
+                }
+            }
 
-                sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+            if (token) {
+                if (tmp !== i)
+                    line.appendChild(document.createTextNode(code.substring(tmp, i)));
+                line.appendChild(token);
+                i += this.previousMatchLength - 1;
+                tmp = i + 1;
             }
         }
 
-        processChunk();
+        if (tmp < code.length)
+            line.appendChild(document.createTextNode(code.substring(tmp, i)));
 
-        var processChunkInterval = setInterval(processChunk, 25);
+        if (messageBubble)
+            line.appendChild(messageBubble);
     }
 }
 
-WebInspector.SourceFrame.prototype.__proto__ = WebInspector.Object.prototype;
-
+WebInspector.JavaScriptSourceSyntaxHighlighter.prototype.__proto__ = WebInspector.SourceSyntaxHighligher.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js
index 97a5bd5d2c..c1b1bbf4a1 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js
@@ -106,11 +106,16 @@ WebInspector.SourceView.prototype = {
         this.sourceFrame.removeEventListener("content loaded", this._contentLoaded, this);
         
         if (this.resource.type === WebInspector.Resource.Type.Script
-            || this.resource.mimeType === 'application/json'
-            || this.resource.mimeType === 'application/javascript'
+            || this.resource.mimeType === "application/json"
+            || this.resource.mimeType === "application/javascript"
             || /\.js(on)?$/.test(this.resource.lastPathComponent) ) {
             this.sourceFrame.addEventListener("syntax highlighting complete", this._syntaxHighlightingComplete, this);
             this.sourceFrame.syntaxHighlightJavascript();
+        } else if (this.resource.type === WebInspector.Resource.Type.Stylesheet
+            || this.resource.mimeType === "text/css"
+            || /\.css$/.test(this.resource.lastPathComponent) ) {
+            this.sourceFrame.addEventListener("syntax highlighting complete", this._syntaxHighlightingComplete, this);
+            this.sourceFrame.syntaxHighlightCSS();
         } else
             this._sourceFrameSetupFinished();
     },
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js
index 01c657d6a2..66b4a92826 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js
@@ -63,9 +63,6 @@ WebInspector.StoragePanel = function(database)
     this.sidebarTree.appendChild(this.cookieListTreeElement);
     this.cookieListTreeElement.expand();
 
-    this.cookieTreeElement = new WebInspector.CookieSidebarTreeElement();
-    this.cookieListTreeElement.appendChild(this.cookieTreeElement);
-
     this.storageViews = document.createElement("div");
     this.storageViews.id = "storage-views";
     this.element.appendChild(this.storageViews);
@@ -120,11 +117,14 @@ WebInspector.StoragePanel.prototype = {
 
         this._domStorage = [];
 
-        delete this._cookieView;
+        this._cookieDomains = {};
+        this._cookieViews = {};
 
         this.databasesListTreeElement.removeChildren();
         this.localStorageListTreeElement.removeChildren();
         this.sessionStorageListTreeElement.removeChildren();
+        this.cookieListTreeElement.removeChildren();
+
         this.storageViews.removeChildren();        
 
         this.storageViewStatusBarItemsContainer.removeChildren();
@@ -146,6 +146,17 @@ WebInspector.StoragePanel.prototype = {
         database._databasesTreeElement = databaseTreeElement;
         this.databasesListTreeElement.appendChild(databaseTreeElement);
     },
+    
+    addCookieDomain: function(domain)
+    {
+        // Eliminate duplicate domains from the list.
+        if (typeof this._cookieDomains[domain] !== "undefined")
+            return;
+
+        var cookieDomainTreeElement = new WebInspector.CookieSidebarTreeElement(domain);
+        this.cookieListTreeElement.appendChild(cookieDomainTreeElement);
+        this._cookieDomains[domain] = true;
+    },
 
     addDOMStorage: function(domStorage)
     {
@@ -158,12 +169,12 @@ WebInspector.StoragePanel.prototype = {
             this.sessionStorageListTreeElement.appendChild(domStorageTreeElement);
     },
 
-    selectDatabase: function(db)
+    selectDatabase: function(databaseId)
     {
         var database;
         for (var i = 0, len = this._databases.length; i < len; ++i) {
             database = this._databases[i];
-            if (database.isDatabase(db)) {
+            if (database.id === databaseId) {
                 this.showDatabase(database);
                 database._databasesTreeElement.select();
                 return;
@@ -240,15 +251,15 @@ WebInspector.StoragePanel.prototype = {
             this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
     },
 
-    showCookies: function()
+    showCookies: function(cookieDomain)
     {
         if (this.visibleView)
             this.visibleView.hide();
 
-        var view = this._cookieView;
+        var view = this._cookieViews[cookieDomain];
         if (!view) {
-            view = new WebInspector.CookieItemsView();
-            this._cookieView = view;
+            view = new WebInspector.CookieItemsView(cookieDomain);
+            this._cookieViews[cookieDomain] = view;
         }
 
         view.show(this.storageViews);
@@ -297,20 +308,21 @@ WebInspector.StoragePanel.prototype = {
         database.getTableNames(tableNamesCallback);
     },
 
-    dataGridForResult: function(result)
+    dataGridForResult: function(rows)
     {
-        if (!result.rows.length)
+        if (!rows.length)
             return null;
 
         var columns = {};
+        var numColumns = 0;
 
-        var rows = result.rows;
-        for (var columnIdentifier in rows.item(0)) {
+        for (var columnIdentifier in rows[0]) {
             var column = {};
             column.width = columnIdentifier.length;
             column.title = columnIdentifier;
 
             columns[columnIdentifier] = column;
+            ++numColumns;
         }
 
         var nodes = [];
@@ -318,12 +330,9 @@ WebInspector.StoragePanel.prototype = {
         for (var i = 0; i < length; ++i) {
             var data = {};
 
-            var row = rows.item(i);
+            var row = rows[i];
             for (var columnIdentifier in row) {
-                // FIXME: (Bug 19439) We should specially format SQL NULL here
-                // (which is represented by JavaScript null here, and turned
-                // into the string "null" by the String() function).
-                var text = String(row[columnIdentifier]);
+                var text = row[columnIdentifier];
                 data[columnIdentifier] = text;
                 if (text.length > columns[columnIdentifier].width)
                     columns[columnIdentifier].width = text.length;
@@ -339,7 +348,7 @@ WebInspector.StoragePanel.prototype = {
             totalColumnWidths += columns[columnIdentifier].width;
 
         // Calculate the percentage width for the columns.
-        const minimumPrecent = 5;
+        const minimumPrecent = Math.min(5, Math.floor(100/numColumns));
         var recoupPercent = 0;
         for (var columnIdentifier in columns) {
             var width = columns[columnIdentifier].width;
@@ -549,7 +558,7 @@ WebInspector.DOMStorageSidebarTreeElement.prototype = {
 
     get mainTitle()
     {
-        return this.domStorage.domain;
+        return this.domStorage.domain ? this.domStorage.domain : WebInspector.UIString("Local Files");
     },
 
     set mainTitle(x)
@@ -570,9 +579,10 @@ WebInspector.DOMStorageSidebarTreeElement.prototype = {
 
 WebInspector.DOMStorageSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
 
-WebInspector.CookieSidebarTreeElement = function()
+WebInspector.CookieSidebarTreeElement = function(cookieDomain)
 {
-    WebInspector.SidebarTreeElement.call(this, "cookie-sidebar-tree-item", null, "", null, false);
+    WebInspector.SidebarTreeElement.call(this, "cookie-sidebar-tree-item", cookieDomain, "", null, false);
+    this._cookieDomain = cookieDomain;
 
     this.refreshTitles();
 }
@@ -580,12 +590,12 @@ WebInspector.CookieSidebarTreeElement = function()
 WebInspector.CookieSidebarTreeElement.prototype = {
     onselect: function()
     {
-        WebInspector.panels.storage.showCookies();
+        WebInspector.panels.storage.showCookies(this._cookieDomain);
     },
-
+    
     get mainTitle()
     {
-        return WebInspector.UIString("Cookies");
+        return this._cookieDomain ? this._cookieDomain : WebInspector.UIString("Local Files");
     },
 
     set mainTitle(x)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TestController.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TestController.js
new file mode 100644
index 0000000000..8da59e7f8a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TestController.js
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TestController = function(callId)
+{
+    this._callId = callId;
+    this._waitUntilDone = false;
+}
+
+WebInspector.TestController.prototype = {
+    waitUntilDone: function()
+    {
+        this._waitUntilDone = true;
+    },
+
+    notifyDone: function(result)
+    {
+        var message = typeof result === "undefined" ? "<undefined>" : JSON.stringify(result);
+        InspectorController.didEvaluateForTestInFrontend(this._callId, message);
+    }
+}
+
+WebInspector.evaluateForTestInFrontend = function(callId, script)
+{
+    var controller = new WebInspector.TestController(callId);
+    try {
+        var result;
+        if (window[script] && typeof window[script] === "function")
+            result = window[script].call(this, controller);
+        else
+            result = window.eval(script);
+
+        if (!controller._waitUntilDone)
+            controller.notifyDone(result);
+    } catch (e) {
+        controller.notifyDone(e.toString());
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
index 5ff774f826..f73ab0d512 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
@@ -252,7 +252,7 @@ WebInspector.TextPrompt.prototype = {
                 foundNextText = true;
             }
 
-            node = node.traverseNextNode(false, this.element);
+            node = node.traverseNextNode(this.element);
         }
 
         return true;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js
index 6d18732699..4363da8fef 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js
@@ -45,10 +45,10 @@ WebInspector.addItemToTimeline = function(record) {
     // Not implemented.
 }
 
-WebInspector.timelineWasEnabled = function() {
+WebInspector.timelineProfilerWasStarted = function() {
     // Not implemented.
 }
 
-WebInspector.timelineWasDisabled = function() {
+WebInspector.timelineProfilerWasStopped = function() {
     // Not implemented.
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index d6d1d616e8..96a20ab7bf 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -75,6 +75,8 @@ WebInspector.WatchExpressionsSection = function()
     this.editable = true;
     this.expanded = true;
     this.propertiesElement.addStyleClass("watch-expressions");
+
+    this._watchObjectGroupId = "watch-group";
 }
 
 WebInspector.WatchExpressionsSection.NewWatchExpression = "\xA0";
@@ -114,6 +116,7 @@ WebInspector.WatchExpressionsSection.prototype = {
                 this.updateProperties(properties, WebInspector.WatchExpressionTreeElement, WebInspector.WatchExpressionsSection.CompareProperties);
         }
 
+        InspectorController.releaseWrapperObjectGroup(this._watchObjectGroupId)
         var properties = [];
 
         // Count the properties, so we known when to call this.updateProperties()
@@ -129,10 +132,10 @@ WebInspector.WatchExpressionsSection.prototype = {
         // which is checked in the appendResult inner function.
         for (var i = 0; i < this.watchExpressions.length; ++i) {
             var expression = this.watchExpressions[i];
-            if (!expression) 
+            if (!expression)
                 continue;
 
-            WebInspector.console.evalInInspectedWindow("(" + expression + ")", appendResult.bind(this, expression, i));
+            WebInspector.console.evalInInspectedWindow("(" + expression + ")", this._watchObjectGroupId, appendResult.bind(this, expression, i));
         }
 
         // note this is setting the expansion of the tree, not the section;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
index 1aaeb3d30f..32f15ce5d2 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
@@ -57,6 +57,7 @@
     <file>StoragePanel.js</file>
     <file>StylesSidebarPane.js</file>
     <file>SummaryBar.js</file>
+    <file>TestController.js</file>
     <file>TextPrompt.js</file>
     <file>TimelineAgent.js</file>
     <file>TopDownProfileDataGridTree.js</file>
@@ -65,6 +66,7 @@
     <file>View.js</file>
     <file>WatchExpressionsSidebarPane.js</file>
     <file>inspector.css</file>
+    <file>inspectorSyntaxHighlight.css</file>
     <file>Images/back.png</file>
     <file>Images/checker.png</file>
     <file>Images/clearConsoleButtonGlyph.png</file>
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
index 358c13cd37..fc08bc28cf 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
@@ -211,7 +211,7 @@ body.attached #search-results-matches {
     background-image: url(Images/profilesIcon.png);
 }
 
-#close-button {
+#close-button-left, #close-button-right {
     width: 14px;
     height: 14px;
     background-image: url(Images/closeButtons.png);
@@ -221,19 +221,27 @@ body.attached #search-results-matches {
     margin: 5px 0;
 }
 
-#close-button:hover {
+#close-button-left:hover, #close-button-right:hover {
     background-position: 14px 0;
 }
 
-#close-button:active {
+#close-button-left:active, #close-button-right:active {
     background-position: 28px 0;
 }
 
-body.detached .toolbar-item.close {
+body.detached .toolbar-item.close-left, body.detached .toolbar-item.close-right {
     display: none;
 }
 
-body.attached.platform-qt .toolbar-item.close {
+body.attached.platform-qt .toolbar-item.close-left, body.attached.platform-qt .toolbar-item.close-right {
+    display: none;
+}
+
+body.platform-mac-tiger .toolbar-item.close-right, body.platform-mac-leopard .toolbar-item.close-right { 
+    display: none;
+}
+
+body:not(.platform-mac-tiger):not(.platform-mac-leopard) .toolbar-item.close-left { 
     display: none;
 }
 
@@ -818,11 +826,6 @@ body.drawer-visible #drawer {
     vertical-align: top;
 }
 
-.invisible {
-    color: inherit;
-    text-decoration: none;
-}
-
 .webkit-line-gutter-backdrop {
     /* Keep this in sync with view-source.css (.webkit-line-gutter-backdrop) */
     width: 31px;
@@ -1637,6 +1640,10 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
     background-position: -46px 0px;
 }
 
+.pane > .title > select > option, .pane > .title > select > hr {
+    color: black;
+}
+
 .pane > .body {
     position: relative;
     display: none;
@@ -2512,6 +2519,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     -webkit-background-size: 1px 6px;
     -webkit-background-origin: padding;
     -webkit-background-clip: padding;
+    z-index: 400;
 }
 
 .summary-graph-legend {
@@ -2558,6 +2566,16 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     z-index: -100;
 }
 
+#resources-event-dividers {
+    position: absolute;
+    left: 0;
+    right: 0;
+    height: 100%;
+    top: 0;
+    z-index: 300;
+    pointer-events: none;
+}
+
 #resources-dividers-label-bar {
     position: absolute;
     top: 93px;
@@ -2578,6 +2596,32 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     background-color: rgba(0, 0, 0, 0.1);
 }
 
+.resources-event-divider-padding {
+    position: absolute;
+    width: 8px;
+    top: 0;
+    bottom: 0;
+    pointer-events: auto;
+}
+
+.resources-onload-divider {
+    position: absolute;
+    width: 2px;
+    top: 0;
+    bottom: 0;
+    z-index: 300;
+    background-color: rgba(255, 0, 0, 0.5);
+}
+
+.resources-ondomcontent-divider {
+    position: absolute;
+    width: 2px;
+    top: 0;
+    bottom: 0;
+    z-index: 300;
+    background-color: rgba(0, 0, 255, 0.5);
+}
+
 .resources-divider.last {
     background-color: transparent;
 }
@@ -3404,3 +3448,7 @@ ol.breakpoint-list {
 .breakpoint-list a:hover {
     color: rgb(15%, 15%, 15%);
 }
+
+.webkit-html-js-node, .webkit-html-css-node {
+    white-space: pre;
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
index f54e30230a..4fa69e0915 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
@@ -30,6 +30,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 <head>
     <meta http-equiv="content-type" content="text/html; charset=utf-8">
     <link rel="stylesheet" type="text/css" href="inspector.css">
+    <link rel="stylesheet" type="text/css" href="inspectorSyntaxHighlight.css">
     <script type="text/javascript" src="utilities.js"></script>
     <script type="text/javascript" src="treeoutline.js"></script>
     <script type="text/javascript" src="inspector.js"></script>
@@ -93,13 +94,15 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="InjectedScript.js"></script>
     <script type="text/javascript" src="InjectedScriptAccess.js"></script>
     <script type="text/javascript" src="TimelineAgent.js"></script>
+    <script type="text/javascript" src="TestController.js"></script>
 </head>
 <body class="detached">
     <div id="toolbar">
-        <div class="toolbar-item close"><button id="close-button"></button></div>
+        <div class="toolbar-item close-left"><button id="close-button-left"></button></div>
         <div class="toolbar-item flexable-space"></div>
         <div class="toolbar-item hidden" id="search-results-matches"></div>
         <div class="toolbar-item"><input id="search" type="search" incremental results="0"><div id="search-toolbar-label" class="toolbar-label"></div></div>
+        <div class="toolbar-item close-right"><button id="close-button-right"></button></div>
     </div>
     <div id="main">
         <div id="main-panels" tabindex="0" spellcheck="false"></div>
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
index de4f4fb479..17b02a1eeb 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
@@ -29,7 +29,6 @@
  */
 
 var Preferences = {
-    ignoreWhitespace: true,
     showUserAgentStyles: true,
     maxInlineTextChildLength: 80,
     minConsoleHeight: 75,
@@ -43,7 +42,8 @@ var Preferences = {
     samplingCPUProfiler: false,
     showColorNicknames: true,
     colorFormat: "hex",
-    eventListenersFilter: "all"
+    eventListenersFilter: "all",
+    resourcesLargeRows: true
 }
 
 var WebInspector = {
@@ -139,12 +139,29 @@ var WebInspector = {
             this.panels.resources = new WebInspector.ResourcesPanel();
         if (hiddenPanels.indexOf("scripts") === -1)
             this.panels.scripts = new WebInspector.ScriptsPanel();
-        if (hiddenPanels.indexOf("profiles") === -1)
+        if (hiddenPanels.indexOf("profiles") === -1) {
             this.panels.profiles = new WebInspector.ProfilesPanel();
+            this.panels.profiles.registerProfileType(new WebInspector.CPUProfileType());
+        }
         if (hiddenPanels.indexOf("storage") === -1 && hiddenPanels.indexOf("databases") === -1)
             this.panels.storage = new WebInspector.StoragePanel();      
     },
 
+    _loadPreferences: function()
+    {
+        var colorFormat = InspectorController.setting("color-format");
+        if (colorFormat)
+            Preferences.colorFormat = colorFormat;
+
+        var eventListenersFilter = InspectorController.setting("event-listeners-filter");
+        if (eventListenersFilter)
+            Preferences.eventListenersFilter = eventListenersFilter;
+
+        var resourcesLargeRows = InspectorController.setting("resources-large-rows");
+        if (typeof resourcesLargeRows !== "undefined")
+            Preferences.resourcesLargeRows = resourcesLargeRows;
+    },
+
     get attached()
     {
         return this._attached;
@@ -351,13 +368,7 @@ WebInspector.loaded = function()
     var platform = InspectorController.platform();
     document.body.addStyleClass("platform-" + platform);
 
-    var colorFormat = InspectorController.setting("color-format");
-    if (colorFormat)
-        Preferences.colorFormat = colorFormat;
-
-    var eventListenersFilter = InspectorController.setting("event-listeners-filter");
-    if (eventListenersFilter)
-        Preferences.eventListenersFilter = eventListenersFilter;
+    this._loadPreferences();
 
     this.drawer = new WebInspector.Drawer();
     this.console = new WebInspector.ConsoleView(this.drawer);
@@ -449,8 +460,9 @@ WebInspector.loaded = function()
     searchField.addEventListener("keyup", this.searchKeyUp.bind(this), false);
     searchField.addEventListener("search", this.performSearch.bind(this), false); // when the search is emptied
 
-    document.getElementById("toolbar").addEventListener("mousedown", this.toolbarDragStart, true);
-    document.getElementById("close-button").addEventListener("click", this.close, true);
+    toolbarElement.addEventListener("mousedown", this.toolbarDragStart, true);
+    document.getElementById("close-button-left").addEventListener("click", this.close, true);
+    document.getElementById("close-button-right").addEventListener("click", this.close, true);
 
     InspectorController.loaded();
 }
@@ -476,7 +488,14 @@ window.addEventListener("load", windowLoaded, false);
 WebInspector.dispatch = function() {
     var methodName = arguments[0];
     var parameters = Array.prototype.slice.call(arguments, 1);
-    WebInspector[methodName].apply(this, parameters);
+
+    // We'd like to enforce asynchronous interaction between the inspector controller and the frontend.
+    // This is important to LayoutTests.
+    function delayDispatch()
+    {
+        WebInspector[methodName].apply(WebInspector, parameters);
+    }
+    setTimeout(delayDispatch, 0);
 }
 
 WebInspector.windowUnload = function(event)
@@ -537,10 +556,9 @@ WebInspector.documentClick = function(event)
 
             WebInspector.showResourceForURL(anchor.href, anchor.lineNumber, anchor.preferredPanel);
         } else {
-            var profileStringRegEx = new RegExp("webkit-profile://.+/([0-9]+)");
-            var profileString = profileStringRegEx.exec(anchor.href);
+            var profileString = WebInspector.ProfileType.URLRegExp.exec(anchor.href);
             if (profileString)
-                WebInspector.showProfileById(profileString[1])
+                WebInspector.showProfileForURL(anchor.href);
         }
     }
 
@@ -989,6 +1007,21 @@ WebInspector.updateResource = function(identifier, payload)
             resource.responseReceivedTime = payload.responseReceivedTime;
         if (payload.endTime)
             resource.endTime = payload.endTime;
+        
+        if (payload.loadEventTime) {
+            // This loadEventTime is for the main resource, and we want to show it
+            // for all resources on this page. This means we want to set it as a member
+            // of the resources panel instead of the individual resource.
+            if (this.panels.resources)
+                this.panels.resources.mainResourceLoadTime = payload.loadEventTime;
+        }
+        
+        if (payload.domContentEventTime) {
+            // This domContentEventTime is for the main resource, so it should go in
+            // the resources panel for the same reasons as above.
+            if (this.panels.resources)
+                this.panels.resources.mainResourceDOMContentTime = payload.domContentEventTime;
+        }
     }
 }
 
@@ -1009,13 +1042,19 @@ WebInspector.removeResource = function(identifier)
 WebInspector.addDatabase = function(payload)
 {
     var database = new WebInspector.Database(
-        payload.database,
+        payload.id,
         payload.domain,
         payload.name,
         payload.version);
     this.panels.storage.addDatabase(database);
 }
 
+WebInspector.addCookieDomain = function(domain)
+{
+    if (this.panels.storage)
+        this.panels.storage.addCookieDomain(domain);
+}
+
 WebInspector.addDOMStorage = function(payload)
 {
     var domStorage = new WebInspector.DOMStorage(
@@ -1224,14 +1263,15 @@ WebInspector.log = function(message)
     logMessage(message);
 }
 
-WebInspector.addProfile = function(profile)
+WebInspector.addProfileHeader = function(profile)
 {
-    this.panels.profiles.addProfile(profile);
+    this.panels.profiles.addProfileHeader(WebInspector.CPUProfileType.TypeId, new WebInspector.CPUProfile(profile));
 }
 
 WebInspector.setRecordingProfile = function(isProfiling)
 {
-    this.panels.profiles.setRecordingProfile(isProfiling);
+    this.panels.profiles.getProfileType(WebInspector.CPUProfileType.TypeId).setRecordingProfile(isProfiling);
+    this.panels.profiles.updateProfileTypeButtons();
 }
 
 WebInspector.drawLoadingPieChart = function(canvas, percent) {
@@ -1337,13 +1377,9 @@ WebInspector.linkifyStringAsFragment = function(string)
         var nonLink = string.substring(0, linkIndex);
         container.appendChild(document.createTextNode(nonLink));
 
-        var profileStringRegEx = new RegExp("webkit-profile://(.+)/[0-9]+");
-        var profileStringMatches = profileStringRegEx.exec(title);
-        var profileTitle;
+        var profileStringMatches = WebInspector.ProfileType.URLRegExp.exec(title);
         if (profileStringMatches)
-            profileTitle = profileStringMatches[1];
-        if (profileTitle)
-            title = WebInspector.panels.profiles.displayTitleForProfileLink(profileTitle);
+            title = WebInspector.panels.profiles.displayTitleForProfileLink(profileStringMatches[2], profileStringMatches[1]);
 
         var realURL = (linkString.indexOf("www.") === 0 ? "http://" + linkString : linkString);
         container.appendChild(WebInspector.linkifyURLAsNode(realURL, title, null, (realURL in WebInspector.resourceURLMap)));
@@ -1356,9 +1392,9 @@ WebInspector.linkifyStringAsFragment = function(string)
     return container;
 }
 
-WebInspector.showProfileById = function(uid) {
+WebInspector.showProfileForURL = function(url) {
     WebInspector.showProfilesPanel();
-    WebInspector.panels.profiles.showProfileById(uid);
+    WebInspector.panels.profiles.showProfileForURL(url);
 }
 
 WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspectorSyntaxHighlight.css b/src/3rdparty/webkit/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
new file mode 100644
index 0000000000..2cbb3c54a7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+.webkit-css-comment { 
+    color: rgb(0, 116, 0);
+}
+
+.webkit-css-string, .webkit-css-keyword, .webkit-css-unit {
+    color: rgb(7, 144, 154);
+}
+
+.webkit-css-number {
+    color: rgb(50, 0, 255);
+}
+
+.webkit-css-property, .webkit-css-at-rule {
+    color: rgb(200, 0, 0);
+}
+
+.webkit-css-url {
+    color: rgb(0, 0, 0);
+}
+
+.webkit-css-selector {
+    color: rgb(0, 0, 0);
+}
+
+.webkit-css-pseudo-class {
+    color: rgb(128, 128, 128);
+}
+
+.webkit-javascript-comment {
+    color: rgb(0, 116, 0);
+}
+
+.webkit-javascript-keyword {
+    color: rgb(170, 13, 145);
+}
+
+.webkit-javascript-number {
+    color: rgb(28, 0, 207);
+}
+
+.webkit-javascript-string, .webkit-javascript-regexp {
+    color: rgb(196, 26, 22);
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js b/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
index 5f41b56830..6df23de0f3 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
@@ -91,7 +91,7 @@ Node.prototype.rangeOfWord = function(offset, stopCharacters, stayWithinNode, di
             if (startNode)
                 break;
 
-            node = node.traversePreviousNode(false, stayWithinNode);
+            node = node.traversePreviousNode(stayWithinNode);
         }
 
         if (!startNode) {
@@ -126,7 +126,7 @@ Node.prototype.rangeOfWord = function(offset, stopCharacters, stayWithinNode, di
             if (endNode)
                 break;
 
-            node = node.traverseNextNode(false, stayWithinNode);
+            node = node.traverseNextNode(stayWithinNode);
         }
 
         if (!endNode) {
@@ -269,9 +269,6 @@ Element.prototype.offsetRelativeToWindow = function(targetWindow)
     return elementOffset;
 }
 
-Element.prototype.firstChildSkippingWhitespace = firstChildSkippingWhitespace;
-Element.prototype.lastChildSkippingWhitespace = lastChildSkippingWhitespace;
-
 Node.prototype.isWhitespace = isNodeWhitespace;
 Node.prototype.displayName = nodeDisplayName;
 Node.prototype.isAncestor = function(node)
@@ -279,8 +276,6 @@ Node.prototype.isAncestor = function(node)
     return isAncestorNode(this, node);
 };
 Node.prototype.isDescendant = isDescendantNode;
-Node.prototype.nextSiblingSkippingWhitespace = nextSiblingSkippingWhitespace;
-Node.prototype.previousSiblingSkippingWhitespace = previousSiblingSkippingWhitespace;
 Node.prototype.traverseNextNode = traverseNextNode;
 Node.prototype.traversePreviousNode = traversePreviousNode;
 Node.prototype.onlyTextChild = onlyTextChild;
@@ -455,172 +450,58 @@ function isDescendantNode(descendant)
     return isAncestorNode(descendant, this);
 }
 
-function nextSiblingSkippingWhitespace()
-{
-    if (!this)
-        return;
-    var node = this.nextSibling;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = node.nextSibling;
-    return node;
-}
-
-function previousSiblingSkippingWhitespace()
+function traverseNextNode(stayWithin)
 {
     if (!this)
         return;
-    var node = this.previousSibling;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = node.previousSibling;
-    return node;
-}
 
-function firstChildSkippingWhitespace()
-{
-    if (!this)
-        return;
     var node = this.firstChild;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = nextSiblingSkippingWhitespace.call(node);
-    return node;
-}
-
-function lastChildSkippingWhitespace()
-{
-    if (!this)
-        return;
-    var node = this.lastChild;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = previousSiblingSkippingWhitespace.call(node);
-    return node;
-}
-
-function traverseNextNode(skipWhitespace, stayWithin)
-{
-    if (!this)
-        return;
-
-    var node = skipWhitespace ? firstChildSkippingWhitespace.call(this) : this.firstChild;
     if (node)
         return node;
 
     if (stayWithin && this === stayWithin)
         return null;
 
-    node = skipWhitespace ? nextSiblingSkippingWhitespace.call(this) : this.nextSibling;
+    node = this.nextSibling;
     if (node)
         return node;
 
     node = this;
-    while (node && !(skipWhitespace ? nextSiblingSkippingWhitespace.call(node) : node.nextSibling) && (!stayWithin || !node.parentNode || node.parentNode !== stayWithin))
+    while (node && !node.nextSibling && (!stayWithin || !node.parentNode || node.parentNode !== stayWithin))
         node = node.parentNode;
     if (!node)
         return null;
 
-    return skipWhitespace ? nextSiblingSkippingWhitespace.call(node) : node.nextSibling;
+    return node.nextSibling;
 }
 
-function traversePreviousNode(skipWhitespace, stayWithin)
+function traversePreviousNode(stayWithin)
 {
     if (!this)
         return;
     if (stayWithin && this === stayWithin)
         return null;
-    var node = skipWhitespace ? previousSiblingSkippingWhitespace.call(this) : this.previousSibling;
-    while (node && (skipWhitespace ? lastChildSkippingWhitespace.call(node) : node.lastChild) )
-        node = skipWhitespace ? lastChildSkippingWhitespace.call(node) : node.lastChild;
+    var node = this.previousSibling;
+    while (node && node.lastChild)
+        node = node.lastChild;
     if (node)
         return node;
     return this.parentNode;
 }
 
-function onlyTextChild(ignoreWhitespace)
+function onlyTextChild()
 {
     if (!this)
         return null;
 
-    var firstChild = ignoreWhitespace ? firstChildSkippingWhitespace.call(this) : this.firstChild;
+    var firstChild = this.firstChild;
     if (!firstChild || firstChild.nodeType !== Node.TEXT_NODE)
         return null;
 
-    var sibling = ignoreWhitespace ? nextSiblingSkippingWhitespace.call(firstChild) : firstChild.nextSibling;
+    var sibling = firstChild.nextSibling;
     return sibling ? null : firstChild;
 }
 
-function nodeTitleInfo(hasChildren, linkify)
-{
-    var info = {title: "", hasChildren: hasChildren};
-
-    switch (this.nodeType) {
-        case Node.DOCUMENT_NODE:
-            info.title = "Document";
-            break;
-
-        case Node.ELEMENT_NODE:
-            info.title = "<span class=\"webkit-html-tag\">&lt;" + this.nodeName.toLowerCase().escapeHTML();
-
-            if (this.hasAttributes()) {
-                for (var i = 0; i < this.attributes.length; ++i) {
-                    var attr = this.attributes[i];
-                    info.title += " <span class=\"webkit-html-attribute\"><span class=\"webkit-html-attribute-name\">" + attr.name.escapeHTML() + "</span>=&#8203;\"";
-
-                    var value = attr.value;
-                    if (linkify && (attr.name === "src" || attr.name === "href")) {
-                        var value = value.replace(/([\/;:\)\]\}])/g, "$1\u200B");
-                        info.title += linkify(attr.value, value, "webkit-html-attribute-value", this.nodeName.toLowerCase() == "a");
-                    } else {
-                        var value = value.escapeHTML();
-                        value = value.replace(/([\/;:\)\]\}])/g, "$1&#8203;");
-                        info.title += "<span class=\"webkit-html-attribute-value\">" + value + "</span>";
-                    }
-                    info.title += "\"</span>";
-                }
-            }
-            info.title += "&gt;</span>&#8203;";
-
-            // If this element only has a single child that is a text node,
-            // just show that text and the closing tag inline rather than
-            // create a subtree for them
-
-            var textChild = onlyTextChild.call(this, Preferences.ignoreWhitespace);
-            var showInlineText = textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength;
-
-            if (showInlineText) {
-                info.title += "<span class=\"webkit-html-text-node\">" + textChild.nodeValue.escapeHTML() + "</span>&#8203;<span class=\"webkit-html-tag\">&lt;/" + this.nodeName.toLowerCase().escapeHTML() + "&gt;</span>";
-                info.hasChildren = false;
-            }
-            break;
-
-        case Node.TEXT_NODE:
-            if (isNodeWhitespace.call(this))
-                info.title = "(whitespace)";
-            else
-                info.title = "\"<span class=\"webkit-html-text-node\">" + this.nodeValue.escapeHTML() + "</span>\"";
-            break
-
-        case Node.COMMENT_NODE:
-            info.title = "<span class=\"webkit-html-comment\">&lt;!--" + this.nodeValue.escapeHTML() + "--&gt;</span>";
-            break;
-
-        case Node.DOCUMENT_TYPE_NODE:
-            info.title = "<span class=\"webkit-html-doctype\">&lt;!DOCTYPE " + this.nodeName;
-            if (this.publicId) {
-                info.title += " PUBLIC \"" + this.publicId + "\"";
-                if (this.systemId)
-                    info.title += " \"" + this.systemId + "\"";
-            } else if (this.systemId)
-                info.title += " SYSTEM \"" + this.systemId + "\"";
-            if (this.internalSubset)
-                info.title += " [" + this.internalSubset + "]";
-            info.title += "&gt;</span>";
-            break;
-        default:
-            info.title = this.nodeName.toLowerCase().collapseWhitespace().escapeHTML();
-    }
-
-    return info;
-}
-
 function appropriateSelectorForNode(node, justSelector)
 {
     if (!node)
diff --git a/src/3rdparty/webkit/WebCore/loader/Cache.cpp b/src/3rdparty/webkit/WebCore/loader/Cache.cpp
index 14edae9d96..391790f416 100644
--- a/src/3rdparty/webkit/WebCore/loader/Cache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/Cache.cpp
@@ -34,6 +34,7 @@
 #include "FrameView.h"
 #include "Image.h"
 #include "ResourceHandle.h"
+#include "SecurityOrigin.h"
 #include <stdio.h>
 #include <wtf/CurrentTime.h>
 
@@ -104,7 +105,7 @@ CachedResource* Cache::requestResource(DocLoader* docLoader, CachedResource::Typ
     if (resource && requestIsPreload && !resource->isPreloaded())
         return 0;
     
-    if (FrameLoader::restrictAccessToLocal() && !FrameLoader::canLoad(url, String(), docLoader->doc())) {
+    if (SecurityOrigin::restrictAccessToLocal() && !SecurityOrigin::canLoad(url, String(), docLoader->doc())) {
         Document* doc = docLoader->doc();
         if (doc && !requestIsPreload)
             FrameLoader::reportLocalLoadFailed(doc->frame(), url.string());
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResourceClient.h b/src/3rdparty/webkit/WebCore/loader/CachedResourceClient.h
index 2e0b15b061..dd9bb94bc1 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResourceClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResourceClient.h
@@ -25,6 +25,8 @@
 #ifndef CachedResourceClient_h
 #define CachedResourceClient_h
 
+#include <wtf/FastAllocBase.h>
+
 #if ENABLE(XBL)
 namespace XBL {
     class XBLDocument;
@@ -48,7 +50,7 @@ namespace WebCore {
      * inherit from this class and overload one of the 3 functions
      *
      */
-    class CachedResourceClient
+    class CachedResourceClient : public FastAllocBase
     {
     public:
         virtual ~CachedResourceClient() { }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResourceHandle.h b/src/3rdparty/webkit/WebCore/loader/CachedResourceHandle.h
index feb59b9dcf..0956e0c03b 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResourceHandle.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResourceHandle.h
@@ -71,9 +71,10 @@ namespace WebCore {
         bool operator==(const CachedResourceHandleBase& o) const { return get() == o.get(); }
         bool operator!=(const CachedResourceHandleBase& o) const { return get() != o.get(); }
     };
-	
-    // Don't inline for winscw compiler to prevent the compiler agressively resolving 
-    // the base class of R* when CachedResourceHandler<T>(R*) is inlined.    
+
+    // Don't inline for winscw compiler to prevent the compiler agressively resolving
+    // the base class of R* when CachedResourceHandler<T>(R*) is inlined.  The bug is
+    // reported at: https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
     template <class R>
 #if !COMPILER(WINSCW)
     inline
diff --git a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
index 14d36f1c76..91c70302e7 100644
--- a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
+++ b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
@@ -488,6 +488,7 @@ class EmptyPluginHalterClient : public PluginHalterClient
 {
 public:
     virtual bool shouldHaltPlugin(Node*) const { return false; }
+    virtual bool enabled() const { return false; }
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
index 93a1f10339..df463979e4 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
@@ -55,6 +55,7 @@
 #include "FrameLoaderClient.h"
 #include "FrameTree.h"
 #include "FrameView.h"
+#include "HTMLAnchorElement.h"
 #include "HTMLAppletElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLFrameElement.h"
@@ -123,96 +124,12 @@ using namespace SVGNames;
 #endif
 using namespace HTMLNames;
 
-struct ScheduledRedirection {
-    enum Type { redirection, locationChange, historyNavigation, formSubmission };
-
-    const Type type;
-    const double delay;
-    const String url;
-    const String referrer;
-    const FrameLoadRequest frameRequest;
-    const RefPtr<Event> event;
-    const RefPtr<FormState> formState;
-    const int historySteps;
-    const bool lockHistory;
-    const bool lockBackForwardList;
-    const bool wasUserGesture;
-    const bool wasRefresh;
-    const bool wasDuringLoad;
-    bool toldClient;
-
-    ScheduledRedirection(double delay, const String& url, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh)
-        : type(redirection)
-        , delay(delay)
-        , url(url)
-        , historySteps(0)
-        , lockHistory(lockHistory)
-        , lockBackForwardList(lockBackForwardList)
-        , wasUserGesture(wasUserGesture)
-        , wasRefresh(refresh)
-        , wasDuringLoad(false)
-        , toldClient(false)
-    {
-        ASSERT(!url.isEmpty());
-    }
-
-    ScheduledRedirection(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh, bool duringLoad)
-        : type(locationChange)
-        , delay(0)
-        , url(url)
-        , referrer(referrer)
-        , historySteps(0)
-        , lockHistory(lockHistory)
-        , lockBackForwardList(lockBackForwardList)
-        , wasUserGesture(wasUserGesture)
-        , wasRefresh(refresh)
-        , wasDuringLoad(duringLoad)
-        , toldClient(false)
-    {
-        ASSERT(!url.isEmpty());
-    }
-
-    explicit ScheduledRedirection(int historyNavigationSteps)
-        : type(historyNavigation)
-        , delay(0)
-        , historySteps(historyNavigationSteps)
-        , lockHistory(false)
-        , lockBackForwardList(false)
-        , wasUserGesture(false)
-        , wasRefresh(false)
-        , wasDuringLoad(false)
-        , toldClient(false)
-    {
-    }
-
-    ScheduledRedirection(const FrameLoadRequest& frameRequest,
-            bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState,
-            bool duringLoad)
-        : type(formSubmission)
-        , delay(0)
-        , frameRequest(frameRequest)
-        , event(event)
-        , formState(formState)
-        , historySteps(0)
-        , lockHistory(lockHistory)
-        , lockBackForwardList(lockBackForwardList)
-        , wasUserGesture(false)
-        , wasRefresh(false)
-        , wasDuringLoad(duringLoad)
-        , toldClient(false)
-    {
-        ASSERT(!frameRequest.isEmpty());
-        ASSERT(this->formState);
-    }
-};
- 
 #if ENABLE(XHTMLMP)
 static const char defaultAcceptHeader[] = "application/xml,application/vnd.wap.xhtml+xml,application/xhtml+xml;profile='http://www.wapforum.org/xhtml',text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
 #else
 static const char defaultAcceptHeader[] = "application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
 #endif
 static double storedTimeOfLastCompletedLoad;
-static FrameLoader::LocalLoadPolicy localLoadPolicy = FrameLoader::AllowLocalLoadsForLocalOnly;
 
 bool isBackForwardLoadType(FrameLoadType type)
 {
@@ -250,39 +167,36 @@ static inline bool canReferToParentFrameEncoding(const Frame* frame, const Frame
 FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     : m_frame(frame)
     , m_client(client)
+    , m_policyChecker(frame)
+    , m_history(frame)
+    , m_notifer(frame)
     , m_state(FrameStateCommittedPage)
     , m_loadType(FrameLoadTypeStandard)
-    , m_policyLoadType(FrameLoadTypeStandard)
     , m_delegateIsHandlingProvisionalLoadError(false)
-    , m_delegateIsDecidingNavigationPolicy(false)
-    , m_delegateIsHandlingUnimplementablePolicy(false)
     , m_firstLayoutDone(false)
     , m_quickRedirectComing(false)
     , m_sentRedirectNotification(false)
     , m_inStopAllLoaders(false)
     , m_isExecutingJavaScriptFormAction(false)
-    , m_isRunningScript(false)
     , m_didCallImplicitClose(false)
     , m_wasUnloadEventEmitted(false)
     , m_unloadEventBeingDispatched(false)
     , m_isComplete(false)
     , m_isLoadingMainResource(false)
-    , m_cancellingWithLoadInProgress(false)
     , m_needsClear(false)
     , m_receivedData(false)
     , m_encodingWasChosenByUser(false)
     , m_containsPlugIns(false)
-    , m_redirectionTimer(this, &FrameLoader::redirectionTimerFired)
     , m_checkTimer(this, &FrameLoader::checkTimerFired)
     , m_shouldCallCheckCompleted(false)
     , m_shouldCallCheckLoadComplete(false)
     , m_opener(0)
-    , m_openedByDOM(false)
     , m_creatingInitialEmptyDocument(false)
     , m_isDisplayingInitialEmptyDocument(false)
     , m_committedFirstRealDocumentLoad(false)
     , m_didPerformFirstNavigation(false)
     , m_loadingFromCachedPage(false)
+    , m_suppressOpenerInNewFrame(false)
 #ifndef NDEBUG
     , m_didDispatchDidCommitLoad(false)
 #endif
@@ -327,7 +241,7 @@ void FrameLoader::setDefersLoading(bool defers)
         m_policyDocumentLoader->setDefersLoading(defers);
 
     if (!defers) {
-        startRedirectionTimer();
+        m_frame->redirectScheduler()->startTimer();
         startCheckCompleteTimer();
     }
 }
@@ -340,7 +254,7 @@ Frame* FrameLoader::createWindow(FrameLoader* frameLoaderForFrameLookup, const F
         Frame* frame = frameLoaderForFrameLookup->frame()->tree()->find(request.frameName());
         if (frame && shouldAllowNavigation(frame)) {
             if (!request.resourceRequest().url().isEmpty())
-                frame->loader()->loadFrameRequest(request, false, false, 0, 0);
+                frame->loader()->loadFrameRequest(request, false, false, 0, 0, SendReferrer);
             if (Page* page = frame->page())
                 page->chrome()->focus();
             created = false;
@@ -404,15 +318,17 @@ void FrameLoader::changeLocation(const KURL& url, const String& referrer, bool l
 
     ResourceRequest request(url, referrer, refresh ? ReloadIgnoringCacheData : UseProtocolCachePolicy);
     
-    if (executeIfJavaScriptURL(request.url(), userGesture))
+    if (m_frame->script()->executeIfJavaScriptURL(request.url(), userGesture))
         return;
 
-    urlSelected(request, "_self", 0, lockHistory, lockBackForwardList, userGesture);
+    urlSelected(request, "_self", 0, lockHistory, lockBackForwardList, userGesture, SendReferrer);
 }
 
-void FrameLoader::urlSelected(const ResourceRequest& request, const String& passedTarget, PassRefPtr<Event> triggeringEvent, bool lockHistory, bool lockBackForwardList, bool userGesture)
+void FrameLoader::urlSelected(const ResourceRequest& request, const String& passedTarget, PassRefPtr<Event> triggeringEvent, bool lockHistory, bool lockBackForwardList, bool userGesture, ReferrerPolicy referrerPolicy)
 {
-    if (executeIfJavaScriptURL(request.url(), userGesture, false))
+    ASSERT(!m_suppressOpenerInNewFrame);
+
+    if (m_frame->script()->executeIfJavaScriptURL(request.url(), userGesture, false))
         return;
 
     String target = passedTarget;
@@ -421,11 +337,16 @@ void FrameLoader::urlSelected(const ResourceRequest& request, const String& pass
 
     FrameLoadRequest frameRequest(request, target);
 
-    if (frameRequest.resourceRequest().httpReferrer().isEmpty())
+    if (referrerPolicy == NoReferrer) {
+        m_suppressOpenerInNewFrame = true;
+        setOpener(0);
+    } else if (frameRequest.resourceRequest().httpReferrer().isEmpty())
         frameRequest.resourceRequest().setHTTPReferrer(m_outgoingReferrer);
     addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
 
-    loadFrameRequest(frameRequest, lockHistory, lockBackForwardList, triggeringEvent, 0);
+    loadFrameRequest(frameRequest, lockHistory, lockBackForwardList, triggeringEvent, 0, referrerPolicy);
+
+    m_suppressOpenerInNewFrame = false;
 }
 
 bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String& urlString, const AtomicString& frameName)
@@ -441,7 +362,7 @@ bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String
 
     Frame* frame = ownerElement->contentFrame();
     if (frame)
-        frame->loader()->scheduleLocationChange(url.string(), m_outgoingReferrer, true, true, isProcessingUserGesture());
+        frame->redirectScheduler()->scheduleLocationChange(url.string(), m_outgoingReferrer, true, true, isProcessingUserGesture());
     else
         frame = loadSubframe(ownerElement, url, frameName, m_outgoingReferrer);
     
@@ -449,7 +370,7 @@ bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String
         return false;
 
     if (!scriptURL.isEmpty())
-        frame->loader()->executeIfJavaScriptURL(scriptURL);
+        frame->script()->executeIfJavaScriptURL(scriptURL);
 
     return true;
 }
@@ -466,12 +387,12 @@ Frame* FrameLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL
         marginHeight = o->getMarginHeight();
     }
 
-    if (!canLoad(url, referrer)) {
+    if (!SecurityOrigin::canLoad(url, referrer, 0)) {
         FrameLoader::reportLocalLoadFailed(m_frame, url.string());
         return 0;
     }
 
-    bool hideReferrer = shouldHideReferrer(url, referrer);
+    bool hideReferrer = SecurityOrigin::shouldHideReferrer(url, referrer);
     RefPtr<Frame> frame = m_client->createFrame(url, name, ownerElement, hideReferrer ? String() : referrer, allowsScrolling, marginWidth, marginHeight);
 
     if (!frame)  {
@@ -521,7 +442,7 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
 
     if (protocolIsJavaScript(u)) {
         m_isExecutingJavaScriptFormAction = true;
-        executeIfJavaScriptURL(u, false, false);
+        m_frame->script()->executeIfJavaScriptURL(u, false, false);
         m_isExecutingJavaScriptFormAction = false;
         return;
     }
@@ -576,7 +497,7 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
     frameRequest.resourceRequest().setURL(u);
     addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
 
-    targetFrame->loader()->scheduleFormSubmission(frameRequest, lockHistory, event, formState);
+    targetFrame->redirectScheduler()->scheduleFormSubmission(frameRequest, lockHistory, event, formState);
 }
 
 void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolicy databasePolicy)
@@ -605,8 +526,14 @@ void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolic
         }
 
         // Dispatching the unload event could have made m_frame->document() null.
-        if (m_frame->document() && !m_frame->document()->inPageCache())
-            m_frame->document()->removeAllEventListeners();
+        if (m_frame->document() && !m_frame->document()->inPageCache()) {
+            // Don't remove event listeners from a transitional empty document (see bug 28716 for more information).
+            bool keepEventListeners = m_isDisplayingInitialEmptyDocument && m_provisionalDocumentLoader
+                && m_frame->document()->securityOrigin()->isSecureTransitionTo(m_provisionalDocumentLoader->url());
+
+            if (!keepEventListeners)
+                m_frame->document()->removeAllEventListeners();
+        }
     }
 
     m_isComplete = true; // to avoid calling completed() in finishedParsing()
@@ -634,7 +561,7 @@ void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolic
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
         child->loader()->stopLoading(unloadEventPolicy);
 
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
 }
 
 void FrameLoader::stop()
@@ -653,7 +580,7 @@ void FrameLoader::stop()
 
 bool FrameLoader::closeURL()
 {
-    saveDocumentState();
+    history()->saveDocumentState();
     
     // Should only send the pagehide event here if the current document exists and has not been placed in the page cache.    
     Document* currentDocument = m_frame->document();
@@ -663,13 +590,6 @@ bool FrameLoader::closeURL()
     return true;
 }
 
-void FrameLoader::cancelRedirection(bool cancelWithLoadInProgress)
-{
-    m_cancellingWithLoadInProgress = cancelWithLoadInProgress;
-
-    stopRedirectionTimer();
-}
-
 KURL FrameLoader::iconURL()
 {
     // If this isn't a top level frame, return nothing
@@ -695,15 +615,14 @@ KURL FrameLoader::iconURL()
 
 bool FrameLoader::didOpenURL(const KURL& url)
 {
-    if (m_scheduledRedirection && m_scheduledRedirection->wasDuringLoad) {
+    if (m_frame->redirectScheduler()->redirectScheduledDuringLoad()) {
         // A redirect was scheduled before the document was created.
         // This can happen when one frame changes another frame's location.
         return false;
     }
 
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
     m_frame->editor()->clearLastEditCommand();
-    closeURL();
 
     m_isComplete = false;
     m_isLoadingMainResource = true;
@@ -738,71 +657,15 @@ void FrameLoader::didExplicitOpen()
     // from a subsequent window.document.open / window.document.write call. 
     // Cancelling redirection here works for all cases because document.open 
     // implicitly precedes document.write.
-    cancelRedirection(); 
+    m_frame->redirectScheduler()->cancel(); 
     if (m_frame->document()->url() != blankURL())
         m_URL = m_frame->document()->url();
 }
 
-bool FrameLoader::executeIfJavaScriptURL(const KURL& url, bool userGesture, bool replaceDocument)
-{
-    if (!protocolIsJavaScript(url))
-        return false;
-
-    if (m_frame->page() && !m_frame->page()->javaScriptURLsAreAllowed())
-        return true;
-
-    const int javascriptSchemeLength = sizeof("javascript:") - 1;
-
-    String script = url.string().substring(javascriptSchemeLength);
-    ScriptValue result;
-    if (m_frame->script()->xssAuditor()->canEvaluateJavaScriptURL(script))
-        result = executeScript(decodeURLEscapeSequences(script), userGesture);
-
-    String scriptResult;
-    if (!result.getString(scriptResult))
-        return true;
-
-    SecurityOrigin* currentSecurityOrigin = m_frame->document()->securityOrigin();
-
-    // FIXME: We should always replace the document, but doing so
-    //        synchronously can cause crashes:
-    //        http://bugs.webkit.org/show_bug.cgi?id=16782
-    if (replaceDocument) {
-        stopAllLoaders();
-        begin(m_URL, true, currentSecurityOrigin);
-        write(scriptResult);
-        end();
-    }
-
-    return true;
-}
-
-ScriptValue FrameLoader::executeScript(const String& script, bool forceUserGesture)
-{
-    return executeScript(ScriptSourceCode(script, forceUserGesture ? KURL() : m_URL));
-}
-
-ScriptValue FrameLoader::executeScript(const ScriptSourceCode& sourceCode)
-{
-    if (!m_frame->script()->isEnabled() || m_frame->script()->isPaused())
-        return ScriptValue();
-
-    bool wasRunningScript = m_isRunningScript;
-    m_isRunningScript = true;
-
-    ScriptValue result = m_frame->script()->evaluate(sourceCode);
-
-    if (!wasRunningScript) {
-        m_isRunningScript = false;
-        Document::updateStyleForAllDocuments();
-    }
-
-    return result;
-}
 
 void FrameLoader::cancelAndClear()
 {
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
 
     if (!m_isComplete)
         closeURL();
@@ -811,6 +674,14 @@ void FrameLoader::cancelAndClear()
     m_frame->script()->updatePlatformScriptObjects();
 }
 
+void FrameLoader::replaceDocument(const String& html)
+{
+    stopAllLoaders();
+    begin(m_URL, true, m_frame->document()->securityOrigin());
+    write(html);
+    end();
+}
+
 void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects, bool clearFrameView)
 {
     m_frame->editor()->clear();
@@ -853,8 +724,7 @@ void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects, boo
     if (clearScriptObjects)
         m_frame->script()->clearScriptObjects();
 
-    m_redirectionTimer.stop();
-    m_scheduledRedirection.clear();
+    m_frame->redirectScheduler()->clear();
 
     m_checkTimer.stop();
     m_shouldCallCheckCompleted = false;
@@ -895,7 +765,7 @@ void FrameLoader::receivedFirstData()
     else
         url = m_frame->document()->completeURL(url).string();
 
-    scheduleHTTPRedirection(delay, url);
+    m_frame->redirectScheduler()->scheduleRedirect(delay, url);
 }
 
 const String& FrameLoader::responseMIMEType() const
@@ -972,7 +842,7 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
             document->parseDNSPrefetchControlHeader(dnsPrefetchControl);
     }
 
-    restoreDocumentState();
+    history()->restoreDocumentState();
 
     document->implicitOpen();
     
@@ -1151,21 +1021,6 @@ void FrameLoader::startIconLoader()
     m_iconLoader->startLoading();
 }
 
-void FrameLoader::setLocalLoadPolicy(LocalLoadPolicy policy)
-{
-    localLoadPolicy = policy;
-}
-
-bool FrameLoader::restrictAccessToLocal()
-{
-    return localLoadPolicy != FrameLoader::AllowLocalLoadsForAll;
-}
-
-bool FrameLoader::allowSubstituteDataAccessToLocal()
-{
-    return localLoadPolicy != FrameLoader::AllowLocalLoadsForLocalOnly;
-}
-
 void FrameLoader::commitIconURLToIconDatabase(const KURL& icon)
 {
     ASSERT(iconDatabase());
@@ -1174,52 +1029,6 @@ void FrameLoader::commitIconURLToIconDatabase(const KURL& icon)
     iconDatabase()->setIconURLForPageURL(icon.string(), originalRequestURL().string());
 }
 
-void FrameLoader::restoreDocumentState()
-{
-    Document* doc = m_frame->document();
-        
-    HistoryItem* itemToRestore = 0;
-    
-    switch (loadType()) {
-        case FrameLoadTypeReload:
-        case FrameLoadTypeReloadFromOrigin:
-        case FrameLoadTypeSame:
-        case FrameLoadTypeReplace:
-            break;
-        case FrameLoadTypeBack:
-        case FrameLoadTypeBackWMLDeckNotAccessible:
-        case FrameLoadTypeForward:
-        case FrameLoadTypeIndexedBackForward:
-        case FrameLoadTypeRedirectWithLockedBackForwardList:
-        case FrameLoadTypeStandard:
-            itemToRestore = m_currentHistoryItem.get(); 
-    }
-    
-    if (!itemToRestore)
-        return;
-
-    LOG(Loading, "WebCoreLoading %s: restoring form state from %p", m_frame->tree()->name().string().utf8().data(), itemToRestore);
-    doc->setStateForNewFormElements(itemToRestore->documentState());
-}
-
-void FrameLoader::gotoAnchor()
-{
-    // If our URL has no ref, then we have no place we need to jump to.
-    // OTOH If CSS target was set previously, we want to set it to 0, recalc
-    // and possibly repaint because :target pseudo class may have been
-    // set (see bug 11321).
-    if (!m_URL.hasFragmentIdentifier() && !m_frame->document()->cssTarget())
-        return;
-
-    String fragmentIdentifier = m_URL.fragmentIdentifier();
-    if (gotoAnchor(fragmentIdentifier))
-        return;
-
-    // Try again after decoding the ref, based on the document's encoding.
-    if (m_decoder)
-        gotoAnchor(decodeURLEscapeSequences(fragmentIdentifier, m_decoder->encoding()));
-}
-
 void FrameLoader::finishedParsing()
 {
     if (m_creatingInitialEmptyDocument)
@@ -1242,8 +1051,7 @@ void FrameLoader::finishedParsing()
     // Check if the scrollbars are really needed for the content.
     // If not, remove them, relayout, and repaint.
     m_frame->view()->restoreScrollbar();
-
-    gotoAnchor();
+    m_frame->view()->scrollToFragment(m_URL);
 }
 
 void FrameLoader::loadDone()
@@ -1298,7 +1106,7 @@ void FrameLoader::checkCompleted()
     RefPtr<Frame> protect(m_frame);
     checkCallImplicitClose(); // if we didn't do it before
 
-    startRedirectionTimer();
+    m_frame->redirectScheduler()->startTimer();
 
     completed();
     if (m_frame->page())
@@ -1363,186 +1171,11 @@ KURL FrameLoader::completeURL(const String& url)
     return m_frame->document()->completeURL(url);
 }
 
-void FrameLoader::scheduleHTTPRedirection(double delay, const String& url)
-{
-    if (delay < 0 || delay > INT_MAX / 1000)
-        return;
-        
-    if (!m_frame->page())
-        return;
-
-    if (url.isEmpty())
-        return;
-
-    // We want a new history item if the refresh timeout is > 1 second.
-    if (!m_scheduledRedirection || delay <= m_scheduledRedirection->delay)
-        scheduleRedirection(new ScheduledRedirection(delay, url, true, delay <= 1, false, false));
-}
-
-static bool mustLockBackForwardList(Frame* targetFrame)
-{
-    // Navigation of a subframe during loading of an ancestor frame does not create a new back/forward item.
-    // The definition of "during load" is any time before all handlers for the load event have been run.
-    // See https://bugs.webkit.org/show_bug.cgi?id=14957 for the original motivation for this.
-    
-    for (Frame* ancestor = targetFrame->tree()->parent(); ancestor; ancestor = ancestor->tree()->parent()) {
-        Document* document = ancestor->document();
-        if (!ancestor->loader()->isComplete() || document && document->processingLoadEvent())
-            return true;
-    }
-    return false;
-}    
-
-void FrameLoader::scheduleLocationChange(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture)
-{
-    if (!m_frame->page())
-        return;
-
-    if (url.isEmpty())
-        return;
-
-    lockBackForwardList = lockBackForwardList || mustLockBackForwardList(m_frame);
-
-    // If the URL we're going to navigate to is the same as the current one, except for the
-    // fragment part, we don't need to schedule the location change.
-    KURL parsedURL(ParsedURLString, url);
-    if (parsedURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(m_URL, parsedURL)) {
-        changeLocation(completeURL(url), referrer, lockHistory, lockBackForwardList, wasUserGesture);
-        return;
-    }
-
-    // Handle a location change of a page with no document as a special case.
-    // This may happen when a frame changes the location of another frame.
-    bool duringLoad = !m_committedFirstRealDocumentLoad;
-
-    scheduleRedirection(new ScheduledRedirection(url, referrer, lockHistory, lockBackForwardList, wasUserGesture, false, duringLoad));
-}
-
-void FrameLoader::scheduleFormSubmission(const FrameLoadRequest& frameRequest,
-    bool lockHistory, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
-{
-    ASSERT(m_frame->page());
-    ASSERT(!frameRequest.isEmpty());
-
-    // FIXME: Do we need special handling for form submissions where the URL is the same
-    // as the current one except for the fragment part? See scheduleLocationChange above.
-
-    // Handle a location change of a page with no document as a special case.
-    // This may happen when a frame changes the location of another frame.
-    bool duringLoad = !m_committedFirstRealDocumentLoad;
-
-    scheduleRedirection(new ScheduledRedirection(frameRequest, lockHistory, mustLockBackForwardList(m_frame), event, formState, duringLoad));
-}
-
-void FrameLoader::scheduleRefresh(bool wasUserGesture)
-{
-    if (!m_frame->page())
-        return;
-
-    if (m_URL.isEmpty())
-        return;
-
-    scheduleRedirection(new ScheduledRedirection(m_URL.string(), m_outgoingReferrer, true, true, wasUserGesture, true, false));
-}
-
-bool FrameLoader::isLocationChange(const ScheduledRedirection& redirection)
-{
-    switch (redirection.type) {
-        case ScheduledRedirection::redirection:
-            return false;
-        case ScheduledRedirection::historyNavigation:
-        case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::formSubmission:
-            return true;
-    }
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-void FrameLoader::scheduleHistoryNavigation(int steps)
-{
-    if (!m_frame->page())
-        return;
-
-    scheduleRedirection(new ScheduledRedirection(steps));
-}
-
-void FrameLoader::goBackOrForward(int distance)
-{
-    if (distance == 0)
-        return;
-        
-    Page* page = m_frame->page();
-    if (!page)
-        return;
-    BackForwardList* list = page->backForwardList();
-    if (!list)
-        return;
-    
-    HistoryItem* item = list->itemAtIndex(distance);
-    if (!item) {
-        if (distance > 0) {
-            int forwardListCount = list->forwardListCount();
-            if (forwardListCount > 0) 
-                item = list->itemAtIndex(forwardListCount);
-        } else {
-            int backListCount = list->backListCount();
-            if (backListCount > 0)
-                item = list->itemAtIndex(-backListCount);
-        }
-    }
-    
-    ASSERT(item); // we should not reach this line with an empty back/forward list
-    if (item)
-        page->goToItem(item, FrameLoadTypeIndexedBackForward);
-}
-
-void FrameLoader::redirectionTimerFired(Timer<FrameLoader>*)
-{
-    ASSERT(m_frame->page());
-
-    if (m_frame->page()->defersLoading())
-        return;
-
-    OwnPtr<ScheduledRedirection> redirection(m_scheduledRedirection.release());
-
-    switch (redirection->type) {
-        case ScheduledRedirection::redirection:
-        case ScheduledRedirection::locationChange:
-            changeLocation(KURL(ParsedURLString, redirection->url), redirection->referrer,
-                redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture, redirection->wasRefresh);
-            return;
-        case ScheduledRedirection::historyNavigation:
-            if (redirection->historySteps == 0) {
-                // Special case for go(0) from a frame -> reload only the frame
-                urlSelected(m_URL, "", 0, redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture);
-                return;
-            }
-            // go(i!=0) from a frame navigates into the history of the frame only,
-            // in both IE and NS (but not in Mozilla). We can't easily do that.
-            if (canGoBackOrForward(redirection->historySteps))
-                goBackOrForward(redirection->historySteps);
-            return;
-        case ScheduledRedirection::formSubmission:
-            // The submitForm function will find a target frame before using the redirection timer.
-            // Now that the timer has fired, we need to repeat the security check which normally is done when
-            // selecting a target, in case conditions have changed. Other code paths avoid this by targeting
-            // without leaving a time window. If we fail the check just silently drop the form submission.
-            if (!redirection->formState->sourceFrame()->loader()->shouldAllowNavigation(m_frame))
-                return;
-            loadFrameRequest(redirection->frameRequest, redirection->lockHistory, redirection->lockBackForwardList,
-                redirection->event, redirection->formState);
-            return;
-    }
-
-    ASSERT_NOT_REACHED();
-}
-
 void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer, Frame* childFrame)
 {
     ASSERT(childFrame);
 
-    HistoryItem* parentItem = currentHistoryItem();
+    HistoryItem* parentItem = history()->currentItem();
     FrameLoadType loadType = this->loadType();
     FrameLoadType childLoadType = FrameLoadTypeRedirectWithLockedBackForwardList;
 
@@ -1558,7 +1191,7 @@ void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer,
             // this is needed is Radar 3213556.
             workingURL = KURL(ParsedURLString, childItem->originalURLString());
             childLoadType = loadType;
-            childFrame->loader()->m_provisionalHistoryItem = childItem;
+            childFrame->loader()->history()->setProvisionalItem(childItem);
         }
     }
 
@@ -1601,54 +1234,6 @@ String FrameLoader::encoding() const
     return settings ? settings->defaultTextEncodingName() : String();
 }
 
-bool FrameLoader::gotoAnchor(const String& name)
-{
-    ASSERT(m_frame->document());
-
-    if (!m_frame->document()->haveStylesheetsLoaded()) {
-        m_frame->document()->setGotoAnchorNeededAfterStylesheetsLoad(true);
-        return false;
-    }
-
-    m_frame->document()->setGotoAnchorNeededAfterStylesheetsLoad(false);
-
-    Element* anchorNode = m_frame->document()->findAnchor(name);
-
-#if ENABLE(SVG)
-    if (m_frame->document()->isSVGDocument()) {
-        if (name.startsWith("xpointer(")) {
-            // We need to parse the xpointer reference here
-        } else if (name.startsWith("svgView(")) {
-            RefPtr<SVGSVGElement> svg = static_cast<SVGDocument*>(m_frame->document())->rootElement();
-            if (!svg->currentView()->parseViewSpec(name))
-                return false;
-            svg->setUseCurrentView(true);
-        } else {
-            if (anchorNode && anchorNode->hasTagName(SVGNames::viewTag)) {
-                RefPtr<SVGViewElement> viewElement = anchorNode->hasTagName(SVGNames::viewTag) ? static_cast<SVGViewElement*>(anchorNode) : 0;
-                if (viewElement.get()) {
-                    RefPtr<SVGSVGElement> svg = static_cast<SVGSVGElement*>(SVGLocatable::nearestViewportElement(viewElement.get()));
-                    svg->inheritViewAttributes(viewElement.get());
-                }
-            }
-        }
-        // FIXME: need to decide which <svg> to focus on, and zoom to that one
-        // FIXME: need to actually "highlight" the viewTarget(s)
-    }
-#endif
-
-    m_frame->document()->setCSSTarget(anchorNode); // Setting to null will clear the current target.
-  
-    // Implement the rule that "" and "top" both mean top of page as in other browsers.
-    if (!anchorNode && !(name.isEmpty() || equalIgnoringCase(name, "top")))
-        return false;
-
-    if (FrameView* view = m_frame->view())
-        view->maintainScrollPositionAtAnchor(anchorNode ? static_cast<Node*>(anchorNode) : m_frame->document());
-
-    return true;
-}
-
 bool FrameLoader::requestObject(RenderPart* renderer, const String& url, const AtomicString& frameName,
     const String& mimeType, const Vector<String>& paramNames, const Vector<String>& paramValues)
 {
@@ -1728,11 +1313,13 @@ bool FrameLoader::loadPlugin(RenderPart* renderer, const KURL& url, const String
     if (renderer && !useFallback) {
         HTMLPlugInElement* element = toPlugInElement(renderer->node());
 
-        if (!canLoad(url, String(), frame()->document())) {
+        if (!SecurityOrigin::canLoad(url, String(), frame()->document())) {
             FrameLoader::reportLocalLoadFailed(m_frame, url.string());
             return false;
         }
 
+        checkIfRunInsecureContent(m_frame->document()->securityOrigin(), url);
+
         widget = m_client->createPlugin(IntSize(renderer->contentWidth(), renderer->contentHeight()),
                                         element, url, paramNames, paramValues, mimeType,
                                         m_frame->document()->isPluginDocument() && !m_containsPlugIns);
@@ -1771,6 +1358,10 @@ void FrameLoader::checkIfDisplayInsecureContent(SecurityOrigin* context, const K
     if (!isMixedContent(context, url))
         return;
 
+    String message = String::format("The page at %s displayed insecure content from %s.\n",
+        m_URL.string().utf8().data(), url.string().utf8().data());
+    m_frame->domWindow()->console()->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, 1, String());
+
     m_client->didDisplayInsecureContent();
 }
 
@@ -1779,6 +1370,10 @@ void FrameLoader::checkIfRunInsecureContent(SecurityOrigin* context, const KURL&
     if (!isMixedContent(context, url))
         return;
 
+    String message = String::format("The page at %s ran insecure content from %s.\n",
+        m_URL.string().utf8().data(), url.string().utf8().data());
+    m_frame->domWindow()->console()->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, 1, String());
+
     m_client->didRunInsecureContent(context);
 }
 
@@ -1801,16 +1396,6 @@ void FrameLoader::setOpener(Frame* opener)
     }
 }
 
-bool FrameLoader::openedByDOM() const
-{
-    return m_openedByDOM;
-}
-
-void FrameLoader::setOpenedByDOM()
-{
-    m_openedByDOM = true;
-}
-
 void FrameLoader::handleFallbackContent()
 {
     HTMLFrameOwnerElement* owner = m_frame->ownerElement();
@@ -1822,7 +1407,7 @@ void FrameLoader::handleFallbackContent()
 void FrameLoader::provisionalLoadStarted()
 {    
     m_firstLayoutDone = false;
-    cancelRedirection(true);
+    m_frame->redirectScheduler()->cancel(true);
     m_client->provisionalLoadStarted();
 }
 
@@ -1892,7 +1477,7 @@ bool FrameLoader::canCachePageContainingThisFrame()
         && !SharedWorkerRepository::hasSharedWorkers(m_frame->document())
 #endif
         && !m_frame->document()->usingGeolocation()
-        && m_currentHistoryItem
+        && history()->currentItem()
         && !m_quickRedirectComing
         && !m_documentLoader->isLoadingInAPISense()
         && !m_documentLoader->isStopping()
@@ -2043,7 +1628,7 @@ bool FrameLoader::logCanCacheFrameDecision(int indentLevel)
 #endif
         if (m_frame->document()->usingGeolocation())
             { PCLOG("   -Frame uses Geolocation"); cannotCache = true; }
-        if (!m_currentHistoryItem)
+        if (!history()->currentItem())
             { PCLOG("   -No current history item"); cannotCache = true; }
         if (m_quickRedirectComing)
             { PCLOG("   -Quick redirect is coming"); cannotCache = true; }
@@ -2109,7 +1694,7 @@ private:
     
     RefPtr<Document> m_document;
 };
-    
+
 // This does the same kind of work that didOpenURL does, except it relies on the fact
 // that a higher level already checked that the URLs match and the scrolling is the right thing to do.
 void FrameLoader::scrollToAnchor(const KURL& url)
@@ -2121,12 +1706,13 @@ void FrameLoader::scrollToAnchor(const KURL& url)
     }
     
     m_URL = url;
-    updateHistoryForAnchorScroll();
+    history()->updateForAnchorScroll();
 
     // If we were in the autoscroll/panScroll mode we want to stop it before following the link to the anchor
     m_frame->eventHandler()->stopAutoscrollTimer();
     started();
-    gotoAnchor();
+    if (FrameView* view = m_frame->view())
+        view->scrollToFragment(m_URL);
 
     // It's important to model this as a load that starts and immediately finishes.
     // Otherwise, the parent frame may think we never finished loading.
@@ -2139,78 +1725,11 @@ bool FrameLoader::isComplete() const
     return m_isComplete;
 }
 
-void FrameLoader::scheduleRedirection(PassOwnPtr<ScheduledRedirection> redirection)
-{
-    ASSERT(m_frame->page());
-
-    // If a redirect was scheduled during a load, then stop the current load.
-    // Otherwise when the current load transitions from a provisional to a 
-    // committed state, pending redirects may be cancelled. 
-    if (redirection->wasDuringLoad) {
-        if (m_provisionalDocumentLoader)
-            m_provisionalDocumentLoader->stopLoading();
-        stopLoading(UnloadEventPolicyUnloadAndPageHide);   
-    }
-
-    stopRedirectionTimer();
-    m_scheduledRedirection = redirection;
-    if (!m_isComplete && m_scheduledRedirection->type != ScheduledRedirection::redirection)
-        completed();
-    startRedirectionTimer();
-}
-
-void FrameLoader::startRedirectionTimer()
-{
-    if (!m_scheduledRedirection)
-        return;
-
-    ASSERT(m_frame->page());
-
-    if (m_redirectionTimer.isActive())
-        return;
-
-    if (m_scheduledRedirection->type == ScheduledRedirection::redirection && !allAncestorsAreComplete())
-        return;
-
-    m_redirectionTimer.startOneShot(m_scheduledRedirection->delay);
-
-    switch (m_scheduledRedirection->type) {
-        case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::redirection:
-            if (m_scheduledRedirection->toldClient)
-                return;
-            m_scheduledRedirection->toldClient = true;
-            clientRedirected(KURL(ParsedURLString, m_scheduledRedirection->url),
-                m_scheduledRedirection->delay,
-                currentTime() + m_redirectionTimer.nextFireInterval(),
-                m_scheduledRedirection->lockBackForwardList);
-            return;
-        case ScheduledRedirection::formSubmission:
-            // FIXME: It would make sense to report form submissions as client redirects too.
-            // But we didn't do that in the past when form submission used a separate delay
-            // mechanism, so doing it will be a behavior change.
-            return;
-        case ScheduledRedirection::historyNavigation:
-            // Don't report history navigations.
-            return;
-    }
-    ASSERT_NOT_REACHED();
-}
-
-void FrameLoader::stopRedirectionTimer()
-{
-    m_redirectionTimer.stop();
-
-    OwnPtr<ScheduledRedirection> redirection(m_scheduledRedirection.release());
-    if (redirection && redirection->toldClient)
-        clientRedirectCancelledOrFinished(m_cancellingWithLoadInProgress);
-}
-
 void FrameLoader::completed()
 {
     RefPtr<Frame> protect(m_frame);
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        child->loader()->startRedirectionTimer();
+        child->redirectScheduler()->startTimer();
     if (Frame* parent = m_frame->tree()->parent())
         parent->loader()->checkCompleted();
     if (m_frame->view())
@@ -2264,7 +1783,7 @@ static bool isFeedWithNestedProtocolInHTTPFamily(const KURL& url)
 }
 
 void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, bool lockHistory, bool lockBackForwardList,
-    PassRefPtr<Event> event, PassRefPtr<FormState> formState)
+    PassRefPtr<Event> event, PassRefPtr<FormState> formState, ReferrerPolicy referrerPolicy)
 {    
     KURL url = request.resourceRequest().url();
 
@@ -2277,13 +1796,13 @@ void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, bool lockHis
 
     ASSERT(frame()->document());
     if (SecurityOrigin::shouldTreatURLAsLocal(url.string()) && !isFeedWithNestedProtocolInHTTPFamily(url)) {
-        if (!canLoad(url, String(), frame()->document()) && !canLoad(url, referrer)) {
+        if (!SecurityOrigin::canLoad(url, String(), frame()->document()) && !SecurityOrigin::canLoad(url, referrer, 0)) {
             FrameLoader::reportLocalLoadFailed(m_frame, url.string());
             return;
         }
     }
 
-    if (shouldHideReferrer(url, referrer))
+    if (SecurityOrigin::shouldHideReferrer(url, referrer) || referrerPolicy == NoReferrer)
         referrer = String();
     
     FrameLoadType loadType;
@@ -2340,7 +1859,8 @@ void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const Stri
     NavigationAction action(newURL, newLoadType, isFormSubmission, event);
 
     if (!targetFrame && !frameName.isEmpty()) {
-        checkNewWindowPolicy(action, request, formState.release(), frameName);
+        policyChecker()->checkNewWindowPolicy(action, FrameLoader::callContinueLoadAfterNewWindowPolicy,
+            request, formState.release(), frameName, this);
         return;
     }
 
@@ -2353,9 +1873,9 @@ void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const Stri
     // work properly.
     if (shouldScrollToAnchor(isFormSubmission, newLoadType, newURL)) {
         oldDocumentLoader->setTriggeringAction(action);
-        stopPolicyCheck();
-        m_policyLoadType = newLoadType;
-        checkNavigationPolicy(request, oldDocumentLoader.get(), formState.release(),
+        policyChecker()->stopCheck();
+        policyChecker()->setLoadType(newLoadType);
+        policyChecker()->checkNavigationPolicy(request, oldDocumentLoader.get(), formState.release(),
             callContinueFragmentScrollAfterNavigationPolicy, this);
     } else {
         // must grab this now, since this load may stop the previous load and clear this flag
@@ -2404,7 +1924,7 @@ void FrameLoader::load(const ResourceRequest& request, const String& frameName,
         return;
     }
 
-    checkNewWindowPolicy(NavigationAction(request.url(), NavigationTypeOther), request, 0, frameName);
+    policyChecker()->checkNewWindowPolicy(NavigationAction(request.url(), NavigationTypeOther), FrameLoader::callContinueLoadAfterNewWindowPolicy, request, 0, frameName, this);
 }
 
 void FrameLoader::loadWithNavigationAction(const ResourceRequest& request, const NavigationAction& action, bool lockHistory, FrameLoadType type, PassRefPtr<FormState> formState)
@@ -2462,54 +1982,41 @@ void FrameLoader::loadWithDocumentLoader(DocumentLoader* loader, FrameLoadType t
     if (m_unloadEventBeingDispatched)
         return;
 
-    m_policyLoadType = type;
+    policyChecker()->setLoadType(type);
     RefPtr<FormState> formState = prpFormState;
     bool isFormSubmission = formState;
 
     const KURL& newURL = loader->request().url();
 
-    if (shouldScrollToAnchor(isFormSubmission, m_policyLoadType, newURL)) {
+    if (shouldScrollToAnchor(isFormSubmission, policyChecker()->loadType(), newURL)) {
         RefPtr<DocumentLoader> oldDocumentLoader = m_documentLoader;
-        NavigationAction action(newURL, m_policyLoadType, isFormSubmission);
+        NavigationAction action(newURL, policyChecker()->loadType(), isFormSubmission);
 
         oldDocumentLoader->setTriggeringAction(action);
-        stopPolicyCheck();
-        checkNavigationPolicy(loader->request(), oldDocumentLoader.get(), formState,
+        policyChecker()->stopCheck();
+        policyChecker()->checkNavigationPolicy(loader->request(), oldDocumentLoader.get(), formState,
             callContinueFragmentScrollAfterNavigationPolicy, this);
     } else {
         if (Frame* parent = m_frame->tree()->parent())
             loader->setOverrideEncoding(parent->loader()->documentLoader()->overrideEncoding());
 
-        stopPolicyCheck();
+        policyChecker()->stopCheck();
         setPolicyDocumentLoader(loader);
         if (loader->triggeringAction().isEmpty())
-            loader->setTriggeringAction(NavigationAction(newURL, m_policyLoadType, isFormSubmission));
+            loader->setTriggeringAction(NavigationAction(newURL, policyChecker()->loadType(), isFormSubmission));
+
+        if (Element* ownerElement = m_frame->document()->ownerElement()) {
+            if (!ownerElement->dispatchBeforeLoadEvent(loader->request().url().string())) {
+                continueLoadAfterNavigationPolicy(loader->request(), formState, false);
+                return;
+            }
+        }
 
-        checkNavigationPolicy(loader->request(), loader, formState,
+        policyChecker()->checkNavigationPolicy(loader->request(), loader, formState,
             callContinueLoadAfterNavigationPolicy, this);
     }
 }
 
-bool FrameLoader::canLoad(const KURL& url, const String& referrer, const Document* doc)
-{
-    return canLoad(url, referrer, doc ? doc->securityOrigin() : 0);
-}
-
-bool FrameLoader::canLoad(const KURL& url, const String& referrer, const SecurityOrigin* securityOrigin)
-{
-    // We can always load any URL that isn't considered local (e.g. http URLs).
-    if (!SecurityOrigin::shouldTreatURLAsLocal(url.string()))
-        return true;
-
-    // If we were provided a document, we let its local file policy dictate the result,
-    // otherwise we allow local loads only if the supplied referrer is also local.
-    if (securityOrigin)
-        return securityOrigin->canLoadLocalResources();
-    if (!referrer.isEmpty())
-        return SecurityOrigin::shouldTreatURLAsLocal(referrer);
-    return false;
-}
-
 void FrameLoader::reportLocalLoadFailed(Frame* frame, const String& url)
 {
     ASSERT(!url.isEmpty());
@@ -2519,22 +2026,6 @@ void FrameLoader::reportLocalLoadFailed(Frame* frame, const String& url)
     frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Not allowed to load local resource: " + url, 0, String());
 }
 
-bool FrameLoader::shouldHideReferrer(const KURL& url, const String& referrer)
-{
-    bool referrerIsSecureURL = protocolIs(referrer, "https");
-    bool referrerIsWebURL = referrerIsSecureURL || protocolIs(referrer, "http");
-
-    if (!referrerIsWebURL)
-        return true;
-
-    if (!referrerIsSecureURL)
-        return false;
-
-    bool URLIsSecureURL = url.protocolIs("https");
-
-    return !URLIsSecureURL;
-}
-
 const ResourceRequest& FrameLoader::initialRequest() const
 {
     return activeDocumentLoader()->originalRequest();
@@ -2545,50 +2036,23 @@ void FrameLoader::receivedData(const char* data, int length)
     activeDocumentLoader()->receivedData(data, length);
 }
 
-void FrameLoader::handleUnimplementablePolicy(const ResourceError& error)
+bool FrameLoader::willLoadMediaElementURL(KURL& url)
 {
-    m_delegateIsHandlingUnimplementablePolicy = true;
-    m_client->dispatchUnableToImplementPolicy(error);
-    m_delegateIsHandlingUnimplementablePolicy = false;
-}
+    ResourceRequest request(url);
 
-void FrameLoader::cannotShowMIMEType(const ResourceResponse& response)
-{
-    handleUnimplementablePolicy(m_client->cannotShowMIMETypeError(response));
-}
+    unsigned long identifier;
+    ResourceError error;
+    requestFromDelegate(request, identifier, error);
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, ResourceResponse(url, String(), -1, String(), String()), -1, error);
 
-ResourceError FrameLoader::interruptionForPolicyChangeError(const ResourceRequest& request)
-{
-    return m_client->interruptForPolicyChangeError(request);
-}
+    url = request.url();
 
-void FrameLoader::checkNavigationPolicy(const ResourceRequest& newRequest, NavigationPolicyDecisionFunction function, void* argument)
-{
-    checkNavigationPolicy(newRequest, activeDocumentLoader(), 0, function, argument);
+    return error.isNull();
 }
 
-void FrameLoader::checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction function, void* argument)
+ResourceError FrameLoader::interruptionForPolicyChangeError(const ResourceRequest& request)
 {
-    ASSERT(activeDocumentLoader());
-    
-    // Always show content with valid substitute data.
-    if (activeDocumentLoader()->substituteData().isValid()) {
-        function(argument, PolicyUse);
-        return;
-    }
-
-#if ENABLE(FTPDIR)
-    // Respect the hidden FTP Directory Listing pref so it can be tested even if the policy delegate might otherwise disallow it
-    Settings* settings = m_frame->settings();
-    if (settings && settings->forceFTPDirectoryListings() && MIMEType == "application/x-ftp-directory") {
-        function(argument, PolicyUse);
-        return;
-    }
-#endif
-
-    m_policyCheck.set(function, argument);
-    m_client->dispatchDecidePolicyForMIMEType(&FrameLoader::continueAfterContentPolicy,
-        MIMEType, activeDocumentLoader()->request());
+    return m_client->interruptForPolicyChangeError(request);
 }
 
 bool FrameLoader::shouldReloadToHandleUnreachableURL(DocumentLoader* docLoader)
@@ -2598,7 +2062,7 @@ bool FrameLoader::shouldReloadToHandleUnreachableURL(DocumentLoader* docLoader)
     if (unreachableURL.isEmpty())
         return false;
 
-    if (!isBackForwardLoadType(m_policyLoadType))
+    if (!isBackForwardLoadType(policyChecker()->loadType()))
         return false;
 
     // We only treat unreachableURLs specially during the delegate callbacks
@@ -2607,7 +2071,7 @@ bool FrameLoader::shouldReloadToHandleUnreachableURL(DocumentLoader* docLoader)
     // case handles malformed URLs and unknown schemes. Loading alternate content
     // at other times behaves like a standard load.
     DocumentLoader* compareDocumentLoader = 0;
-    if (m_delegateIsDecidingNavigationPolicy || m_delegateIsHandlingUnimplementablePolicy)
+    if (policyChecker()->delegateIsDecidingNavigationPolicy() || policyChecker()->delegateIsHandlingUnimplementablePolicy())
         compareDocumentLoader = m_policyDocumentLoader.get();
     else if (m_delegateIsHandlingProvisionalLoadError)
         compareDocumentLoader = m_provisionalDocumentLoader.get();
@@ -2762,7 +2226,7 @@ void FrameLoader::stopAllLoaders(DatabasePolicy databasePolicy)
 
     m_inStopAllLoaders = true;
 
-    stopPolicyCheck();
+    policyChecker()->stopCheck();
 
     stopLoadingSubframes();
     if (m_provisionalDocumentLoader)
@@ -2893,7 +2357,7 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
 
     // Check to see if we need to cache the page we are navigating away from into the back/forward cache.
     // We are doing this here because we know for sure that a new page is about to be loaded.
-    cachePageForHistoryItem(m_currentHistoryItem.get());
+    cachePageForHistoryItem(history()->currentItem());
     
     if (m_loadType != FrameLoadTypeReplace)
         closeOldDataSources();
@@ -2927,7 +2391,7 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
     LOG(Loading, "WebCoreLoading %s: Finished committing provisional load to URL %s", m_frame->tree()->name().string().utf8().data(), m_URL.string().utf8().data());
 
     if (m_loadType == FrameLoadTypeStandard && m_documentLoader->isClientRedirect())
-        updateHistoryForClientRedirect();
+        history()->updateForClientRedirect();
 
     if (m_loadingFromCachedPage) {
         m_frame->document()->documentDidBecomeActive();
@@ -2947,10 +2411,10 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
             // FIXME: If we get a resource with more than 2B bytes, this code won't do the right thing.
             // However, with today's computers and networking speeds, this won't happen in practice.
             // Could be an issue with a giant local file.
-            sendRemainingDelegateMessages(identifier, response, static_cast<int>(response.expectedContentLength()), error);
+            notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, static_cast<int>(response.expectedContentLength()), error);
         }
         
-        pageCache()->remove(m_currentHistoryItem.get());
+        pageCache()->remove(history()->currentItem());
 
         m_documentLoader->setPrimaryLoadComplete(true);
 
@@ -2968,7 +2432,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
         return;
 
     m_client->setCopiesOnScroll();
-    updateHistoryForCommit();
+    history()->updateForCommit();
 
     // The call to closeURL() invokes the unload event handler, which can execute arbitrary
     // JavaScript. If the script initiates a new load, we need to abandon the current load,
@@ -3000,7 +2464,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
         case FrameLoadTypeIndexedBackForward:
             if (Page* page = m_frame->page())
                 if (page->backForwardList()) {
-                    updateHistoryForBackForwardNavigation();
+                    history()->updateForBackForwardNavigation();
 
                     // Create a document view for this document, or used the cached view.
                     if (cachedPage) {
@@ -3018,12 +2482,12 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
         case FrameLoadTypeReloadFromOrigin:
         case FrameLoadTypeSame:
         case FrameLoadTypeReplace:
-            updateHistoryForReload();
+            history()->updateForReload();
             m_client->transitionToCommittedForNewPage();
             break;
 
         case FrameLoadTypeStandard:
-            updateHistoryForStandardLoad();
+            history()->updateForStandardLoad();
 #ifndef BUILDING_ON_TIGER
             // This code was originally added for a Leopard performance imporvement. We decided to 
             // ifdef it to fix correctness issues on Tiger documented in <rdar://problem/5441823>.
@@ -3034,7 +2498,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
             break;
 
         case FrameLoadTypeRedirectWithLockedBackForwardList:
-            updateHistoryForRedirectWithLockedBackForwardList();
+            history()->updateForRedirectWithLockedBackForwardList();
             m_client->transitionToCommittedForNewPage();
             break;
 
@@ -3130,7 +2594,7 @@ void FrameLoader::open(CachedPage& cachedPage)
     ASSERT(m_frame->page());
     ASSERT(m_frame->page()->mainFrame() == m_frame);
 
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
 
     // We still have to close the previous part page.
     closeURL();
@@ -3242,12 +2706,6 @@ String FrameLoader::generatedMIMETypeForURLScheme(const String& URLScheme)
     return m_client->generatedMIMETypeForURLScheme(URLScheme);
 }
 
-void FrameLoader::cancelContentPolicyCheck()
-{
-    m_client->cancelPolicyCheck();
-    m_policyCheck.clear();
-}
-
 void FrameLoader::didReceiveServerRedirectForProvisionalLoadForFrame()
 {
     m_client->dispatchDidReceiveServerRedirectForProvisionalLoad();
@@ -3288,6 +2746,8 @@ void FrameLoader::finishedLoadingDocument(DocumentLoader* loader)
     loader->setParsedArchiveData(mainResource->data());
 
     m_responseMIMEType = mainResource->mimeType();
+
+    closeURL();
     didOpenURL(mainResource->url());
 
     String userChosenEncoding = documentLoader()->overrideEncoding();
@@ -3367,14 +2827,6 @@ CachePolicy FrameLoader::subresourceCachePolicy() const
     return CachePolicyVerify;
 }
 
-void FrameLoader::stopPolicyCheck()
-{
-    m_client->cancelPolicyCheck();
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-    check.cancel();
-}
-
 void FrameLoader::checkLoadCompleteForThisFrame()
 {
     ASSERT(m_client->hasWebView());
@@ -3397,7 +2849,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
             RefPtr<HistoryItem> item;
             if (Page* page = m_frame->page())
                 if (isBackForwardLoadType(loadType()) && m_frame == page->mainFrame())
-                    item = m_currentHistoryItem;
+                    item = history()->currentItem();
                 
             bool shouldReset = true;
             if (!(pdl->isLoadingInAPISense() && !pdl->isStopping())) {
@@ -3446,7 +2898,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
             // If the user had a scroll point, scroll to it, overriding the anchor point if any.
             if (Page* page = m_frame->page())
                 if ((isBackForwardLoadType(m_loadType) || m_loadType == FrameLoadTypeReload || m_loadType == FrameLoadTypeReloadFromOrigin) && page->backForwardList())
-                    restoreScrollPositionAndViewState();
+                    history()->restoreScrollPositionAndViewState();
 
             if (m_creatingInitialEmptyDocument || !m_committedFirstRealDocumentLoad)
                 return;
@@ -3473,14 +2925,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
     ASSERT_NOT_REACHED();
 }
 
-void FrameLoader::continueAfterContentPolicy(PolicyAction policy)
-{
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-    check.call(policy);
-}
-
-void FrameLoader::continueLoadAfterWillSubmitForm(PolicyAction)
+void FrameLoader::continueLoadAfterWillSubmitForm()
 {
     if (!m_provisionalDocumentLoader)
         return;
@@ -3503,7 +2948,7 @@ void FrameLoader::continueLoadAfterWillSubmitForm(PolicyAction)
 
     if (Page* page = m_frame->page()) {
         identifier = page->progress()->createUniqueIdentifier();
-        dispatchAssignIdentifierToInitialRequest(identifier, m_provisionalDocumentLoader.get(), m_provisionalDocumentLoader->originalRequest());
+        notifier()->assignIdentifierToInitialRequest(identifier, m_provisionalDocumentLoader.get(), m_provisionalDocumentLoader->originalRequest());
     }
 
     if (!m_provisionalDocumentLoader->startLoadingMainResource(identifier))
@@ -3514,7 +2959,7 @@ void FrameLoader::didFirstLayout()
 {
     if (Page* page = m_frame->page())
         if (isBackForwardLoadType(m_loadType) && page->backForwardList())
-            restoreScrollPositionAndViewState();
+            history()->restoreScrollPositionAndViewState();
 
     m_firstLayoutDone = true;
     m_client->dispatchDidFirstLayout();
@@ -3531,9 +2976,7 @@ void FrameLoader::frameLoadCompleted()
 
     m_client->frameLoadCompleted();
 
-    // Even if already complete, we might have set a previous item on a frame that
-    // didn't do any data loading on the past transaction. Make sure to clear these out.
-    m_previousHistoryItem = 0;
+    history()->updateForFrameLoadCompleted();
 
     // After a canceled provisional load, firstLayoutDone is false.
     // Reset it to true if we're displaying a page.
@@ -3634,7 +3077,7 @@ void FrameLoader::detachFromParent()
 
     closeURL();
     stopAllLoaders();
-    saveScrollPositionAndViewStateToItem(currentHistoryItem());
+    history()->saveScrollPositionAndViewStateToItem(history()->currentItem());
     detachChildren();
 
 #if ENABLE(INSPECTOR)
@@ -3777,7 +3220,7 @@ void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String
         if (Frame* targetFrame = formState ? 0 : findFrameForNavigation(frameName))
             targetFrame->loader()->loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());
         else
-            checkNewWindowPolicy(action, workingResourceRequest, formState.release(), frameName);
+            policyChecker()->checkNewWindowPolicy(action, FrameLoader::callContinueLoadAfterNewWindowPolicy, workingResourceRequest, formState.release(), frameName, this);
     } else
         loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());    
 }
@@ -3785,7 +3228,7 @@ void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String
 unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& request, StoredCredentials storedCredentials, ResourceError& error, ResourceResponse& response, Vector<char>& data)
 {
     String referrer = m_outgoingReferrer;
-    if (shouldHideReferrer(request.url(), referrer))
+    if (SecurityOrigin::shouldHideReferrer(request.url(), referrer))
         referrer = String();
     
     ResourceRequest initialRequest = request;
@@ -3820,49 +3263,9 @@ unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& requ
         }
 #endif
     }
-    
-    sendRemainingDelegateMessages(identifier, response, data.size(), error);
-    return identifier;
-}
-
-void FrameLoader::assignIdentifierToInitialRequest(unsigned long identifier, const ResourceRequest& clientRequest)
-{
-    return dispatchAssignIdentifierToInitialRequest(identifier, activeDocumentLoader(), clientRequest);
-}
-
-void FrameLoader::willSendRequest(ResourceLoader* loader, ResourceRequest& clientRequest, const ResourceResponse& redirectResponse)
-{
-    applyUserAgent(clientRequest);
-    dispatchWillSendRequest(loader->documentLoader(), loader->identifier(), clientRequest, redirectResponse);
-}
-
-void FrameLoader::didReceiveResponse(ResourceLoader* loader, const ResourceResponse& r)
-{
-    activeDocumentLoader()->addResponse(r);
-    
-    if (Page* page = m_frame->page())
-        page->progress()->incrementProgress(loader->identifier(), r);
-    dispatchDidReceiveResponse(loader->documentLoader(), loader->identifier(), r);
-}
 
-void FrameLoader::didReceiveData(ResourceLoader* loader, const char* data, int length, int lengthReceived)
-{
-    if (Page* page = m_frame->page())
-        page->progress()->incrementProgress(loader->identifier(), data, length);
-    dispatchDidReceiveContentLength(loader->documentLoader(), loader->identifier(), lengthReceived);
-}
-
-void FrameLoader::didFailToLoad(ResourceLoader* loader, const ResourceError& error)
-{
-    if (Page* page = m_frame->page())
-        page->progress()->completeProgress(loader->identifier());
-    if (!error.isNull())
-        m_client->dispatchDidFailLoading(loader->documentLoader(), loader->identifier(), error);
-}
-
-void FrameLoader::didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
-{
-    m_client->dispatchDidLoadResourceByXMLHttpRequest(identifier, sourceString);
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, data.size(), error);
+    return identifier;
 }
 
 const ResourceRequest& FrameLoader::originalRequest() const
@@ -3876,7 +3279,7 @@ void FrameLoader::receivedMainResourceError(const ResourceError& error, bool isC
     RefPtr<Frame> protect(m_frame);
 
     RefPtr<DocumentLoader> loader = activeDocumentLoader();
-    
+
     if (isComplete) {
         // FIXME: Don't want to do this if an entirely new load is going, so should check
         // that both data sources on the frame are either this or nil.
@@ -3884,7 +3287,7 @@ void FrameLoader::receivedMainResourceError(const ResourceError& error, bool isC
         if (m_client->shouldFallBack(error))
             handleFallbackContent();
     }
-    
+
     if (m_state == FrameStateProvisional && m_provisionalDocumentLoader) {
         if (m_submittedFormURL == m_provisionalDocumentLoader->originalRequestCopy().url())
             m_submittedFormURL = KURL();
@@ -3892,7 +3295,7 @@ void FrameLoader::receivedMainResourceError(const ResourceError& error, bool isC
         // We might have made a page cache item, but now we're bailing out due to an error before we ever
         // transitioned to the new page (before WebFrameState == commit).  The goal here is to restore any state
         // so that the existing view (that wenever got far enough to replace) can continue being used.
-        invalidateCurrentItemCachedPage();
+        history()->invalidateCurrentItemCachedPage();
         
         // Call clientRedirectCancelledOrFinished here so that the frame load delegate is notified that the redirect's
         // status has changed, if there was a redirect. The frame load delegate may have saved some state about
@@ -3902,8 +3305,7 @@ void FrameLoader::receivedMainResourceError(const ResourceError& error, bool isC
         if (m_sentRedirectNotification)
             clientRedirectCancelledOrFinished(false);
     }
-    
-    
+
     loader->mainReceivedError(error, isComplete);
 }
 
@@ -3916,7 +3318,7 @@ void FrameLoader::callContinueFragmentScrollAfterNavigationPolicy(void* argument
 
 void FrameLoader::continueFragmentScrollAfterNavigationPolicy(const ResourceRequest& request, bool shouldContinue)
 {
-    bool isRedirect = m_quickRedirectComing || m_policyLoadType == FrameLoadTypeRedirectWithLockedBackForwardList;
+    bool isRedirect = m_quickRedirectComing || policyChecker()->loadType() == FrameLoadTypeRedirectWithLockedBackForwardList;
     m_quickRedirectComing = false;
 
     if (!shouldContinue)
@@ -3937,7 +3339,7 @@ void FrameLoader::continueFragmentScrollAfterNavigationPolicy(const ResourceRequ
         // we have already saved away the scroll and doc state for the long slow load,
         // but it's not an obvious case.
 
-        addHistoryItemForFragmentScroll();
+        history()->updateBackForwardListForFragmentScroll();
     }
     
     scrollToAnchor(url);
@@ -3972,101 +3374,6 @@ bool FrameLoader::shouldScrollToAnchor(bool isFormSubmission, FrameLoadType load
         && !m_frame->document()->isFrameSet();
 }
 
-void FrameLoader::checkNewWindowPolicy(const NavigationAction& action, const ResourceRequest& request,
-    PassRefPtr<FormState> formState, const String& frameName)
-{
-    m_policyCheck.set(request, formState, frameName,
-        callContinueLoadAfterNewWindowPolicy, this);
-    m_client->dispatchDecidePolicyForNewWindowAction(&FrameLoader::continueAfterNewWindowPolicy,
-        action, request, formState, frameName);
-}
-
-void FrameLoader::continueAfterNewWindowPolicy(PolicyAction policy)
-{
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-
-    switch (policy) {
-        case PolicyIgnore:
-            check.clearRequest();
-            break;
-        case PolicyDownload:
-            m_client->startDownload(check.request());
-            check.clearRequest();
-            break;
-        case PolicyUse:
-            break;
-    }
-
-    check.call(policy == PolicyUse);
-}
-
-void FrameLoader::checkNavigationPolicy(const ResourceRequest& request, DocumentLoader* loader,
-    PassRefPtr<FormState> formState, NavigationPolicyDecisionFunction function, void* argument)
-{
-    NavigationAction action = loader->triggeringAction();
-    if (action.isEmpty()) {
-        action = NavigationAction(request.url(), NavigationTypeOther);
-        loader->setTriggeringAction(action);
-    }
-        
-    // Don't ask more than once for the same request or if we are loading an empty URL.
-    // This avoids confusion on the part of the client.
-    if (equalIgnoringHeaderFields(request, loader->lastCheckedRequest()) || (!request.isNull() && request.url().isEmpty())) {
-        function(argument, request, 0, true);
-        loader->setLastCheckedRequest(request);
-        return;
-    }
-    
-    // We are always willing to show alternate content for unreachable URLs;
-    // treat it like a reload so it maintains the right state for b/f list.
-    if (loader->substituteData().isValid() && !loader->substituteData().failingURL().isEmpty()) {
-        if (isBackForwardLoadType(m_policyLoadType))
-            m_policyLoadType = FrameLoadTypeReload;
-        function(argument, request, 0, true);
-        return;
-    }
-    
-    loader->setLastCheckedRequest(request);
-
-    m_policyCheck.set(request, formState.get(), function, argument);
-
-    m_delegateIsDecidingNavigationPolicy = true;
-    m_client->dispatchDecidePolicyForNavigationAction(&FrameLoader::continueAfterNavigationPolicy,
-        action, request, formState);
-    m_delegateIsDecidingNavigationPolicy = false;
-}
-
-void FrameLoader::continueAfterNavigationPolicy(PolicyAction policy)
-{
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-
-    bool shouldContinue = policy == PolicyUse;
-    
-    switch (policy) {
-        case PolicyIgnore:
-            check.clearRequest();
-            break;
-        case PolicyDownload:
-            m_client->startDownload(check.request());
-            check.clearRequest();
-            break;
-        case PolicyUse: {
-            ResourceRequest request(check.request());
-            
-            if (!m_client->canHandleRequest(request)) {
-                handleUnimplementablePolicy(m_client->cannotShowURLError(check.request()));
-                check.clearRequest();
-                shouldContinue = false;
-            }
-            break;
-        }
-    }
-
-    check.call(shouldContinue);
-}
-
 void FrameLoader::callContinueLoadAfterNavigationPolicy(void* argument,
     const ResourceRequest& request, PassRefPtr<FormState> formState, bool shouldContinue)
 {
@@ -4081,7 +3388,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
     // through this method already, nested; otherwise, policyDataSource should still be set.
     ASSERT(m_policyDocumentLoader || !m_provisionalDocumentLoader->unreachableURL().isEmpty());
 
-    bool isTargetItem = m_provisionalHistoryItem ? m_provisionalHistoryItem->isTargetItem() : false;
+    bool isTargetItem = history()->provisionalItem() ? history()->provisionalItem()->isTargetItem() : false;
 
     // Two reasons we can't continue:
     //    1) Navigation policy delegate said we can't so request is nil. A primary case of this 
@@ -4101,10 +3408,10 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
         // If the navigation request came from the back/forward menu, and we punt on it, we have the 
         // problem that we have optimistically moved the b/f cursor already, so move it back.  For sanity, 
         // we only do this when punting a navigation for the target frame or top-level frame.  
-        if ((isTargetItem || isLoadingMainFrame()) && isBackForwardLoadType(m_policyLoadType))
+        if ((isTargetItem || isLoadingMainFrame()) && isBackForwardLoadType(policyChecker()->loadType()))
             if (Page* page = m_frame->page()) {
                 Frame* mainFrame = page->mainFrame();
-                if (HistoryItem* resetItem = mainFrame->loader()->m_currentHistoryItem.get()) {
+                if (HistoryItem* resetItem = mainFrame->loader()->history()->currentItem()) {
                     page->backForwardList()->goToItem(resetItem);
                     Settings* settings = m_frame->settings();
                     page->setGlobalHistoryItem((!settings || settings->privateBrowsingEnabled()) ? 0 : resetItem);
@@ -4113,7 +3420,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
         return;
     }
 
-    FrameLoadType type = m_policyLoadType;
+    FrameLoadType type = policyChecker()->loadType();
     stopAllLoaders();
     
     // <rdar://problem/6250856> - In certain circumstances on pages with multiple frames, stopAllLoaders()
@@ -4138,12 +3445,11 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
         return;
 
     if (formState)
-        m_client->dispatchWillSubmitForm(&FrameLoader::continueLoadAfterWillSubmitForm, formState);
+        m_client->dispatchWillSubmitForm(&PolicyChecker::continueLoadAfterWillSubmitForm, formState);
     else
         continueLoadAfterWillSubmitForm();
 }
 
-
 void FrameLoader::callContinueLoadAfterNewWindowPolicy(void* argument,
     const ResourceRequest& request, PassRefPtr<FormState> formState, const String& frameName, bool shouldContinue)
 {
@@ -4165,26 +3471,13 @@ void FrameLoader::continueLoadAfterNewWindowPolicy(const ResourceRequest& reques
     if (frameName != "_blank")
         mainFrame->tree()->setName(frameName);
 
-    mainFrame->loader()->setOpenedByDOM();
+    mainFrame->page()->setOpenedByDOM();
     mainFrame->loader()->m_client->dispatchShow();
-    mainFrame->loader()->setOpener(frame.get());
+    if (!m_suppressOpenerInNewFrame)
+        mainFrame->loader()->setOpener(frame.get());
     mainFrame->loader()->loadWithNavigationAction(request, NavigationAction(), false, FrameLoadTypeStandard, formState);
 }
 
-void FrameLoader::sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse& response, int length, const ResourceError& error)
-{    
-    if (!response.isNull())
-        dispatchDidReceiveResponse(m_documentLoader.get(), identifier, response);
-    
-    if (length > 0)
-        dispatchDidReceiveContentLength(m_documentLoader.get(), identifier, length);
-    
-    if (error.isNull())
-        dispatchDidFinishLoading(m_documentLoader.get(), identifier);
-    else
-        m_client->dispatchDidFailLoading(m_documentLoader.get(), identifier, error);
-}
-
 void FrameLoader::requestFromDelegate(ResourceRequest& request, unsigned long& identifier, ResourceError& error)
 {
     ASSERT(!request.isNull());
@@ -4192,11 +3485,11 @@ void FrameLoader::requestFromDelegate(ResourceRequest& request, unsigned long& i
     identifier = 0;
     if (Page* page = m_frame->page()) {
         identifier = page->progress()->createUniqueIdentifier();
-        dispatchAssignIdentifierToInitialRequest(identifier, m_documentLoader.get(), request);
+        notifier()->assignIdentifierToInitialRequest(identifier, m_documentLoader.get(), request);
     }
 
     ResourceRequest newRequest(request);
-    dispatchWillSendRequest(m_documentLoader.get(), identifier, newRequest, ResourceResponse());
+    notifier()->dispatchWillSendRequest(m_documentLoader.get(), identifier, newRequest, ResourceResponse());
 
     if (newRequest.isNull())
         error = cancelledError(request);
@@ -4234,7 +3527,7 @@ void FrameLoader::loadedResourceFromMemoryCache(const CachedResource* resource)
     unsigned long identifier;
     ResourceError error;
     requestFromDelegate(request, identifier, error);
-    sendRemainingDelegateMessages(identifier, resource->response(), resource->encodedSize(), error);
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, resource->response(), resource->encodedSize(), error);
 }
 
 void FrameLoader::applyUserAgent(ResourceRequest& request)
@@ -4262,34 +3555,9 @@ bool FrameLoader::shouldInterruptLoadForXFrameOptions(const String& content, con
     return false;
 }
 
-bool FrameLoader::canGoBackOrForward(int distance) const
-{
-    if (Page* page = m_frame->page()) {
-        if (distance == 0)
-            return true;
-        if (distance > 0 && distance <= page->backForwardList()->forwardListCount())
-            return true;
-        if (distance < 0 && -distance <= page->backForwardList()->backListCount())
-            return true;
-    }
-    return false;
-}
-
-int FrameLoader::getHistoryLength()
-{
-    if (Page* page = m_frame->page())
-        return page->backForwardList()->backListCount() + 1;
-    return 0;
-}
-
-void FrameLoader::addHistoryItemForFragmentScroll()
-{
-    addBackForwardItemClippedAtTarget(false);
-}
-
 bool FrameLoader::loadProvisionalItemFromCachedPage()
 {
-    RefPtr<CachedPage> cachedPage = pageCache()->get(m_provisionalHistoryItem.get());
+    RefPtr<CachedPage> cachedPage = pageCache()->get(history()->provisionalItem());
     if (!cachedPage || !cachedPage->document())
         return false;
 
@@ -4333,119 +3601,21 @@ void FrameLoader::pageHidden()
 
 bool FrameLoader::shouldTreatURLAsSameAsCurrent(const KURL& url) const
 {
-    if (!m_currentHistoryItem)
+    if (!history()->currentItem())
         return false;
-    return url == m_currentHistoryItem->url() || url == m_currentHistoryItem->originalURL();
-}
-
-PassRefPtr<HistoryItem> FrameLoader::createHistoryItem(bool useOriginal)
-{
-    DocumentLoader* docLoader = documentLoader();
-    
-    KURL unreachableURL = docLoader ? docLoader->unreachableURL() : KURL();
-    
-    KURL url;
-    KURL originalURL;
-
-    if (!unreachableURL.isEmpty()) {
-        url = unreachableURL;
-        originalURL = unreachableURL;
-    } else {
-        originalURL = docLoader ? docLoader->originalURL() : KURL();
-        if (useOriginal)
-            url = originalURL;
-        else if (docLoader)
-            url = docLoader->requestURL();
-    }
-
-    LOG(History, "WebCoreHistory: Creating item for %s", url.string().ascii().data());
-    
-    // Frames that have never successfully loaded any content
-    // may have no URL at all. Currently our history code can't
-    // deal with such things, so we nip that in the bud here.
-    // Later we may want to learn to live with nil for URL.
-    // See bug 3368236 and related bugs for more information.
-    if (url.isEmpty()) 
-        url = blankURL();
-    if (originalURL.isEmpty())
-        originalURL = blankURL();
-    
-    Frame* parentFrame = m_frame->tree()->parent();
-    String parent = parentFrame ? parentFrame->tree()->name() : "";
-    String title = docLoader ? docLoader->title() : "";
-
-    RefPtr<HistoryItem> item = HistoryItem::create(url, m_frame->tree()->name(), parent, title);
-    item->setOriginalURLString(originalURL.string());
-
-    if (!unreachableURL.isEmpty() || !docLoader || docLoader->response().httpStatusCode() >= 400)
-        item->setLastVisitWasFailure(true);
-
-    // Save form state if this is a POST
-    if (docLoader) {
-        if (useOriginal)
-            item->setFormInfoFromRequest(docLoader->originalRequest());
-        else
-            item->setFormInfoFromRequest(docLoader->request());
-    }
-    
-    // Set the item for which we will save document state
-    m_previousHistoryItem = m_currentHistoryItem;
-    m_currentHistoryItem = item;
-    
-    return item.release();
+    return url == history()->currentItem()->url() || url == history()->currentItem()->originalURL();
 }
 
-void FrameLoader::addBackForwardItemClippedAtTarget(bool doClip)
+void FrameLoader::checkDidPerformFirstNavigation()
 {
-    // In the case of saving state about a page with frames, we store a tree of items that mirrors the frame tree.  
-    // The item that was the target of the user's navigation is designated as the "targetItem".  
-    // When this function is called with doClip=true we're able to create the whole tree except for the target's children, 
-    // which will be loaded in the future. That part of the tree will be filled out as the child loads are committed.
-
     Page* page = m_frame->page();
     if (!page)
         return;
 
-    if (documentLoader()->urlForHistory().isEmpty())
-        return;
-
-    Frame* mainFrame = page->mainFrame();
-    ASSERT(mainFrame);
-    FrameLoader* frameLoader = mainFrame->loader();
-
-    if (!frameLoader->m_didPerformFirstNavigation && page->backForwardList()->entries().size() == 1) {
-        frameLoader->m_didPerformFirstNavigation = true;
+    if (!m_didPerformFirstNavigation && page->backForwardList()->entries().size() == 1) {
+        m_didPerformFirstNavigation = true;
         m_client->didPerformFirstNavigation();
     }
-
-    RefPtr<HistoryItem> item = frameLoader->createHistoryItemTree(m_frame, doClip);
-    LOG(BackForward, "WebCoreBackForward - Adding backforward item %p for frame %s", item.get(), documentLoader()->url().string().ascii().data());
-    page->backForwardList()->addItem(item);
-}
-
-PassRefPtr<HistoryItem> FrameLoader::createHistoryItemTree(Frame* targetFrame, bool clipAtTarget)
-{
-    RefPtr<HistoryItem> bfItem = createHistoryItem(m_frame->tree()->parent() ? true : false);
-    if (m_previousHistoryItem)
-        saveScrollPositionAndViewStateToItem(m_previousHistoryItem.get());
-    if (!(clipAtTarget && m_frame == targetFrame)) {
-        // save frame state for items that aren't loading (khtml doesn't save those)
-        saveDocumentState();
-        for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling()) {
-            FrameLoader* childLoader = child->loader();
-            bool hasChildLoaded = childLoader->frameHasLoaded();
-            
-            // If the child is a frame corresponding to an <object> element that never loaded,
-            // we don't want to create a history item, because that causes fallback content
-            // to be ignored on reload.
-            
-            if (!(!hasChildLoaded && childLoader->isHostedByObjectElement()))
-                bfItem->addChildItem(childLoader->createHistoryItemTree(targetFrame, clipAtTarget));
-        }
-    }
-    if (m_frame == targetFrame)
-        bfItem->setIsTargetItem(true);
-    return bfItem;
 }
 
 Frame* FrameLoader::findFrameForNavigation(const AtomicString& name)
@@ -4456,100 +3626,10 @@ Frame* FrameLoader::findFrameForNavigation(const AtomicString& name)
     return frame;
 }
 
-void FrameLoader::saveScrollPositionAndViewStateToItem(HistoryItem* item)
-{
-    if (!item || !m_frame->view())
-        return;
-        
-    item->setScrollPoint(m_frame->view()->scrollPosition());
-    // FIXME: It would be great to work out a way to put this code in WebCore instead of calling through to the client.
-    m_client->saveViewStateToItem(item);
-}
-
-/*
- There is a race condition between the layout and load completion that affects restoring the scroll position.
- We try to restore the scroll position at both the first layout and upon load completion.
- 
- 1) If first layout happens before the load completes, we want to restore the scroll position then so that the
- first time we draw the page is already scrolled to the right place, instead of starting at the top and later
- jumping down.  It is possible that the old scroll position is past the part of the doc laid out so far, in
- which case the restore silent fails and we will fix it in when we try to restore on doc completion.
- 2) If the layout happens after the load completes, the attempt to restore at load completion time silently
- fails.  We then successfully restore it when the layout happens.
-*/
-void FrameLoader::restoreScrollPositionAndViewState()
-{
-    if (!m_committedFirstRealDocumentLoad)
-        return;
-
-    ASSERT(m_currentHistoryItem);
-    
-    // FIXME: As the ASSERT attests, it seems we should always have a currentItem here.
-    // One counterexample is <rdar://problem/4917290>
-    // For now, to cover this issue in release builds, there is no technical harm to returning
-    // early and from a user standpoint - as in the above radar - the previous page load failed 
-    // so there *is* no scroll or view state to restore!
-    if (!m_currentHistoryItem)
-        return;
-    
-    // FIXME: It would be great to work out a way to put this code in WebCore instead of calling
-    // through to the client. It's currently used only for the PDF view on Mac.
-    m_client->restoreViewState();
-    
-    if (FrameView* view = m_frame->view())
-        if (!view->wasScrolledByUser())
-            view->setScrollPosition(m_currentHistoryItem->scrollPoint());
-}
-
-void FrameLoader::invalidateCurrentItemCachedPage()
-{
-    // When we are pre-commit, the currentItem is where the pageCache data resides    
-    CachedPage* cachedPage = pageCache()->get(m_currentHistoryItem.get());
-
-    // FIXME: This is a grotesque hack to fix <rdar://problem/4059059> Crash in RenderFlow::detach
-    // Somehow the PageState object is not properly updated, and is holding onto a stale document.
-    // Both Xcode and FileMaker see this crash, Safari does not.
-    
-    ASSERT(!cachedPage || cachedPage->document() == m_frame->document());
-    if (cachedPage && cachedPage->document() == m_frame->document()) {
-        cachedPage->document()->setInPageCache(false);
-        cachedPage->clear();
-    }
-    
-    if (cachedPage)
-        pageCache()->remove(m_currentHistoryItem.get());
-}
-
-void FrameLoader::saveDocumentState()
-{
-    if (m_creatingInitialEmptyDocument)
-        return;
-
-    // For a standard page load, we will have a previous item set, which will be used to
-    // store the form state.  However, in some cases we will have no previous item, and
-    // the current item is the right place to save the state.  One example is when we
-    // detach a bunch of frames because we are navigating from a site with frames to
-    // another site.  Another is when saving the frame state of a frame that is not the
-    // target of the current navigation (if we even decide to save with that granularity).
-
-    // Because of previousItem's "masking" of currentItem for this purpose, it's important
-    // that previousItem be cleared at the end of a page transition.  We leverage the
-    // checkLoadComplete recursion to achieve this goal.
-
-    HistoryItem* item = m_previousHistoryItem ? m_previousHistoryItem.get() : m_currentHistoryItem.get();
-    if (!item)
-        return;
-
-    Document* document = m_frame->document();
-    ASSERT(document);
-    
-    if (item->isCurrentDocument(document)) {
-        LOG(Loading, "WebCoreLoading %s: saving form state to %p", m_frame->tree()->name().string().utf8().data(), item);
-        item->setDocumentState(document->formElementsState());
-    }
-}
-
 // Loads content into this frame, as specified by history item
+// FIXME: This function should really be split into a couple pieces, some of
+// which should be methods of HistoryController and some of which should be
+// methods of FrameLoader.
 void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
 {
     if (!m_frame->page())
@@ -4568,7 +3648,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
     // check for all that as an additional optimization.
     // We also do not do anchor-style navigation if we're posting a form or navigating from
     // a page that was resulted from a form post.
-    bool shouldScroll = !formData && !(m_currentHistoryItem && m_currentHistoryItem->formData()) && urlsMatchItem(item);
+    bool shouldScroll = !formData && !(history()->currentItem() && history()->currentItem()->formData()) && history()->urlsMatchItem(item);
 
 #if ENABLE(WML)
     // All WML decks should go through the real load mechanism, not the scroll-to-anchor code
@@ -4578,12 +3658,12 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
 
     if (shouldScroll) {
         // Must do this maintenance here, since we don't go through a real page reload
-        saveScrollPositionAndViewStateToItem(m_currentHistoryItem.get());
+        history()->saveScrollPositionAndViewStateToItem(history()->currentItem());
 
         if (FrameView* view = m_frame->view())
             view->setWasScrolledByUser(false);
 
-        m_currentHistoryItem = item;
+        history()->setCurrentItem(item);
 
         // FIXME: Form state might need to be saved here too.
 
@@ -4592,7 +3672,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
         scrollToAnchor(item->url());
     
         // must do this maintenance here, since we don't go through a real page reload
-        restoreScrollPositionAndViewState();
+        history()->restoreScrollPositionAndViewState();
         
         // Fake the URL change by updating the data source's request.  This will no longer
         // be necessary if we do the better fix described above.
@@ -4604,7 +3684,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
         m_client->didFinishLoad();
     } else {
         // Remember this item so we can traverse any child items as child frames load
-        m_provisionalHistoryItem = item;
+        history()->setProvisionalItem(item);
 
         bool inPageCache = false;
         
@@ -4621,7 +3701,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
                 loadWithDocumentLoader(cachedPage->documentLoader(), loadType, 0);   
                 inPageCache = true;
             } else {
-                LOG(PageCache, "Not restoring page for %s from back/forward cache because cache entry has expired", m_provisionalHistoryItem->url().string().ascii().data());
+                LOG(PageCache, "Not restoring page for %s from back/forward cache because cache entry has expired", history()->provisionalItem()->url().string().ascii().data());
                 pageCache()->remove(item);
             }
         }
@@ -4696,322 +3776,6 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
     }
 }
 
-// Walk the frame tree and ensure that the URLs match the URLs in the item.
-bool FrameLoader::urlsMatchItem(HistoryItem* item) const
-{
-    const KURL& currentURL = documentLoader()->url();
-    if (!equalIgnoringFragmentIdentifier(currentURL, item->url()))
-        return false;
-
-    const HistoryItemVector& childItems = item->children();
-
-    unsigned size = childItems.size();
-    for (unsigned i = 0; i < size; ++i) {
-        Frame* childFrame = m_frame->tree()->child(childItems[i]->target());
-        if (childFrame && !childFrame->loader()->urlsMatchItem(childItems[i].get()))
-            return false;
-    }
-
-    return true;
-}
-
-// Main funnel for navigating to a previous location (back/forward, non-search snap-back)
-// This includes recursion to handle loading into framesets properly
-void FrameLoader::goToItem(HistoryItem* targetItem, FrameLoadType type)
-{
-    ASSERT(!m_frame->tree()->parent());
-    
-    // shouldGoToHistoryItem is a private delegate method. This is needed to fix:
-    // <rdar://problem/3951283> can view pages from the back/forward cache that should be disallowed by Parental Controls
-    // Ultimately, history item navigations should go through the policy delegate. That's covered in:
-    // <rdar://problem/3979539> back/forward cache navigations should consult policy delegate
-    Page* page = m_frame->page();
-    if (!page)
-        return;
-    if (!m_client->shouldGoToHistoryItem(targetItem))
-        return;
-
-    // Set the BF cursor before commit, which lets the user quickly click back/forward again.
-    // - plus, it only makes sense for the top level of the operation through the frametree,
-    // as opposed to happening for some/one of the page commits that might happen soon
-    BackForwardList* bfList = page->backForwardList();
-    HistoryItem* currentItem = bfList->currentItem();    
-    bfList->goToItem(targetItem);
-    Settings* settings = m_frame->settings();
-    page->setGlobalHistoryItem((!settings || settings->privateBrowsingEnabled()) ? 0 : targetItem);
-    recursiveGoToItem(targetItem, currentItem, type);
-}
-
-// The general idea here is to traverse the frame tree and the item tree in parallel,
-// tracking whether each frame already has the content the item requests.  If there is
-// a match (by URL), we just restore scroll position and recurse.  Otherwise we must
-// reload that frame, and all its kids.
-void FrameLoader::recursiveGoToItem(HistoryItem* item, HistoryItem* fromItem, FrameLoadType type)
-{
-    ASSERT(item);
-    ASSERT(fromItem);
-    
-    KURL itemURL = item->url();
-    KURL currentURL;
-    if (documentLoader())
-        currentURL = documentLoader()->url();
-    
-    // Always reload the target frame of the item we're going to.  This ensures that we will
-    // do -some- load for the transition, which means a proper notification will be posted
-    // to the app.
-    // The exact URL has to match, including fragment.  We want to go through the _load
-    // method, even if to do a within-page navigation.
-    // The current frame tree and the frame tree snapshot in the item have to match.
-    if (!item->isTargetItem() &&
-        itemURL == currentURL &&
-        ((m_frame->tree()->name().isEmpty() && item->target().isEmpty()) || m_frame->tree()->name() == item->target()) &&
-        childFramesMatchItem(item))
-    {
-        // This content is good, so leave it alone and look for children that need reloading
-        // Save form state (works from currentItem, since prevItem is nil)
-        ASSERT(!m_previousHistoryItem);
-        saveDocumentState();
-        saveScrollPositionAndViewStateToItem(m_currentHistoryItem.get());
-
-        if (FrameView* view = m_frame->view())
-            view->setWasScrolledByUser(false);
-
-        m_currentHistoryItem = item;
-                
-        // Restore form state (works from currentItem)
-        restoreDocumentState();
-        
-        // Restore the scroll position (we choose to do this rather than going back to the anchor point)
-        restoreScrollPositionAndViewState();
-        
-        const HistoryItemVector& childItems = item->children();
-        
-        int size = childItems.size();
-        for (int i = 0; i < size; ++i) {
-            String childFrameName = childItems[i]->target();
-            HistoryItem* fromChildItem = fromItem->childItemWithTarget(childFrameName);
-            ASSERT(fromChildItem || fromItem->isTargetItem());
-            Frame* childFrame = m_frame->tree()->child(childFrameName);
-            ASSERT(childFrame);
-            childFrame->loader()->recursiveGoToItem(childItems[i].get(), fromChildItem, type);
-        }
-    } else {
-        loadItem(item, type);
-    }
-}
-
-// helper method that determines whether the subframes described by the item's subitems
-// match our own current frameset
-bool FrameLoader::childFramesMatchItem(HistoryItem* item) const
-{
-    const HistoryItemVector& childItems = item->children();
-    if (childItems.size() != m_frame->tree()->childCount())
-        return false;
-    
-    unsigned size = childItems.size();
-    for (unsigned i = 0; i < size; ++i) {
-        if (!m_frame->tree()->child(childItems[i]->target()))
-            return false;
-    }
-    
-    // Found matches for all item targets
-    return true;
-}
-
-// There are 3 things you might think of as "history", all of which are handled by these functions.
-//
-//     1) Back/forward: The m_currentHistoryItem is part of this mechanism.
-//     2) Global history: Handled by the client.
-//     3) Visited links: Handled by the PageGroup.
-
-void FrameLoader::updateHistoryForStandardLoad()
-{
-    LOG(History, "WebCoreHistory: Updating History for Standard Load in frame %s", documentLoader()->url().string().ascii().data());
-
-    Settings* settings = m_frame->settings();
-    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
-    const KURL& historyURL = documentLoader()->urlForHistory();
-
-    if (!documentLoader()->isClientRedirect()) {
-        if (!historyURL.isEmpty()) {
-            addBackForwardItemClippedAtTarget(true);
-            if (!needPrivacy) {
-                m_client->updateGlobalHistory();
-                m_documentLoader->setDidCreateGlobalHistoryEntry(true);
-                if (m_documentLoader->unreachableURL().isEmpty())
-                    m_client->updateGlobalHistoryRedirectLinks();
-            }
-            if (Page* page = m_frame->page())
-                page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
-        }
-    } else if (documentLoader()->unreachableURL().isEmpty() && m_currentHistoryItem) {
-        m_currentHistoryItem->setURL(documentLoader()->url());
-        m_currentHistoryItem->setFormInfoFromRequest(documentLoader()->request());
-    }
-
-    if (!historyURL.isEmpty() && !needPrivacy) {
-        if (Page* page = m_frame->page())
-            page->group().addVisitedLink(historyURL);
-
-        if (!m_documentLoader->didCreateGlobalHistoryEntry() && documentLoader()->unreachableURL().isEmpty() && !url().isEmpty())
-            m_client->updateGlobalHistoryRedirectLinks();
-    }
-}
-
-void FrameLoader::updateHistoryForClientRedirect()
-{
-#if !LOG_DISABLED
-    if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for client redirect in frame %s", documentLoader()->title().utf8().data());
-#endif
-
-    // Clear out form data so we don't try to restore it into the incoming page.  Must happen after
-    // webcore has closed the URL and saved away the form state.
-    if (m_currentHistoryItem) {
-        m_currentHistoryItem->clearDocumentState();
-        m_currentHistoryItem->clearScrollPoint();
-    }
-
-    Settings* settings = m_frame->settings();
-    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
-    const KURL& historyURL = documentLoader()->urlForHistory();
-
-    if (!historyURL.isEmpty() && !needPrivacy) {
-        if (Page* page = m_frame->page())
-            page->group().addVisitedLink(historyURL);
-    }
-}
-
-void FrameLoader::updateHistoryForBackForwardNavigation()
-{
-#if !LOG_DISABLED
-    if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for back/forward navigation in frame %s", documentLoader()->title().utf8().data());
-#endif
-
-    // Must grab the current scroll position before disturbing it
-    saveScrollPositionAndViewStateToItem(m_previousHistoryItem.get());
-}
-
-void FrameLoader::updateHistoryForReload()
-{
-#if !LOG_DISABLED
-    if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for reload in frame %s", documentLoader()->title().utf8().data());
-#endif
-
-    if (m_currentHistoryItem) {
-        pageCache()->remove(m_currentHistoryItem.get());
-    
-        if (loadType() == FrameLoadTypeReload || loadType() == FrameLoadTypeReloadFromOrigin)
-            saveScrollPositionAndViewStateToItem(m_currentHistoryItem.get());
-    
-        // Sometimes loading a page again leads to a different result because of cookies. Bugzilla 4072
-        if (documentLoader()->unreachableURL().isEmpty())
-            m_currentHistoryItem->setURL(documentLoader()->requestURL());
-    }
-}
-
-void FrameLoader::updateHistoryForRedirectWithLockedBackForwardList()
-{
-#if !LOG_DISABLED
-    if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for redirect load in frame %s", documentLoader()->title().utf8().data());
-#endif
-    
-    Settings* settings = m_frame->settings();
-    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
-    const KURL& historyURL = documentLoader()->urlForHistory();
-
-    if (documentLoader()->isClientRedirect()) {
-        if (!m_currentHistoryItem && !m_frame->tree()->parent()) {
-            if (!historyURL.isEmpty()) {
-                addBackForwardItemClippedAtTarget(true);
-                if (!needPrivacy) {
-                    m_client->updateGlobalHistory();
-                    m_documentLoader->setDidCreateGlobalHistoryEntry(true);
-                    if (m_documentLoader->unreachableURL().isEmpty())
-                        m_client->updateGlobalHistoryRedirectLinks();
-                }
-                if (Page* page = m_frame->page())
-                    page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
-            }
-        }
-        if (m_currentHistoryItem) {
-            m_currentHistoryItem->setURL(documentLoader()->url());
-            m_currentHistoryItem->setFormInfoFromRequest(documentLoader()->request());
-        }
-    } else {
-        Frame* parentFrame = m_frame->tree()->parent();
-        if (parentFrame && parentFrame->loader()->m_currentHistoryItem)
-            parentFrame->loader()->m_currentHistoryItem->setChildItem(createHistoryItem(true));
-    }
-
-    if (!historyURL.isEmpty() && !needPrivacy) {
-        if (Page* page = m_frame->page())
-            page->group().addVisitedLink(historyURL);
-
-        if (!m_documentLoader->didCreateGlobalHistoryEntry() && documentLoader()->unreachableURL().isEmpty() && !url().isEmpty())
-            m_client->updateGlobalHistoryRedirectLinks();
-    }
-}
-
-void FrameLoader::updateHistoryForCommit()
-{
-#if !LOG_DISABLED
-    if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for commit in frame %s", documentLoader()->title().utf8().data());
-#endif
-    FrameLoadType type = loadType();
-    if (isBackForwardLoadType(type) ||
-        ((type == FrameLoadTypeReload || type == FrameLoadTypeReloadFromOrigin) && !provisionalDocumentLoader()->unreachableURL().isEmpty())) {
-        // Once committed, we want to use current item for saving DocState, and
-        // the provisional item for restoring state.
-        // Note previousItem must be set before we close the URL, which will
-        // happen when the data source is made non-provisional below
-        m_previousHistoryItem = m_currentHistoryItem;
-        ASSERT(m_provisionalHistoryItem);
-        m_currentHistoryItem = m_provisionalHistoryItem;
-        m_provisionalHistoryItem = 0;
-    }
-}
-
-void FrameLoader::updateHistoryForAnchorScroll()
-{
-    if (m_URL.isEmpty())
-        return;
-
-    Settings* settings = m_frame->settings();
-    if (!settings || settings->privateBrowsingEnabled())
-        return;
-
-    Page* page = m_frame->page();
-    if (!page)
-        return;
-
-    page->group().addVisitedLink(m_URL);
-}
-
-// Walk the frame tree, telling all frames to save their form state into their current
-// history item.
-void FrameLoader::saveDocumentAndScrollState()
-{
-    for (Frame* frame = m_frame; frame; frame = frame->tree()->traverseNext(m_frame)) {
-        frame->loader()->saveDocumentState();
-        frame->loader()->saveScrollPositionAndViewStateToItem(frame->loader()->currentHistoryItem());
-    }
-}
-
-HistoryItem* FrameLoader::currentHistoryItem()
-{
-    return m_currentHistoryItem.get();
-}
-
-void FrameLoader::setCurrentHistoryItem(PassRefPtr<HistoryItem> item)
-{
-    m_currentHistoryItem = item;
-}
-
 void FrameLoader::setMainDocumentError(DocumentLoader* loader, const ResourceError& error)
 {
     m_client->setMainDocumentError(loader, error);
@@ -5053,116 +3817,11 @@ ResourceError FrameLoader::fileDoesNotExistError(const ResourceResponse& respons
     return m_client->fileDoesNotExistError(response);    
 }
 
-void FrameLoader::didFinishLoad(ResourceLoader* loader)
-{    
-    if (Page* page = m_frame->page())
-        page->progress()->completeProgress(loader->identifier());
-    dispatchDidFinishLoading(loader->documentLoader(), loader->identifier());
-}
-
 bool FrameLoader::shouldUseCredentialStorage(ResourceLoader* loader)
 {
     return m_client->shouldUseCredentialStorage(loader->documentLoader(), loader->identifier());
 }
 
-void FrameLoader::didReceiveAuthenticationChallenge(ResourceLoader* loader, const AuthenticationChallenge& currentWebChallenge)
-{
-    m_client->dispatchDidReceiveAuthenticationChallenge(loader->documentLoader(), loader->identifier(), currentWebChallenge);
-}
-
-void FrameLoader::didCancelAuthenticationChallenge(ResourceLoader* loader, const AuthenticationChallenge& currentWebChallenge)
-{
-    m_client->dispatchDidCancelAuthenticationChallenge(loader->documentLoader(), loader->identifier(), currentWebChallenge);
-}
-
-PolicyCheck::PolicyCheck()
-    : m_navigationFunction(0)
-    , m_newWindowFunction(0)
-    , m_contentFunction(0)
-{
-}
-
-void PolicyCheck::clear()
-{
-    clearRequest();
-    m_navigationFunction = 0;
-    m_newWindowFunction = 0;
-    m_contentFunction = 0;
-}
-
-void PolicyCheck::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
-    NavigationPolicyDecisionFunction function, void* argument)
-{
-    m_request = request;
-    m_formState = formState;
-    m_frameName = String();
-
-    m_navigationFunction = function;
-    m_newWindowFunction = 0;
-    m_contentFunction = 0;
-    m_argument = argument;
-}
-
-void PolicyCheck::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
-    const String& frameName, NewWindowPolicyDecisionFunction function, void* argument)
-{
-    m_request = request;
-    m_formState = formState;
-    m_frameName = frameName;
-
-    m_navigationFunction = 0;
-    m_newWindowFunction = function;
-    m_contentFunction = 0;
-    m_argument = argument;
-}
-
-void PolicyCheck::set(ContentPolicyDecisionFunction function, void* argument)
-{
-    m_request = ResourceRequest();
-    m_formState = 0;
-    m_frameName = String();
-
-    m_navigationFunction = 0;
-    m_newWindowFunction = 0;
-    m_contentFunction = function;
-    m_argument = argument;
-}
-
-void PolicyCheck::call(bool shouldContinue)
-{
-    if (m_navigationFunction)
-        m_navigationFunction(m_argument, m_request, m_formState.get(), shouldContinue);
-    if (m_newWindowFunction)
-        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, shouldContinue);
-    ASSERT(!m_contentFunction);
-}
-
-void PolicyCheck::call(PolicyAction action)
-{
-    ASSERT(!m_navigationFunction);
-    ASSERT(!m_newWindowFunction);
-    ASSERT(m_contentFunction);
-    m_contentFunction(m_argument, action);
-}
-
-void PolicyCheck::clearRequest()
-{
-    m_request = ResourceRequest();
-    m_formState = 0;
-    m_frameName = String();
-}
-
-void PolicyCheck::cancel()
-{
-    clearRequest();
-    if (m_navigationFunction)
-        m_navigationFunction(m_argument, m_request, m_formState.get(), false);
-    if (m_newWindowFunction)
-        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, false);
-    if (m_contentFunction)
-        m_contentFunction(m_argument, PolicyIgnore);
-}
-
 void FrameLoader::setTitle(const String& title)
 {
     documentLoader()->setTitle(title);
@@ -5219,7 +3878,7 @@ PassRefPtr<Widget> FrameLoader::createJavaAppletWidget(const IntSize& size, HTML
 
     if (!codeBaseURLString.isEmpty()) {
         KURL codeBaseURL = completeURL(codeBaseURLString);
-        if (!canLoad(codeBaseURL, String(), element->document())) {
+        if (!SecurityOrigin::canLoad(codeBaseURL, String(), element->document())) {
             FrameLoader::reportLocalLoadFailed(m_frame, codeBaseURL.string());
             return 0;
         }
@@ -5243,8 +3902,7 @@ void FrameLoader::didChangeTitle(DocumentLoader* loader)
 
     if (loader == m_documentLoader) {
         // Must update the entries in the back-forward list too.
-        if (m_currentHistoryItem)
-            m_currentHistoryItem->setTitle(loader->title());
+        history()->setCurrentItemTitle(loader->title());
         // This must go through the WebFrame because it has the right notion of the current b/f item.
         m_client->setTitle(loader->title(), loader->urlForHistory());
         m_client->setMainFrameDocumentReady(true); // update observers with new DOMDocument
@@ -5269,63 +3927,6 @@ void FrameLoader::dispatchDidCommitLoad()
 #endif
 }
 
-void FrameLoader::dispatchAssignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
-{
-    m_client->assignIdentifierToInitialRequest(identifier, loader, request);
-
-#if ENABLE(INSPECTOR)
-    if (Page* page = m_frame->page())
-        page->inspectorController()->identifierForInitialRequest(identifier, loader, request);
-#endif
-}
-
-void FrameLoader::dispatchWillSendRequest(DocumentLoader* loader, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
-{
-    StringImpl* oldRequestURL = request.url().string().impl();
-    m_documentLoader->didTellClientAboutLoad(request.url());
-
-    m_client->dispatchWillSendRequest(loader, identifier, request, redirectResponse);
-
-    // If the URL changed, then we want to put that new URL in the "did tell client" set too.
-    if (!request.isNull() && oldRequestURL != request.url().string().impl())
-        m_documentLoader->didTellClientAboutLoad(request.url());
-
-#if ENABLE(INSPECTOR)
-    if (Page* page = m_frame->page())
-        page->inspectorController()->willSendRequest(loader, identifier, request, redirectResponse);
-#endif
-}
-
-void FrameLoader::dispatchDidReceiveResponse(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
-{
-    m_client->dispatchDidReceiveResponse(loader, identifier, r);
-
-#if ENABLE(INSPECTOR)
-    if (Page* page = m_frame->page())
-        page->inspectorController()->didReceiveResponse(loader, identifier, r);
-#endif
-}
-
-void FrameLoader::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int length)
-{
-    m_client->dispatchDidReceiveContentLength(loader, identifier, length);
-
-#if ENABLE(INSPECTOR)
-    if (Page* page = m_frame->page())
-        page->inspectorController()->didReceiveContentLength(loader, identifier, length);
-#endif
-}
-
-void FrameLoader::dispatchDidFinishLoading(DocumentLoader* loader, unsigned long identifier)
-{
-    m_client->dispatchDidFinishLoading(loader, identifier);
-
-#if ENABLE(INSPECTOR)
-    if (Page* page = m_frame->page())
-        page->inspectorController()->didFinishLoading(loader, identifier);
-#endif
-}
-
 void FrameLoader::tellClientAboutPastMemoryCacheLoads()
 {
     ASSERT(m_frame->page());
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
index 4b4959b358..bf0eebc8c5 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
@@ -32,6 +32,11 @@
 
 #include "CachePolicy.h"
 #include "FrameLoaderTypes.h"
+#include "HistoryController.h"
+#include "PolicyCallback.h"
+#include "PolicyChecker.h"
+#include "RedirectScheduler.h"
+#include "ResourceLoadNotifier.h"
 #include "ResourceRequest.h"
 #include "ThreadableLoader.h"
 #include "Timer.h"
@@ -39,603 +44,465 @@
 
 namespace WebCore {
 
-    class Archive;
-    class AuthenticationChallenge;
-    class CachedFrameBase;
-    class CachedPage;
-    class CachedResource;
-    class Document;
-    class DocumentLoader;
-    class Event;
-    class FormData;
-    class FormState;
-    class Frame;
-    class FrameLoaderClient;
-    class HistoryItem;
-    class HTMLAppletElement;
-    class HTMLFormElement;
-    class HTMLFrameOwnerElement;
-    class IconLoader;
-    class IntSize;
-    class NavigationAction;
-    class RenderPart;
-    class ResourceError;
-    class ResourceLoader;
-    class ResourceResponse;
-    class ScriptSourceCode;
-    class ScriptString;
-    class ScriptValue;
-    class SecurityOrigin;
-    class SharedBuffer;
-    class SubstituteData;
-    class TextResourceDecoder;
-    class Widget;
-
-    struct FrameLoadRequest;
-    struct ScheduledRedirection;
-    struct WindowFeatures;
-
-    bool isBackForwardLoadType(FrameLoadType);
-
-    typedef void (*NavigationPolicyDecisionFunction)(void* argument,
-        const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
-    typedef void (*NewWindowPolicyDecisionFunction)(void* argument,
-        const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
-    typedef void (*ContentPolicyDecisionFunction)(void* argument, PolicyAction);
-
-    class PolicyCheck {
-    public:
-        PolicyCheck();
-
-        void clear();
-        void set(const ResourceRequest&, PassRefPtr<FormState>,
-            NavigationPolicyDecisionFunction, void* argument);
-        void set(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName,
-            NewWindowPolicyDecisionFunction, void* argument);
-        void set(ContentPolicyDecisionFunction, void* argument);
-
-        const ResourceRequest& request() const { return m_request; }
-        void clearRequest();
-
-        void call(bool shouldContinue);
-        void call(PolicyAction);
-        void cancel();
-
-    private:
-        ResourceRequest m_request;
-        RefPtr<FormState> m_formState;
-        String m_frameName;
-
-        NavigationPolicyDecisionFunction m_navigationFunction;
-        NewWindowPolicyDecisionFunction m_newWindowFunction;
-        ContentPolicyDecisionFunction m_contentFunction;
-        void* m_argument;
-    };
-
-    class FrameLoader : public Noncopyable {
-    public:
-        FrameLoader(Frame*, FrameLoaderClient*);
-        ~FrameLoader();
-
-        void init();
-
-        Frame* frame() const { return m_frame; }
-
-        // FIXME: This is not cool, people. There are too many different functions that all start loads.
-        // We should aim to consolidate these into a smaller set of functions, and try to reuse more of
-        // the logic by extracting common code paths.
-
-        void prepareForLoadStart();
-        void setupForReplace();
-        void setupForReplaceByMIMEType(const String& newMIMEType);
-
-        void loadURLIntoChildFrame(const KURL&, const String& referer, Frame*);
-
-        void loadFrameRequest(const FrameLoadRequest&, bool lockHistory, bool lockBackForwardList,  // Called by submitForm, calls loadPostRequest and loadURL.
-            PassRefPtr<Event>, PassRefPtr<FormState>);
-
-        void load(const ResourceRequest&, bool lockHistory);                                        // Called by WebFrame, calls load(ResourceRequest, SubstituteData).
-        void load(const ResourceRequest&, const SubstituteData&, bool lockHistory);                 // Called both by WebFrame and internally, calls load(DocumentLoader*).
-        void load(const ResourceRequest&, const String& frameName, bool lockHistory);               // Called by WebPluginController.
-        
-        void loadArchive(PassRefPtr<Archive>);
-
-        // Returns true for any non-local URL. If document parameter is supplied, its local load policy dictates,
-        // otherwise if referrer is non-empty and represents a local file, then the local load is allowed.
-        static bool canLoad(const KURL&, const String& referrer, const Document*);
-        static bool canLoad(const KURL&, const String& referrer, const SecurityOrigin* = 0);
-        static void reportLocalLoadFailed(Frame*, const String& url);
-
-        static bool shouldHideReferrer(const KURL&, const String& referrer);
-
-        // Called by createWindow in JSDOMWindowBase.cpp, e.g. to fulfill a modal dialog creation
-        Frame* createWindow(FrameLoader* frameLoaderForFrameLookup, const FrameLoadRequest&, const WindowFeatures&, bool& created);
-
-        unsigned long loadResourceSynchronously(const ResourceRequest&, StoredCredentials, ResourceError&, ResourceResponse&, Vector<char>& data);
-
-        bool canHandleRequest(const ResourceRequest&);
-
-        // Also not cool.
-        void stopAllLoaders(DatabasePolicy = DatabasePolicyStop);
-        void stopForUserCancel(bool deferCheckLoadComplete = false);
-
-        bool isLoadingMainResource() const { return m_isLoadingMainResource; }
-        bool isLoading() const;
-        bool frameHasLoaded() const;
-
-        int numPendingOrLoadingRequests(bool recurse) const;
-        String referrer() const;
-        String outgoingReferrer() const;
-        String outgoingOrigin() const;
-
-        DocumentLoader* activeDocumentLoader() const;
-        DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
-        DocumentLoader* policyDocumentLoader() const { return m_policyDocumentLoader.get(); }
-        DocumentLoader* provisionalDocumentLoader() const { return m_provisionalDocumentLoader.get(); }
-        FrameState state() const { return m_state; }
-        static double timeOfLastCompletedLoad();
-
-        bool shouldUseCredentialStorage(ResourceLoader*);
-        void didReceiveAuthenticationChallenge(ResourceLoader*, const AuthenticationChallenge&);
-        void didCancelAuthenticationChallenge(ResourceLoader*, const AuthenticationChallenge&);
-        
-        void assignIdentifierToInitialRequest(unsigned long identifier, const ResourceRequest&);
-        void willSendRequest(ResourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
-        void didReceiveResponse(ResourceLoader*, const ResourceResponse&);
-        void didReceiveData(ResourceLoader*, const char*, int, int lengthReceived);
-        void didFinishLoad(ResourceLoader*);
-        void didFailToLoad(ResourceLoader*, const ResourceError&);
-        void didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
-        const ResourceRequest& originalRequest() const;
-        const ResourceRequest& initialRequest() const;
-        void receivedMainResourceError(const ResourceError&, bool isComplete);
-        void receivedData(const char*, int);
-
-        void handleFallbackContent();
-        bool isStopping() const;
+class Archive;
+class AuthenticationChallenge;
+class CachedFrameBase;
+class CachedPage;
+class CachedResource;
+class Document;
+class DocumentLoader;
+class Event;
+class FormData;
+class FormState;
+class Frame;
+class FrameLoaderClient;
+class HistoryItem;
+class HTMLAppletElement;
+class HTMLFormElement;
+class HTMLFrameOwnerElement;
+class IconLoader;
+class IntSize;
+class NavigationAction;
+class RenderPart;
+class ResourceError;
+class ResourceLoader;
+class ResourceResponse;
+class ScriptSourceCode;
+class ScriptString;
+class ScriptValue;
+class SecurityOrigin;
+class SharedBuffer;
+class SubstituteData;
+class TextResourceDecoder;
+class Widget;
+
+struct FrameLoadRequest;
+struct WindowFeatures;
+
+bool isBackForwardLoadType(FrameLoadType);
+
+class FrameLoader : public Noncopyable {
+public:
+    FrameLoader(Frame*, FrameLoaderClient*);
+    ~FrameLoader();
+
+    void init();
+
+    Frame* frame() const { return m_frame; }
+
+    PolicyChecker* policyChecker() const { return &m_policyChecker; }
+    HistoryController* history() const { return &m_history; }
+    ResourceLoadNotifier* notifier() const { return &m_notifer; }
+
+    // FIXME: This is not cool, people. There are too many different functions that all start loads.
+    // We should aim to consolidate these into a smaller set of functions, and try to reuse more of
+    // the logic by extracting common code paths.
+
+    void prepareForLoadStart();
+    void setupForReplace();
+    void setupForReplaceByMIMEType(const String& newMIMEType);
+
+    void loadURLIntoChildFrame(const KURL&, const String& referer, Frame*);
+
+    void loadFrameRequest(const FrameLoadRequest&, bool lockHistory, bool lockBackForwardList,  // Called by submitForm, calls loadPostRequest and loadURL.
+        PassRefPtr<Event>, PassRefPtr<FormState>, ReferrerPolicy);
+
+    void load(const ResourceRequest&, bool lockHistory);                                        // Called by WebFrame, calls load(ResourceRequest, SubstituteData).
+    void load(const ResourceRequest&, const SubstituteData&, bool lockHistory);                 // Called both by WebFrame and internally, calls load(DocumentLoader*).
+    void load(const ResourceRequest&, const String& frameName, bool lockHistory);               // Called by WebPluginController.
+    
+    void loadArchive(PassRefPtr<Archive>);
 
-        void finishedLoading();
+    static void reportLocalLoadFailed(Frame*, const String& url);
 
-        ResourceError cancelledError(const ResourceRequest&) const;
-        ResourceError fileDoesNotExistError(const ResourceResponse&) const;
-        ResourceError blockedError(const ResourceRequest&) const;
-        ResourceError cannotShowURLError(const ResourceRequest&) const;
+    // Called by createWindow in JSDOMWindowBase.cpp, e.g. to fulfill a modal dialog creation
+    Frame* createWindow(FrameLoader* frameLoaderForFrameLookup, const FrameLoadRequest&, const WindowFeatures&, bool& created);
 
-        void cannotShowMIMEType(const ResourceResponse&);
-        ResourceError interruptionForPolicyChangeError(const ResourceRequest&);
+    unsigned long loadResourceSynchronously(const ResourceRequest&, StoredCredentials, ResourceError&, ResourceResponse&, Vector<char>& data);
 
-        bool isHostedByObjectElement() const;
-        bool isLoadingMainFrame() const;
-        bool canShowMIMEType(const String& MIMEType) const;
-        bool representationExistsForURLScheme(const String& URLScheme);
-        String generatedMIMETypeForURLScheme(const String& URLScheme);
+    bool canHandleRequest(const ResourceRequest&);
 
-        void checkNavigationPolicy(const ResourceRequest&, NavigationPolicyDecisionFunction function, void* argument);
-        void checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction, void* argument);
-        void cancelContentPolicyCheck();
+    // Also not cool.
+    void stopAllLoaders(DatabasePolicy = DatabasePolicyStop);
+    void stopForUserCancel(bool deferCheckLoadComplete = false);
 
-        void reload(bool endToEndReload = false);
-        void reloadWithOverrideEncoding(const String& overrideEncoding);
+    bool isLoadingMainResource() const { return m_isLoadingMainResource; }
+    bool isLoading() const;
+    bool frameHasLoaded() const;
 
-        void didReceiveServerRedirectForProvisionalLoadForFrame();
-        void finishedLoadingDocument(DocumentLoader*);
-        void committedLoad(DocumentLoader*, const char*, int);
-        bool isReplacing() const;
-        void setReplacing();
-        void revertToProvisional(DocumentLoader*);
-        void setMainDocumentError(DocumentLoader*, const ResourceError&);
-        void mainReceivedCompleteError(DocumentLoader*, const ResourceError&);
-        bool subframeIsLoading() const;
-        void willChangeTitle(DocumentLoader*);
-        void didChangeTitle(DocumentLoader*);
+    int numPendingOrLoadingRequests(bool recurse) const;
+    String referrer() const;
+    String outgoingReferrer() const;
+    String outgoingOrigin() const;
 
-        FrameLoadType loadType() const;
-        CachePolicy subresourceCachePolicy() const;
+    DocumentLoader* activeDocumentLoader() const;
+    DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
+    DocumentLoader* policyDocumentLoader() const { return m_policyDocumentLoader.get(); }
+    DocumentLoader* provisionalDocumentLoader() const { return m_provisionalDocumentLoader.get(); }
+    FrameState state() const { return m_state; }
+    static double timeOfLastCompletedLoad();
 
-        void didFirstLayout();
-        bool firstLayoutDone() const;
+    bool shouldUseCredentialStorage(ResourceLoader*);
+    const ResourceRequest& originalRequest() const;
+    const ResourceRequest& initialRequest() const;
+    void receivedMainResourceError(const ResourceError&, bool isComplete);
+    void receivedData(const char*, int);
 
-        void didFirstVisuallyNonEmptyLayout();
+    bool willLoadMediaElementURL(KURL&);
 
-        void loadedResourceFromMemoryCache(const CachedResource*);
-        void tellClientAboutPastMemoryCacheLoads();
+    void handleFallbackContent();
+    bool isStopping() const;
 
-        void checkLoadComplete();
-        void detachFromParent();
-        void detachViewsAndDocumentLoader();
+    void finishedLoading();
 
-        void addExtraFieldsToSubresourceRequest(ResourceRequest&);
-        void addExtraFieldsToMainResourceRequest(ResourceRequest&);
-        
-        static void addHTTPOriginIfNeeded(ResourceRequest&, String origin);
+    ResourceError cancelledError(const ResourceRequest&) const;
+    ResourceError fileDoesNotExistError(const ResourceResponse&) const;
+    ResourceError blockedError(const ResourceRequest&) const;
+    ResourceError cannotShowURLError(const ResourceRequest&) const;
+    ResourceError interruptionForPolicyChangeError(const ResourceRequest&);
 
-        FrameLoaderClient* client() const { return m_client; }
+    bool isHostedByObjectElement() const;
+    bool isLoadingMainFrame() const;
+    bool canShowMIMEType(const String& MIMEType) const;
+    bool representationExistsForURLScheme(const String& URLScheme);
+    String generatedMIMETypeForURLScheme(const String& URLScheme);
 
-        void setDefersLoading(bool);
+    void reload(bool endToEndReload = false);
+    void reloadWithOverrideEncoding(const String& overrideEncoding);
 
-        void changeLocation(const KURL&, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false, bool refresh = false);
-        void urlSelected(const ResourceRequest&, const String& target, PassRefPtr<Event>, bool lockHistory, bool lockBackForwardList, bool userGesture);
-        bool requestFrame(HTMLFrameOwnerElement*, const String& url, const AtomicString& frameName);
+    void didReceiveServerRedirectForProvisionalLoadForFrame();
+    void finishedLoadingDocument(DocumentLoader*);
+    void committedLoad(DocumentLoader*, const char*, int);
+    bool isReplacing() const;
+    void setReplacing();
+    void revertToProvisional(DocumentLoader*);
+    void setMainDocumentError(DocumentLoader*, const ResourceError&);
+    void mainReceivedCompleteError(DocumentLoader*, const ResourceError&);
+    bool subframeIsLoading() const;
+    void willChangeTitle(DocumentLoader*);
+    void didChangeTitle(DocumentLoader*);
 
-        void submitForm(const char* action, const String& url,
-            PassRefPtr<FormData>, const String& target, const String& contentType, const String& boundary,
-            bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
+    FrameLoadType loadType() const;
+    CachePolicy subresourceCachePolicy() const;
 
-        void stop();
-        void stopLoading(UnloadEventPolicy, DatabasePolicy = DatabasePolicyStop);
-        bool closeURL();
+    void didFirstLayout();
+    bool firstLayoutDone() const;
 
-        void didExplicitOpen();
+    void didFirstVisuallyNonEmptyLayout();
 
-        KURL iconURL();
-        void commitIconURLToIconDatabase(const KURL&);
+    void loadedResourceFromMemoryCache(const CachedResource*);
+    void tellClientAboutPastMemoryCacheLoads();
 
-        KURL baseURL() const;
+    void checkLoadComplete();
+    void detachFromParent();
+    void detachViewsAndDocumentLoader();
 
-        bool isScheduledLocationChangePending() const { return m_scheduledRedirection && isLocationChange(*m_scheduledRedirection); }
-        void scheduleHTTPRedirection(double delay, const String& url);
-        void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false);
-        void scheduleRefresh(bool userGesture = false);
-        void scheduleHistoryNavigation(int steps);
+    void addExtraFieldsToSubresourceRequest(ResourceRequest&);
+    void addExtraFieldsToMainResourceRequest(ResourceRequest&);
+    
+    static void addHTTPOriginIfNeeded(ResourceRequest&, String origin);
 
-        bool canGoBackOrForward(int distance) const;
-        void goBackOrForward(int distance);
-        int getHistoryLength();
+    FrameLoaderClient* client() const { return m_client; }
 
-        void begin();
-        void begin(const KURL&, bool dispatchWindowObjectAvailable = true, SecurityOrigin* forcedSecurityOrigin = 0);
+    void setDefersLoading(bool);
 
-        void write(const char* string, int length = -1, bool flush = false);
-        void write(const String&);
-        void end();
-        void endIfNotLoadingMainResource();
+    void changeLocation(const KURL&, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false, bool refresh = false);
+    void urlSelected(const ResourceRequest&, const String& target, PassRefPtr<Event>, bool lockHistory, bool lockBackForwardList, bool userGesture, ReferrerPolicy);
+    bool requestFrame(HTMLFrameOwnerElement*, const String& url, const AtomicString& frameName);
 
-        void setEncoding(const String& encoding, bool userChosen);
-        String encoding() const;
+    void submitForm(const char* action, const String& url,
+        PassRefPtr<FormData>, const String& target, const String& contentType, const String& boundary,
+        bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
 
-        ScriptValue executeScript(const ScriptSourceCode&);
-        ScriptValue executeScript(const String& script, bool forceUserGesture = false);
+    void stop();
+    void stopLoading(UnloadEventPolicy, DatabasePolicy = DatabasePolicyStop);
+    bool closeURL();
 
-        void gotoAnchor();
+    void didExplicitOpen();
 
-        void tokenizerProcessedData();
+    KURL iconURL();
+    void commitIconURLToIconDatabase(const KURL&);
 
-        void handledOnloadEvents();
-        String userAgent(const KURL&) const;
+    KURL baseURL() const;
 
-        PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const HashMap<String, String>& args);
+    void replaceDocument(const String&);
 
-        void dispatchWindowObjectAvailable();
-        void dispatchDocumentElementAvailable();
-        void restoreDocumentState();
+    void begin();
+    void begin(const KURL&, bool dispatchWindowObjectAvailable = true, SecurityOrigin* forcedSecurityOrigin = 0);
 
-        // Mixed content related functions.
-        static bool isMixedContent(SecurityOrigin* context, const KURL&);
-        void checkIfDisplayInsecureContent(SecurityOrigin* context, const KURL&);
-        void checkIfRunInsecureContent(SecurityOrigin* context, const KURL&);
+    void write(const char* string, int length = -1, bool flush = false);
+    void write(const String&);
+    void end();
+    void endIfNotLoadingMainResource();
 
-        Frame* opener();
-        void setOpener(Frame*);
-        bool openedByDOM() const;
-        void setOpenedByDOM();
+    void setEncoding(const String& encoding, bool userChosen);
+    String encoding() const;
 
-        bool isProcessingUserGesture();
+    void tokenizerProcessedData();
 
-        void resetMultipleFormSubmissionProtection();
+    void handledOnloadEvents();
+    String userAgent(const KURL&) const;
 
-        void addData(const char* bytes, int length);
+    PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const HashMap<String, String>& args);
 
-        void checkCallImplicitClose();
+    void dispatchWindowObjectAvailable();
+    void dispatchDocumentElementAvailable();
 
-        void frameDetached();
+    // Mixed content related functions.
+    static bool isMixedContent(SecurityOrigin* context, const KURL&);
+    void checkIfDisplayInsecureContent(SecurityOrigin* context, const KURL&);
+    void checkIfRunInsecureContent(SecurityOrigin* context, const KURL&);
 
-        const KURL& url() const { return m_URL; }
+    Frame* opener();
+    void setOpener(Frame*);
 
-        void setResponseMIMEType(const String&);
-        const String& responseMIMEType() const;
+    bool isProcessingUserGesture();
 
-        bool containsPlugins() const;
+    void resetMultipleFormSubmissionProtection();
 
-        void loadDone();
-        void finishedParsing();
-        void checkCompleted();
+    void addData(const char* bytes, int length);
 
-        bool isComplete() const;
+    void checkCallImplicitClose();
 
-        bool requestObject(RenderPart* frame, const String& url, const AtomicString& frameName,
-            const String& serviceType, const Vector<String>& paramNames, const Vector<String>& paramValues);
+    void frameDetached();
 
-        KURL completeURL(const String& url);
+    const KURL& url() const { return m_URL; }
 
-        void cancelAndClear();
+    void setResponseMIMEType(const String&);
+    const String& responseMIMEType() const;
 
-        void setTitle(const String&);
+    bool containsPlugins() const;
 
-        void commitProvisionalLoad(PassRefPtr<CachedPage>);
-        bool isLoadingFromCachedPage() const { return m_loadingFromCachedPage; }
+    void loadDone();
+    void finishedParsing();
+    void checkCompleted();
 
-        void goToItem(HistoryItem*, FrameLoadType);
-        void saveDocumentAndScrollState();
+    void checkDidPerformFirstNavigation();
 
-        HistoryItem* currentHistoryItem();
-        void setCurrentHistoryItem(PassRefPtr<HistoryItem>);
+    bool isComplete() const;
 
-        enum LocalLoadPolicy {
-            AllowLocalLoadsForAll,  // No restriction on local loads.
-            AllowLocalLoadsForLocalAndSubstituteData,
-            AllowLocalLoadsForLocalOnly,
-        };
-        static void setLocalLoadPolicy(LocalLoadPolicy);
-        static bool restrictAccessToLocal();
-        static bool allowSubstituteDataAccessToLocal();
+    bool requestObject(RenderPart* frame, const String& url, const AtomicString& frameName,
+        const String& serviceType, const Vector<String>& paramNames, const Vector<String>& paramValues);
 
-        bool committingFirstRealLoad() const { return !m_creatingInitialEmptyDocument && !m_committedFirstRealDocumentLoad; }
+    KURL completeURL(const String& url);
 
-        void iconLoadDecisionAvailable();
+    void cancelAndClear();
 
-        bool shouldAllowNavigation(Frame* targetFrame) const;
-        Frame* findFrameForNavigation(const AtomicString& name);
+    void setTitle(const String&);
 
-        void startIconLoader();
+    void commitProvisionalLoad(PassRefPtr<CachedPage>);
+    bool isLoadingFromCachedPage() const { return m_loadingFromCachedPage; }
 
-        void applyUserAgent(ResourceRequest& request);
+    bool committingFirstRealLoad() const { return !m_creatingInitialEmptyDocument && !m_committedFirstRealDocumentLoad; }
+    bool committedFirstRealDocumentLoad() const { return m_committedFirstRealDocumentLoad; }
+    bool creatingInitialEmptyDocument() const { return m_creatingInitialEmptyDocument; }
 
-        bool shouldInterruptLoadForXFrameOptions(const String&, const KURL&);
+    void iconLoadDecisionAvailable();
 
-        void open(CachedFrameBase&);
+    bool shouldAllowNavigation(Frame* targetFrame) const;
+    Frame* findFrameForNavigation(const AtomicString& name);
 
-    private:
-        PassRefPtr<HistoryItem> createHistoryItem(bool useOriginal);
-        PassRefPtr<HistoryItem> createHistoryItemTree(Frame* targetFrame, bool clipAtTarget);
+    void startIconLoader();
 
-        bool canCachePageContainingThisFrame();
-#ifndef NDEBUG
-        void logCanCachePageDecision();
-        bool logCanCacheFrameDecision(int indentLevel);
-#endif
+    void applyUserAgent(ResourceRequest& request);
 
-        void addBackForwardItemClippedAtTarget(bool doClip);
-        void restoreScrollPositionAndViewState();
-        void saveDocumentState();
-        void loadItem(HistoryItem*, FrameLoadType);
-        bool urlsMatchItem(HistoryItem*) const;
-        void invalidateCurrentItemCachedPage();
-        void recursiveGoToItem(HistoryItem*, HistoryItem*, FrameLoadType);
-        bool childFramesMatchItem(HistoryItem*) const;
-
-        void updateHistoryForBackForwardNavigation();
-        void updateHistoryForReload();
-        void updateHistoryForStandardLoad();
-        void updateHistoryForRedirectWithLockedBackForwardList();
-        void updateHistoryForClientRedirect();
-        void updateHistoryForCommit();
-        void updateHistoryForAnchorScroll();
-    
-        void redirectionTimerFired(Timer<FrameLoader>*);
-        void checkTimerFired(Timer<FrameLoader>*);
-        
-        void cancelRedirection(bool newLoadInProgress = false);
+    bool shouldInterruptLoadForXFrameOptions(const String&, const KURL&);
 
-        void started();
+    void open(CachedFrameBase&);
 
-        void completed();
+    // FIXME: Should these really be public?
+    void completed();
+    bool allAncestorsAreComplete() const; // including this
+    bool allChildrenAreComplete() const; // immediate children, not all descendants
+    void clientRedirected(const KURL&, double delay, double fireDate, bool lockBackForwardList);
+    void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
+    void loadItem(HistoryItem*, FrameLoadType);
 
-        bool shouldUsePlugin(const KURL&, const String& mimeType, bool hasFallback, bool& useFallback);
-        bool loadPlugin(RenderPart*, const KURL&, const String& mimeType,
-        const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
-        
-        bool loadProvisionalItemFromCachedPage();
-        void cachePageForHistoryItem(HistoryItem*);
-        void pageHidden();
+    // FIXME: This is public because this asynchronous callback from the FrameLoaderClient
+    // uses the policy machinery (and therefore is called via the PolicyChecker).  Once we
+    // introduce a proper callback type for this function, we should make it private again.
+    void continueLoadAfterWillSubmitForm();
 
-        void receivedFirstData();
+private:
+    bool canCachePageContainingThisFrame();
+#ifndef NDEBUG
+    void logCanCachePageDecision();
+    bool logCanCacheFrameDecision(int indentLevel);
+#endif
 
-        void updateFirstPartyForCookies();
-        void setFirstPartyForCookies(const KURL&);
-        
-        void addExtraFieldsToRequest(ResourceRequest&, FrameLoadType loadType, bool isMainResource, bool cookiePolicyURLFromRequest);
+    void checkTimerFired(Timer<FrameLoader>*);
 
-        // Also not cool.
-        void stopLoadingSubframes();
+    void started();
 
-        void clearProvisionalLoad();
-        void markLoadComplete();
-        void transitionToCommitted(PassRefPtr<CachedPage>);
-        void frameLoadCompleted();
+    bool shouldUsePlugin(const KURL&, const String& mimeType, bool hasFallback, bool& useFallback);
+    bool loadPlugin(RenderPart*, const KURL&, const String& mimeType,
+    const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
+    
+    bool loadProvisionalItemFromCachedPage();
+    void cachePageForHistoryItem(HistoryItem*);
+    void pageHidden();
 
-        void mainReceivedError(const ResourceError&, bool isComplete);
+    void receivedFirstData();
+
+    void updateFirstPartyForCookies();
+    void setFirstPartyForCookies(const KURL&);
+    
+    void addExtraFieldsToRequest(ResourceRequest&, FrameLoadType loadType, bool isMainResource, bool cookiePolicyURLFromRequest);
 
-        void setLoadType(FrameLoadType);
+    // Also not cool.
+    void stopLoadingSubframes();
 
-        void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>, NavigationPolicyDecisionFunction, void* argument);
-        void checkNewWindowPolicy(const NavigationAction&, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName);
+    void clearProvisionalLoad();
+    void markLoadComplete();
+    void transitionToCommitted(PassRefPtr<CachedPage>);
+    void frameLoadCompleted();
 
-        void continueAfterNavigationPolicy(PolicyAction);
-        void continueAfterNewWindowPolicy(PolicyAction);
-        void continueAfterContentPolicy(PolicyAction);
-        void continueLoadAfterWillSubmitForm(PolicyAction = PolicyUse);
+    void mainReceivedError(const ResourceError&, bool isComplete);
 
-        static void callContinueLoadAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
-        void continueLoadAfterNavigationPolicy(const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
-        static void callContinueLoadAfterNewWindowPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
-        void continueLoadAfterNewWindowPolicy(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
-        static void callContinueFragmentScrollAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
-        void continueFragmentScrollAfterNavigationPolicy(const ResourceRequest&, bool shouldContinue);
-        bool shouldScrollToAnchor(bool isFormSubmission, FrameLoadType, const KURL&);
-        void addHistoryItemForFragmentScroll();
+    void setLoadType(FrameLoadType);
 
-        void stopPolicyCheck();
+    static void callContinueLoadAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+    static void callContinueLoadAfterNewWindowPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
+    static void callContinueFragmentScrollAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
 
-        void checkLoadCompleteForThisFrame();
+    void continueLoadAfterNavigationPolicy(const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+    void continueLoadAfterNewWindowPolicy(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
+    void continueFragmentScrollAfterNavigationPolicy(const ResourceRequest&, bool shouldContinue);
 
-        void setDocumentLoader(DocumentLoader*);
-        void setPolicyDocumentLoader(DocumentLoader*);
-        void setProvisionalDocumentLoader(DocumentLoader*);
+    bool shouldScrollToAnchor(bool isFormSubmission, FrameLoadType, const KURL&);
 
-        void setState(FrameState);
+    void checkLoadCompleteForThisFrame();
 
-        void closeOldDataSources();
-        void open(CachedPage&);
+    void setDocumentLoader(DocumentLoader*);
+    void setPolicyDocumentLoader(DocumentLoader*);
+    void setProvisionalDocumentLoader(DocumentLoader*);
 
-        void updateHistoryAfterClientRedirect();
+    void setState(FrameState);
 
-        void clear(bool clearWindowProperties = true, bool clearScriptObjects = true, bool clearFrameView = true);
+    void closeOldDataSources();
+    void open(CachedPage&);
 
-        bool shouldReloadToHandleUnreachableURL(DocumentLoader*);
-        void handleUnimplementablePolicy(const ResourceError&);
+    void updateHistoryAfterClientRedirect();
 
-        void scheduleRedirection(PassOwnPtr<ScheduledRedirection>);
-        void startRedirectionTimer();
-        void stopRedirectionTimer();
+    void clear(bool clearWindowProperties = true, bool clearScriptObjects = true, bool clearFrameView = true);
 
-        void dispatchDidCommitLoad();
-        void dispatchAssignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
-        void dispatchWillSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
-        void dispatchDidReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse&);
-        void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int length);
-        void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier);
+    bool shouldReloadToHandleUnreachableURL(DocumentLoader*);
 
-        static bool isLocationChange(const ScheduledRedirection&);
-        void scheduleFormSubmission(const FrameLoadRequest&, bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
+    void dispatchDidCommitLoad();
 
-        void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>); // Calls continueLoadAfterNavigationPolicy
-        void load(DocumentLoader*);                                                         // Calls loadWithDocumentLoader   
+    void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>); // Calls continueLoadAfterNavigationPolicy
+    void load(DocumentLoader*);                                                         // Calls loadWithDocumentLoader   
 
-        void loadWithNavigationAction(const ResourceRequest&, const NavigationAction&,      // Calls loadWithDocumentLoader
-            bool lockHistory, FrameLoadType, PassRefPtr<FormState>);
+    void loadWithNavigationAction(const ResourceRequest&, const NavigationAction&,      // Calls loadWithDocumentLoader
+        bool lockHistory, FrameLoadType, PassRefPtr<FormState>);
 
-        void loadPostRequest(const ResourceRequest&, const String& referrer,                // Called by loadFrameRequest, calls loadWithNavigationAction
-            const String& frameName, bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);
-        void loadURL(const KURL&, const String& referrer, const String& frameName,          // Called by loadFrameRequest, calls loadWithNavigationAction or dispatches to navigation policy delegate
-            bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);                                                         
+    void loadPostRequest(const ResourceRequest&, const String& referrer,                // Called by loadFrameRequest, calls loadWithNavigationAction
+        const String& frameName, bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);
+    void loadURL(const KURL&, const String& referrer, const String& frameName,          // Called by loadFrameRequest, calls loadWithNavigationAction or dispatches to navigation policy delegate
+        bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);                                                         
 
-        void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
-        void clientRedirected(const KURL&, double delay, double fireDate, bool lockBackForwardList);
-        bool shouldReload(const KURL& currentURL, const KURL& destinationURL);
+    bool shouldReload(const KURL& currentURL, const KURL& destinationURL);
 
-        void sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
-        void requestFromDelegate(ResourceRequest&, unsigned long& identifier, ResourceError&);
+    void requestFromDelegate(ResourceRequest&, unsigned long& identifier, ResourceError&);
 
-        void recursiveCheckLoadComplete();
+    void recursiveCheckLoadComplete();
 
-        void detachChildren();
-        void closeAndRemoveChild(Frame*);
+    void detachChildren();
+    void closeAndRemoveChild(Frame*);
 
-        Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
+    Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
 
-        // Returns true if argument is a JavaScript URL.
-        bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
+    void scrollToAnchor(const KURL&);
 
-        bool gotoAnchor(const String& name); // returns true if the anchor was found
-        void scrollToAnchor(const KURL&);
+    void provisionalLoadStarted();
 
-        void provisionalLoadStarted();
+    bool canCachePage();
 
-        bool canCachePage();
+    bool didOpenURL(const KURL&);
 
-        bool didOpenURL(const KURL&);
+    void scheduleCheckCompleted();
+    void scheduleCheckLoadComplete();
+    void startCheckCompleteTimer();
 
-        void scheduleCheckCompleted();
-        void scheduleCheckLoadComplete();
-        void startCheckCompleteTimer();
+    KURL originalRequestURL() const;
 
-        KURL originalRequestURL() const;
+    bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
 
-        bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
+    Frame* m_frame;
+    FrameLoaderClient* m_client;
 
-        void saveScrollPositionAndViewStateToItem(HistoryItem*);
+    mutable PolicyChecker m_policyChecker;
+    mutable HistoryController m_history;
+    mutable ResourceLoadNotifier m_notifer;
 
-        bool allAncestorsAreComplete() const; // including this
-        bool allChildrenAreComplete() const; // immediate children, not all descendants
+    FrameState m_state;
+    FrameLoadType m_loadType;
 
-        Frame* m_frame;
-        FrameLoaderClient* m_client;
+    // Document loaders for the three phases of frame loading. Note that while 
+    // a new request is being loaded, the old document loader may still be referenced.
+    // E.g. while a new request is in the "policy" state, the old document loader may
+    // be consulted in particular as it makes sense to imply certain settings on the new loader.
+    RefPtr<DocumentLoader> m_documentLoader;
+    RefPtr<DocumentLoader> m_provisionalDocumentLoader;
+    RefPtr<DocumentLoader> m_policyDocumentLoader;
 
-        FrameState m_state;
-        FrameLoadType m_loadType;
+    bool m_delegateIsHandlingProvisionalLoadError;
 
-        // Document loaders for the three phases of frame loading. Note that while 
-        // a new request is being loaded, the old document loader may still be referenced.
-        // E.g. while a new request is in the "policy" state, the old document loader may
-        // be consulted in particular as it makes sense to imply certain settings on the new loader.
-        RefPtr<DocumentLoader> m_documentLoader;
-        RefPtr<DocumentLoader> m_provisionalDocumentLoader;
-        RefPtr<DocumentLoader> m_policyDocumentLoader;
+    bool m_firstLayoutDone;
+    bool m_quickRedirectComing;
+    bool m_sentRedirectNotification;
+    bool m_inStopAllLoaders;
 
-        // This identifies the type of navigation action which prompted this load. Note 
-        // that WebKit conveys this value as the WebActionNavigationTypeKey value
-        // on navigation action delegate callbacks.
-        FrameLoadType m_policyLoadType;
-        PolicyCheck m_policyCheck;
+    String m_outgoingReferrer;
 
-        bool m_delegateIsHandlingProvisionalLoadError;
-        bool m_delegateIsDecidingNavigationPolicy;
-        bool m_delegateIsHandlingUnimplementablePolicy;
+    bool m_isExecutingJavaScriptFormAction;
 
-        bool m_firstLayoutDone;
-        bool m_quickRedirectComing;
-        bool m_sentRedirectNotification;
-        bool m_inStopAllLoaders;
+    String m_responseMIMEType;
 
-        String m_outgoingReferrer;
+    bool m_didCallImplicitClose;
+    bool m_wasUnloadEventEmitted;
+    bool m_unloadEventBeingDispatched;
+    bool m_isComplete;
+    bool m_isLoadingMainResource;
 
-        bool m_isExecutingJavaScriptFormAction;
-        bool m_isRunningScript;
+    KURL m_URL;
+    KURL m_workingURL;
 
-        String m_responseMIMEType;
+    OwnPtr<IconLoader> m_iconLoader;
+    bool m_mayLoadIconLater;
 
-        bool m_didCallImplicitClose;
-        bool m_wasUnloadEventEmitted;
-        bool m_unloadEventBeingDispatched;
-        bool m_isComplete;
-        bool m_isLoadingMainResource;
+    bool m_cancellingWithLoadInProgress;
 
-        KURL m_URL;
-        KURL m_workingURL;
+    bool m_needsClear;
+    bool m_receivedData;
 
-        OwnPtr<IconLoader> m_iconLoader;
-        bool m_mayLoadIconLater;
+    bool m_encodingWasChosenByUser;
+    String m_encoding;
+    RefPtr<TextResourceDecoder> m_decoder;
 
-        bool m_cancellingWithLoadInProgress;
+    bool m_containsPlugIns;
 
-        OwnPtr<ScheduledRedirection> m_scheduledRedirection;
+    KURL m_submittedFormURL;
 
-        bool m_needsClear;
-        bool m_receivedData;
+    Timer<FrameLoader> m_checkTimer;
+    bool m_shouldCallCheckCompleted;
+    bool m_shouldCallCheckLoadComplete;
 
-        bool m_encodingWasChosenByUser;
-        String m_encoding;
-        RefPtr<TextResourceDecoder> m_decoder;
+    Frame* m_opener;
+    HashSet<Frame*> m_openedFrames;
 
-        bool m_containsPlugIns;
+    bool m_creatingInitialEmptyDocument;
+    bool m_isDisplayingInitialEmptyDocument;
+    bool m_committedFirstRealDocumentLoad;
 
-        KURL m_submittedFormURL;
+    bool m_didPerformFirstNavigation;
+    bool m_loadingFromCachedPage;
+    bool m_suppressOpenerInNewFrame;
     
-        Timer<FrameLoader> m_redirectionTimer;
-        Timer<FrameLoader> m_checkTimer;
-        bool m_shouldCallCheckCompleted;
-        bool m_shouldCallCheckLoadComplete;
-
-        Frame* m_opener;
-        HashSet<Frame*> m_openedFrames;
-
-        bool m_openedByDOM;
-
-        bool m_creatingInitialEmptyDocument;
-        bool m_isDisplayingInitialEmptyDocument;
-        bool m_committedFirstRealDocumentLoad;
-
-        RefPtr<HistoryItem> m_currentHistoryItem;
-        RefPtr<HistoryItem> m_previousHistoryItem;
-        RefPtr<HistoryItem> m_provisionalHistoryItem;
-        
-        bool m_didPerformFirstNavigation;
-        bool m_loadingFromCachedPage;
-        
 #ifndef NDEBUG
-        bool m_didDispatchDidCommitLoad;
+    bool m_didDispatchDidCommitLoad;
 #endif
-    };
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
index 5ba4b10590..2042b32096 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
@@ -60,6 +60,7 @@ namespace WebCore {
     class KURL;
     class NavigationAction;
     class PluginView;
+    class PolicyChecker;
     class ResourceError;
     class ResourceHandle;
     class ResourceLoader;
@@ -72,7 +73,7 @@ namespace WebCore {
     class String;
     class Widget;
 
-    typedef void (FrameLoader::*FramePolicyFunction)(PolicyAction);
+    typedef void (PolicyChecker::*FramePolicyFunction)(PolicyAction);
 
     class FrameLoaderClient {
     public:
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h b/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
index 76299f566c..e7d51c7974 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
@@ -87,6 +87,11 @@ namespace WebCore {
         UnloadEventPolicyUnloadOnly,
         UnloadEventPolicyUnloadAndPageHide
     };
+
+    enum ReferrerPolicy {
+        SendReferrer,
+        NoReferrer
+    };
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/loader/HistoryController.cpp b/src/3rdparty/webkit/WebCore/loader/HistoryController.cpp
new file mode 100644
index 0000000000..501640a7b9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/HistoryController.cpp
@@ -0,0 +1,627 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HistoryController.h"
+
+#include "CachedPage.h"
+#include "CString.h"
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "FrameTree.h"
+#include "FrameView.h"
+#include "HistoryItem.h"
+#include "Logging.h"
+#include "Page.h"
+#include "PageCache.h"
+#include "PageGroup.h"
+#include "Settings.h"
+
+namespace WebCore {
+
+HistoryController::HistoryController(Frame* frame)
+    : m_frame(frame)
+{
+}
+
+HistoryController::~HistoryController()
+{
+}
+
+void HistoryController::saveScrollPositionAndViewStateToItem(HistoryItem* item)
+{
+    if (!item || !m_frame->view())
+        return;
+        
+    item->setScrollPoint(m_frame->view()->scrollPosition());
+    // FIXME: It would be great to work out a way to put this code in WebCore instead of calling through to the client.
+    m_frame->loader()->client()->saveViewStateToItem(item);
+}
+
+/*
+ There is a race condition between the layout and load completion that affects restoring the scroll position.
+ We try to restore the scroll position at both the first layout and upon load completion.
+ 
+ 1) If first layout happens before the load completes, we want to restore the scroll position then so that the
+ first time we draw the page is already scrolled to the right place, instead of starting at the top and later
+ jumping down.  It is possible that the old scroll position is past the part of the doc laid out so far, in
+ which case the restore silent fails and we will fix it in when we try to restore on doc completion.
+ 2) If the layout happens after the load completes, the attempt to restore at load completion time silently
+ fails.  We then successfully restore it when the layout happens.
+*/
+void HistoryController::restoreScrollPositionAndViewState()
+{
+    if (!m_frame->loader()->committedFirstRealDocumentLoad())
+        return;
+
+    ASSERT(m_currentItem);
+    
+    // FIXME: As the ASSERT attests, it seems we should always have a currentItem here.
+    // One counterexample is <rdar://problem/4917290>
+    // For now, to cover this issue in release builds, there is no technical harm to returning
+    // early and from a user standpoint - as in the above radar - the previous page load failed 
+    // so there *is* no scroll or view state to restore!
+    if (!m_currentItem)
+        return;
+    
+    // FIXME: It would be great to work out a way to put this code in WebCore instead of calling
+    // through to the client. It's currently used only for the PDF view on Mac.
+    m_frame->loader()->client()->restoreViewState();
+    
+    if (FrameView* view = m_frame->view())
+        if (!view->wasScrolledByUser())
+            view->setScrollPosition(m_currentItem->scrollPoint());
+}
+
+void HistoryController::updateBackForwardListForFragmentScroll()
+{
+    updateBackForwardListClippedAtTarget(false);
+}
+
+void HistoryController::saveDocumentState()
+{
+    // FIXME: Reading this bit of FrameLoader state here is unfortunate.  I need to study
+    // this more to see if we can remove this dependency.
+    if (m_frame->loader()->creatingInitialEmptyDocument())
+        return;
+
+    // For a standard page load, we will have a previous item set, which will be used to
+    // store the form state.  However, in some cases we will have no previous item, and
+    // the current item is the right place to save the state.  One example is when we
+    // detach a bunch of frames because we are navigating from a site with frames to
+    // another site.  Another is when saving the frame state of a frame that is not the
+    // target of the current navigation (if we even decide to save with that granularity).
+
+    // Because of previousItem's "masking" of currentItem for this purpose, it's important
+    // that previousItem be cleared at the end of a page transition.  We leverage the
+    // checkLoadComplete recursion to achieve this goal.
+
+    HistoryItem* item = m_previousItem ? m_previousItem.get() : m_currentItem.get();
+    if (!item)
+        return;
+
+    Document* document = m_frame->document();
+    ASSERT(document);
+    
+    if (item->isCurrentDocument(document)) {
+        LOG(Loading, "WebCoreLoading %s: saving form state to %p", m_frame->tree()->name().string().utf8().data(), item);
+        item->setDocumentState(document->formElementsState());
+    }
+}
+
+// Walk the frame tree, telling all frames to save their form state into their current
+// history item.
+void HistoryController::saveDocumentAndScrollState()
+{
+    for (Frame* frame = m_frame; frame; frame = frame->tree()->traverseNext(m_frame)) {
+        frame->loader()->history()->saveDocumentState();
+        frame->loader()->history()->saveScrollPositionAndViewStateToItem(frame->loader()->history()->currentItem());
+    }
+}
+
+void HistoryController::restoreDocumentState()
+{
+    Document* doc = m_frame->document();
+        
+    HistoryItem* itemToRestore = 0;
+    
+    switch (m_frame->loader()->loadType()) {
+        case FrameLoadTypeReload:
+        case FrameLoadTypeReloadFromOrigin:
+        case FrameLoadTypeSame:
+        case FrameLoadTypeReplace:
+            break;
+        case FrameLoadTypeBack:
+        case FrameLoadTypeBackWMLDeckNotAccessible:
+        case FrameLoadTypeForward:
+        case FrameLoadTypeIndexedBackForward:
+        case FrameLoadTypeRedirectWithLockedBackForwardList:
+        case FrameLoadTypeStandard:
+            itemToRestore = m_currentItem.get(); 
+    }
+    
+    if (!itemToRestore)
+        return;
+
+    LOG(Loading, "WebCoreLoading %s: restoring form state from %p", m_frame->tree()->name().string().utf8().data(), itemToRestore);
+    doc->setStateForNewFormElements(itemToRestore->documentState());
+}
+
+void HistoryController::invalidateCurrentItemCachedPage()
+{
+    // When we are pre-commit, the currentItem is where the pageCache data resides    
+    CachedPage* cachedPage = pageCache()->get(currentItem());
+
+    // FIXME: This is a grotesque hack to fix <rdar://problem/4059059> Crash in RenderFlow::detach
+    // Somehow the PageState object is not properly updated, and is holding onto a stale document.
+    // Both Xcode and FileMaker see this crash, Safari does not.
+    
+    ASSERT(!cachedPage || cachedPage->document() == m_frame->document());
+    if (cachedPage && cachedPage->document() == m_frame->document()) {
+        cachedPage->document()->setInPageCache(false);
+        cachedPage->clear();
+    }
+    
+    if (cachedPage)
+        pageCache()->remove(currentItem());
+}
+
+// Main funnel for navigating to a previous location (back/forward, non-search snap-back)
+// This includes recursion to handle loading into framesets properly
+void HistoryController::goToItem(HistoryItem* targetItem, FrameLoadType type)
+{
+    ASSERT(!m_frame->tree()->parent());
+    
+    // shouldGoToHistoryItem is a private delegate method. This is needed to fix:
+    // <rdar://problem/3951283> can view pages from the back/forward cache that should be disallowed by Parental Controls
+    // Ultimately, history item navigations should go through the policy delegate. That's covered in:
+    // <rdar://problem/3979539> back/forward cache navigations should consult policy delegate
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+    if (!m_frame->loader()->client()->shouldGoToHistoryItem(targetItem))
+        return;
+
+    // Set the BF cursor before commit, which lets the user quickly click back/forward again.
+    // - plus, it only makes sense for the top level of the operation through the frametree,
+    // as opposed to happening for some/one of the page commits that might happen soon
+    BackForwardList* bfList = page->backForwardList();
+    HistoryItem* currentItem = bfList->currentItem();    
+    bfList->goToItem(targetItem);
+    Settings* settings = m_frame->settings();
+    page->setGlobalHistoryItem((!settings || settings->privateBrowsingEnabled()) ? 0 : targetItem);
+    recursiveGoToItem(targetItem, currentItem, type);
+}
+
+// Walk the frame tree and ensure that the URLs match the URLs in the item.
+bool HistoryController::urlsMatchItem(HistoryItem* item) const
+{
+    const KURL& currentURL = m_frame->loader()->documentLoader()->url();
+    if (!equalIgnoringFragmentIdentifier(currentURL, item->url()))
+        return false;
+
+    const HistoryItemVector& childItems = item->children();
+
+    unsigned size = childItems.size();
+    for (unsigned i = 0; i < size; ++i) {
+        Frame* childFrame = m_frame->tree()->child(childItems[i]->target());
+        if (childFrame && !childFrame->loader()->history()->urlsMatchItem(childItems[i].get()))
+            return false;
+    }
+
+    return true;
+}
+
+void HistoryController::updateForBackForwardNavigation()
+{
+#if !LOG_DISABLED
+    if (m_frame->loader()->documentLoader())
+        LOG(History, "WebCoreHistory: Updating History for back/forward navigation in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+#endif
+
+    // Must grab the current scroll position before disturbing it
+    saveScrollPositionAndViewStateToItem(m_previousItem.get());
+}
+
+void HistoryController::updateForReload()
+{
+#if !LOG_DISABLED
+    if (m_frame->loader()->documentLoader())
+        LOG(History, "WebCoreHistory: Updating History for reload in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+#endif
+
+    if (m_currentItem) {
+        pageCache()->remove(m_currentItem.get());
+    
+        if (m_frame->loader()->loadType() == FrameLoadTypeReload || m_frame->loader()->loadType() == FrameLoadTypeReloadFromOrigin)
+            saveScrollPositionAndViewStateToItem(m_currentItem.get());
+    
+        // Sometimes loading a page again leads to a different result because of cookies. Bugzilla 4072
+        if (m_frame->loader()->documentLoader()->unreachableURL().isEmpty())
+            m_currentItem->setURL(m_frame->loader()->documentLoader()->requestURL());
+    }
+}
+
+// There are 3 things you might think of as "history", all of which are handled by these functions.
+//
+//     1) Back/forward: The m_currentItem is part of this mechanism.
+//     2) Global history: Handled by the client.
+//     3) Visited links: Handled by the PageGroup.
+
+void HistoryController::updateForStandardLoad()
+{
+    LOG(History, "WebCoreHistory: Updating History for Standard Load in frame %s", m_frame->loader()->documentLoader()->url().string().ascii().data());
+
+    FrameLoader* frameLoader = m_frame->loader();
+
+    Settings* settings = m_frame->settings();
+    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
+    const KURL& historyURL = frameLoader->documentLoader()->urlForHistory();
+
+    if (!frameLoader->documentLoader()->isClientRedirect()) {
+        if (!historyURL.isEmpty()) {
+            updateBackForwardListClippedAtTarget(true);
+            if (!needPrivacy) {
+                frameLoader->client()->updateGlobalHistory();
+                frameLoader->documentLoader()->setDidCreateGlobalHistoryEntry(true);
+                if (frameLoader->documentLoader()->unreachableURL().isEmpty())
+                    frameLoader->client()->updateGlobalHistoryRedirectLinks();
+            }
+            if (Page* page = m_frame->page())
+                page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
+        }
+    } else if (frameLoader->documentLoader()->unreachableURL().isEmpty() && m_currentItem) {
+        m_currentItem->setURL(frameLoader->documentLoader()->url());
+        m_currentItem->setFormInfoFromRequest(frameLoader->documentLoader()->request());
+    }
+
+    if (!historyURL.isEmpty() && !needPrivacy) {
+        if (Page* page = m_frame->page())
+            page->group().addVisitedLink(historyURL);
+
+        if (!frameLoader->documentLoader()->didCreateGlobalHistoryEntry() && frameLoader->documentLoader()->unreachableURL().isEmpty() && !frameLoader->url().isEmpty())
+            frameLoader->client()->updateGlobalHistoryRedirectLinks();
+    }
+}
+
+void HistoryController::updateForRedirectWithLockedBackForwardList()
+{
+#if !LOG_DISABLED
+    if (m_frame->loader()->documentLoader())
+        LOG(History, "WebCoreHistory: Updating History for redirect load in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+#endif
+    
+    Settings* settings = m_frame->settings();
+    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
+    const KURL& historyURL = m_frame->loader()->documentLoader()->urlForHistory();
+
+    if (m_frame->loader()->documentLoader()->isClientRedirect()) {
+        if (!m_currentItem && !m_frame->tree()->parent()) {
+            if (!historyURL.isEmpty()) {
+                updateBackForwardListClippedAtTarget(true);
+                if (!needPrivacy) {
+                    m_frame->loader()->client()->updateGlobalHistory();
+                    m_frame->loader()->documentLoader()->setDidCreateGlobalHistoryEntry(true);
+                    if (m_frame->loader()->documentLoader()->unreachableURL().isEmpty())
+                        m_frame->loader()->client()->updateGlobalHistoryRedirectLinks();
+                }
+                if (Page* page = m_frame->page())
+                    page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
+            }
+        }
+        if (m_currentItem) {
+            m_currentItem->setURL(m_frame->loader()->documentLoader()->url());
+            m_currentItem->setFormInfoFromRequest(m_frame->loader()->documentLoader()->request());
+        }
+    } else {
+        Frame* parentFrame = m_frame->tree()->parent();
+        if (parentFrame && parentFrame->loader()->history()->m_currentItem)
+            parentFrame->loader()->history()->m_currentItem->setChildItem(createItem(true));
+    }
+
+    if (!historyURL.isEmpty() && !needPrivacy) {
+        if (Page* page = m_frame->page())
+            page->group().addVisitedLink(historyURL);
+
+        if (!m_frame->loader()->documentLoader()->didCreateGlobalHistoryEntry() && m_frame->loader()->documentLoader()->unreachableURL().isEmpty() && !m_frame->loader()->url().isEmpty())
+            m_frame->loader()->client()->updateGlobalHistoryRedirectLinks();
+    }
+}
+
+void HistoryController::updateForClientRedirect()
+{
+#if !LOG_DISABLED
+    if (m_frame->loader()->documentLoader())
+        LOG(History, "WebCoreHistory: Updating History for client redirect in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+#endif
+
+    // Clear out form data so we don't try to restore it into the incoming page.  Must happen after
+    // webcore has closed the URL and saved away the form state.
+    if (m_currentItem) {
+        m_currentItem->clearDocumentState();
+        m_currentItem->clearScrollPoint();
+    }
+
+    Settings* settings = m_frame->settings();
+    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
+    const KURL& historyURL = m_frame->loader()->documentLoader()->urlForHistory();
+
+    if (!historyURL.isEmpty() && !needPrivacy) {
+        if (Page* page = m_frame->page())
+            page->group().addVisitedLink(historyURL);
+    }
+}
+
+void HistoryController::updateForCommit()
+{
+    FrameLoader* frameLoader = m_frame->loader();
+#if !LOG_DISABLED
+    if (frameLoader->documentLoader())
+        LOG(History, "WebCoreHistory: Updating History for commit in frame %s", frameLoader->documentLoader()->title().utf8().data());
+#endif
+    FrameLoadType type = frameLoader->loadType();
+    if (isBackForwardLoadType(type) ||
+        ((type == FrameLoadTypeReload || type == FrameLoadTypeReloadFromOrigin) && !frameLoader->provisionalDocumentLoader()->unreachableURL().isEmpty())) {
+        // Once committed, we want to use current item for saving DocState, and
+        // the provisional item for restoring state.
+        // Note previousItem must be set before we close the URL, which will
+        // happen when the data source is made non-provisional below
+        m_previousItem = m_currentItem;
+        ASSERT(m_provisionalItem);
+        m_currentItem = m_provisionalItem;
+        m_provisionalItem = 0;
+    }
+}
+
+void HistoryController::updateForAnchorScroll()
+{
+    if (m_frame->loader()->url().isEmpty())
+        return;
+
+    Settings* settings = m_frame->settings();
+    if (!settings || settings->privateBrowsingEnabled())
+        return;
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    page->group().addVisitedLink(m_frame->loader()->url());
+}
+
+void HistoryController::updateForFrameLoadCompleted()
+{
+    // Even if already complete, we might have set a previous item on a frame that
+    // didn't do any data loading on the past transaction. Make sure to clear these out.
+    m_previousItem = 0;
+}
+
+void HistoryController::setCurrentItem(HistoryItem* item)
+{
+    m_currentItem = item;
+}
+
+void HistoryController::setCurrentItemTitle(const String& title)
+{
+    if (m_currentItem)
+        m_currentItem->setTitle(title);
+}
+
+void HistoryController::setProvisionalItem(HistoryItem* item)
+{
+    m_provisionalItem = item;
+}
+
+PassRefPtr<HistoryItem> HistoryController::createItem(bool useOriginal)
+{
+    DocumentLoader* docLoader = m_frame->loader()->documentLoader();
+    
+    KURL unreachableURL = docLoader ? docLoader->unreachableURL() : KURL();
+    
+    KURL url;
+    KURL originalURL;
+
+    if (!unreachableURL.isEmpty()) {
+        url = unreachableURL;
+        originalURL = unreachableURL;
+    } else {
+        originalURL = docLoader ? docLoader->originalURL() : KURL();
+        if (useOriginal)
+            url = originalURL;
+        else if (docLoader)
+            url = docLoader->requestURL();
+    }
+
+    LOG(History, "WebCoreHistory: Creating item for %s", url.string().ascii().data());
+    
+    // Frames that have never successfully loaded any content
+    // may have no URL at all. Currently our history code can't
+    // deal with such things, so we nip that in the bud here.
+    // Later we may want to learn to live with nil for URL.
+    // See bug 3368236 and related bugs for more information.
+    if (url.isEmpty()) 
+        url = blankURL();
+    if (originalURL.isEmpty())
+        originalURL = blankURL();
+    
+    Frame* parentFrame = m_frame->tree()->parent();
+    String parent = parentFrame ? parentFrame->tree()->name() : "";
+    String title = docLoader ? docLoader->title() : "";
+
+    RefPtr<HistoryItem> item = HistoryItem::create(url, m_frame->tree()->name(), parent, title);
+    item->setOriginalURLString(originalURL.string());
+
+    if (!unreachableURL.isEmpty() || !docLoader || docLoader->response().httpStatusCode() >= 400)
+        item->setLastVisitWasFailure(true);
+
+    // Save form state if this is a POST
+    if (docLoader) {
+        if (useOriginal)
+            item->setFormInfoFromRequest(docLoader->originalRequest());
+        else
+            item->setFormInfoFromRequest(docLoader->request());
+    }
+    
+    // Set the item for which we will save document state
+    m_previousItem = m_currentItem;
+    m_currentItem = item;
+    
+    return item.release();
+}
+
+PassRefPtr<HistoryItem> HistoryController::createItemTree(Frame* targetFrame, bool clipAtTarget)
+{
+    RefPtr<HistoryItem> bfItem = createItem(m_frame->tree()->parent() ? true : false);
+    if (m_previousItem)
+        saveScrollPositionAndViewStateToItem(m_previousItem.get());
+    if (!(clipAtTarget && m_frame == targetFrame)) {
+        // save frame state for items that aren't loading (khtml doesn't save those)
+        saveDocumentState();
+        for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling()) {
+            FrameLoader* childLoader = child->loader();
+            bool hasChildLoaded = childLoader->frameHasLoaded();
+
+            // If the child is a frame corresponding to an <object> element that never loaded,
+            // we don't want to create a history item, because that causes fallback content
+            // to be ignored on reload.
+            
+            if (!(!hasChildLoaded && childLoader->isHostedByObjectElement()))
+                bfItem->addChildItem(childLoader->history()->createItemTree(targetFrame, clipAtTarget));
+        }
+    }
+    if (m_frame == targetFrame)
+        bfItem->setIsTargetItem(true);
+    return bfItem;
+}
+
+// The general idea here is to traverse the frame tree and the item tree in parallel,
+// tracking whether each frame already has the content the item requests.  If there is
+// a match (by URL), we just restore scroll position and recurse.  Otherwise we must
+// reload that frame, and all its kids.
+void HistoryController::recursiveGoToItem(HistoryItem* item, HistoryItem* fromItem, FrameLoadType type)
+{
+    ASSERT(item);
+    ASSERT(fromItem);
+
+    KURL itemURL = item->url();
+    KURL currentURL;
+    if (m_frame->loader()->documentLoader())
+        currentURL = m_frame->loader()->documentLoader()->url();
+
+    // Always reload the target frame of the item we're going to.  This ensures that we will
+    // do -some- load for the transition, which means a proper notification will be posted
+    // to the app.
+    // The exact URL has to match, including fragment.  We want to go through the _load
+    // method, even if to do a within-page navigation.
+    // The current frame tree and the frame tree snapshot in the item have to match.
+    if (!item->isTargetItem() &&
+        itemURL == currentURL &&
+        ((m_frame->tree()->name().isEmpty() && item->target().isEmpty()) || m_frame->tree()->name() == item->target()) &&
+        childFramesMatchItem(item))
+    {
+        // This content is good, so leave it alone and look for children that need reloading
+        // Save form state (works from currentItem, since prevItem is nil)
+        ASSERT(!m_previousItem);
+        saveDocumentState();
+        saveScrollPositionAndViewStateToItem(m_currentItem.get());
+
+        if (FrameView* view = m_frame->view())
+            view->setWasScrolledByUser(false);
+
+        m_currentItem = item;
+                
+        // Restore form state (works from currentItem)
+        restoreDocumentState();
+        
+        // Restore the scroll position (we choose to do this rather than going back to the anchor point)
+        restoreScrollPositionAndViewState();
+        
+        const HistoryItemVector& childItems = item->children();
+        
+        int size = childItems.size();
+        for (int i = 0; i < size; ++i) {
+            String childFrameName = childItems[i]->target();
+            HistoryItem* fromChildItem = fromItem->childItemWithTarget(childFrameName);
+            ASSERT(fromChildItem || fromItem->isTargetItem());
+            Frame* childFrame = m_frame->tree()->child(childFrameName);
+            ASSERT(childFrame);
+            childFrame->loader()->history()->recursiveGoToItem(childItems[i].get(), fromChildItem, type);
+        }
+    } else {
+        m_frame->loader()->loadItem(item, type);
+    }
+}
+
+// helper method that determines whether the subframes described by the item's subitems
+// match our own current frameset
+bool HistoryController::childFramesMatchItem(HistoryItem* item) const
+{
+    const HistoryItemVector& childItems = item->children();
+    if (childItems.size() != m_frame->tree()->childCount())
+        return false;
+    
+    unsigned size = childItems.size();
+    for (unsigned i = 0; i < size; ++i) {
+        if (!m_frame->tree()->child(childItems[i]->target()))
+            return false;
+    }
+    
+    // Found matches for all item targets
+    return true;
+}
+
+void HistoryController::updateBackForwardListClippedAtTarget(bool doClip)
+{
+    // In the case of saving state about a page with frames, we store a tree of items that mirrors the frame tree.  
+    // The item that was the target of the user's navigation is designated as the "targetItem".  
+    // When this function is called with doClip=true we're able to create the whole tree except for the target's children, 
+    // which will be loaded in the future. That part of the tree will be filled out as the child loads are committed.
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    if (m_frame->loader()->documentLoader()->urlForHistory().isEmpty())
+        return;
+
+    Frame* mainFrame = page->mainFrame();
+    ASSERT(mainFrame);
+    FrameLoader* frameLoader = mainFrame->loader();
+
+    frameLoader->checkDidPerformFirstNavigation();
+
+    RefPtr<HistoryItem> item = frameLoader->history()->createItemTree(m_frame, doClip);
+    LOG(BackForward, "WebCoreBackForward - Adding backforward item %p for frame %s", item.get(), m_frame->loader()->documentLoader()->url().string().ascii().data());
+    page->backForwardList()->addItem(item);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/HistoryController.h b/src/3rdparty/webkit/WebCore/loader/HistoryController.h
new file mode 100644
index 0000000000..4ecae69f9e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/HistoryController.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HistoryController_h
+#define HistoryController_h
+
+#include "FrameLoaderTypes.h"
+#include "PlatformString.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class Frame;
+class HistoryItem;
+
+class HistoryController : public Noncopyable {
+public:
+    HistoryController(Frame*);
+    ~HistoryController();
+
+    void saveScrollPositionAndViewStateToItem(HistoryItem*);
+    void restoreScrollPositionAndViewState();
+
+    void updateBackForwardListForFragmentScroll();
+
+    void saveDocumentState();
+    void saveDocumentAndScrollState();
+    void restoreDocumentState();
+
+    void invalidateCurrentItemCachedPage();
+
+    void goToItem(HistoryItem*, FrameLoadType);
+    bool urlsMatchItem(HistoryItem*) const;
+
+    void updateForBackForwardNavigation();
+    void updateForReload();
+    void updateForStandardLoad();
+    void updateForRedirectWithLockedBackForwardList();
+    void updateForClientRedirect();
+    void updateForCommit();
+    void updateForAnchorScroll();
+    void updateForFrameLoadCompleted();
+
+    HistoryItem* currentItem() const { return m_currentItem.get(); }
+    void setCurrentItem(HistoryItem*);
+    void setCurrentItemTitle(const String&);
+
+    HistoryItem* provisionalItem() const { return m_provisionalItem.get(); }
+    void setProvisionalItem(HistoryItem*);
+
+private:
+    PassRefPtr<HistoryItem> createItem(bool useOriginal);
+    PassRefPtr<HistoryItem> createItemTree(Frame* targetFrame, bool clipAtTarget);
+
+    void recursiveGoToItem(HistoryItem*, HistoryItem*, FrameLoadType);
+    bool childFramesMatchItem(HistoryItem*) const;
+    void updateBackForwardListClippedAtTarget(bool doClip);
+
+    Frame* m_frame;
+
+    RefPtr<HistoryItem> m_currentItem;
+    RefPtr<HistoryItem> m_previousItem;
+    RefPtr<HistoryItem> m_provisionalItem;
+};
+
+} // namespace WebCore
+
+#endif // HistoryController_h
diff --git a/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp b/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp
index b183a662f7..cdc31bcd09 100644
--- a/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp
@@ -31,34 +31,40 @@
 
 namespace WebCore {
 
-class ImageLoadEventSender {
+class ImageEventSender {
 public:
-    ImageLoadEventSender();
+    ImageEventSender(const AtomicString& eventType);
 
-    void dispatchLoadEventSoon(ImageLoader*);
-    void cancelLoadEvent(ImageLoader*);
+    void dispatchEventSoon(ImageLoader*);
+    void cancelEvent(ImageLoader*);
 
-    void dispatchPendingLoadEvents();
+    void dispatchPendingEvents();
 
 private:
-    ~ImageLoadEventSender();
+    void timerFired(Timer<ImageEventSender>*);
 
-    void timerFired(Timer<ImageLoadEventSender>*);
-
-    Timer<ImageLoadEventSender> m_timer;
+    AtomicString m_eventType;
+    Timer<ImageEventSender> m_timer;
     Vector<ImageLoader*> m_dispatchSoonList;
     Vector<ImageLoader*> m_dispatchingList;
 };
 
-static ImageLoadEventSender& loadEventSender()
+static ImageEventSender& beforeLoadEventSender()
+{
+    DEFINE_STATIC_LOCAL(ImageEventSender, sender, (eventNames().beforeloadEvent));
+    return sender;
+}
+
+static ImageEventSender& loadEventSender()
 {
-    DEFINE_STATIC_LOCAL(ImageLoadEventSender, sender, ());
+    DEFINE_STATIC_LOCAL(ImageEventSender, sender, (eventNames().loadEvent));
     return sender;
 }
 
 ImageLoader::ImageLoader(Element* element)
     : m_element(element)
     , m_image(0)
+    , m_firedBeforeLoad(true)
     , m_firedLoad(true)
     , m_imageComplete(true)
     , m_loadManually(false)
@@ -69,7 +75,10 @@ ImageLoader::~ImageLoader()
 {
     if (m_image)
         m_image->removeClient(this);
-    loadEventSender().cancelLoadEvent(this);
+    if (!m_firedBeforeLoad)
+        beforeLoadEventSender().cancelEvent(this);
+    if (!m_firedLoad)
+        loadEventSender().cancelEvent(this);
 }
 
 void ImageLoader::setImage(CachedImage* newImage)
@@ -78,6 +87,7 @@ void ImageLoader::setImage(CachedImage* newImage)
     CachedImage* oldImage = m_image.get();
     if (newImage != oldImage) {
         setLoadingImage(newImage);
+        m_firedBeforeLoad = true;
         m_firedLoad = true;
         m_imageComplete = true;
         if (newImage)
@@ -89,16 +99,16 @@ void ImageLoader::setImage(CachedImage* newImage)
     if (RenderObject* renderer = m_element->renderer()) {
         if (!renderer->isImage())
             return;
-
         toRenderImage(renderer)->resetAnimation();
     }
 }
 
 void ImageLoader::setLoadingImage(CachedImage* loadingImage)
 {
-    m_firedLoad = false;
-    m_imageComplete = false;
     m_image = loadingImage;
+    m_firedBeforeLoad = !loadingImage;
+    m_firedLoad = !loadingImage;
+    m_imageComplete = !loadingImage;
 }
 
 void ImageLoader::updateFromElement()
@@ -137,8 +147,13 @@ void ImageLoader::updateFromElement()
     CachedImage* oldImage = m_image.get();
     if (newImage != oldImage) {
         setLoadingImage(newImage);
-        if (newImage)
+        if (newImage) {
             newImage->addClient(this);
+            if (!m_element->document()->hasListenerType(Document::BEFORELOAD_LISTENER))
+                dispatchPendingBeforeLoadEvent();
+            else
+                beforeLoadEventSender().dispatchEventSoon(this);
+        }
         if (oldImage)
             oldImage->removeClient(this);
     }
@@ -146,7 +161,6 @@ void ImageLoader::updateFromElement()
     if (RenderObject* renderer = m_element->renderer()) {
         if (!renderer->isImage())
             return;
-
         toRenderImage(renderer)->resetAnimation();
     }
 }
@@ -161,16 +175,48 @@ void ImageLoader::updateFromElementIgnoringPreviousError()
 void ImageLoader::notifyFinished(CachedResource*)
 {
     ASSERT(m_failedLoadURL.isEmpty());
+
     m_imageComplete = true;
+    if (haveFiredBeforeLoadEvent())
+        updateRenderer();
 
-    loadEventSender().dispatchLoadEventSoon(this);
+    loadEventSender().dispatchEventSoon(this);
+}
 
+void ImageLoader::updateRenderer()
+{
     if (RenderObject* renderer = m_element->renderer()) {
         if (!renderer->isImage())
             return;
+        RenderImage* imageRenderer = toRenderImage(renderer);
+        
+        // Only update the renderer if it doesn't have an image or if what we have
+        // is a complete image.  This prevents flickering in the case where a dynamic
+        // change is happening between two images.
+        CachedImage* cachedImage = imageRenderer->cachedImage();
+        if (m_image != cachedImage && (m_imageComplete || !imageRenderer->cachedImage()))
+            imageRenderer->setCachedImage(m_image.get());
+    }
+}
 
-        toRenderImage(renderer)->setCachedImage(m_image.get());
+void ImageLoader::dispatchPendingBeforeLoadEvent()
+{
+    if (m_firedBeforeLoad)
+        return;
+    if (!m_image)
+        return;
+    if (!m_element->document()->attached())
+        return;
+    m_firedBeforeLoad = true;
+    if (m_element->dispatchBeforeLoadEvent(m_image->url())) {
+        updateRenderer();
+        return;
+    }
+    if (m_image) {
+        m_image->removeClient(this);
+        m_image = 0;
     }
+    loadEventSender().cancelEvent(this);
 }
 
 void ImageLoader::dispatchPendingLoadEvent()
@@ -185,24 +231,26 @@ void ImageLoader::dispatchPendingLoadEvent()
     dispatchLoadEvent();
 }
 
-void ImageLoader::dispatchPendingLoadEvents()
+void ImageLoader::dispatchPendingEvents()
 {
-    loadEventSender().dispatchPendingLoadEvents();
+    beforeLoadEventSender().dispatchPendingEvents();
+    loadEventSender().dispatchPendingEvents();
 }
 
-ImageLoadEventSender::ImageLoadEventSender()
-    : m_timer(this, &ImageLoadEventSender::timerFired)
+ImageEventSender::ImageEventSender(const AtomicString& eventType)
+    : m_eventType(eventType)
+    , m_timer(this, &ImageEventSender::timerFired)
 {
 }
 
-void ImageLoadEventSender::dispatchLoadEventSoon(ImageLoader* loader)
+void ImageEventSender::dispatchEventSoon(ImageLoader* loader)
 {
     m_dispatchSoonList.append(loader);
     if (!m_timer.isActive())
         m_timer.startOneShot(0);
 }
 
-void ImageLoadEventSender::cancelLoadEvent(ImageLoader* loader)
+void ImageEventSender::cancelEvent(ImageLoader* loader)
 {
     // Remove instances of this loader from both lists.
     // Use loops because we allow multiple instances to get into the lists.
@@ -220,7 +268,7 @@ void ImageLoadEventSender::cancelLoadEvent(ImageLoader* loader)
         m_timer.stop();
 }
 
-void ImageLoadEventSender::dispatchPendingLoadEvents()
+void ImageEventSender::dispatchPendingEvents()
 {
     // Need to avoid re-entering this function; if new dispatches are
     // scheduled before the parent finishes processing the list, they
@@ -233,15 +281,19 @@ void ImageLoadEventSender::dispatchPendingLoadEvents()
     m_dispatchingList.swap(m_dispatchSoonList);
     size_t size = m_dispatchingList.size();
     for (size_t i = 0; i < size; ++i) {
-        if (ImageLoader* loader = m_dispatchingList[i])
-            loader->dispatchPendingLoadEvent();
+        if (ImageLoader* loader = m_dispatchingList[i]) {
+            if (m_eventType == eventNames().beforeloadEvent)
+                loader->dispatchPendingBeforeLoadEvent();
+            else
+                loader->dispatchPendingLoadEvent();
+        }
     }
     m_dispatchingList.clear();
 }
 
-void ImageLoadEventSender::timerFired(Timer<ImageLoadEventSender>*)
+void ImageEventSender::timerFired(Timer<ImageEventSender>*)
 {
-    dispatchPendingLoadEvents();
+    dispatchPendingEvents();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/ImageLoader.h b/src/3rdparty/webkit/WebCore/loader/ImageLoader.h
index 3496f75c75..7f42e3397f 100644
--- a/src/3rdparty/webkit/WebCore/loader/ImageLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/ImageLoader.h
@@ -53,9 +53,10 @@ public:
 
     void setLoadManually(bool loadManually) { m_loadManually = loadManually; }
 
+    bool haveFiredBeforeLoadEvent() const { return m_firedBeforeLoad; }
     bool haveFiredLoadEvent() const { return m_firedLoad; }
 
-    static void dispatchPendingLoadEvents();
+    static void dispatchPendingEvents();
 
 protected:
     virtual void notifyFinished(CachedResource*);
@@ -64,14 +65,18 @@ private:
     virtual void dispatchLoadEvent() = 0;
     virtual String sourceURI(const AtomicString&) const = 0;
 
-    friend class ImageLoadEventSender;
+    friend class ImageEventSender;
+    void dispatchPendingBeforeLoadEvent();
     void dispatchPendingLoadEvent();
 
     void setLoadingImage(CachedImage*);
 
+    void updateRenderer();
+
     Element* m_element;
     CachedResourceHandle<CachedImage> m_image;
     AtomicString m_failedLoadURL;
+    bool m_firedBeforeLoad : 1;
     bool m_firedLoad : 1;
     bool m_imageComplete : 1;
     bool m_loadManually : 1;
diff --git a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
index a3e90fd897..c37daef344 100644
--- a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
@@ -77,7 +77,7 @@ void MainResourceLoader::receivedError(const ResourceError& error)
 
     if (!cancelled()) {
         ASSERT(!reachedTerminalState());
-        frameLoader()->didFailToLoad(this, error);
+        frameLoader()->notifier()->didFailToLoad(this, error);
         
         releaseResources();
     }
@@ -93,7 +93,7 @@ void MainResourceLoader::didCancel(const ResourceError& error)
     RefPtr<MainResourceLoader> protect(this);
 
     if (m_waitingForContentPolicy) {
-        frameLoader()->cancelContentPolicyCheck();
+        frameLoader()->policyChecker()->cancelCheck();
         ASSERT(m_waitingForContentPolicy);
         m_waitingForContentPolicy = false;
         deref(); // balances ref in didReceiveResponse
@@ -182,7 +182,7 @@ void MainResourceLoader::willSendRequest(ResourceRequest& newRequest, const Reso
     // synchronously for these redirect cases.
     if (!redirectResponse.isNull()) {
         ref(); // balanced by deref in continueAfterNavigationPolicy
-        frameLoader()->checkNavigationPolicy(newRequest, callContinueAfterNavigationPolicy, this);
+        frameLoader()->policyChecker()->checkNavigationPolicy(newRequest, callContinueAfterNavigationPolicy, this);
     }
 }
 
@@ -205,7 +205,7 @@ void MainResourceLoader::continueAfterContentPolicy(PolicyAction contentPolicy,
         // Prevent remote web archives from loading because they can claim to be from any domain and thus avoid cross-domain security checks (4120255).
         bool isRemoteWebArchive = equalIgnoringCase("application/x-webarchive", mimeType) && !m_substituteData.isValid() && !url.isLocalFile();
         if (!frameLoader()->canShowMIMEType(mimeType) || isRemoteWebArchive) {
-            frameLoader()->cannotShowMIMEType(r);
+            frameLoader()->policyChecker()->cannotShowMIMEType(r);
             // Check reachedTerminalState since the load may have already been cancelled inside of _handleUnimplementablePolicyWithErrorCode::.
             if (!reachedTerminalState())
                 stopLoadingForPolicyChange();
@@ -320,7 +320,25 @@ void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
     ASSERT(!m_waitingForContentPolicy);
     m_waitingForContentPolicy = true;
     ref(); // balanced by deref in continueAfterContentPolicy and didCancel
-    frameLoader()->checkContentPolicy(m_response.mimeType(), callContinueAfterContentPolicy, this);
+
+    ASSERT(frameLoader()->activeDocumentLoader());
+
+    // Always show content with valid substitute data.
+    if (frameLoader()->activeDocumentLoader()->substituteData().isValid()) {
+        callContinueAfterContentPolicy(this, PolicyUse);
+        return;
+    }
+
+#if ENABLE(FTPDIR)
+    // Respect the hidden FTP Directory Listing pref so it can be tested even if the policy delegate might otherwise disallow it
+    Settings* settings = m_frame->settings();
+    if (settings && settings->forceFTPDirectoryListings() && m_response.mimeType() == "application/x-ftp-directory") {
+        callContinueAfterContentPolicy(this, PolicyUse);
+        return;
+    }
+#endif
+
+    frameLoader()->policyChecker()->checkContentPolicy(m_response.mimeType(), callContinueAfterContentPolicy, this);
 }
 
 void MainResourceLoader::didReceiveData(const char* data, int length, long long lengthReceived, bool allAtOnce)
diff --git a/src/3rdparty/webkit/WebCore/loader/PolicyCallback.cpp b/src/3rdparty/webkit/WebCore/loader/PolicyCallback.cpp
new file mode 100644
index 0000000000..14799cf7ea
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/PolicyCallback.cpp
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PolicyCallback.h"
+
+#include "FormState.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "HTMLFormElement.h"
+
+namespace WebCore {
+
+PolicyCallback::PolicyCallback()
+    : m_navigationFunction(0)
+    , m_newWindowFunction(0)
+    , m_contentFunction(0)
+{
+}
+
+PolicyCallback::~PolicyCallback()
+{
+}
+
+void PolicyCallback::clear()
+{
+    clearRequest();
+    m_navigationFunction = 0;
+    m_newWindowFunction = 0;
+    m_contentFunction = 0;
+}
+
+void PolicyCallback::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
+    NavigationPolicyDecisionFunction function, void* argument)
+{
+    m_request = request;
+    m_formState = formState;
+    m_frameName = String();
+
+    m_navigationFunction = function;
+    m_newWindowFunction = 0;
+    m_contentFunction = 0;
+    m_argument = argument;
+}
+
+void PolicyCallback::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
+    const String& frameName, NewWindowPolicyDecisionFunction function, void* argument)
+{
+    m_request = request;
+    m_formState = formState;
+    m_frameName = frameName;
+
+    m_navigationFunction = 0;
+    m_newWindowFunction = function;
+    m_contentFunction = 0;
+    m_argument = argument;
+}
+
+void PolicyCallback::set(ContentPolicyDecisionFunction function, void* argument)
+{
+    m_request = ResourceRequest();
+    m_formState = 0;
+    m_frameName = String();
+
+    m_navigationFunction = 0;
+    m_newWindowFunction = 0;
+    m_contentFunction = function;
+    m_argument = argument;
+}
+
+void PolicyCallback::call(bool shouldContinue)
+{
+    if (m_navigationFunction)
+        m_navigationFunction(m_argument, m_request, m_formState.get(), shouldContinue);
+    if (m_newWindowFunction)
+        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, shouldContinue);
+    ASSERT(!m_contentFunction);
+}
+
+void PolicyCallback::call(PolicyAction action)
+{
+    ASSERT(!m_navigationFunction);
+    ASSERT(!m_newWindowFunction);
+    ASSERT(m_contentFunction);
+    m_contentFunction(m_argument, action);
+}
+
+void PolicyCallback::clearRequest()
+{
+    m_request = ResourceRequest();
+    m_formState = 0;
+    m_frameName = String();
+}
+
+void PolicyCallback::cancel()
+{
+    clearRequest();
+    if (m_navigationFunction)
+        m_navigationFunction(m_argument, m_request, m_formState.get(), false);
+    if (m_newWindowFunction)
+        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, false);
+    if (m_contentFunction)
+        m_contentFunction(m_argument, PolicyIgnore);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/PolicyCallback.h b/src/3rdparty/webkit/WebCore/loader/PolicyCallback.h
new file mode 100644
index 0000000000..757fff822a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/PolicyCallback.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PolicyCallback_h
+#define PolicyCallback_h
+
+#include "FrameLoaderTypes.h"
+#include "PlatformString.h"
+#include "ResourceRequest.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class FormState;
+
+typedef void (*NavigationPolicyDecisionFunction)(void* argument,
+    const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+typedef void (*NewWindowPolicyDecisionFunction)(void* argument,
+    const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
+typedef void (*ContentPolicyDecisionFunction)(void* argument, PolicyAction);
+
+class PolicyCallback {
+public:
+    PolicyCallback();
+    ~PolicyCallback();
+
+    void clear();
+    void set(const ResourceRequest&, PassRefPtr<FormState>,
+        NavigationPolicyDecisionFunction, void* argument);
+    void set(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName,
+        NewWindowPolicyDecisionFunction, void* argument);
+    void set(ContentPolicyDecisionFunction, void* argument);
+
+    const ResourceRequest& request() const { return m_request; }
+    void clearRequest();
+
+    void call(bool shouldContinue);
+    void call(PolicyAction);
+    void cancel();
+
+private:
+    ResourceRequest m_request;
+    RefPtr<FormState> m_formState;
+    String m_frameName;
+
+    NavigationPolicyDecisionFunction m_navigationFunction;
+    NewWindowPolicyDecisionFunction m_newWindowFunction;
+    ContentPolicyDecisionFunction m_contentFunction;
+    void* m_argument;
+};
+
+} // namespace WebCore
+
+#endif // PolicyCallback_h
diff --git a/src/3rdparty/webkit/WebCore/loader/PolicyChecker.cpp b/src/3rdparty/webkit/WebCore/loader/PolicyChecker.cpp
new file mode 100644
index 0000000000..196ab4ff30
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/PolicyChecker.cpp
@@ -0,0 +1,197 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PolicyChecker.h"
+
+#include "DocumentLoader.h"
+#include "FormState.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "HTMLFormElement.h"
+
+namespace WebCore {
+
+PolicyChecker::PolicyChecker(Frame* frame)
+    : m_frame(frame)
+    , m_delegateIsDecidingNavigationPolicy(false)
+    , m_delegateIsHandlingUnimplementablePolicy(false)
+    , m_loadType(FrameLoadTypeStandard)
+{
+}
+
+void PolicyChecker::checkNavigationPolicy(const ResourceRequest& newRequest, NavigationPolicyDecisionFunction function, void* argument)
+{
+    checkNavigationPolicy(newRequest, m_frame->loader()->activeDocumentLoader(), 0, function, argument);
+}
+
+void PolicyChecker::checkNavigationPolicy(const ResourceRequest& request, DocumentLoader* loader,
+    PassRefPtr<FormState> formState, NavigationPolicyDecisionFunction function, void* argument)
+{
+    NavigationAction action = loader->triggeringAction();
+    if (action.isEmpty()) {
+        action = NavigationAction(request.url(), NavigationTypeOther);
+        loader->setTriggeringAction(action);
+    }
+
+    // Don't ask more than once for the same request or if we are loading an empty URL.
+    // This avoids confusion on the part of the client.
+    if (equalIgnoringHeaderFields(request, loader->lastCheckedRequest()) || (!request.isNull() && request.url().isEmpty())) {
+        function(argument, request, 0, true);
+        loader->setLastCheckedRequest(request);
+        return;
+    }
+    
+    // We are always willing to show alternate content for unreachable URLs;
+    // treat it like a reload so it maintains the right state for b/f list.
+    if (loader->substituteData().isValid() && !loader->substituteData().failingURL().isEmpty()) {
+        if (isBackForwardLoadType(m_loadType))
+            m_loadType = FrameLoadTypeReload;
+        function(argument, request, 0, true);
+        return;
+    }
+    
+    loader->setLastCheckedRequest(request);
+
+    m_callback.set(request, formState.get(), function, argument);
+
+    m_delegateIsDecidingNavigationPolicy = true;
+    m_frame->loader()->client()->dispatchDecidePolicyForNavigationAction(&PolicyChecker::continueAfterNavigationPolicy,
+        action, request, formState);
+    m_delegateIsDecidingNavigationPolicy = false;
+}
+
+void PolicyChecker::checkNewWindowPolicy(const NavigationAction& action, NewWindowPolicyDecisionFunction function,
+    const ResourceRequest& request, PassRefPtr<FormState> formState, const String& frameName, void* argument)
+{
+    m_callback.set(request, formState, frameName, function, argument);
+    m_frame->loader()->client()->dispatchDecidePolicyForNewWindowAction(&PolicyChecker::continueAfterNewWindowPolicy,
+        action, request, formState, frameName);
+}
+
+void PolicyChecker::checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction function, void* argument)
+{
+    m_callback.set(function, argument);
+    m_frame->loader()->client()->dispatchDecidePolicyForMIMEType(&PolicyChecker::continueAfterContentPolicy,
+        MIMEType, m_frame->loader()->activeDocumentLoader()->request());
+}
+
+void PolicyChecker::cancelCheck()
+{
+    m_frame->loader()->client()->cancelPolicyCheck();
+    m_callback.clear();
+}
+
+void PolicyChecker::stopCheck()
+{
+    m_frame->loader()->client()->cancelPolicyCheck();
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+    callback.cancel();
+}
+
+void PolicyChecker::cannotShowMIMEType(const ResourceResponse& response)
+{
+    handleUnimplementablePolicy(m_frame->loader()->client()->cannotShowMIMETypeError(response));
+}
+
+void PolicyChecker::continueLoadAfterWillSubmitForm(PolicyAction)
+{
+    // See header file for an explaination of why this function
+    // isn't like the others.
+    m_frame->loader()->continueLoadAfterWillSubmitForm();
+}
+
+void PolicyChecker::continueAfterNavigationPolicy(PolicyAction policy)
+{
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+
+    bool shouldContinue = policy == PolicyUse;
+
+    switch (policy) {
+        case PolicyIgnore:
+            callback.clearRequest();
+            break;
+        case PolicyDownload:
+            m_frame->loader()->client()->startDownload(callback.request());
+            callback.clearRequest();
+            break;
+        case PolicyUse: {
+            ResourceRequest request(callback.request());
+
+            if (!m_frame->loader()->client()->canHandleRequest(request)) {
+                handleUnimplementablePolicy(m_frame->loader()->cannotShowURLError(callback.request()));
+                callback.clearRequest();
+                shouldContinue = false;
+            }
+            break;
+        }
+    }
+
+    callback.call(shouldContinue);
+}
+
+void PolicyChecker::continueAfterNewWindowPolicy(PolicyAction policy)
+{
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+
+    switch (policy) {
+        case PolicyIgnore:
+            callback.clearRequest();
+            break;
+        case PolicyDownload:
+            m_frame->loader()->client()->startDownload(callback.request());
+            callback.clearRequest();
+            break;
+        case PolicyUse:
+            break;
+    }
+
+    callback.call(policy == PolicyUse);
+}
+
+void PolicyChecker::continueAfterContentPolicy(PolicyAction policy)
+{
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+    callback.call(policy);
+}
+
+void PolicyChecker::handleUnimplementablePolicy(const ResourceError& error)
+{
+    m_delegateIsHandlingUnimplementablePolicy = true;
+    m_frame->loader()->client()->dispatchUnableToImplementPolicy(error);
+    m_delegateIsHandlingUnimplementablePolicy = false;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/PolicyChecker.h b/src/3rdparty/webkit/WebCore/loader/PolicyChecker.h
new file mode 100644
index 0000000000..541729c36e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/PolicyChecker.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PolicyChecker_h
+#define PolicyChecker_h
+
+#include "FrameLoaderTypes.h"
+#include "PlatformString.h"
+#include "PolicyCallback.h"
+#include "ResourceRequest.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class DocumentLoader;
+class FormState;
+class Frame;
+class NavigationAction;
+class ResourceError;
+class ResourceResponse;
+
+class PolicyChecker : public Noncopyable {
+public:
+    PolicyChecker(Frame*);
+
+    void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>, NavigationPolicyDecisionFunction, void* argument);
+    void checkNavigationPolicy(const ResourceRequest&, NavigationPolicyDecisionFunction, void* argument);
+    void checkNewWindowPolicy(const NavigationAction&, NewWindowPolicyDecisionFunction, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, void* argument);
+    void checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction, void* argument);
+
+    // FIXME: These are different.  They could use better names.
+    void cancelCheck();
+    void stopCheck();
+
+    void cannotShowMIMEType(const ResourceResponse&);
+
+    FrameLoadType loadType() const { return m_loadType; }
+    void setLoadType(FrameLoadType loadType) { m_loadType = loadType; }
+
+    bool delegateIsDecidingNavigationPolicy() const { return m_delegateIsDecidingNavigationPolicy; }
+    bool delegateIsHandlingUnimplementablePolicy() const { return m_delegateIsHandlingUnimplementablePolicy; }
+
+    // FIXME: This function is a cheat.  Basically, this is just an asynchronouc callback
+    // from the FrameLoaderClient, but this callback uses the policy types and so has to
+    // live on this object.  In the long term, we should create a type for non-policy
+    // callbacks from the FrameLoaderClient and remove this vestige.  I just don't have
+    // the heart to hack on all the platforms to make that happen right now.
+    void continueLoadAfterWillSubmitForm(PolicyAction);
+
+private:
+    void continueAfterNavigationPolicy(PolicyAction);
+    void continueAfterNewWindowPolicy(PolicyAction);
+    void continueAfterContentPolicy(PolicyAction);
+
+    void handleUnimplementablePolicy(const ResourceError&);
+
+    Frame* m_frame;
+
+    bool m_delegateIsDecidingNavigationPolicy;
+    bool m_delegateIsHandlingUnimplementablePolicy;
+
+    // This identifies the type of navigation action which prompted this load. Note 
+    // that WebKit conveys this value as the WebActionNavigationTypeKey value
+    // on navigation action delegate callbacks.
+    FrameLoadType m_loadType;
+    PolicyCallback m_callback;
+};
+
+} // namespace WebCore
+
+#endif // PolicyChecker_h
diff --git a/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.cpp b/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.cpp
new file mode 100644
index 0000000000..f015c12934
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.cpp
@@ -0,0 +1,374 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2009 Adam Barth. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RedirectScheduler.h"
+
+#include "DocumentLoader.h"
+#include "Event.h"
+#include "FormState.h"
+#include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "FrameLoader.h"
+#include "HTMLFormElement.h"
+#include <wtf/CurrentTime.h>
+
+namespace WebCore {
+
+struct ScheduledRedirection {
+    enum Type { redirection, locationChange, historyNavigation, formSubmission };
+
+    const Type type;
+    const double delay;
+    const String url;
+    const String referrer;
+    const FrameLoadRequest frameRequest;
+    const RefPtr<Event> event;
+    const RefPtr<FormState> formState;
+    const int historySteps;
+    const bool lockHistory;
+    const bool lockBackForwardList;
+    const bool wasUserGesture;
+    const bool wasRefresh;
+    const bool wasDuringLoad;
+    bool toldClient;
+
+    ScheduledRedirection(double delay, const String& url, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh)
+        : type(redirection)
+        , delay(delay)
+        , url(url)
+        , historySteps(0)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(wasUserGesture)
+        , wasRefresh(refresh)
+        , wasDuringLoad(false)
+        , toldClient(false)
+    {
+        ASSERT(!url.isEmpty());
+    }
+
+    ScheduledRedirection(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh, bool duringLoad)
+        : type(locationChange)
+        , delay(0)
+        , url(url)
+        , referrer(referrer)
+        , historySteps(0)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(wasUserGesture)
+        , wasRefresh(refresh)
+        , wasDuringLoad(duringLoad)
+        , toldClient(false)
+    {
+        ASSERT(!url.isEmpty());
+    }
+
+    explicit ScheduledRedirection(int historyNavigationSteps)
+        : type(historyNavigation)
+        , delay(0)
+        , historySteps(historyNavigationSteps)
+        , lockHistory(false)
+        , lockBackForwardList(false)
+        , wasUserGesture(false)
+        , wasRefresh(false)
+        , wasDuringLoad(false)
+        , toldClient(false)
+    {
+    }
+
+    ScheduledRedirection(const FrameLoadRequest& frameRequest,
+            bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState,
+            bool duringLoad)
+        : type(formSubmission)
+        , delay(0)
+        , frameRequest(frameRequest)
+        , event(event)
+        , formState(formState)
+        , historySteps(0)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(false)
+        , wasRefresh(false)
+        , wasDuringLoad(duringLoad)
+        , toldClient(false)
+    {
+        ASSERT(!frameRequest.isEmpty());
+        ASSERT(this->formState);
+    }
+};
+
+RedirectScheduler::RedirectScheduler(Frame* frame)
+    : m_frame(frame)
+    , m_timer(this, &RedirectScheduler::timerFired)
+{
+}
+
+RedirectScheduler::~RedirectScheduler()
+{
+}
+
+bool RedirectScheduler::redirectScheduledDuringLoad()
+{
+    return m_scheduledRedirection && m_scheduledRedirection->wasDuringLoad;
+}
+
+void RedirectScheduler::clear()
+{
+    m_timer.stop();
+    m_scheduledRedirection.clear();
+}
+
+void RedirectScheduler::scheduleRedirect(double delay, const String& url)
+{
+    if (delay < 0 || delay > INT_MAX / 1000)
+        return;
+        
+    if (!m_frame->page())
+        return;
+
+    if (url.isEmpty())
+        return;
+
+    // We want a new history item if the refresh timeout is > 1 second.
+    if (!m_scheduledRedirection || delay <= m_scheduledRedirection->delay)
+        schedule(new ScheduledRedirection(delay, url, true, delay <= 1, false, false));
+}
+
+bool RedirectScheduler::mustLockBackForwardList(Frame* targetFrame)
+{
+    // Navigation of a subframe during loading of an ancestor frame does not create a new back/forward item.
+    // The definition of "during load" is any time before all handlers for the load event have been run.
+    // See https://bugs.webkit.org/show_bug.cgi?id=14957 for the original motivation for this.
+    
+    for (Frame* ancestor = targetFrame->tree()->parent(); ancestor; ancestor = ancestor->tree()->parent()) {
+        Document* document = ancestor->document();
+        if (!ancestor->loader()->isComplete() || document && document->processingLoadEvent())
+            return true;
+    }
+    return false;
+}
+
+void RedirectScheduler::scheduleLocationChange(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture)
+{
+    if (!m_frame->page())
+        return;
+
+    if (url.isEmpty())
+        return;
+
+    lockBackForwardList = lockBackForwardList || mustLockBackForwardList(m_frame);
+
+    FrameLoader* loader = m_frame->loader();
+    
+    // If the URL we're going to navigate to is the same as the current one, except for the
+    // fragment part, we don't need to schedule the location change.
+    KURL parsedURL(ParsedURLString, url);
+    if (parsedURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(loader->url(), parsedURL)) {
+        loader->changeLocation(loader->completeURL(url), referrer, lockHistory, lockBackForwardList, wasUserGesture);
+        return;
+    }
+
+    // Handle a location change of a page with no document as a special case.
+    // This may happen when a frame changes the location of another frame.
+    bool duringLoad = !loader->committedFirstRealDocumentLoad();
+
+    schedule(new ScheduledRedirection(url, referrer, lockHistory, lockBackForwardList, wasUserGesture, false, duringLoad));
+}
+
+void RedirectScheduler::scheduleFormSubmission(const FrameLoadRequest& frameRequest,
+    bool lockHistory, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
+{
+    ASSERT(m_frame->page());
+    ASSERT(!frameRequest.isEmpty());
+
+    // FIXME: Do we need special handling for form submissions where the URL is the same
+    // as the current one except for the fragment part? See scheduleLocationChange above.
+
+    // Handle a location change of a page with no document as a special case.
+    // This may happen when a frame changes the location of another frame.
+    bool duringLoad = !m_frame->loader()->committedFirstRealDocumentLoad();
+
+    schedule(new ScheduledRedirection(frameRequest, lockHistory, mustLockBackForwardList(m_frame), event, formState, duringLoad));
+}
+
+void RedirectScheduler::scheduleRefresh(bool wasUserGesture)
+{
+    if (!m_frame->page())
+        return;
+    
+    const KURL& url = m_frame->loader()->url();
+
+    if (url.isEmpty())
+        return;
+
+    schedule(new ScheduledRedirection(url.string(), m_frame->loader()->outgoingReferrer(), true, true, wasUserGesture, true, false));
+}
+
+bool RedirectScheduler::locationChangePending()
+{
+    if (!m_scheduledRedirection)
+        return false;
+
+    switch (m_scheduledRedirection->type) {
+        case ScheduledRedirection::redirection:
+            return false;
+        case ScheduledRedirection::historyNavigation:
+        case ScheduledRedirection::locationChange:
+        case ScheduledRedirection::formSubmission:
+            return true;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+void RedirectScheduler::scheduleHistoryNavigation(int steps)
+{
+    if (!m_frame->page())
+        return;
+
+    schedule(new ScheduledRedirection(steps));
+}
+
+void RedirectScheduler::timerFired(Timer<RedirectScheduler>*)
+{
+    ASSERT(m_frame->page());
+
+    if (m_frame->page()->defersLoading())
+        return;
+
+    OwnPtr<ScheduledRedirection> redirection(m_scheduledRedirection.release());
+    FrameLoader* loader = m_frame->loader();
+
+    switch (redirection->type) {
+        case ScheduledRedirection::redirection:
+        case ScheduledRedirection::locationChange:
+            loader->changeLocation(KURL(ParsedURLString, redirection->url), redirection->referrer,
+                redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture, redirection->wasRefresh);
+            return;
+        case ScheduledRedirection::historyNavigation:
+            if (redirection->historySteps == 0) {
+                // Special case for go(0) from a frame -> reload only the frame
+                loader->urlSelected(loader->url(), "", 0, redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture, SendReferrer);
+                return;
+            }
+            // go(i!=0) from a frame navigates into the history of the frame only,
+            // in both IE and NS (but not in Mozilla). We can't easily do that.
+            if (m_frame->page()->canGoBackOrForward(redirection->historySteps))
+                m_frame->page()->goBackOrForward(redirection->historySteps);
+            return;
+        case ScheduledRedirection::formSubmission:
+            // The submitForm function will find a target frame before using the redirection timer.
+            // Now that the timer has fired, we need to repeat the security check which normally is done when
+            // selecting a target, in case conditions have changed. Other code paths avoid this by targeting
+            // without leaving a time window. If we fail the check just silently drop the form submission.
+            if (!redirection->formState->sourceFrame()->loader()->shouldAllowNavigation(m_frame))
+                return;
+            loader->loadFrameRequest(redirection->frameRequest, redirection->lockHistory, redirection->lockBackForwardList,
+                redirection->event, redirection->formState, SendReferrer);
+            return;
+    }
+
+    ASSERT_NOT_REACHED();
+}
+
+void RedirectScheduler::schedule(PassOwnPtr<ScheduledRedirection> redirection)
+{
+    ASSERT(m_frame->page());
+    FrameLoader* loader = m_frame->loader();
+
+    // If a redirect was scheduled during a load, then stop the current load.
+    // Otherwise when the current load transitions from a provisional to a 
+    // committed state, pending redirects may be cancelled. 
+    if (redirection->wasDuringLoad) {
+        if (DocumentLoader* provisionalDocumentLoader = loader->provisionalDocumentLoader())
+            provisionalDocumentLoader->stopLoading();
+        loader->stopLoading(UnloadEventPolicyUnloadAndPageHide);   
+    }
+
+    cancel();
+    m_scheduledRedirection = redirection;
+    if (!loader->isComplete() && m_scheduledRedirection->type != ScheduledRedirection::redirection)
+        loader->completed();
+    startTimer();
+}
+
+void RedirectScheduler::startTimer()
+{
+    if (!m_scheduledRedirection)
+        return;
+
+    ASSERT(m_frame->page());
+    
+    FrameLoader* loader = m_frame->loader();
+
+    if (m_timer.isActive())
+        return;
+
+    if (m_scheduledRedirection->type == ScheduledRedirection::redirection && !loader->allAncestorsAreComplete())
+        return;
+
+    m_timer.startOneShot(m_scheduledRedirection->delay);
+
+    switch (m_scheduledRedirection->type) {
+        case ScheduledRedirection::locationChange:
+        case ScheduledRedirection::redirection:
+            if (m_scheduledRedirection->toldClient)
+                return;
+            m_scheduledRedirection->toldClient = true;
+            loader->clientRedirected(KURL(ParsedURLString, m_scheduledRedirection->url),
+                m_scheduledRedirection->delay,
+                currentTime() + m_timer.nextFireInterval(),
+                m_scheduledRedirection->lockBackForwardList);
+            return;
+        case ScheduledRedirection::formSubmission:
+            // FIXME: It would make sense to report form submissions as client redirects too.
+            // But we didn't do that in the past when form submission used a separate delay
+            // mechanism, so doing it will be a behavior change.
+            return;
+        case ScheduledRedirection::historyNavigation:
+            // Don't report history navigations.
+            return;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+void RedirectScheduler::cancel(bool newLoadInProgress)
+{
+    m_timer.stop();
+
+    OwnPtr<ScheduledRedirection> redirection(m_scheduledRedirection.release());
+    if (redirection && redirection->toldClient)
+        m_frame->loader()->clientRedirectCancelledOrFinished(newLoadInProgress);
+}
+
+} // namespace WebCore
+
diff --git a/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.h b/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.h
new file mode 100644
index 0000000000..005a1736da
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2009 Adam Barth. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RedirectScheduler_h
+#define RedirectScheduler_h
+
+#include "Event.h"
+#include "Timer.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class FormState;
+class Frame;
+class String;
+
+struct FrameLoadRequest;
+struct ScheduledRedirection;
+
+class RedirectScheduler : public Noncopyable {
+public:
+    RedirectScheduler(Frame*);
+    ~RedirectScheduler();
+
+    bool redirectScheduledDuringLoad();
+    bool locationChangePending();
+
+    void scheduleRedirect(double delay, const String& url);
+    void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false);
+    void scheduleFormSubmission(const FrameLoadRequest&, bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
+    void scheduleRefresh(bool userGesture = false);
+    void scheduleHistoryNavigation(int steps);
+
+    void startTimer();
+
+    void cancel(bool newLoadInProgress = false);
+    void clear();
+
+private:
+    void timerFired(Timer<RedirectScheduler>*);
+    void schedule(PassOwnPtr<ScheduledRedirection>);
+
+    static bool mustLockBackForwardList(Frame* targetFrame);
+
+    Frame* m_frame;
+    Timer<RedirectScheduler> m_timer;
+    OwnPtr<ScheduledRedirection> m_scheduledRedirection;
+};
+
+} // namespace WebCore
+
+#endif // FrameLoader_h
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.cpp b/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.cpp
new file mode 100644
index 0000000000..4cddd01c39
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.cpp
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ResourceLoadNotifier.h"
+
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "InspectorController.h"
+#include "Page.h"
+#include "ProgressTracker.h"
+#include "ResourceLoader.h"
+
+namespace WebCore {
+
+ResourceLoadNotifier::ResourceLoadNotifier(Frame* frame)
+    : m_frame(frame)
+{
+}
+
+void ResourceLoadNotifier::didReceiveAuthenticationChallenge(ResourceLoader* loader, const AuthenticationChallenge& currentWebChallenge)
+{
+    m_frame->loader()->client()->dispatchDidReceiveAuthenticationChallenge(loader->documentLoader(), loader->identifier(), currentWebChallenge);
+}
+
+void ResourceLoadNotifier::didCancelAuthenticationChallenge(ResourceLoader* loader, const AuthenticationChallenge& currentWebChallenge)
+{
+    m_frame->loader()->client()->dispatchDidCancelAuthenticationChallenge(loader->documentLoader(), loader->identifier(), currentWebChallenge);
+}
+
+void ResourceLoadNotifier::willSendRequest(ResourceLoader* loader, ResourceRequest& clientRequest, const ResourceResponse& redirectResponse)
+{
+    m_frame->loader()->applyUserAgent(clientRequest);
+
+    dispatchWillSendRequest(loader->documentLoader(), loader->identifier(), clientRequest, redirectResponse);
+}
+
+void ResourceLoadNotifier::didReceiveResponse(ResourceLoader* loader, const ResourceResponse& r)
+{
+    loader->documentLoader()->addResponse(r);
+
+    if (Page* page = m_frame->page())
+        page->progress()->incrementProgress(loader->identifier(), r);
+
+    dispatchDidReceiveResponse(loader->documentLoader(), loader->identifier(), r);
+}
+
+void ResourceLoadNotifier::didReceiveData(ResourceLoader* loader, const char* data, int length, int lengthReceived)
+{
+    if (Page* page = m_frame->page())
+        page->progress()->incrementProgress(loader->identifier(), data, length);
+
+    dispatchDidReceiveContentLength(loader->documentLoader(), loader->identifier(), lengthReceived);
+}
+
+void ResourceLoadNotifier::didFinishLoad(ResourceLoader* loader)
+{    
+    if (Page* page = m_frame->page())
+        page->progress()->completeProgress(loader->identifier());
+    dispatchDidFinishLoading(loader->documentLoader(), loader->identifier());
+}
+
+void ResourceLoadNotifier::didFailToLoad(ResourceLoader* loader, const ResourceError& error)
+{
+    if (Page* page = m_frame->page())
+        page->progress()->completeProgress(loader->identifier());
+
+    if (!error.isNull())
+        m_frame->loader()->client()->dispatchDidFailLoading(loader->documentLoader(), loader->identifier(), error);
+}
+
+void ResourceLoadNotifier::didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
+{
+    m_frame->loader()->client()->dispatchDidLoadResourceByXMLHttpRequest(identifier, sourceString);
+}
+
+void ResourceLoadNotifier::assignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
+{
+    m_frame->loader()->client()->assignIdentifierToInitialRequest(identifier, loader, request);
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->identifierForInitialRequest(identifier, loader, request);
+#endif
+}
+
+void ResourceLoadNotifier::dispatchWillSendRequest(DocumentLoader* loader, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+{
+    StringImpl* oldRequestURL = request.url().string().impl();
+    m_frame->loader()->documentLoader()->didTellClientAboutLoad(request.url());
+
+    m_frame->loader()->client()->dispatchWillSendRequest(loader, identifier, request, redirectResponse);
+
+    // If the URL changed, then we want to put that new URL in the "did tell client" set too.
+    if (!request.isNull() && oldRequestURL != request.url().string().impl())
+        m_frame->loader()->documentLoader()->didTellClientAboutLoad(request.url());
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->willSendRequest(loader, identifier, request, redirectResponse);
+#endif
+}
+
+void ResourceLoadNotifier::dispatchDidReceiveResponse(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
+{
+    m_frame->loader()->client()->dispatchDidReceiveResponse(loader, identifier, r);
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->didReceiveResponse(loader, identifier, r);
+#endif
+}
+
+void ResourceLoadNotifier::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int length)
+{
+    m_frame->loader()->client()->dispatchDidReceiveContentLength(loader, identifier, length);
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->didReceiveContentLength(loader, identifier, length);
+#endif
+}
+
+void ResourceLoadNotifier::dispatchDidFinishLoading(DocumentLoader* loader, unsigned long identifier)
+{
+    m_frame->loader()->client()->dispatchDidFinishLoading(loader, identifier);
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->didFinishLoading(loader, identifier);
+#endif
+}
+
+void ResourceLoadNotifier::sendRemainingDelegateMessages(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& response, int length, const ResourceError& error)
+{
+    if (!response.isNull())
+        dispatchDidReceiveResponse(loader, identifier, response);
+
+    if (length > 0)
+        dispatchDidReceiveContentLength(loader, identifier, length);
+
+    if (error.isNull())
+        dispatchDidFinishLoading(loader, identifier);
+    else
+        m_frame->loader()->client()->dispatchDidFailLoading(loader, identifier, error);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.h b/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.h
new file mode 100644
index 0000000000..f06ecde81c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ResourceLoadNotifier_h
+#define ResourceLoadNotifier_h
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class AuthenticationChallenge;
+class DocumentLoader;
+class Frame;
+class ResourceError;
+class ResourceLoader;
+class ResourceResponse;
+//### tempfix, to be removed
+#ifdef __SYMBIAN32__
+struct ResourceRequest;
+#else
+class ResourceRequest;
+#endif
+class ScriptString;
+
+class ResourceLoadNotifier : public Noncopyable {
+public:
+    ResourceLoadNotifier(Frame*);
+
+    void didReceiveAuthenticationChallenge(ResourceLoader*, const AuthenticationChallenge&);
+    void didCancelAuthenticationChallenge(ResourceLoader*, const AuthenticationChallenge&);
+
+    void willSendRequest(ResourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
+    void didReceiveResponse(ResourceLoader*, const ResourceResponse&);
+    void didReceiveData(ResourceLoader*, const char*, int, int lengthReceived);
+    void didFinishLoad(ResourceLoader*);
+    void didFailToLoad(ResourceLoader*, const ResourceError&);
+    void didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
+
+    void assignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
+    void dispatchWillSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
+    void dispatchDidReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse&);
+    void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int length);
+    void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier);
+
+    void sendRemainingDelegateMessages(DocumentLoader*, unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
+
+private:
+    Frame* m_frame;
+};
+
+} // namespace WebCore
+
+#endif // ResourceLoadNotifier_h
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
index ee7dea9437..9244cf0b19 100644
--- a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
@@ -197,18 +197,18 @@ void ResourceLoader::willSendRequest(ResourceRequest& request, const ResourceRes
     // Protect this in this delegate method since the additional processing can do
     // anything including possibly derefing this; one example of this is Radar 3266216.
     RefPtr<ResourceLoader> protector(this);
-        
+
     ASSERT(!m_reachedTerminalState);
 
     if (m_sendResourceLoadCallbacks) {
         if (!m_identifier) {
             m_identifier = m_frame->page()->progress()->createUniqueIdentifier();
-            frameLoader()->assignIdentifierToInitialRequest(m_identifier, request);
+            frameLoader()->notifier()->assignIdentifierToInitialRequest(m_identifier, documentLoader(), request);
         }
 
-        frameLoader()->willSendRequest(this, request, redirectResponse);
+        frameLoader()->notifier()->willSendRequest(this, request, redirectResponse);
     }
-    
+
     m_request = request;
 }
 
@@ -230,7 +230,7 @@ void ResourceLoader::didReceiveResponse(const ResourceResponse& r)
         data->removeGeneratedFilesIfNeeded();
         
     if (m_sendResourceLoadCallbacks)
-        frameLoader()->didReceiveResponse(this, m_response);
+        frameLoader()->notifier()->didReceiveResponse(this, m_response);
 }
 
 void ResourceLoader::didReceiveData(const char* data, int length, long long lengthReceived, bool allAtOnce)
@@ -250,7 +250,7 @@ void ResourceLoader::didReceiveData(const char* data, int length, long long leng
     // However, with today's computers and networking speeds, this won't happen in practice.
     // Could be an issue with a giant local file.
     if (m_sendResourceLoadCallbacks && m_frame)
-        frameLoader()->didReceiveData(this, data, length, static_cast<int>(lengthReceived));
+        frameLoader()->notifier()->didReceiveData(this, data, length, static_cast<int>(lengthReceived));
 }
 
 void ResourceLoader::willStopBufferingData(const char* data, int length)
@@ -284,7 +284,7 @@ void ResourceLoader::didFinishLoadingOnePart()
         return;
     m_calledDidFinishLoad = true;
     if (m_sendResourceLoadCallbacks)
-        frameLoader()->didFinishLoad(this);
+        frameLoader()->notifier()->didFinishLoad(this);
 }
 
 void ResourceLoader::didFail(const ResourceError& error)
@@ -301,7 +301,7 @@ void ResourceLoader::didFail(const ResourceError& error)
         data->removeGeneratedFilesIfNeeded();
 
     if (m_sendResourceLoadCallbacks && !m_calledDidFinishLoad)
-        frameLoader()->didFailToLoad(this, error);
+        frameLoader()->notifier()->didFailToLoad(this, error);
 
     releaseResources();
 }
@@ -330,7 +330,7 @@ void ResourceLoader::didCancel(const ResourceError& error)
         m_handle = 0;
     }
     if (m_sendResourceLoadCallbacks && !m_calledDidFinishLoad)
-        frameLoader()->didFailToLoad(this, error);
+        frameLoader()->notifier()->didFailToLoad(this, error);
 
     releaseResources();
 }
@@ -433,7 +433,7 @@ void ResourceLoader::didReceiveAuthenticationChallenge(const AuthenticationChall
     // Protect this in this delegate method since the additional processing can do
     // anything including possibly derefing this; one example of this is Radar 3266216.
     RefPtr<ResourceLoader> protector(this);
-    frameLoader()->didReceiveAuthenticationChallenge(this, challenge);
+    frameLoader()->notifier()->didReceiveAuthenticationChallenge(this, challenge);
 }
 
 void ResourceLoader::didCancelAuthenticationChallenge(const AuthenticationChallenge& challenge)
@@ -441,7 +441,7 @@ void ResourceLoader::didCancelAuthenticationChallenge(const AuthenticationChalle
     // Protect this in this delegate method since the additional processing can do
     // anything including possibly derefing this; one example of this is Radar 3266216.
     RefPtr<ResourceLoader> protector(this);
-    frameLoader()->didCancelAuthenticationChallenge(this, challenge);
+    frameLoader()->notifier()->didCancelAuthenticationChallenge(this, challenge);
 }
 
 void ResourceLoader::receivedCancellation(const AuthenticationChallenge&)
diff --git a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp
index 047cc6d00b..2ee46267bd 100644
--- a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp
@@ -33,6 +33,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "ResourceHandle.h"
+#include "SecurityOrigin.h"
 #include "SubresourceLoaderClient.h"
 #include <wtf/RefCountedLeakCounter.h>
 
@@ -72,13 +73,13 @@ PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, Subresourc
     ResourceRequest newRequest = request;
 
     if (!skipCanLoadCheck
-            && FrameLoader::restrictAccessToLocal()
-            && !FrameLoader::canLoad(request.url(), String(), frame->document())) {
+            && SecurityOrigin::restrictAccessToLocal()
+            && !SecurityOrigin::canLoad(request.url(), String(), frame->document())) {
         FrameLoader::reportLocalLoadFailed(frame, request.url().string());
         return 0;
     }
     
-    if (FrameLoader::shouldHideReferrer(request.url(), fl->outgoingReferrer()))
+    if (SecurityOrigin::shouldHideReferrer(request.url(), fl->outgoingReferrer()))
         newRequest.clearHTTPReferrer();
     else if (!request.httpReferrer())
         newRequest.setHTTPReferrer(fl->outgoingReferrer());
diff --git a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
index 6819759b5a..bd362f46f2 100644
--- a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
@@ -91,7 +91,7 @@ WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(PassRefPtr<Threadable
                                                            const ResourceRequest& request, const ThreadableLoaderOptions& options)
     : m_workerClientWrapper(workerClientWrapper)
     , m_loaderProxy(loaderProxy)
-    , m_taskMode(taskMode.copy())
+    , m_taskMode(taskMode.crossThreadString())
 {
     ASSERT(m_workerClientWrapper.get());
     m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, options));
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index ed27ba049b..c66f36f0ed 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -158,7 +158,7 @@ void ApplicationCacheGroup::selectCache(Frame* frame, const KURL& passedManifest
             // Restart the current navigation from the top of the navigation algorithm, undoing any changes that were made
             // as part of the initial load.
             // The navigation will not result in the same resource being loaded, because "foreign" entries are never picked during navigation.
-            frame->loader()->scheduleLocationChange(documentLoader->url(), frame->loader()->referrer(), true);
+            frame->redirectScheduler()->scheduleLocationChange(documentLoader->url(), frame->loader()->referrer(), true);
         }
         
         return;
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
index b78291d872..78ca0a592c 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
@@ -128,7 +128,7 @@ bool IconDatabase::open(const String& databasePath)
         return false;
     }
 
-    m_databaseDirectory = databasePath.copy();
+    m_databaseDirectory = databasePath.crossThreadString();
 
     // Formulate the full path for the database file
     m_completeDatabasePath = pathByAppendingComponent(m_databaseDirectory, defaultDatabaseFilename());
@@ -227,7 +227,7 @@ Image* IconDatabase::iconForPageURL(const String& pageURLOriginal, const IntSize
     
     PageURLRecord* pageRecord = m_pageURLToRecordMap.get(pageURLOriginal);
     if (!pageRecord) {
-        pageURLCopy = pageURLOriginal.copy();
+        pageURLCopy = pageURLOriginal.crossThreadString();
         pageRecord = getOrCreatePageURLRecord(pageURLCopy);
     }
     
@@ -263,7 +263,7 @@ Image* IconDatabase::iconForPageURL(const String& pageURLOriginal, const IntSize
     // mark it to be read by the background thread
     if (iconRecord->imageDataStatus() == ImageDataStatusUnknown) {
         if (pageURLCopy.isNull())
-            pageURLCopy = pageURLOriginal.copy();
+            pageURLCopy = pageURLOriginal.crossThreadString();
     
         MutexLocker locker(m_pendingReadingLock);
         m_pageURLsInterestedInIcons.add(pageURLCopy);
@@ -312,7 +312,7 @@ String IconDatabase::iconURLForPageURL(const String& pageURLOriginal)
     
     PageURLRecord* pageRecord = m_pageURLToRecordMap.get(pageURLOriginal);
     if (!pageRecord)
-        pageRecord = getOrCreatePageURLRecord(pageURLOriginal.copy());
+        pageRecord = getOrCreatePageURLRecord(pageURLOriginal.crossThreadString());
     
     // If pageRecord is NULL, one of two things is true -
     // 1 - The initial url import is incomplete and this pageURL has already been marked to be notified once it is complete if an iconURL exists
@@ -321,7 +321,7 @@ String IconDatabase::iconURLForPageURL(const String& pageURLOriginal)
         return String();
     
     // Possible the pageRecord is around because it's a retained pageURL with no iconURL, so we have to check
-    return pageRecord->iconRecord() ? pageRecord->iconRecord()->iconURL().copy() : String();
+    return pageRecord->iconRecord() ? pageRecord->iconRecord()->iconURL().threadsafeCopy() : String();
 }
 
 #ifdef CAN_THEME_URL_ICON
@@ -405,7 +405,7 @@ void IconDatabase::retainIconForPageURL(const String& pageURLOriginal)
     String pageURL;
     
     if (!record) {
-        pageURL = pageURLOriginal.copy();
+        pageURL = pageURLOriginal.crossThreadString();
 
         record = new PageURLRecord(pageURL);
         m_pageURLToRecordMap.set(pageURL, record);
@@ -413,7 +413,7 @@ void IconDatabase::retainIconForPageURL(const String& pageURLOriginal)
     
     if (!record->retain()) {
         if (pageURL.isNull())
-            pageURL = pageURLOriginal.copy();
+            pageURL = pageURLOriginal.crossThreadString();
 
         // This page just had its retain count bumped from 0 to 1 - Record that fact
         m_retainedPageURLs.add(pageURL);
@@ -488,7 +488,7 @@ void IconDatabase::releaseIconForPageURL(const String& pageURLOriginal)
     // Mark stuff for deletion from the database only if we're not in private browsing
     if (!m_privateBrowsingEnabled) {
         MutexLocker locker(m_pendingSyncLock);
-        m_pageURLsPendingSync.set(pageURLOriginal.copy(), pageRecord->snapshot(true));
+        m_pageURLsPendingSync.set(pageURLOriginal.crossThreadString(), pageRecord->snapshot(true));
     
         // If this page is the last page to refer to a particular IconRecord, that IconRecord needs to
         // be marked for deletion
@@ -512,7 +512,7 @@ void IconDatabase::setIconDataForIconURL(PassRefPtr<SharedBuffer> dataOriginal,
         return;
     
     RefPtr<SharedBuffer> data = dataOriginal ? dataOriginal->copy() : 0;
-    String iconURL = iconURLOriginal.copy();
+    String iconURL = iconURLOriginal.crossThreadString();
     
     Vector<String> pageURLs;
     {
@@ -589,8 +589,8 @@ void IconDatabase::setIconURLForPageURL(const String& iconURLOriginal, const Str
         if (pageRecord && pageRecord->iconRecord() && pageRecord->iconRecord()->iconURL() == iconURLOriginal)
             return;
             
-        pageURL = pageURLOriginal.copy();
-        iconURL = iconURLOriginal.copy();
+        pageURL = pageURLOriginal.crossThreadString();
+        iconURL = iconURLOriginal.crossThreadString();
 
         if (!pageRecord) {
             pageRecord = new PageURLRecord(pageURL);
@@ -847,13 +847,13 @@ bool IconDatabase::isOpen() const
 String IconDatabase::databasePath() const
 {
     MutexLocker locker(m_syncLock);
-    return m_completeDatabasePath.copy();
+    return m_completeDatabasePath.threadsafeCopy();
 }
 
 String IconDatabase::defaultDatabaseFilename()
 {
     DEFINE_STATIC_LOCAL(String, defaultDatabaseFilename, ("WebpageIcons.db"));
-    return defaultDatabaseFilename.copy();
+    return defaultDatabaseFilename.threadsafeCopy();
 }
 
 // Unlike getOrCreatePageURLRecord(), getOrCreateIconRecord() does not mark the icon as "interested in import"
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp
index 03a7964426..7b7cc9f621 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp
@@ -53,7 +53,7 @@ const int updateTimerDelay = 5;
 String IconDatabase::defaultDatabaseFilename()
 {
     DEFINE_STATIC_LOCAL(String, defaultDatabaseFilename, ("Icons.db"));
-    return defaultDatabaseFilename.copy();
+    return defaultDatabaseFilename.threadsafeCopy();
 }
 
 IconDatabase* iconDatabase()
diff --git a/src/3rdparty/webkit/WebCore/page/ChromeClient.h b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
index 2d112753f3..5231603586 100644
--- a/src/3rdparty/webkit/WebCore/page/ChromeClient.h
+++ b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
@@ -203,6 +203,10 @@ namespace WebCore {
         virtual void scheduleCompositingLayerSync() = 0;
 #endif
 
+        virtual bool supportsFullscreenForNode(const Node*) { return false; }
+        virtual void enterFullscreenForNode(Node*) { }
+        virtual void exitFullscreenForNode(Node*) { }
+        
 #if PLATFORM(MAC)
         virtual KeyboardUIMode keyboardUIMode() { return KeyboardAccessDefault; }
 
diff --git a/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp b/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
index a3a86a5339..7d773ca004 100644
--- a/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
@@ -166,10 +166,12 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         frame->editor()->copy();
         break;
     case ContextMenuItemTagGoBack:
-        frame->loader()->goBackOrForward(-1);
+        if (Page* page = frame->page())
+            page->goBackOrForward(-1);
         break;
     case ContextMenuItemTagGoForward:
-        frame->loader()->goBackOrForward(1);
+        if (Page* page = frame->page())
+            page->goBackOrForward(1);
         break;
     case ContextMenuItemTagStop:
         frame->loader()->stop();
@@ -215,7 +217,7 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         break;
     case ContextMenuItemTagOpenLink:
         if (Frame* targetFrame = result.targetFrame())
-            targetFrame->loader()->loadFrameRequest(FrameLoadRequest(ResourceRequest(result.absoluteLinkURL(), frame->loader()->outgoingReferrer())), false, false, 0, 0);
+            targetFrame->loader()->loadFrameRequest(FrameLoadRequest(ResourceRequest(result.absoluteLinkURL(), frame->loader()->outgoingReferrer())), false, false, 0, 0, SendReferrer);
         else
             openNewWindow(result.absoluteLinkURL(), frame);
         break;
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
index 5ac4049881..c30b6b9c45 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
@@ -64,6 +64,7 @@
 #include "PlatformString.h"
 #include "Screen.h"
 #include "SecurityOrigin.h"
+#include "SerializedScriptValue.h"
 #include "Settings.h"
 #include "Storage.h"
 #include "StorageArea.h"
@@ -80,7 +81,7 @@ namespace WebCore {
 
 class PostMessageTimer : public TimerBase {
 public:
-    PostMessageTimer(DOMWindow* window, const String& message, const String& sourceOrigin, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortChannelArray> channels, SecurityOrigin* targetOrigin)
+    PostMessageTimer(DOMWindow* window, PassRefPtr<SerializedScriptValue> message, const String& sourceOrigin, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortChannelArray> channels, SecurityOrigin* targetOrigin)
         : m_window(window)
         , m_message(message)
         , m_origin(sourceOrigin)
@@ -104,7 +105,7 @@ private:
     }
 
     RefPtr<DOMWindow> m_window;
-    String m_message;
+    RefPtr<SerializedScriptValue> m_message;
     String m_origin;
     RefPtr<DOMWindow> m_source;
     OwnPtr<MessagePortChannelArray> m_channels;
@@ -635,7 +636,7 @@ NotificationCenter* DOMWindow::webkitNotifications() const
 }
 #endif
 
-void DOMWindow::postMessage(const String& message, MessagePort* port, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
+void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
 {
     MessagePortArray ports;
     if (port)
@@ -643,7 +644,7 @@ void DOMWindow::postMessage(const String& message, MessagePort* port, const Stri
     postMessage(message, &ports, targetOrigin, source, ec);
 }
 
-void DOMWindow::postMessage(const String& message, const MessagePortArray* ports, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
+void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
 {
     if (!m_frame)
         return;
@@ -739,12 +740,9 @@ void DOMWindow::close()
         return;
 
     Settings* settings = m_frame->settings();
-    bool allowScriptsToCloseWindows =
-        settings && settings->allowScriptsToCloseWindows();
+    bool allowScriptsToCloseWindows = settings && settings->allowScriptsToCloseWindows();
 
-    if (m_frame->loader()->openedByDOM()
-        || m_frame->loader()->getHistoryLength() <= 1
-        || allowScriptsToCloseWindows)
+    if (page->openedByDOM() || page->getHistoryLength() <= 1 || allowScriptsToCloseWindows)
         m_frame->scheduleClose();
 }
 
@@ -1296,6 +1294,14 @@ void DOMWindow::dispatchLoadEvent()
         ownerEvent->setTarget(ownerElement);
         ownerElement->dispatchGenericEvent(ownerEvent.release());
     }
+
+#if ENABLE(INSPECTOR)
+    if (!frame() || !frame()->page())
+        return;
+
+    if (InspectorController* controller = frame()->page()->inspectorController())
+        controller->mainResourceFiredLoadEvent(frame()->loader()->documentLoader(), url());
+#endif
 }
 
 bool DOMWindow::dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget> prpTarget)
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.h b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
index f2177ee8e3..25eadc87a4 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
@@ -59,6 +59,7 @@ namespace WebCore {
     class NotificationCenter;
     class PostMessageTimer;
     class ScheduledAction;
+    class SerializedScriptValue;
     class Screen;
     class WebKitPoint;
 
@@ -214,9 +215,9 @@ namespace WebCore {
         NotificationCenter* webkitNotifications() const;
 #endif
 
-        void postMessage(const String& message, const MessagePortArray*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
-        void postMessage(const String& message, MessagePort*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
         void postMessageTimerFired(PostMessageTimer*);
 
         void scrollBy(int x, int y) const;
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
index 4e3a03e738..45870019a1 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
@@ -182,11 +182,11 @@ module window {
 
         // cross-document messaging
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        [DoNotCheckDomainSecurity, Custom] void postMessage(in DOMString message, in [Optional] Array messagePorts, in DOMString targetOrigin)
+        [DoNotCheckDomainSecurity, Custom] void postMessage(in SerializedScriptValue message, in [Optional] Array messagePorts, in DOMString targetOrigin)
             raises(DOMException);
 #else
         // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
-        [DoNotCheckDomainSecurity, Custom] void postMessage(in DOMString message, in [Optional] MessagePort messagePort, in DOMString targetOrigin)
+        [DoNotCheckDomainSecurity, Custom] void postMessage(in SerializedScriptValue message, in [Optional] MessagePort messagePort, in DOMString targetOrigin)
             raises(DOMException);
 #endif
 
@@ -434,16 +434,17 @@ module window {
         attribute [Conditional=3D_CANVAS] CanvasRenderingContext3DConstructor CanvasRenderingContext3D;
         attribute TextMetricsConstructor TextMetrics;
 
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasArrayBufferConstructor CanvasArrayBuffer; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasByteArrayConstructor CanvasByteArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasUnsignedByteArrayConstructor CanvasUnsignedByteArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasShortArrayConstructor CanvasShortArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasUnsignedShortArrayConstructor CanvasUnsignedShortArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasIntArrayConstructor CanvasIntArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasUnsignedIntArrayConstructor CanvasUnsignedIntArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasFloatArrayConstructor CanvasFloatArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasArrayBufferConstructor CanvasArrayBuffer; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasByteArrayConstructor CanvasByteArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedByteArrayConstructor CanvasUnsignedByteArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasShortArrayConstructor CanvasShortArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedShortArrayConstructor CanvasUnsignedShortArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasIntArrayConstructor CanvasIntArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedIntArrayConstructor CanvasUnsignedIntArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasFloatArrayConstructor CanvasFloatArray; // Usable with new operator
 
         attribute EventConstructor Event;
+        attribute BeforeLoadEventConstructor BeforeLoadEvent;
         attribute KeyboardEventConstructor KeyboardEvent;
         attribute MouseEventConstructor MouseEvent;
         attribute MutationEventConstructor MutationEvent;
@@ -501,11 +502,11 @@ module window {
 #endif
 
 #if defined(ENABLE_SHARED_WORKERS) && ENABLE_SHARED_WORKERS
-        attribute [JSCCustomGetter] SharedWorkerConstructor SharedWorker; // Usable with the new operator
+        attribute [JSCCustomGetter, EnabledAtRuntime] SharedWorkerConstructor SharedWorker; // Usable with the new operator
 #endif
 
 #if defined(ENABLE_WEB_SOCKETS) && ENABLE_WEB_SOCKETS
-        attribute [JSCCustomGetter] WebSocketConstructor WebSocket; // Usable with the new operator
+        attribute [JSCCustomGetter,EnabledAtRuntime] WebSocketConstructor WebSocket; // Usable with the new operator
 #endif
 
         attribute PluginConstructor Plugin;
@@ -522,11 +523,11 @@ module window {
         attribute StorageEventConstructor StorageEvent;
 #endif
 
-        attribute [CustomGetter,Conditional=VIDEO] HTMLAudioElementConstructor Audio; // Usable with the new operator
-        attribute [Conditional=VIDEO] HTMLAudioElementConstructor HTMLAudioElement;
-        attribute [Conditional=VIDEO] HTMLMediaElementConstructor HTMLMediaElement;
-        attribute [Conditional=VIDEO] HTMLVideoElementConstructor HTMLVideoElement;
-        attribute [Conditional=VIDEO] MediaErrorConstructor MediaError;
+        attribute [CustomGetter, Conditional=VIDEO, EnabledAtRuntime] HTMLAudioElementConstructor Audio; // Usable with the new operator
+        attribute [Conditional=VIDEO, EnabledAtRuntime] HTMLAudioElementConstructor HTMLAudioElement;
+        attribute [Conditional=VIDEO, EnabledAtRuntime] HTMLMediaElementConstructor HTMLMediaElement;
+        attribute [Conditional=VIDEO, EnabledAtRuntime] HTMLVideoElementConstructor HTMLVideoElement;
+        attribute [Conditional=VIDEO, EnabledAtRuntime] MediaErrorConstructor MediaError;
 
 #if defined(ENABLE_XPATH) && ENABLE_XPATH
         attribute XPathEvaluatorConstructor XPathEvaluator;
@@ -559,7 +560,7 @@ module window {
         attribute SVGFECompositeElementConstructor SVGFECompositeElement;
 //      attribute SVGFEConvolveMatrixElementConstructor SVGFEConvolveMatrixElement;
         attribute SVGFEDisplacementMapElementConstructor SVGFEDisplacementMapElement;
-//      attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
+        attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
         attribute SVGFETurbulenceElementConstructor SVGFETurbulenceElement;
 #endif
 #endif
diff --git a/src/3rdparty/webkit/WebCore/page/DragController.cpp b/src/3rdparty/webkit/WebCore/page/DragController.cpp
index ab3a6534bb..634595add7 100644
--- a/src/3rdparty/webkit/WebCore/page/DragController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DragController.cpp
@@ -649,6 +649,12 @@ bool DragController::startDrag(Frame* src, Clipboard* clipboard, DragOperation s
 
     if (isDHTMLDrag)
         dragImage = clipboard->createDragImage(dragImageOffset);
+    else {
+        // This drag operation is not a DHTML drag and may go outside the WebView.
+        // We provide a default set of allowed drag operations that follows from:
+        // http://trac.webkit.org/browser/trunk/WebKit/mac/WebView/WebHTMLView.mm?rev=48526#L3430
+        m_sourceDragOperation = (DragOperation)(DragOperationGeneric | DragOperationCopy);
+    }
 
     // We allow DHTML/JS to set the drag image, even if its a link, image or text we're dragging.
     // This is in the spirit of the IE API, which allows overriding of pasteboard data and DragOp.
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
index 1075e72d80..4e97aba886 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
@@ -127,10 +127,12 @@ inline bool EventHandler::eventLoopHandleMouseUp(const MouseEventWithHitTestResu
     return false;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 inline bool EventHandler::eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&)
 {
     return false;
 }
+#endif
 
 #endif
 
@@ -1528,15 +1530,15 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
         // it is sometimes incorrect when dragging within subframes, as seen with
         // LayoutTests/fast/events/drag-in-frames.html.
         if (newTarget) {
-            if (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag))
-                accept = static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame()->eventHandler()->updateDragAndDrop(event, clipboard);
+            Frame* frame = (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame() : 0;
+            if (frame)
+                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
             else
                 accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget, event, clipboard);
         }
 
         if (m_dragTarget) {
-            Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) 
-                            ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
+            Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
             if (frame)
                 accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
             else
@@ -1544,8 +1546,9 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
         }
     } else {
         if (newTarget) {
-            if (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag))
-                accept = static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame()->eventHandler()->updateDragAndDrop(event, clipboard);
+            Frame* frame = (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame() : 0;
+            if (frame)
+                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
             else
                 accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget, event, clipboard);
         }
@@ -2178,7 +2181,7 @@ void EventHandler::freeClipboard()
 
 bool EventHandler::shouldDragAutoNode(Node* node, const IntPoint& point) const
 {
-    if (!node || node->hasChildNodes() || !m_frame->view())
+    if (!node || !m_frame->view())
         return false;
     Page* page = m_frame->page();
     return page && page->dragController()->mayStartDragAtEventLocation(m_frame, point);
diff --git a/src/3rdparty/webkit/WebCore/page/EventSource.cpp b/src/3rdparty/webkit/WebCore/page/EventSource.cpp
index ae3c0c326e..2c9a34358b 100644
--- a/src/3rdparty/webkit/WebCore/page/EventSource.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventSource.cpp
@@ -45,6 +45,7 @@
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include "ScriptExecutionContext.h"
+#include "SerializedScriptValue.h"
 #include "TextResourceDecoder.h"
 #include "ThreadableLoader.h"
 
@@ -294,7 +295,7 @@ void EventSource::stop()
 PassRefPtr<MessageEvent> EventSource::createMessageEvent()
 {
     RefPtr<MessageEvent> event = MessageEvent::create();
-    event->initMessageEvent(m_eventName.isEmpty() ? eventNames().messageEvent : AtomicString(m_eventName), false, false, String::adopt(m_data), m_origin, m_lastEventId, 0, 0);
+    event->initMessageEvent(m_eventName.isEmpty() ? eventNames().messageEvent : AtomicString(m_eventName), false, false, SerializedScriptValue::create(String::adopt(m_data)), m_origin, m_lastEventId, 0, 0);
     return event.release();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/page/Frame.cpp b/src/3rdparty/webkit/WebCore/page/Frame.cpp
index e8e796fd81..fab7e3fb33 100644
--- a/src/3rdparty/webkit/WebCore/page/Frame.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Frame.cpp
@@ -123,6 +123,7 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
     : m_page(page)
     , m_treeNode(this, parentFromOwnerElement(ownerElement))
     , m_loader(this, frameLoaderClient)
+    , m_redirectScheduler(this)
     , m_ownerElement(ownerElement)
     , m_script(this)
     , m_selectionGranularity(CharacterGranularity)
@@ -197,6 +198,7 @@ Frame::~Frame()
 
     if (m_domWindow)
         m_domWindow->disconnectFrame();
+    script()->clearWindowShell();
 
     HashSet<DOMWindow*>::iterator end = m_liveFormerWindows.end();
     for (HashSet<DOMWindow*>::iterator it = m_liveFormerWindows.begin(); it != end; ++it)
@@ -220,6 +222,11 @@ FrameLoader* Frame::loader() const
     return &m_loader;
 }
 
+RedirectScheduler* Frame::redirectScheduler() const
+{
+    return &m_redirectScheduler;
+}
+
 FrameView* Frame::view() const
 {
     return m_view.get();
@@ -875,12 +882,11 @@ void Frame::injectUserScriptsForWorld(unsigned worldID, const UserScriptVector&
     if (!doc)
         return;
 
-    // FIXME: Need to implement pattern checking.
     Vector<ScriptSourceCode> sourceCode;
     unsigned count = userScripts.size();
     for (unsigned i = 0; i < count; ++i) {
         UserScript* script = userScripts[i].get();
-        if (script->injectionTime() == injectionTime && UserContentURLPattern::matchesPatterns(doc->url(), script->patterns()))
+        if (script->injectionTime() == injectionTime && UserContentURLPattern::matchesPatterns(doc->url(), script->whitelist(), script->blacklist()))
             sourceCode.append(ScriptSourceCode(script->source(), script->url()));
     }
     script()->evaluateInIsolatedWorld(worldID, sourceCode);
diff --git a/src/3rdparty/webkit/WebCore/page/Frame.h b/src/3rdparty/webkit/WebCore/page/Frame.h
index b98dbc4742..6208bbdfe1 100644
--- a/src/3rdparty/webkit/WebCore/page/Frame.h
+++ b/src/3rdparty/webkit/WebCore/page/Frame.h
@@ -67,6 +67,7 @@ namespace WebCore {
     class Editor;
     class EventHandler;
     class FrameLoader;
+    class RedirectScheduler;
     class FrameLoaderClient;
     class FrameTree;
     class FrameView;
@@ -110,6 +111,7 @@ namespace WebCore {
         Editor* editor() const;
         EventHandler* eventHandler() const;
         FrameLoader* loader() const;
+        RedirectScheduler* redirectScheduler() const;
         SelectionController* selection() const;
         FrameTree* tree() const;
         AnimationController* animation() const;
@@ -334,6 +336,7 @@ namespace WebCore {
         Page* m_page;
         mutable FrameTree m_treeNode;
         mutable FrameLoader m_loader;
+        mutable RedirectScheduler m_redirectScheduler;
 
         mutable RefPtr<DOMWindow> m_domWindow;
         HashSet<DOMWindow*> m_liveFormerWindows;
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.cpp b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
index 675cba1a33..bc4e4f21cd 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
@@ -52,12 +52,24 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "Settings.h"
+#include "TextResourceDecoder.h"
 #include <wtf/CurrentTime.h>
 
 #if USE(ACCELERATED_COMPOSITING)
 #include "RenderLayerCompositor.h"
 #endif
 
+#if ENABLE(SVG)
+#include "SVGDocument.h"
+#include "SVGLocatable.h"
+#include "SVGNames.h"
+#include "SVGPreserveAspectRatio.h"
+#include "SVGSVGElement.h"
+#include "SVGViewElement.h"
+#include "SVGViewSpec.h"
+#endif
+
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -640,6 +652,7 @@ void FrameView::layout(bool allowSubtree)
     beginDeferredRepaints();
     layer->updateLayerPositions((m_doFullRepaint ? RenderLayer::DoFullRepaint : 0)
                                 | RenderLayer::CheckForRepaint
+                                | RenderLayer::IsCompositingUpdateRoot
                                 | RenderLayer::UpdateCompositingLayers);
     endDeferredRepaints();
 
@@ -769,6 +782,72 @@ void FrameView::restoreScrollbar()
     setScrollbarsSuppressed(false);
 }
 
+bool FrameView::scrollToFragment(const KURL& url)
+{
+    // If our URL has no ref, then we have no place we need to jump to.
+    // OTOH If CSS target was set previously, we want to set it to 0, recalc
+    // and possibly repaint because :target pseudo class may have been
+    // set (see bug 11321).
+    if (!url.hasFragmentIdentifier() && !m_frame->document()->cssTarget())
+        return false;
+
+    String fragmentIdentifier = url.fragmentIdentifier();
+    if (scrollToAnchor(fragmentIdentifier))
+        return true;
+
+    // Try again after decoding the ref, based on the document's encoding.
+    if (TextResourceDecoder* decoder = m_frame->document()->decoder())
+        return scrollToAnchor(decodeURLEscapeSequences(fragmentIdentifier, decoder->encoding()));
+
+    return false;
+}
+
+bool FrameView::scrollToAnchor(const String& name)
+{
+    ASSERT(m_frame->document());
+
+    if (!m_frame->document()->haveStylesheetsLoaded()) {
+        m_frame->document()->setGotoAnchorNeededAfterStylesheetsLoad(true);
+        return false;
+    }
+
+    m_frame->document()->setGotoAnchorNeededAfterStylesheetsLoad(false);
+
+    Element* anchorNode = m_frame->document()->findAnchor(name);
+
+#if ENABLE(SVG)
+    if (m_frame->document()->isSVGDocument()) {
+        if (name.startsWith("xpointer(")) {
+            // We need to parse the xpointer reference here
+        } else if (name.startsWith("svgView(")) {
+            RefPtr<SVGSVGElement> svg = static_cast<SVGDocument*>(m_frame->document())->rootElement();
+            if (!svg->currentView()->parseViewSpec(name))
+                return false;
+            svg->setUseCurrentView(true);
+        } else {
+            if (anchorNode && anchorNode->hasTagName(SVGNames::viewTag)) {
+                RefPtr<SVGViewElement> viewElement = anchorNode->hasTagName(SVGNames::viewTag) ? static_cast<SVGViewElement*>(anchorNode) : 0;
+                if (viewElement.get()) {
+                    RefPtr<SVGSVGElement> svg = static_cast<SVGSVGElement*>(SVGLocatable::nearestViewportElement(viewElement.get()));
+                    svg->inheritViewAttributes(viewElement.get());
+                }
+            }
+        }
+        // FIXME: need to decide which <svg> to focus on, and zoom to that one
+        // FIXME: need to actually "highlight" the viewTarget(s)
+    }
+#endif
+
+    m_frame->document()->setCSSTarget(anchorNode); // Setting to null will clear the current target.
+  
+    // Implement the rule that "" and "top" both mean top of page as in other browsers.
+    if (!anchorNode && !(name.isEmpty() || equalIgnoringCase(name, "top")))
+        return false;
+
+    maintainScrollPositionAtAnchor(anchorNode ? static_cast<Node*>(anchorNode) : m_frame->document());
+    return true;
+}
+
 void FrameView::maintainScrollPositionAtAnchor(Node* anchorNode)
 {
     m_maintainScrollPositionAnchor = anchorNode;
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.h b/src/3rdparty/webkit/WebCore/page/FrameView.h
index 4c900ae3fa..3d17d2c418 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.h
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.h
@@ -183,6 +183,8 @@ public:
 
     void adjustPageHeight(float* newBottom, float oldTop, float oldBottom, float bottomLimit);
 
+    bool scrollToFragment(const KURL&);
+    bool scrollToAnchor(const String&);
     void maintainScrollPositionAtAnchor(Node*);
 
     // Methods to convert points and rects between the coordinate space of the renderer, and this view.
diff --git a/src/3rdparty/webkit/WebCore/page/History.cpp b/src/3rdparty/webkit/WebCore/page/History.cpp
index 25271328d4..9a27f1c39b 100644
--- a/src/3rdparty/webkit/WebCore/page/History.cpp
+++ b/src/3rdparty/webkit/WebCore/page/History.cpp
@@ -50,28 +50,30 @@ unsigned History::length() const
 {
     if (!m_frame)
         return 0;
-    return m_frame->loader()->getHistoryLength();
+    if (!m_frame->page())
+        return 0;
+    return m_frame->page()->getHistoryLength();
 }
 
 void History::back()
 {
     if (!m_frame)
         return;
-    m_frame->loader()->scheduleHistoryNavigation(-1);
+    m_frame->redirectScheduler()->scheduleHistoryNavigation(-1);
 }
 
 void History::forward()
 {
     if (!m_frame)
         return;
-    m_frame->loader()->scheduleHistoryNavigation(1);
+    m_frame->redirectScheduler()->scheduleHistoryNavigation(1);
 }
 
 void History::go(int distance)
 {
     if (!m_frame)
         return;
-    m_frame->loader()->scheduleHistoryNavigation(distance);
+    m_frame->redirectScheduler()->scheduleHistoryNavigation(distance);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Page.cpp b/src/3rdparty/webkit/WebCore/page/Page.cpp
index 2d0c91c3ff..8a685f4676 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Page.cpp
@@ -119,6 +119,7 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     , m_theme(RenderTheme::themeForPage(this))
     , m_editorClient(editorClient)
     , m_frameCount(0)
+    , m_openedByDOM(false)
     , m_tabKeyCyclesThroughElements(true)
     , m_defersLoading(false)
     , m_inLowQualityInterpolationMode(false)
@@ -136,7 +137,6 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     , m_customHTMLTokenizerTimeDelay(-1)
     , m_customHTMLTokenizerChunkSize(-1)
     , m_canStartPlugins(true)
-    , m_pluginHalterClient(pluginHalterClient)
 {
 #if !ENABLE(CONTEXT_MENUS)
     UNUSED_PARAM(contextMenuClient);
@@ -156,7 +156,10 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     ASSERT(!allPages->contains(this));
     allPages->add(this);
 
-    pluginHalterEnabledStateChanged();
+    if (pluginHalterClient) {
+        m_pluginHalter.set(new PluginHalter(pluginHalterClient));
+        m_pluginHalter->setPluginAllowedRunTime(m_settings->pluginAllowedRunTime());
+    }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     JavaScriptDebugServer::shared().pageCreated(this);
@@ -201,6 +204,16 @@ void Page::setMainFrame(PassRefPtr<Frame> mainFrame)
     m_mainFrame = mainFrame;
 }
 
+bool Page::openedByDOM() const
+{
+    return m_openedByDOM;
+}
+
+void Page::setOpenedByDOM()
+{
+    m_openedByDOM = true;
+}
+
 BackForwardList* Page::backForwardList()
 {
     return m_backForwardList.get();
@@ -228,6 +241,40 @@ bool Page::goForward()
     return false;
 }
 
+bool Page::canGoBackOrForward(int distance) const
+{
+    if (distance == 0)
+        return true;
+    if (distance > 0 && distance <= m_backForwardList->forwardListCount())
+        return true;
+    if (distance < 0 && -distance <= m_backForwardList->backListCount())
+        return true;
+    return false;
+}
+
+void Page::goBackOrForward(int distance)
+{
+    if (distance == 0)
+        return;
+
+    HistoryItem* item = m_backForwardList->itemAtIndex(distance);
+    if (!item) {
+        if (distance > 0) {
+            int forwardListCount = m_backForwardList->forwardListCount();
+            if (forwardListCount > 0) 
+                item = m_backForwardList->itemAtIndex(forwardListCount);
+        } else {
+            int backListCount = m_backForwardList->backListCount();
+            if (backListCount > 0)
+                item = m_backForwardList->itemAtIndex(-backListCount);
+        }
+    }
+
+    ASSERT(item); // we should not reach this line with an empty back/forward list
+    if (item)
+        goToItem(item, FrameLoadTypeIndexedBackForward);
+}
+
 void Page::goToItem(HistoryItem* item, FrameLoadType type)
 {
     // Abort any current load if we're going to a history item
@@ -244,7 +291,12 @@ void Page::goToItem(HistoryItem* item, FrameLoadType type)
         databasePolicy = DatabasePolicyContinue;
 #endif
     m_mainFrame->loader()->stopAllLoaders(databasePolicy);
-    m_mainFrame->loader()->goToItem(item, type);
+    m_mainFrame->loader()->history()->goToItem(item, type);
+}
+
+int Page::getHistoryLength()
+{
+    return m_backForwardList->backListCount() + 1;
 }
 
 void Page::setGlobalHistoryItem(HistoryItem* item)
@@ -683,16 +735,6 @@ InspectorTimelineAgent* Page::inspectorTimelineAgent() const
 }
 #endif
 
-void Page::pluginHalterEnabledStateChanged()
-{
-    if (m_settings->pluginHalterEnabled()) {
-        ASSERT(!m_pluginHalter);
-        m_pluginHalter.set(new PluginHalter(m_pluginHalterClient));
-        m_pluginHalter->setPluginAllowedRunTime(m_settings->pluginAllowedRunTime());
-    } else
-        m_pluginHalter = 0;
-}
-
 void Page::pluginAllowedRunTimeChanged()
 {
     if (m_pluginHalter)
diff --git a/src/3rdparty/webkit/WebCore/page/Page.h b/src/3rdparty/webkit/WebCore/page/Page.h
index 602d99b8b8..488646450a 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.h
+++ b/src/3rdparty/webkit/WebCore/page/Page.h
@@ -103,6 +103,9 @@ namespace WebCore {
         void setMainFrame(PassRefPtr<Frame>);
         Frame* mainFrame() const { return m_mainFrame.get(); }
 
+        bool openedByDOM() const;
+        void setOpenedByDOM();
+
         BackForwardList* backForwardList();
 
         // FIXME: The following three methods don't fall under the responsibilities of the Page object
@@ -111,7 +114,10 @@ namespace WebCore {
         // makes more sense when that class exists.
         bool goBack();
         bool goForward();
+        bool canGoBackOrForward(int distance) const;
+        void goBackOrForward(int distance);
         void goToItem(HistoryItem*, FrameLoadType);
+        int getHistoryLength();
 
         HistoryItem* globalHistoryItem() const { return m_globalHistoryItem.get(); }
         void setGlobalHistoryItem(HistoryItem*);
@@ -187,7 +193,6 @@ namespace WebCore {
         void didStartPlugin(HaltablePlugin*);
         void didStopPlugin(HaltablePlugin*);
         void pluginAllowedRunTimeChanged();
-        void pluginHalterEnabledStateChanged();
 
         static void setDebuggerForAllPages(JSC::Debugger*);
         void setDebugger(JSC::Debugger*);
@@ -261,6 +266,7 @@ namespace WebCore {
 
         int m_frameCount;
         String m_groupName;
+        bool m_openedByDOM;
 
         bool m_tabKeyCyclesThroughElements;
         bool m_defersLoading;
@@ -293,7 +299,6 @@ namespace WebCore {
         HashSet<PluginView*> m_unstartedPlugins;
 
         OwnPtr<PluginHalter> m_pluginHalter;
-        PluginHalterClient* m_pluginHalterClient;
 
 #if ENABLE(DOM_STORAGE)
         RefPtr<StorageNamespace> m_sessionStorage;
diff --git a/src/3rdparty/webkit/WebCore/page/PageGroup.cpp b/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
index f9855a74ca..427c240ec4 100644
--- a/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
@@ -191,20 +191,21 @@ StorageNamespace* PageGroup::localStorage()
     if (!m_localStorage) {
         // Need a page in this page group to query the settings for the local storage database path.
         Page* page = *m_pages.begin();
-        ASSERT(page);
-        m_localStorage = StorageNamespace::localStorageNamespace(page->settings()->localStorageDatabasePath());
+        const String& path = page->settings()->localStorageDatabasePath();
+        unsigned quota = page->settings()->localStorageQuota();
+        m_localStorage = StorageNamespace::localStorageNamespace(path, quota);
     }
 
     return m_localStorage.get();
 }
 #endif
 
-void PageGroup::addUserScript(const String& source, const KURL& url, const Vector<String>& patterns, 
-                              unsigned worldID, UserScriptInjectionTime injectionTime)
+void PageGroup::addUserScriptToWorld(unsigned worldID, const String& source, const KURL& url,  PassOwnPtr<Vector<String> > whitelist,
+                                     PassOwnPtr<Vector<String> > blacklist, UserScriptInjectionTime injectionTime)
 {
     if (worldID == UINT_MAX)
         return;
-    OwnPtr<UserScript> userScript(new UserScript(source, url, patterns, worldID, injectionTime));
+    OwnPtr<UserScript> userScript(new UserScript(source, url, whitelist, blacklist, worldID, injectionTime));
     if (!m_userScripts)
         m_userScripts.set(new UserScriptMap);
     UserScriptVector*& scriptsInWorld = m_userScripts->add(worldID, 0).first->second;
@@ -213,11 +214,12 @@ void PageGroup::addUserScript(const String& source, const KURL& url, const Vecto
     scriptsInWorld->append(userScript.release());
 }
 
-void PageGroup::addUserStyleSheet(const String& source, const KURL& url, const Vector<String>& patterns, unsigned worldID)
+void PageGroup::addUserStyleSheetToWorld(unsigned worldID, const String& source, const KURL& url, PassOwnPtr<Vector<String> > whitelist,
+                                         PassOwnPtr<Vector<String> > blacklist)
 {
     if (worldID == UINT_MAX)
         return;
-    OwnPtr<UserStyleSheet> userStyleSheet(new UserStyleSheet(source, url, patterns, worldID));
+    OwnPtr<UserStyleSheet> userStyleSheet(new UserStyleSheet(source, url, whitelist, blacklist, worldID));
     if (!m_userStyleSheets)
         m_userStyleSheets.set(new UserStyleSheetMap);
     UserStyleSheetVector*& styleSheetsInWorld = m_userStyleSheets->add(worldID, 0).first->second;
@@ -233,23 +235,93 @@ void PageGroup::addUserStyleSheet(const String& source, const KURL& url, const V
     }
 }
 
-void PageGroup::removeUserContentForWorld(unsigned worldID)
+void PageGroup::removeUserScriptFromWorld(unsigned worldID, const KURL& url)
 {
-    if (m_userScripts) {
-        UserScriptMap::iterator it = m_userScripts->find(worldID);
-        if (it != m_userScripts->end()) {
-            m_userScripts->remove(it);
-            delete it->second;
-        }
+    if (!m_userScripts)
+        return;
+
+    UserScriptMap::iterator it = m_userScripts->find(worldID);
+    if (it == m_userScripts->end())
+        return;
+    
+    UserScriptVector* scripts = it->second;
+    for (int i = scripts->size() - 1; i >= 0; --i) {
+        if (scripts->at(i)->url() == url)
+            scripts->remove(i);
     }
     
-    if (m_userStyleSheets) {
-        UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
-        if (it != m_userStyleSheets->end()) {
-            m_userStyleSheets->remove(it);
-            delete it->second;
+    if (!scripts->isEmpty())
+        return;
+    
+    delete it->second;
+    m_userScripts->remove(it);
+}
+
+void PageGroup::removeUserStyleSheetFromWorld(unsigned worldID, const KURL& url)
+{
+    if (!m_userStyleSheets)
+        return;
+
+    UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+    bool sheetsChanged = false;
+    if (it == m_userStyleSheets->end())
+        return;
+    
+    UserStyleSheetVector* stylesheets = it->second;
+    for (int i = stylesheets->size() - 1; i >= 0; --i) {
+        if (stylesheets->at(i)->url() == url) {
+            stylesheets->remove(i);
+            sheetsChanged = true;
         }
     }
+        
+    if (!sheetsChanged)
+        return;
+
+    if (!stylesheets->isEmpty()) {
+        delete it->second;
+        m_userStyleSheets->remove(it);
+    }
+    
+    // Clear our cached sheets and have them just reparse.
+    HashSet<Page*>::const_iterator end = m_pages.end();
+    for (HashSet<Page*>::const_iterator it = m_pages.begin(); it != end; ++it) {
+        for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext())
+            frame->document()->clearPageGroupUserSheets();
+    }
+}
+
+void PageGroup::removeUserScriptsFromWorld(unsigned worldID)
+{
+    if (!m_userScripts)
+        return;
+
+    UserScriptMap::iterator it = m_userScripts->find(worldID);
+    if (it == m_userScripts->end())
+        return;
+       
+    delete it->second;
+    m_userScripts->remove(it);
+}
+
+void PageGroup::removeUserStyleSheetsFromWorld(unsigned worldID)
+{
+    if (!m_userStyleSheets)
+        return;
+    
+    UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+    if (it == m_userStyleSheets->end())
+        return;
+    
+    delete it->second;
+    m_userStyleSheets->remove(it);
+
+    // Clear our cached sheets and have them just reparse.
+    HashSet<Page*>::const_iterator end = m_pages.end();
+    for (HashSet<Page*>::const_iterator it = m_pages.begin(); it != end; ++it) {
+        for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext())
+            frame->document()->clearPageGroupUserSheets();
+    }
 }
 
 void PageGroup::removeAllUserContent()
diff --git a/src/3rdparty/webkit/WebCore/page/PageGroup.h b/src/3rdparty/webkit/WebCore/page/PageGroup.h
index 0bf3fbca71..c233cd1118 100644
--- a/src/3rdparty/webkit/WebCore/page/PageGroup.h
+++ b/src/3rdparty/webkit/WebCore/page/PageGroup.h
@@ -70,16 +70,23 @@ namespace WebCore {
         bool hasLocalStorage() { return m_localStorage; }
 #endif
 
-        void addUserScript(const String& source, const KURL&, const Vector<String>& patterns,
-                           unsigned worldID, UserScriptInjectionTime);
-        const UserScriptMap* userScripts() const { return m_userScripts.get(); }
+        void addUserScriptToWorld(unsigned worldID, const String& source, const KURL&, 
+                                  PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
+                                  UserScriptInjectionTime);
+        void addUserStyleSheetToWorld(unsigned worldID, const String& source, const KURL&,
+                               PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist);
         
-        void addUserStyleSheet(const String& source, const KURL&, const Vector<String>& patterns, unsigned worldID);
-        const UserStyleSheetMap* userStyleSheets() const { return m_userStyleSheets.get(); }
+        void removeUserScriptFromWorld(unsigned, const KURL&);
+        void removeUserStyleSheetFromWorld(unsigned, const KURL&);
         
-        void removeUserContentForWorld(unsigned);
+        void removeUserScriptsFromWorld(unsigned);
+        void removeUserStyleSheetsFromWorld(unsigned);
+    
         void removeAllUserContent();
         
+        const UserScriptMap* userScripts() const { return m_userScripts.get(); }
+        const UserStyleSheetMap* userStyleSheets() const { return m_userStyleSheets.get(); }
+
     private:
         void addVisitedLink(LinkHash stringHash);
 
diff --git a/src/3rdparty/webkit/WebCore/page/PluginHalter.cpp b/src/3rdparty/webkit/WebCore/page/PluginHalter.cpp
index 8025337c8d..63f5469860 100644
--- a/src/3rdparty/webkit/WebCore/page/PluginHalter.cpp
+++ b/src/3rdparty/webkit/WebCore/page/PluginHalter.cpp
@@ -28,7 +28,6 @@
 #include "PluginHalter.h"
 
 #include "HaltablePlugin.h"
-#include "PluginHalterClient.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/Vector.h>
 
@@ -49,6 +48,9 @@ void PluginHalter::didStartPlugin(HaltablePlugin* obj)
     ASSERT_ARG(obj, obj);
     ASSERT_ARG(obj, !m_plugins.contains(obj));
 
+    if (!m_client->enabled())
+        return;
+
     double currentTime = WTF::currentTime();
 
     m_plugins.add(obj, currentTime);
@@ -61,6 +63,9 @@ void PluginHalter::didStartPlugin(HaltablePlugin* obj)
 
 void PluginHalter::didStopPlugin(HaltablePlugin* obj)
 {
+    if (!m_client->enabled())
+        return;
+
     m_plugins.remove(obj);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/page/PluginHalter.h b/src/3rdparty/webkit/WebCore/page/PluginHalter.h
index 26f51013ab..eddce34fbc 100644
--- a/src/3rdparty/webkit/WebCore/page/PluginHalter.h
+++ b/src/3rdparty/webkit/WebCore/page/PluginHalter.h
@@ -26,13 +26,14 @@
 #ifndef PluginHalter_h
 #define PluginHalter_h
 
+#include "PluginHalterClient.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
 class HaltablePlugin;
-class PluginHalterClient;
 
 class PluginHalter {
 public:
@@ -47,7 +48,7 @@ private:
     void timerFired(Timer<PluginHalter>*);
     void startTimerIfNecessary();
 
-    PluginHalterClient* m_client;
+    OwnPtr<PluginHalterClient> m_client;
     Timer<PluginHalter> m_timer;
     unsigned m_pluginAllowedRunTime;
     double m_oldestStartTime;
diff --git a/src/3rdparty/webkit/WebCore/page/PluginHalterClient.h b/src/3rdparty/webkit/WebCore/page/PluginHalterClient.h
index 7ea460ac06..f77091f147 100644
--- a/src/3rdparty/webkit/WebCore/page/PluginHalterClient.h
+++ b/src/3rdparty/webkit/WebCore/page/PluginHalterClient.h
@@ -35,6 +35,7 @@ public:
     virtual ~PluginHalterClient() { }
 
     virtual bool shouldHaltPlugin(Node*) const = 0;
+    virtual bool enabled() const = 0;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/PrintContext.cpp b/src/3rdparty/webkit/WebCore/page/PrintContext.cpp
index 4d3a839927..bba678a716 100644
--- a/src/3rdparty/webkit/WebCore/page/PrintContext.cpp
+++ b/src/3rdparty/webkit/WebCore/page/PrintContext.cpp
@@ -25,6 +25,7 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "RenderView.h"
+#include "Settings.h"
 
 using namespace WebCore;
 
@@ -95,18 +96,23 @@ void PrintContext::computePageRects(const FloatRect& printRect, float headerHeig
 
 void PrintContext::begin(float width)
 {
-    // By imaging to a width a little wider than the available pixels,
-    // thin pages will be scaled down a little, matching the way they
-    // print in IE and Camino. This lets them use fewer sheets than they
-    // would otherwise, which is presumably why other browsers do this.
-    // Wide pages will be scaled down more than this.
-    const float PrintingMinimumShrinkFactor = 1.25f;
-
-    // This number determines how small we are willing to reduce the page content
-    // in order to accommodate the widest line. If the page would have to be
-    // reduced smaller to make the widest line fit, we just clip instead (this
-    // behavior matches MacIE and Mozilla, at least)
-    const float PrintingMaximumShrinkFactor = 2.0f;
+    float PrintingMinimumShrinkFactor = m_frame->settings() ? m_frame->settings()->printingMinimumShrinkFactor() : 0.0f;
+    float PrintingMaximumShrinkFactor = m_frame->settings() ? m_frame->settings()->printingMaximumShrinkFactor() : 0.0f;
+
+    if (PrintingMaximumShrinkFactor < PrintingMinimumShrinkFactor || PrintingMinimumShrinkFactor <= 0.0f) {
+        // By imaging to a width a little wider than the available pixels,
+        // thin pages will be scaled down a little, matching the way they
+        // print in IE and Camino. This lets them use fewer sheets than they
+        // would otherwise, which is presumably why other browsers do this.
+        // Wide pages will be scaled down more than this.
+        PrintingMinimumShrinkFactor = 1.25f;
+
+        // This number determines how small we are willing to reduce the page content
+        // in order to accommodate the widest line. If the page would have to be
+        // reduced smaller to make the widest line fit, we just clip instead (this
+        // behavior matches MacIE and Mozilla, at least)
+        PrintingMaximumShrinkFactor = 2.0f;
+    }
 
     float minLayoutWidth = width * PrintingMinimumShrinkFactor;
     float maxLayoutWidth = width * PrintingMaximumShrinkFactor;
diff --git a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
index b91c1f1976..338bf9fa3d 100644
--- a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
@@ -30,13 +30,15 @@
 #include "SecurityOrigin.h"
 
 #include "CString.h"
-#include "FrameLoader.h"
+#include "Document.h"
 #include "KURL.h"
 #include "OriginAccessEntry.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
+static SecurityOrigin::LocalLoadPolicy localLoadPolicy = SecurityOrigin::AllowLocalLoadsForLocalOnly;
+
 typedef Vector<OriginAccessEntry> OriginAccessWhiteList;
 typedef HashMap<String, OriginAccessWhiteList*> OriginAccessMap;
 
@@ -116,9 +118,9 @@ SecurityOrigin::SecurityOrigin(const KURL& url)
 }
 
 SecurityOrigin::SecurityOrigin(const SecurityOrigin* other)
-    : m_protocol(other->m_protocol.copy())
-    , m_host(other->m_host.copy())
-    , m_domain(other->m_domain.copy())
+    : m_protocol(other->m_protocol.threadsafeCopy())
+    , m_host(other->m_host.threadsafeCopy())
+    , m_domain(other->m_domain.threadsafeCopy())
     , m_port(other->m_port)
     , m_noAccess(other->m_noAccess)
     , m_universalAccess(other->m_universalAccess)
@@ -144,7 +146,7 @@ PassRefPtr<SecurityOrigin> SecurityOrigin::createEmpty()
     return create(KURL());
 }
 
-PassRefPtr<SecurityOrigin> SecurityOrigin::copy()
+PassRefPtr<SecurityOrigin> SecurityOrigin::threadsafeCopy()
 {
     return adoptRef(new SecurityOrigin(this));
 }
@@ -237,6 +239,20 @@ bool SecurityOrigin::taintsCanvas(const KURL& url) const
     return true;
 }
 
+bool SecurityOrigin::canLoad(const KURL& url, const String& referrer, Document* document)
+{
+    if (!shouldTreatURLAsLocal(url.string()))
+        return true;
+
+    // If we were provided a document, we let its local file policy dictate the result,
+    // otherwise we allow local loads only if the supplied referrer is also local.
+    if (document)
+        return document->securityOrigin()->canLoadLocalResources();
+    if (!referrer.isEmpty())
+        return shouldTreatURLAsLocal(referrer);
+    return false;
+}
+
 void SecurityOrigin::grantLoadLocalResources()
 {
     // This method exists only to support backwards compatibility with older
@@ -244,7 +260,7 @@ void SecurityOrigin::grantLoadLocalResources()
     // in a SecurityOrigin is a security hazard because the documents without
     // the privilege can obtain the privilege by injecting script into the
     // documents that have been granted the privilege.
-    ASSERT(FrameLoader::allowSubstituteDataAccessToLocal());
+    ASSERT(allowSubstituteDataAccessToLocal());
     m_canLoadLocalResources = true;
 }
 
@@ -370,13 +386,11 @@ bool SecurityOrigin::isSameSchemeHostPort(const SecurityOrigin* other) const
     return true;
 }
 
-// static
 void SecurityOrigin::registerURLSchemeAsLocal(const String& scheme)
 {
     localSchemes().add(scheme);
 }
 
-// static
 void SecurityOrigin::removeURLSchemeRegisteredAsLocal(const String& scheme)
 {
     if (scheme == "file")
@@ -392,13 +406,11 @@ void SecurityOrigin::removeURLSchemeRegisteredAsLocal(const String& scheme)
     localSchemes().remove(scheme);
 }
 
-// static
 const URLSchemesMap&  SecurityOrigin::localURLSchemes()
 {
     return localSchemes();
 }
 
-// static
 bool SecurityOrigin::shouldTreatURLAsLocal(const String& url)
 {
     // This avoids an allocation of another String and the HashSet contains()
@@ -419,7 +431,6 @@ bool SecurityOrigin::shouldTreatURLAsLocal(const String& url)
     return localSchemes().contains(scheme);
 }
 
-// static
 bool SecurityOrigin::shouldTreatURLSchemeAsLocal(const String& scheme)
 {
     // This avoids an allocation of another String and the HashSet contains()
@@ -438,18 +449,47 @@ bool SecurityOrigin::shouldTreatURLSchemeAsLocal(const String& scheme)
     return localSchemes().contains(scheme);
 }
 
-// static
 void SecurityOrigin::registerURLSchemeAsNoAccess(const String& scheme)
 {
     noAccessSchemes().add(scheme);
 }
 
-// static
 bool SecurityOrigin::shouldTreatURLSchemeAsNoAccess(const String& scheme)
 {
     return noAccessSchemes().contains(scheme);
 }
 
+bool SecurityOrigin::shouldHideReferrer(const KURL& url, const String& referrer)
+{
+    bool referrerIsSecureURL = protocolIs(referrer, "https");
+    bool referrerIsWebURL = referrerIsSecureURL || protocolIs(referrer, "http");
+
+    if (!referrerIsWebURL)
+        return true;
+
+    if (!referrerIsSecureURL)
+        return false;
+
+    bool URLIsSecureURL = url.protocolIs("https");
+
+    return !URLIsSecureURL;
+}
+
+void SecurityOrigin::setLocalLoadPolicy(LocalLoadPolicy policy)
+{
+    localLoadPolicy = policy;
+}
+
+bool SecurityOrigin::restrictAccessToLocal()
+{
+    return localLoadPolicy != SecurityOrigin::AllowLocalLoadsForAll;
+}
+
+bool SecurityOrigin::allowSubstituteDataAccessToLocal()
+{
+    return localLoadPolicy != SecurityOrigin::AllowLocalLoadsForLocalOnly;
+}
+
 void SecurityOrigin::whiteListAccessFromOrigin(const SecurityOrigin& sourceOrigin, const String& destinationProtocol, const String& destinationDomains, bool allowDestinationSubdomains)
 {
     ASSERT(isMainThread());
diff --git a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
index 732afa8f78..46e6fada44 100644
--- a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
+++ b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
@@ -40,7 +40,8 @@
 namespace WebCore {
 
     typedef HashSet<String, CaseFoldingHash> URLSchemesMap;
-    
+
+    class Document;
     class KURL;
     
     class SecurityOrigin : public ThreadSafeShared<SecurityOrigin> {
@@ -52,7 +53,7 @@ namespace WebCore {
 
         // Create a deep copy of this SecurityOrigin.  This method is useful
         // when marshalling a SecurityOrigin to another thread.
-        PassRefPtr<SecurityOrigin> copy();
+        PassRefPtr<SecurityOrigin> threadsafeCopy();
 
         // Set the domain property of this security origin to newDomain.  This
         // function does not check whether newDomain is a suffix of the current
@@ -81,6 +82,11 @@ namespace WebCore {
         // drawing an image onto an HTML canvas element with the drawImage API.
         bool taintsCanvas(const KURL&) const;
 
+        // Returns true for any non-local URL. If document parameter is supplied,
+        // its local load policy dictates, otherwise if referrer is non-empty and
+        // represents a local file, then the local load is allowed.
+        static bool canLoad(const KURL&, const String& referrer, Document* document);
+
         // Returns true if this SecurityOrigin can load local resources, such
         // as images, iframes, and style sheets, and can link to local URLs.
         // For example, call this function before creating an iframe to a
@@ -143,6 +149,17 @@ namespace WebCore {
         static bool shouldTreatURLAsLocal(const String&);
         static bool shouldTreatURLSchemeAsLocal(const String&);
 
+        static bool shouldHideReferrer(const KURL&, const String& referrer);
+
+        enum LocalLoadPolicy {
+            AllowLocalLoadsForAll,  // No restriction on local loads.
+            AllowLocalLoadsForLocalAndSubstituteData,
+            AllowLocalLoadsForLocalOnly,
+        };
+        static void setLocalLoadPolicy(LocalLoadPolicy);
+        static bool restrictAccessToLocal();
+        static bool allowSubstituteDataAccessToLocal();
+
         static void registerURLSchemeAsNoAccess(const String&);
         static bool shouldTreatURLSchemeAsNoAccess(const String&);
 
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.cpp b/src/3rdparty/webkit/WebCore/page/Settings.cpp
index ab438a1b68..48f310b663 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Settings.cpp
@@ -61,7 +61,10 @@ Settings::Settings(Page* page)
     , m_defaultFontSize(0)
     , m_defaultFixedFontSize(0)
     , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
+    , m_localStorageQuota(5 * 1024 * 1024)  // Suggested by the HTML5 spec.
     , m_pluginAllowedRunTime(numeric_limits<unsigned>::max())
+    , m_printingMinimumShrinkFactor(0.0f)
+    , m_printingMaximumShrinkFactor(0.0f)
     , m_isJavaEnabled(false)
     , m_loadsImagesAutomatically(false)
     , m_privateBrowsingEnabled(false)
@@ -116,11 +119,7 @@ Settings::Settings(Page* page)
     , m_xssAuditorEnabled(false)
     , m_acceleratedCompositingEnabled(true)
     , m_experimentalNotificationsEnabled(false)
-    , m_pluginHalterEnabled(false)
-    , m_experimentalWebGLEnabled(false)
-#if ENABLE(WEB_SOCKETS)
-    , m_experimentalWebSocketsEnabled(false)
-#endif
+    , m_webGLEnabled(false)
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -262,6 +261,11 @@ void Settings::setSessionStorageEnabled(bool sessionStorageEnabled)
     m_sessionStorageEnabled = sessionStorageEnabled;
 }
 
+void Settings::setLocalStorageQuota(unsigned localStorageQuota)
+{
+    m_localStorageQuota = localStorageQuota;
+}
+
 void Settings::setPrivateBrowsingEnabled(bool privateBrowsingEnabled)
 {
     m_privateBrowsingEnabled = privateBrowsingEnabled;
@@ -509,16 +513,6 @@ void Settings::setExperimentalNotificationsEnabled(bool enabled)
     m_experimentalNotificationsEnabled = enabled;
 }
 
-void Settings::setPluginHalterEnabled(bool enabled)
-{
-    if (m_pluginHalterEnabled == enabled)
-        return;
-
-    m_pluginHalterEnabled = enabled;
-
-    m_page->pluginHalterEnabledStateChanged();
-}
-
 void Settings::setPluginAllowedRunTime(unsigned runTime)
 {
     m_pluginAllowedRunTime = runTime;
@@ -532,16 +526,19 @@ void Settings::setShouldUseHighResolutionTimers(bool shouldUseHighResolutionTime
 }
 #endif
 
-void Settings::setExperimentalWebGLEnabled(bool enabled)
+void Settings::setWebGLEnabled(bool enabled)
 {
-    m_experimentalWebGLEnabled = enabled;
+    m_webGLEnabled = enabled;
 }
 
-#if ENABLE(WEB_SOCKETS)
-void Settings::setExperimentalWebSocketsEnabled(bool enabled)
+void Settings::setPrintingMinimumShrinkFactor(float printingMinimumShrinkFactor)
 {
-    m_experimentalWebSocketsEnabled = enabled;
-}
-#endif
+    m_printingMinimumShrinkFactor = printingMinimumShrinkFactor;
+}    
+
+void Settings::setPrintingMaximumShrinkFactor(float printingMaximumShrinkFactor)
+{
+    m_printingMaximumShrinkFactor = printingMaximumShrinkFactor;
+}    
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.h b/src/3rdparty/webkit/WebCore/page/Settings.h
index ec9c8f95f1..bdb07b9164 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.h
+++ b/src/3rdparty/webkit/WebCore/page/Settings.h
@@ -128,6 +128,9 @@ namespace WebCore {
         void setSessionStorageEnabled(bool);
         bool sessionStorageEnabled() const { return m_sessionStorageEnabled; }
 
+        void setLocalStorageQuota(unsigned);
+        unsigned localStorageQuota() const { return m_localStorageQuota; }
+
         void setPrivateBrowsingEnabled(bool);
         bool privateBrowsingEnabled() const { return m_privateBrowsingEnabled; }
 
@@ -261,21 +264,17 @@ namespace WebCore {
         static bool shouldUseHighResolutionTimers() { return gShouldUseHighResolutionTimers; }
 #endif
 
-        void setPluginHalterEnabled(bool);
-        bool pluginHalterEnabled() const { return m_pluginHalterEnabled; }
-
         void setPluginAllowedRunTime(unsigned);
         unsigned pluginAllowedRunTime() const { return m_pluginAllowedRunTime; }
 
-        // This run-time flag is only temporary while the WebGL
-        // specification is being developed.
-        void setExperimentalWebGLEnabled(bool);
-        bool experimentalWebGLEnabled() const { return m_experimentalWebGLEnabled; }
+        void setWebGLEnabled(bool);
+        bool webGLEnabled() const { return m_webGLEnabled; }
 
-#if ENABLE(WEB_SOCKETS)
-        void setExperimentalWebSocketsEnabled(bool);
-        bool experimentalWebSocketsEnabled() const { return m_experimentalWebSocketsEnabled; }
-#endif
+        void setPrintingMinimumShrinkFactor(float);
+        float printingMinimumShrinkFactor() const { return m_printingMinimumShrinkFactor; }
+
+        void setPrintingMaximumShrinkFactor(float);
+        float printingMaximumShrinkFactor() const { return m_printingMaximumShrinkFactor; }
 
     private:
         Page* m_page;
@@ -297,7 +296,10 @@ namespace WebCore {
         int m_defaultFontSize;
         int m_defaultFixedFontSize;
         size_t m_maximumDecodedImageSize;
+        unsigned m_localStorageQuota;
         unsigned m_pluginAllowedRunTime;
+        float m_printingMinimumShrinkFactor;
+        float m_printingMaximumShrinkFactor;
         bool m_isJavaEnabled : 1;
         bool m_loadsImagesAutomatically : 1;
         bool m_privateBrowsingEnabled : 1;
@@ -343,12 +345,7 @@ namespace WebCore {
         bool m_xssAuditorEnabled : 1;
         bool m_acceleratedCompositingEnabled : 1;
         bool m_experimentalNotificationsEnabled : 1;
-        bool m_pluginHalterEnabled : 1;
-        bool m_experimentalWebGLEnabled : 1;
-
-#if ENABLE(WEB_SOCKETS)
-        bool m_experimentalWebSocketsEnabled : 1;
-#endif
+        bool m_webGLEnabled : 1;
 
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
diff --git a/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.cpp b/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.cpp
index 1960131510..5f0a3114e9 100644
--- a/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.cpp
+++ b/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.cpp
@@ -30,19 +30,33 @@
 
 namespace WebCore {
 
-bool UserContentURLPattern::matchesPatterns(const KURL& url, const Vector<String>& patterns)
+bool UserContentURLPattern::matchesPatterns(const KURL& url, const Vector<String>* whitelist, const Vector<String>* blacklist)
 {
-    // Treat no patterns at all as though a pattern of * was specified.
-    if (patterns.isEmpty())
-        return true;
+    // In order for a URL to be a match it has to be present in the whitelist and not present in the blacklist.
+    // If there is no whitelist at all, then all URLs are assumed to be in the whitelist.
+    bool matchesWhitelist = !whitelist || whitelist->isEmpty();
+    if (!matchesWhitelist) {
+        for (unsigned i = 0; i < whitelist->size(); ++i) {
+            UserContentURLPattern contentPattern(whitelist->at(i));
+            if (contentPattern.matches(url)) {
+                matchesWhitelist = true;
+                break;
+            }
+        }
+    }
 
-    for (unsigned i = 0; i < patterns.size(); ++i) {
-        UserContentURLPattern contentPattern(patterns[i]);
-        if (contentPattern.matches(url))
-            return true;
+    bool matchesBlacklist = false;
+    if (blacklist) {
+        for (unsigned i = 0; i < blacklist->size(); ++i) {
+            UserContentURLPattern contentPattern(blacklist->at(i));
+            if (contentPattern.matches(url)) {
+                matchesBlacklist = true;
+                break;
+            }
+        }
     }
 
-    return false;
+    return matchesWhitelist && !matchesBlacklist;
 }
 
 bool UserContentURLPattern::parse(const String& pattern)
diff --git a/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.h b/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.h
index bc87f55ad7..0b1a248c72 100644
--- a/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.h
+++ b/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.h
@@ -49,7 +49,7 @@ public:
 
     bool matchSubdomains() const { return m_matchSubdomains; }
     
-    static bool matchesPatterns(const KURL&, const Vector<String>&);
+    static bool matchesPatterns(const KURL&, const Vector<String>* whitelist, const Vector<String>* blacklist);
 
 private:
     bool parse(const String& pattern);
diff --git a/src/3rdparty/webkit/WebCore/page/UserScript.h b/src/3rdparty/webkit/WebCore/page/UserScript.h
index 51031ab21d..dbbb87952b 100644
--- a/src/3rdparty/webkit/WebCore/page/UserScript.h
+++ b/src/3rdparty/webkit/WebCore/page/UserScript.h
@@ -29,6 +29,7 @@
 #include "KURL.h"
 #include "UserScriptTypes.h"
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -36,11 +37,12 @@ namespace WebCore {
 class UserScript {
 public:
     UserScript(const String& source, const KURL& url,
-               const Vector<String>& patterns, unsigned worldID,
-               UserScriptInjectionTime injectionTime)
+               PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
+               unsigned worldID, UserScriptInjectionTime injectionTime)
         : m_source(source)
         , m_url(url)
-        , m_patterns(patterns)
+        , m_whitelist(whitelist)
+        , m_blacklist(blacklist)
         , m_worldID(worldID)
         , m_injectionTime(injectionTime)
     {
@@ -48,14 +50,16 @@ public:
 
     const String& source() const { return m_source; }
     const KURL& url() const { return m_url; }
-    const Vector<String>& patterns() const { return m_patterns; }
+    const Vector<String>* whitelist() const { return m_whitelist.get(); }
+    const Vector<String>* blacklist() const { return m_blacklist.get(); }
     unsigned worldID() const { return m_worldID; }
     UserScriptInjectionTime injectionTime() const { return m_injectionTime; }
     
 private:
     String m_source;
     KURL m_url;
-    Vector<String> m_patterns;
+    OwnPtr<Vector<String> > m_whitelist;
+    OwnPtr<Vector<String> > m_blacklist;
     unsigned m_worldID;
     UserScriptInjectionTime m_injectionTime;
 };
diff --git a/src/3rdparty/webkit/WebCore/page/UserStyleSheet.h b/src/3rdparty/webkit/WebCore/page/UserStyleSheet.h
index 5ae95c381e..56bec408b0 100644
--- a/src/3rdparty/webkit/WebCore/page/UserStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/page/UserStyleSheet.h
@@ -29,6 +29,7 @@
 #include "KURL.h"
 #include "UserStyleSheetTypes.h"
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -36,23 +37,27 @@ namespace WebCore {
 class UserStyleSheet {
 public:
     UserStyleSheet(const String& source, const KURL& url,
-               const Vector<String>& patterns, unsigned worldID)
+                   PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
+                   unsigned worldID)
         : m_source(source)
         , m_url(url)
-        , m_patterns(patterns)
+        , m_whitelist(whitelist)
+        , m_blacklist(blacklist)
         , m_worldID(worldID)
     {
     }
 
     const String& source() const { return m_source; }
     const KURL& url() const { return m_url; }
-    const Vector<String>& patterns() const { return m_patterns; }
+    const Vector<String>* whitelist() const { return m_whitelist.get(); }
+    const Vector<String>* blacklist() const { return m_blacklist.get(); }
     unsigned worldID() const { return m_worldID; }
 
 private:
     String m_source;
     KURL m_url;
-    Vector<String> m_patterns;
+    OwnPtr<Vector<String> > m_whitelist;
+    OwnPtr<Vector<String> > m_blacklist;
     unsigned m_worldID;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
index 4fcc53cdab..890c3fa832 100644
--- a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
+++ b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
@@ -58,15 +58,30 @@ static bool isNonCanonicalCharacter(UChar c)
     return (c == '\\' || c == '0' || c < ' ' || c >= 127);
 }
 
-String XSSAuditor::CachingURLCanonicalizer::canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities)
+static bool isIllegalURICharacter(UChar c)
 {
-    if (decodeEntities == m_decodeEntities && encoding == m_encoding && url == m_inputURL)
+    // The characters described in section 2.4.3 of RFC 2396 <http://www.faqs.org/rfcs/rfc2396.html> in addition to the 
+    // single quote character "'" are considered illegal URI characters. That is, the following characters cannot appear
+    // in a valid URI: ', ", <, >
+    //
+    // If the request does not contain these characters then we can assume that no inline scripts have been injected 
+    // into the response page, because it is impossible to write an inline script of the form <script>...</script>
+    // without "<", ">".
+    return (c == '\'' || c == '"' || c == '<' || c == '>');
+}
+
+String XSSAuditor::CachingURLCanonicalizer::canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
+                                                            bool decodeURLEscapeSequencesTwice)
+{
+    if (decodeEntities == m_decodeEntities && decodeURLEscapeSequencesTwice == m_decodeURLEscapeSequencesTwice 
+        && encoding == m_encoding && url == m_inputURL)
         return m_cachedCanonicalizedURL;
 
-    m_cachedCanonicalizedURL = canonicalize(decodeURL(url, encoding, decodeEntities));
+    m_cachedCanonicalizedURL = canonicalize(decodeURL(url, encoding, decodeEntities, decodeURLEscapeSequencesTwice));
     m_inputURL = url;
     m_encoding = encoding;
     m_decodeEntities = decodeEntities;
+    m_decodeURLEscapeSequencesTwice = decodeURLEscapeSequencesTwice;
     return m_cachedCanonicalizedURL;
 }
 
@@ -90,7 +105,7 @@ bool XSSAuditor::canEvaluate(const String& code) const
     if (!isEnabled())
         return true;
 
-    if (findInRequest(code, false)) {
+    if (findInRequest(code, false, true)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
@@ -103,7 +118,7 @@ bool XSSAuditor::canEvaluateJavaScriptURL(const String& code) const
     if (!isEnabled())
         return true;
 
-    if (findInRequest(code)) {
+    if (findInRequest(code, true, false, true)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
@@ -116,7 +131,7 @@ bool XSSAuditor::canCreateInlineEventListener(const String&, const String& code)
     if (!isEnabled())
         return true;
 
-    if (findInRequest(code)) {
+    if (findInRequest(code, true, true)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
@@ -129,6 +144,16 @@ bool XSSAuditor::canLoadExternalScriptFromSrc(const String& context, const Strin
     if (!isEnabled())
         return true;
 
+    // If the script is loaded from the same URL as the enclosing page, it's
+    // probably not an XSS attack, so we reduce false positives by allowing the
+    // script. If the script has a query string, we're more suspicious,
+    // however, because that's pretty rare and the attacker might be able to
+    // trick a server-side script into doing something dangerous with the query
+    // string.
+    KURL scriptURL(m_frame->document()->url(), url);
+    if (m_frame->document()->url().host() == scriptURL.host() && scriptURL.query().isEmpty())
+        return true;
+
     if (findInRequest(context + url)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
@@ -170,7 +195,7 @@ String XSSAuditor::canonicalize(const String& string)
     return result.removeCharacters(&isNonCanonicalCharacter);
 }
 
-String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding, bool decodeEntities)
+String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding, bool decodeEntities, bool decodeURLEscapeSequencesTwice)
 {
     String result;
     String url = string;
@@ -181,6 +206,13 @@ String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding,
     String decodedResult = encoding.decode(utf8Url.data(), utf8Url.length());
     if (!decodedResult.isEmpty())
         result = decodedResult;
+    if (decodeURLEscapeSequencesTwice) {
+        result = decodeURLEscapeSequences(result);
+        utf8Url = result.utf8();
+        decodedResult = encoding.decode(utf8Url.data(), utf8Url.length());
+        if (!decodedResult.isEmpty())
+            result = decodedResult;
+    }
     if (decodeEntities)
         result = decodeHTMLEntities(result);
     return result;
@@ -223,18 +255,20 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
     return String::adopt(result);
 }
 
-bool XSSAuditor::findInRequest(const String& string, bool decodeEntities) const
+bool XSSAuditor::findInRequest(const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters, 
+                               bool decodeURLEscapeSequencesTwice) const
 {
     bool result = false;
     Frame* parentFrame = m_frame->tree()->parent();
     if (parentFrame && m_frame->document()->url() == blankURL())
-        result = findInRequest(parentFrame, string, decodeEntities);
+        result = findInRequest(parentFrame, string, decodeEntities, allowRequestIfNoIllegalURICharacters, decodeURLEscapeSequencesTwice);
     if (!result)
-        result = findInRequest(m_frame, string, decodeEntities);
+        result = findInRequest(m_frame, string, decodeEntities, allowRequestIfNoIllegalURICharacters, decodeURLEscapeSequencesTwice);
     return result;
 }
 
-bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEntities) const
+bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters, 
+                               bool decodeURLEscapeSequencesTwice) const
 {
     ASSERT(frame->document());
 
@@ -273,9 +307,14 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEn
 
     if (string.length() < pageURL.length()) {
         // The string can actually fit inside the pageURL.
-        String decodedPageURL = m_cache.canonicalizeURL(pageURL, frame->document()->decoder()->encoding(), decodeEntities);
+        String decodedPageURL = m_cache.canonicalizeURL(pageURL, frame->document()->decoder()->encoding(), decodeEntities, decodeURLEscapeSequencesTwice);
+
+        if (allowRequestIfNoIllegalURICharacters && (!formDataObj || formDataObj->isEmpty()) 
+            && decodedPageURL.find(&isIllegalURICharacter, 0) == -1)
+            return false; // Injection is impossible because the request does not contain any illegal URI characters. 
+
         if (decodedPageURL.find(canonicalizedString, 0, false) != -1)
-           return true;  // We've found the smoking gun.
+            return true;  // We've found the smoking gun.
     }
 
     if (formDataObj && !formDataObj->isEmpty()) {
@@ -285,7 +324,7 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEn
             // the url-encoded POST data because the length of the url-decoded
             // code is less than or equal to the length of the url-encoded
             // string.
-            String decodedFormData = m_cache.canonicalizeURL(formData, frame->document()->decoder()->encoding(), decodeEntities);
+            String decodedFormData = m_cache.canonicalizeURL(formData, frame->document()->decoder()->encoding(), decodeEntities, decodeURLEscapeSequencesTwice);
             if (decodedFormData.find(canonicalizedString, 0, false) != -1)
                 return true;  // We found the string in the POST data.
         }
diff --git a/src/3rdparty/webkit/WebCore/page/XSSAuditor.h b/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
index 58b2cc2c5c..adfa5c7959 100644
--- a/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
+++ b/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
@@ -102,25 +102,30 @@ namespace WebCore {
         class CachingURLCanonicalizer
         {
         public:
-            CachingURLCanonicalizer() : m_decodeEntities(false) { }
-            String canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities);
+            CachingURLCanonicalizer() : m_decodeEntities(false), m_decodeURLEscapeSequencesTwice(false) { }
+            String canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
+                                   bool decodeURLEscapeSequencesTwice);
 
         private:
             // The parameters we were called with last.
             String m_inputURL;
             TextEncoding m_encoding;
             bool m_decodeEntities;
+            bool m_decodeURLEscapeSequencesTwice;
 
             // The cached result.
             String m_cachedCanonicalizedURL;
         };
 
         static String canonicalize(const String&);
-        static String decodeURL(const String& url, const TextEncoding& encoding, bool decodeEntities);
+        static String decodeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
+                                bool decodeURLEscapeSequencesTwice = false);
         static String decodeHTMLEntities(const String&, bool leaveUndecodableEntitiesUntouched = true);
 
-        bool findInRequest(const String&, bool decodeEntities = true) const;
-        bool findInRequest(Frame*, const String&, bool decodeEntities = true) const;
+        bool findInRequest(const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false, 
+                           bool decodeURLEscapeSequencesTwice = false) const;
+        bool findInRequest(Frame*, const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false, 
+                           bool decodeURLEscapeSequencesTwice = false) const;
 
         // The frame to audit.
         Frame* m_frame;
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
index e54be8b124..ec0e284199 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
@@ -361,6 +361,10 @@ public:
     {
         Color fromColor = (a->*m_getter)();
         Color toColor = (b->*m_getter)();
+
+        if (!fromColor.isValid() && !toColor.isValid())
+            return true;
+
         if (!fromColor.isValid())
             fromColor = a->color();
         if (!toColor.isValid())
@@ -373,6 +377,10 @@ public:
     {
         Color fromColor = (a->*m_getter)();
         Color toColor = (b->*m_getter)();
+
+        if (!fromColor.isValid() && !toColor.isValid())
+            return;
+
         if (!fromColor.isValid())
             fromColor = a->color();
         if (!toColor.isValid())
@@ -635,7 +643,7 @@ static void ensurePropertyMap()
         gPropertyWrappers->append(new PropertyWrapperMaybeInvalidColor(CSSPropertyOutlineColor, &RenderStyle::outlineColor, &RenderStyle::setOutlineColor));
 
         // These are for shadows
-        gPropertyWrappers->append(new PropertyWrapperShadow(CSSPropertyBoxShadow, &RenderStyle::boxShadow, &RenderStyle::setBoxShadow));
+        gPropertyWrappers->append(new PropertyWrapperShadow(CSSPropertyWebkitBoxShadow, &RenderStyle::boxShadow, &RenderStyle::setBoxShadow));
         gPropertyWrappers->append(new PropertyWrapperShadow(CSSPropertyTextShadow, &RenderStyle::textShadow, &RenderStyle::setTextShadow));
 
 #if ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
index 691932e4c3..aa5de2c872 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
@@ -55,7 +55,7 @@ AnimationControllerPrivate::AnimationControllerPrivate(Frame* frame)
     , m_lastStyleAvailableWaiter(0)
     , m_responseWaiters(0)
     , m_lastResponseWaiter(0)
-    , m_waitingForAResponse(false)
+    , m_waitingForResponse(false)
 {
 }
 
@@ -279,6 +279,19 @@ double AnimationControllerPrivate::beginAnimationUpdateTime()
     return m_beginAnimationUpdateTime;
 }
 
+void AnimationControllerPrivate::endAnimationUpdate()
+{
+    styleAvailable();
+    if (!m_waitingForResponse)
+        startTimeResponse(beginAnimationUpdateTime());
+}
+
+void AnimationControllerPrivate::receivedStartTimeResponse(double time)
+{
+    m_waitingForResponse = false;
+    startTimeResponse(time);
+}
+
 PassRefPtr<RenderStyle> AnimationControllerPrivate::getAnimatedStyleForRenderer(RenderObject* renderer)
 {
     if (!renderer)
@@ -378,7 +391,7 @@ void AnimationControllerPrivate::addToStartTimeResponseWaitList(AnimationBase* a
     ASSERT(!animation->next());
     
     if (willGetResponse)
-        m_waitingForAResponse = true;
+        m_waitingForResponse = true;
     
     if (m_responseWaiters)
         m_lastResponseWaiter->setNext(animation);
@@ -408,13 +421,13 @@ void AnimationControllerPrivate::removeFromStartTimeResponseWaitList(AnimationBa
     }
 }
 
-void AnimationControllerPrivate::startTimeResponse(double t)
+void AnimationControllerPrivate::startTimeResponse(double time)
 {
     // Go through list of waiters and send them on their way
     for (AnimationBase* animation = m_responseWaiters; animation; ) {
         AnimationBase* nextAnimation = animation->next();
         animation->setNext(0);
-        animation->onAnimationStartResponse(t);
+        animation->onAnimationStartResponse(time);
         animation = nextAnimation;
     }
     
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationControllerPrivate.h b/src/3rdparty/webkit/WebCore/page/animation/AnimationControllerPrivate.h
index 359b9b52fb..7db3803858 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationControllerPrivate.h
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationControllerPrivate.h
@@ -80,18 +80,8 @@ public:
 
     double beginAnimationUpdateTime();
     void setBeginAnimationUpdateTime(double t) { m_beginAnimationUpdateTime = t; }
-    void endAnimationUpdate()
-    {
-        styleAvailable();
-        if (!m_waitingForAResponse)
-            startTimeResponse(beginAnimationUpdateTime());
-    }
-    
-    void receivedStartTimeResponse(double t)
-    {
-        m_waitingForAResponse = false;
-        startTimeResponse(t);
-    }
+    void endAnimationUpdate();
+    void receivedStartTimeResponse(double);
     
     void addToStyleAvailableWaitList(AnimationBase*);
     void removeFromStyleAvailableWaitList(AnimationBase*);    
@@ -127,7 +117,7 @@ private:
     
     AnimationBase* m_responseWaiters;
     AnimationBase* m_lastResponseWaiter;
-    bool m_waitingForAResponse;
+    bool m_waitingForResponse;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp b/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp
index 8e6349d5dd..50fc781bf5 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp
@@ -142,10 +142,8 @@ void ImplicitAnimation::onAnimationEnd(double elapsedTime)
     if (keyframeAnim)
         keyframeAnim->setUnanimatedStyle(m_toStyle);
     
-    if (!sendTransitionEvent(eventNames().webkitTransitionEndEvent, elapsedTime)) {
-        // We didn't dispatch an event, which would call endAnimation(), so we'll just call it here.
-        endAnimation(true);
-    }
+    sendTransitionEvent(eventNames().webkitTransitionEndEvent, elapsedTime);
+    endAnimation(true);
 }
 
 bool ImplicitAnimation::sendTransitionEvent(const AtomicString& eventType, double elapsedTime)
diff --git a/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp b/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp
index 39ae1e7500..7e37e5f65b 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp
@@ -244,10 +244,8 @@ void KeyframeAnimation::onAnimationIteration(double elapsedTime)
 
 void KeyframeAnimation::onAnimationEnd(double elapsedTime)
 {
-    if (!sendAnimationEvent(eventNames().webkitAnimationEndEvent, elapsedTime)) {
-        // We didn't dispatch an event, which would call endAnimation(), so we'll just call it here.
-        endAnimation(true);
-    }
+    sendAnimationEvent(eventNames().webkitAnimationEndEvent, elapsedTime);
+    endAnimation(true);
 }
 
 bool KeyframeAnimation::sendAnimationEvent(const AtomicString& eventType, double elapsedTime)
diff --git a/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp b/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
index 21fa7dfe77..ee6aa4e277 100644
--- a/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
@@ -361,10 +361,10 @@ void ContextMenu::populate()
                 appendItem(StopItem);
                 appendItem(ReloadItem);
 #else
-                if (loader->canGoBackOrForward(-1))
+                if (frame->page() && frame->page()->canGoBackOrForward(-1))
                     appendItem(BackItem);
 
-                if (loader->canGoBackOrForward(1))
+                if (frame->page() && frame->page()->canGoBackOrForward(1))
                     appendItem(ForwardItem);
 
                 // use isLoadingInAPISense rather than isLoading because Stop/Reload are
@@ -721,10 +721,10 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
 #endif
 #if PLATFORM(GTK)
         case ContextMenuItemTagGoBack:
-            shouldEnable = frame->loader()->canGoBackOrForward(-1);
+            shouldEnable = frame->page() && frame->page()->canGoBackOrForward(-1);
             break;
         case ContextMenuItemTagGoForward:
-            shouldEnable = frame->loader()->canGoBackOrForward(1);
+            shouldEnable = frame->page() && frame->page()->canGoBackOrForward(1);
             break;
         case ContextMenuItemTagStop:
             shouldEnable = frame->loader()->documentLoader()->isLoadingInAPISense();
diff --git a/src/3rdparty/webkit/WebCore/platform/Cookie.h b/src/3rdparty/webkit/WebCore/platform/Cookie.h
index 3e74ddc635..0fe3851e2d 100644
--- a/src/3rdparty/webkit/WebCore/platform/Cookie.h
+++ b/src/3rdparty/webkit/WebCore/platform/Cookie.h
@@ -27,6 +27,7 @@
 #define Cookie_h
 
 #include "PlatformString.h"
+#include "StringHash.h"
 
 namespace WebCore {
 
@@ -58,6 +59,24 @@ namespace WebCore {
         bool session;
     };
 
+    struct CookieHash {
+        static unsigned hash(Cookie key)
+        { 
+            return StringHash::hash(key.name) + StringHash::hash(key.domain) + StringHash::hash(key.path) + key.secure;
+        }
+
+        static bool equal(Cookie a, Cookie b)
+        {
+            return a.name == b.name && a.domain == b.domain && a.path == b.path && a.secure == b.secure;
+        }
+    };
+}
+
+namespace WTF {
+    template<typename T> struct DefaultHash;
+    template<> struct DefaultHash<WebCore::Cookie> {
+        typedef WebCore::CookieHash Hash;
+    };
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.cpp b/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.cpp
index 9ca626fefe..d02da6c41f 100644
--- a/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.cpp
@@ -41,7 +41,7 @@ namespace WebCore {
 
 CrossThreadCopierBase<false, String>::Type CrossThreadCopierBase<false, String>::copy(const String& str)
 {
-    return str.copy();
+    return str.crossThreadString();
 }
 
 CrossThreadCopierBase<false, ResourceError>::Type CrossThreadCopierBase<false, ResourceError>::copy(const ResourceError& error)
diff --git a/src/3rdparty/webkit/WebCore/platform/KURL.cpp b/src/3rdparty/webkit/WebCore/platform/KURL.cpp
index aa9c6245c6..ffacc19bf3 100644
--- a/src/3rdparty/webkit/WebCore/platform/KURL.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/KURL.cpp
@@ -529,7 +529,7 @@ void KURL::init(const KURL& base, const String& relative, const TextEncoding& en
 KURL KURL::copy() const
 {
     KURL result = *this;
-    result.m_string = result.m_string.copy();
+    result.m_string = result.m_string.crossThreadString();
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp b/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
index b323332d97..d0aae0cf5d 100644
--- a/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
@@ -106,7 +106,7 @@ static inline bool isUnicodeEncoding(const TextEncoding* encoding)
 static bool lowerCaseEqualsASCII(const char* begin, const char* end, const char* str)
 {
     while (begin != end && *str) {
-        ASSERT(isASCIILower(*str));
+        ASSERT(toASCIILower(*str) == *str);
         if (toASCIILower(*begin++) != *str++)
             return false;
     }
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp b/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
index d8c3318d37..ee8726a45b 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
@@ -751,6 +751,22 @@ void ScrollView::paintScrollCorner(GraphicsContext* context, const IntRect& corn
     ScrollbarTheme::nativeTheme()->paintScrollCorner(this, context, cornerRect);
 }
 
+void ScrollView::paintScrollbars(GraphicsContext* context, const IntRect& rect)
+{
+    if (m_horizontalScrollbar)
+        m_horizontalScrollbar->paint(context, rect);
+    if (m_verticalScrollbar)
+        m_verticalScrollbar->paint(context, rect);
+
+    paintScrollCorner(context, scrollCornerRect());
+}
+
+void ScrollView::paintPanScrollIcon(GraphicsContext* context)
+{
+    DEFINE_STATIC_LOCAL(Image*, panScrollIcon, (Image::loadPlatformResource("panIcon").releaseRef()));
+    context->drawImage(panScrollIcon, m_panScrollIconPoint);
+}
+
 void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
 {
     if (platformWidget()) {
@@ -785,20 +801,15 @@ void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
         scrollViewDirtyRect.intersect(frameRect());
         context->translate(x(), y());
         scrollViewDirtyRect.move(-x(), -y());
-        if (m_horizontalScrollbar)
-            m_horizontalScrollbar->paint(context, scrollViewDirtyRect);
-        if (m_verticalScrollbar)
-            m_verticalScrollbar->paint(context, scrollViewDirtyRect);
 
-        paintScrollCorner(context, scrollCornerRect());
+        paintScrollbars(context, scrollViewDirtyRect);
+
         context->restore();
     }
 
     // Paint the panScroll Icon
-    if (m_drawPanScrollIcon) {
-        DEFINE_STATIC_LOCAL(RefPtr<Image>, panScrollIcon, (Image::loadPlatformResource("panIcon")));
-        context->drawImage(panScrollIcon.get(), m_panScrollIconPoint);
-    }
+    if (m_drawPanScrollIcon)
+        paintPanScrollIcon(context);
 }
 
 bool ScrollView::isPointInScrollbarCorner(const IntPoint& windowPoint)
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollView.h b/src/3rdparty/webkit/WebCore/platform/ScrollView.h
index 8fcdf608af..1950a54a6c 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollView.h
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollView.h
@@ -207,6 +207,7 @@ public:
 
     // Widget override.  Handles painting of the contents of the view as well as the scrollbars.
     virtual void paint(GraphicsContext*, const IntRect&);
+    void paintScrollbars(GraphicsContext*, const IntRect&);
 
     // Widget overrides to ensure that our children's visibility status is kept up to date when we get shown and hidden.
     virtual void show();
@@ -217,6 +218,7 @@ public:
     static const int noPanScrollRadius = 15;
     void addPanScrollIcon(const IntPoint&);
     void removePanScrollIcon();
+    void paintPanScrollIcon(GraphicsContext*);
 
     virtual bool isPointInScrollbarCorner(const IntPoint&);
     virtual bool scrollbarCornerPresent() const;
@@ -234,7 +236,7 @@ protected:
     
     virtual void contentsResized() = 0;
     virtual void visibleContentsResized() = 0;
-    
+
     // These methods are used to create/destroy scrollbars.
     void setHasHorizontalScrollbar(bool);
     void setHasVerticalScrollbar(bool);
diff --git a/src/3rdparty/webkit/WebCore/platform/SuddenTermination.h b/src/3rdparty/webkit/WebCore/platform/SuddenTermination.h
index 7171102461..3fc5b0fd57 100644
--- a/src/3rdparty/webkit/WebCore/platform/SuddenTermination.h
+++ b/src/3rdparty/webkit/WebCore/platform/SuddenTermination.h
@@ -30,6 +30,9 @@
 
 namespace WebCore {
 
+    // Once disabled via one or more more calls to disableSuddenTermination(), fast shutdown
+    // is not valid until enableSuddenTermination() has been called an equal number of times.
+    // On Mac, these are thin wrappers around Mac OS X functions of the same name.
     void disableSuddenTermination();
     void enableSuddenTermination();
 
diff --git a/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h b/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h
index 3ab41ddaf0..e13231379f 100644
--- a/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h
+++ b/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h
@@ -46,7 +46,7 @@ typedef unsigned ControlStates;
 // Must follow CSSValueKeywords.in order
 enum ControlPart {
     NoControlPart, CheckboxPart, RadioPart, PushButtonPart, SquareButtonPart, ButtonPart,
-    ButtonBevelPart, DefaultButtonPart, ListboxPart, ListItemPart, 
+    ButtonBevelPart, DefaultButtonPart, ListButtonPart, ListboxPart, ListItemPart,
     MediaFullscreenButtonPart, MediaMuteButtonPart, MediaPlayButtonPart, MediaSeekBackButtonPart, 
     MediaSeekForwardButtonPart, MediaRewindButtonPart, MediaReturnToRealtimeButtonPart,
     MediaSliderPart, MediaSliderThumbPart, MediaVolumeSliderContainerPart, MediaVolumeSliderPart, MediaVolumeSliderThumbPart,
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
index 0f3f9aa4a2..d712efbe8b 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
@@ -141,6 +141,7 @@ public:
 #endif
 
 #if PLATFORM(WIN)
+    static PassRefPtr<BitmapImage> create(HBITMAP);
     virtual bool getHBITMAP(HBITMAP);
     virtual bool getHBITMAPOfSize(HBITMAP, LPSIZE);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h b/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h
index a60af29a78..fc63db9e78 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h
@@ -29,6 +29,7 @@
 #include "FontRenderingMode.h"
 #include "FontSmoothingMode.h"
 #include "FontTraitsMask.h"
+#include "TextRenderingMode.h"
 
 namespace WebCore {
 
@@ -63,6 +64,7 @@ public:
         , m_renderingMode(NormalRenderingMode)
         , m_keywordSize(0)
         , m_fontSmoothing(AutoSmoothing)
+        , m_textRendering(AutoTextRendering)
     {
     }
 
@@ -87,6 +89,7 @@ public:
     FontRenderingMode renderingMode() const { return static_cast<FontRenderingMode>(m_renderingMode); }
     unsigned keywordSize() const { return m_keywordSize; }
     FontSmoothingMode fontSmoothing() const { return static_cast<FontSmoothingMode>(m_fontSmoothing); }
+    TextRenderingMode textRenderingMode() const { return static_cast<TextRenderingMode>(m_textRendering); }
 
     FontTraitsMask traitsMask() const;
 
@@ -102,6 +105,7 @@ public:
     void setRenderingMode(FontRenderingMode mode) { m_renderingMode = mode; }
     void setKeywordSize(unsigned s) { m_keywordSize = s; }
     void setFontSmoothing(FontSmoothingMode smoothing) { m_fontSmoothing = smoothing; }
+    void setTextRenderingMode(TextRenderingMode rendering) { m_textRendering = rendering; }
 
 private:
     FontFamily m_familyList; // The list of font families to be used.
@@ -125,6 +129,7 @@ private:
                            // (e.g., 13px monospace vs. 16px everything else).  Sizes are 1-8 (like the HTML size values for <font>).
 
     unsigned m_fontSmoothing : 2; // FontSmoothingMode
+    unsigned m_textRendering : 2; // TextRenderingMode
 };
 
 inline bool FontDescription::operator==(const FontDescription& other) const
@@ -140,7 +145,8 @@ inline bool FontDescription::operator==(const FontDescription& other) const
         && m_usePrinterFont == other.m_usePrinterFont
         && m_renderingMode == other.m_renderingMode
         && m_keywordSize == other.m_keywordSize
-        && m_fontSmoothing == other.m_fontSmoothing;
+        && m_fontSmoothing == other.m_fontSmoothing
+        && m_textRendering == other.m_textRendering;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp
index b0e39dbb6c..5246593c76 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp
@@ -251,6 +251,10 @@ bool Font::canUseGlyphCache(const TextRun& run) const
             return false;
     }
 
+    TextRenderingMode textMode = m_fontDescription.textRenderingMode();
+    if (textMode == OptimizeLegibility || textMode == GeometricPrecision)
+        return false;
+
     return true;
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h
index e0d9294a14..c6bb20c00b 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h
@@ -297,6 +297,11 @@ namespace WebCore {
         void addPath(const Path&);
 
         void clip(const Path&);
+
+        // This clip function is used only by <canvas> code. It allows
+        // implementations to handle clipping on the canvas differently since
+        // the disipline is different.
+        void canvasClip(const Path&);
         void clipOut(const Path&);
 
         void scale(const FloatSize&);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
index edda2151a7..67224e280c 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
@@ -45,6 +45,7 @@ const Platform3DObject NullPlatform3DObject = 0;
 #endif
 
 namespace WebCore {
+    class CanvasActiveInfo;
     class CanvasArray;
     class CanvasBuffer;
     class CanvasUnsignedByteArray;
@@ -61,9 +62,15 @@ namespace WebCore {
     class HTMLVideoElement;
     class ImageData;
     class WebKitCSSMatrix;
-    
+
+    struct ActiveInfo {
+        String name;
+        unsigned type;
+        int size;
+    };
+
     // FIXME: ideally this would be used on all platforms.
-#if PLATFORM(SKIA)
+#if PLATFORM(CHROMIUM)
     class GraphicsContext3DInternal;
 #endif
 
@@ -77,7 +84,7 @@ namespace WebCore {
 #if PLATFORM(MAC)
         PlatformGraphicsContext3D platformGraphicsContext3D() const { return m_contextObj; }
         Platform3DObject platformTexture() const { return m_texture; }
-#elif PLATFORM(SKIA)
+#elif PLATFORM(CHROMIUM)
         PlatformGraphicsContext3D platformGraphicsContext3D() const;
         Platform3DObject platformTexture() const;
 #else
@@ -141,6 +148,9 @@ namespace WebCore {
         void frontFace(unsigned long mode);
         void generateMipmap(unsigned long target);
 
+        bool getActiveAttrib(CanvasProgram* program, unsigned long index, ActiveInfo&);
+        bool getActiveUniform(CanvasProgram* program, unsigned long index, ActiveInfo&);
+
         int  getAttribLocation(CanvasProgram*, const String& name);
 
         bool getBoolean(unsigned long pname);
@@ -204,8 +214,7 @@ namespace WebCore {
         void pixelStorei(unsigned long pname, long param);
         void polygonOffset(double factor, double units);
         
-        // TBD
-        //void readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type, void* pixels);
+        PassRefPtr<CanvasArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
         
         void releaseShaderCompiler();
         void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
@@ -323,7 +332,7 @@ namespace WebCore {
 #endif        
 
         // FIXME: ideally this would be used on all platforms.
-#if PLATFORM(SKIA)
+#if PLATFORM(CHROMIUM)
         friend class GraphicsContext3DInternal;
         OwnPtr<GraphicsContext3DInternal> m_internal;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
index b375bd3a9b..d196a0c59d 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -86,6 +86,16 @@ GraphicsLayer::~GraphicsLayer()
     removeFromParent();
 }
 
+bool GraphicsLayer::hasAncestor(GraphicsLayer* ancestor) const
+{
+    for (GraphicsLayer* curr = parent(); curr; curr = curr->parent()) {
+        if (curr == ancestor)
+            return true;
+    }
+    
+    return false;
+}
+
 void GraphicsLayer::addChild(GraphicsLayer* childLayer)
 {
     ASSERT(childLayer != this);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
index 2924073e13..e5b17a6452 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
@@ -172,6 +172,9 @@ public:
     GraphicsLayer* parent() const { return m_parent; };
     void setParent(GraphicsLayer* layer) { m_parent = layer; } // Internal use only.
     
+    // Returns true if the layer has the given layer as an ancestor (excluding self).
+    bool hasAncestor(GraphicsLayer*) const;
+    
     const Vector<GraphicsLayer*>& children() const { return m_children; }
 
     // Add child layers. If the child is already parented, it will be removed from its old parent.
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.cpp
index 799368b968..bf7ae21bb5 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.cpp
@@ -120,8 +120,6 @@ size_t ImageSource::frameCount() const
     return m_decoder ? m_decoder->frameCount() : 0;
 }
 
-#if !PLATFORM(QT)
-
 NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
 {
     if (!m_decoder)
@@ -180,6 +178,4 @@ bool ImageSource::frameIsCompleteAtIndex(size_t index)
     return buffer && buffer->status() == RGBA32Buffer::FrameComplete;
 }
 
-#endif
-
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
index 23410b2ec4..3b32b654b0 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
@@ -62,10 +62,11 @@ public:
     virtual void load(const String&) { }
     virtual void cancelLoad() { }
     
+    virtual void prepareToPlay() { }
     virtual void play() { }
     virtual void pause() { }    
 
-    virtual bool supportsFullscreen() const { return false; }
+    virtual PlatformMedia platformMedia() const { return NoPlatformMedia; }
 
     virtual IntSize naturalSize() const { return IntSize(0, 0); }
 
@@ -104,8 +105,10 @@ public:
 
     virtual void paint(GraphicsContext*, const IntRect&) { }
 
+    virtual bool canLoadPoster() const { return false; }
+    virtual void setPoster(const String&) { }
+
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-    virtual void setPoster(const String& /*url*/) { }
     virtual void deliverNotification(MediaPlayerProxyNotificationType) { }
     virtual void setMediaPlayerProxy(WebMediaPlayerProxy*) { }
 #endif
@@ -253,18 +256,26 @@ void MediaPlayer::load(const String& url, const ContentType& contentType)
         m_private.set(createNullMediaPlayer(this));
 }    
 
-#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+bool MediaPlayer::canLoadPoster() const
+{
+    return m_private->canLoadPoster();
+}
+    
 void MediaPlayer::setPoster(const String& url)
 {
     m_private->setPoster(url);
 }    
-#endif
 
 void MediaPlayer::cancelLoad()
 {
     m_private->cancelLoad();
 }    
 
+void MediaPlayer::prepareToPlay()
+{
+    m_private->prepareToPlay();
+}
+    
 void MediaPlayer::play()
 {
     m_private->play();
@@ -338,6 +349,11 @@ bool MediaPlayer::inMediaDocument()
     return document && document->isMediaDocument();
 }
 
+PlatformMedia MediaPlayer::platformMedia() const
+{
+    return m_private->platformMedia();
+}
+
 MediaPlayer::NetworkState MediaPlayer::networkState()
 {
     return m_private->networkState();
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
index 4c5ee5b0ba..4cc6476db7 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
@@ -38,8 +38,24 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/Noncopyable.h>
 
+#ifdef __OBJC__
+@class QTMovie;
+#else
+class QTMovie;
+#endif
+
 namespace WebCore {
 
+// Structure that will hold every native
+// types supported by the current media player.
+// We have to do that has multiple media players
+// backend can live at runtime.
+typedef struct PlatformMedia {
+    QTMovie* qtMovie;
+} PlatformMedia;
+
+static const PlatformMedia NoPlatformMedia = { 0 };
+
 class ContentType;
 class FrameView;
 class GraphicsContext;
@@ -110,6 +126,8 @@ public:
 
     bool supportsFullscreen() const;
     bool supportsSave() const;
+    PlatformMedia platformMedia() const;
+
     IntSize naturalSize();
     bool hasVideo() const;
     bool hasAudio() const;
@@ -127,6 +145,7 @@ public:
     bool visible() const;
     void setVisible(bool);
     
+    void prepareToPlay();
     void play();
     void pause();    
     
@@ -186,8 +205,10 @@ public:
 
     MediaPlayerClient* mediaPlayerClient() const { return m_mediaPlayerClient; }
 
+    bool canLoadPoster() const;
+    void setPoster(const String&);
+
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-    void setPoster(const String& url);
     void deliverNotification(MediaPlayerProxyNotificationType notification);
     void setMediaPlayerProxy(WebMediaPlayerProxy* proxy);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
index 9cc89c5230..f5687b3112 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
@@ -43,6 +43,9 @@ public:
     virtual void load(const String& url) = 0;
     virtual void cancelLoad() = 0;
     
+    virtual void prepareToPlay() { }
+    virtual PlatformMedia platformMedia() const { return NoPlatformMedia; }
+
     virtual void play() = 0;
     virtual void pause() = 0;    
 
@@ -93,8 +96,10 @@ public:
 
     virtual void setAutobuffer(bool) { };
 
+    virtual bool canLoadPoster() const { return false; }
+    virtual void setPoster(const String&) { }
+
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-    virtual void setPoster(const String& url) = 0;
     virtual void deliverNotification(MediaPlayerProxyNotificationType) = 0;
     virtual void setMediaPlayerProxy(WebMediaPlayerProxy*) = 0;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h b/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h
index d326658a66..387a5c77eb 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h
@@ -28,6 +28,7 @@
 #include "FontPlatformData.h"
 #include "GlyphPageTreeNode.h"
 #include "GlyphWidthMap.h"
+#include "TextRenderingMode.h"
 #include <wtf/OwnPtr.h>
 
 #if USE(ATSUI)
@@ -120,7 +121,7 @@ public:
 
 #if USE(CORE_TEXT)
     CTFontRef getCTFont() const;
-    CFDictionaryRef getCFStringAttributes() const;
+    CFDictionaryRef getCFStringAttributes(TextRenderingMode) const;
 #endif
 
 #if USE(ATSUI)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/TextRenderingMode.h b/src/3rdparty/webkit/WebCore/platform/graphics/TextRenderingMode.h
new file mode 100644
index 0000000000..4f817a4a42
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/TextRenderingMode.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef TextRenderingMode_h
+#define TextRenderingMode_h
+
+namespace WebCore {
+
+    enum TextRenderingMode { AutoTextRendering, OptimizeSpeed, OptimizeLegibility, GeometricPrecision };
+    
+} // namespace WebCore
+
+#endif // TextRenderingMode_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp
index f452a2d159..1b4116530e 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -133,8 +133,8 @@ void FEComposite::apply(Filter* filter)
     FloatRect srcRect = FloatRect(0.f, 0.f, -1.f, -1.f);
     switch (m_type) {
     case FECOMPOSITE_OPERATOR_OVER:
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
         filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
         break;
     case FECOMPOSITE_OPERATOR_IN:
         filterContext->save();
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
new file mode 100644
index 0000000000..a62dfdcacb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
@@ -0,0 +1,139 @@
+/*
+    Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
+                  2004, 2005 Rob Buis <buis@kde.org>
+                  2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    aint with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(FILTERS)
+#include "FEGaussianBlur.h"
+
+#include "CanvasPixelArray.h"
+#include "Filter.h"
+#include "GraphicsContext.h"
+#include "ImageData.h"
+#include <math.h>
+
+namespace WebCore {
+
+FEGaussianBlur::FEGaussianBlur(FilterEffect* in, const float& x, const float& y)
+    : FilterEffect()
+    , m_in(in)
+    , m_x(x)
+    , m_y(y)
+{
+}
+
+PassRefPtr<FEGaussianBlur> FEGaussianBlur::create(FilterEffect* in, const float& x, const float& y)
+{
+    return adoptRef(new FEGaussianBlur(in, x, y));
+}
+
+float FEGaussianBlur::stdDeviationX() const
+{
+    return m_x;
+}
+
+void FEGaussianBlur::setStdDeviationX(float x)
+{
+    m_x = x;
+}
+
+float FEGaussianBlur::stdDeviationY() const
+{
+    return m_y;
+}
+
+void FEGaussianBlur::setStdDeviationY(float y)
+{
+    m_y = y;
+}
+
+void boxBlur(CanvasPixelArray*& srcPixelArray, CanvasPixelArray*& dstPixelArray,
+                 unsigned dx, int stride, int strideLine, int effectWidth, int effectHeight, bool alphaImage)
+{
+    int dxLeft = static_cast<int>(floor(dx / 2));
+    int dxRight = dx - dxLeft;
+
+    for (int y = 0; y < effectHeight; ++y) {
+        int line = y * strideLine;
+        for (int channel = 3; channel >= 0; --channel) {
+            int sum = 0;
+            // Fill the kernel
+            int maxKernelSize = std::min(dxRight, effectWidth);
+            for (int i = 0; i < maxKernelSize; ++i)
+                sum += srcPixelArray->get(line + i * stride + channel);
+
+            // Blurring
+            for (int x = 0; x < effectWidth; ++x) {
+                int pixelByteOffset = line + x * stride + channel;
+                dstPixelArray->set(pixelByteOffset, static_cast<unsigned char>(sum / dx));
+                if (x >= dxLeft)
+                    sum -= srcPixelArray->get(pixelByteOffset - dxLeft * stride);
+                if (x + dxRight < effectWidth)
+                    sum += srcPixelArray->get(pixelByteOffset + dxRight * stride);
+            }
+            if (alphaImage) // Source image is black, it just has different alpha values
+                break;
+        }
+    }
+}
+
+void FEGaussianBlur::apply(Filter* filter)
+{
+    m_in->apply(filter);
+    if (!m_in->resultImage())
+        return;
+
+    if (!getEffectContext())
+        return;
+
+    setIsAlphaImage(m_in->isAlphaImage());
+
+    if (m_x == 0 || m_y == 0)
+        return;
+
+    unsigned sdx = static_cast<unsigned>(floor(m_x * 3 * sqrt(2 * M_PI) / 4.f + 0.5f));
+    unsigned sdy = static_cast<unsigned>(floor(m_y * 3 * sqrt(2 * M_PI) / 4.f + 0.5f));
+
+    IntRect effectDrawingRect = calculateDrawingIntRect(m_in->subRegion());
+    RefPtr<ImageData> srcImageData(m_in->resultImage()->getPremultipliedImageData(effectDrawingRect));
+    CanvasPixelArray* srcPixelArray(srcImageData->data());
+
+    IntRect imageRect(IntPoint(), resultImage()->size());
+    RefPtr<ImageData> tmpImageData = ImageData::create(imageRect.width(), imageRect.height());
+    CanvasPixelArray* tmpPixelArray(tmpImageData->data());
+
+    int stride = 4 * imageRect.width();
+    for (int i = 0; i < 3; ++i) {
+        boxBlur(srcPixelArray, tmpPixelArray, sdx, 4, stride, imageRect.width(), imageRect.height(), isAlphaImage());
+        boxBlur(tmpPixelArray, srcPixelArray, sdy, stride, 4, imageRect.height(), imageRect.width(), isAlphaImage());
+    }
+
+    resultImage()->putPremultipliedImageData(srcImageData.get(), imageRect, IntPoint());
+}
+
+void FEGaussianBlur::dump()
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.h
index 69f1cc5174..ecdb9e3b34 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.h
@@ -19,10 +19,10 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef SVGFEGaussianBlur_h
-#define SVGFEGaussianBlur_h
+#ifndef FEGaussianBlur_h
+#define FEGaussianBlur_h
 
-#if ENABLE(SVG) && ENABLE(FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
 #include "Filter.h"
 
@@ -41,7 +41,6 @@ namespace WebCore {
         virtual FloatRect uniteChildEffectSubregions(Filter* filter) { return calculateUnionOfChildEffectSubregions(filter, m_in.get()); }
         void apply(Filter*);
         void dump();
-        TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
         FEGaussianBlur(FilterEffect*, const float&, const float&);
@@ -53,6 +52,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(FILTERS)
+#endif // ENABLE(FILTERS)
 
-#endif // SVGFEGaussianBlur_h
+#endif // FEGaussianBlur_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp
index 5818e505f7..68900b51b2 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -25,14 +25,11 @@
 namespace WebCore {
 
 FilterEffect::FilterEffect()
-    : m_xBBoxMode(false)
-    , m_yBBoxMode(false)
-    , m_widthBBoxMode(false)
-    , m_heightBBoxMode(false)
-    , m_hasX(false)
+    : m_hasX(false)
     , m_hasY(false)
     , m_hasWidth(false)
     , m_hasHeight(false)
+    , m_alphaImage(false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h
index e2b8a0efe6..b30e513b63 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h
@@ -38,18 +38,6 @@ namespace WebCore {
     public:
         virtual ~FilterEffect();
 
-        bool xBoundingBoxMode() const { return m_xBBoxMode; }
-        void setXBoundingBoxMode(bool bboxMode) { m_xBBoxMode = bboxMode; }
-
-        bool yBoundingBoxMode() const { return m_yBBoxMode; }
-        void setYBoundingBoxMode(bool bboxMode) { m_yBBoxMode = bboxMode; }
-
-        bool widthBoundingBoxMode() const { return m_widthBBoxMode; }
-        void setWidthBoundingBoxMode(bool bboxMode) { m_widthBBoxMode = bboxMode; }
-
-        bool heightBoundingBoxMode() const { return m_heightBBoxMode; }
-        void setHeightBoundingBoxMode(bool bboxMode) { m_heightBBoxMode = bboxMode; }
-
         void setUnionOfChildEffectSubregions(const FloatRect& uniteRect) { m_unionOfChildEffectSubregions = uniteRect; }
         FloatRect unionOfChildEffectSubregions() const { return m_unionOfChildEffectSubregions; }
 
@@ -79,6 +67,10 @@ namespace WebCore {
         FloatRect calculateDrawingRect(const FloatRect&);
         IntRect calculateDrawingIntRect(const FloatRect&);
 
+        // black image with different alpha values
+        bool isAlphaImage() { return m_alphaImage; }
+        void setIsAlphaImage(bool alphaImage) { m_alphaImage = alphaImage; }
+
         virtual FloatRect uniteChildEffectSubregions(Filter* filter) { return filter->filterRegion(); }
         virtual FloatRect calculateEffectRect(Filter*);
         virtual void apply(Filter*) = 0;
@@ -102,6 +94,8 @@ namespace WebCore {
         bool m_hasWidth : 1;
         bool m_hasHeight : 1;
 
+        bool m_alphaImage;
+
         FloatRect m_subRegion;
         FloatRect m_unionOfChildEffectSubregions;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.cpp
index 646a57b51b..1b6309b601 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.cpp
@@ -22,6 +22,7 @@
 #if ENABLE(FILTERS)
 #include "SourceAlpha.h"
 
+#include "Color.h"
 #include "GraphicsContext.h"
 #include "PlatformString.h"
 #include "Filter.h"
@@ -41,8 +42,30 @@ const AtomicString& SourceAlpha::effectName()
     return s_effectName;
 }
 
-void SourceAlpha::apply(Filter*)
+FloatRect SourceAlpha::calculateEffectRect(Filter* filter)
 {
+    FloatRect clippedSourceRect = filter->sourceImageRect();
+    if (filter->sourceImageRect().x() < filter->filterRegion().x())
+        clippedSourceRect.setX(filter->filterRegion().x());
+    if (filter->sourceImageRect().y() < filter->filterRegion().y())
+        clippedSourceRect.setY(filter->filterRegion().y());
+    setSubRegion(clippedSourceRect);
+    return filter->filterRegion();
+}
+
+void SourceAlpha::apply(Filter* filter)
+{
+    GraphicsContext* filterContext = getEffectContext();
+    if (!filterContext)
+        return;
+
+    setIsAlphaImage(true);
+
+    FloatRect imageRect(FloatPoint(), filter->sourceImage()->image()->size());
+    filterContext->save();
+    filterContext->clipToImageBuffer(imageRect, filter->sourceImage());
+    filterContext->fillRect(imageRect, Color::black);
+    filterContext->restore();
 }
 
 void SourceAlpha::dump()
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.h
index 5341562ff1..172d05a170 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.h
@@ -35,7 +35,7 @@ namespace WebCore {
         static const AtomicString& effectName();
 
         virtual bool isSourceInput() { return true; }
-        virtual FloatRect calculateEffectRect(Filter* filter) { return filter->sourceImageRect(); }
+        virtual FloatRect calculateEffectRect(Filter*);
         void apply(Filter*);
         void dump();
     
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ColorQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ColorQt.cpp
index 5d167409b2..151766ac30 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ColorQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ColorQt.cpp
@@ -40,7 +40,10 @@ Color::Color(const QColor& c)
 
 Color::operator QColor() const
 {
-    return QColor(red(), green(), blue(), alpha());
+    if (m_valid)
+        return QColor(red(), green(), blue(), alpha());
+    else
+        return QColor();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index 094054b293..57a481ae71 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -422,7 +422,7 @@ void GraphicsContext::drawRect(const IntRect& rect)
         IntRect shadowRect = rect;
         shadowRect.move(shadowSize.width(), shadowSize.height());
         shadowRect.inflate(static_cast<int>(p->pen().widthF()));
-        p->fillRect(shadowRect, shadowColor);
+        p->fillRect(shadowRect, QColor(shadowColor));
     }
 
     p->drawRect(rect);
@@ -482,11 +482,11 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         // Do a rect fill of our endpoints.  This ensures we always have the
         // appearance of being a border.  We then draw the actual dotted/dashed line.
         if (isVerticalLine) {
-            p->fillRect(FloatRect(p1.x() - width / 2, p1.y() - width, width, width), color);
-            p->fillRect(FloatRect(p2.x() - width / 2, p2.y(), width, width), color);
+            p->fillRect(FloatRect(p1.x() - width / 2, p1.y() - width, width, width), QColor(color));
+            p->fillRect(FloatRect(p2.x() - width / 2, p2.y(), width, width), QColor(color));
         } else {
-            p->fillRect(FloatRect(p1.x() - width, p1.y() - width / 2, width, width), color);
-            p->fillRect(FloatRect(p2.x(), p2.y() - width / 2, width, width), color);
+            p->fillRect(FloatRect(p1.x() - width, p1.y() - width / 2, width, width), QColor(color));
+            p->fillRect(FloatRect(p2.x(), p2.y() - width / 2, width, width), QColor(color));
         }
 
         // Example: 80 pixels with a width of 30 pixels.
@@ -718,7 +718,7 @@ static inline void drawBorderlessRectShadow(GraphicsContext* context, QPainter*
     if (context->getShadow(shadowSize, shadowBlur, shadowColor)) {
         FloatRect shadowRect(rect);
         shadowRect.move(shadowSize.width(), shadowSize.height());
-        p->fillRect(shadowRect, shadowColor);
+        p->fillRect(shadowRect, QColor(shadowColor));
     }
 }
 
@@ -1053,20 +1053,29 @@ void GraphicsContext::clip(const Path& path)
     m_data->p()->setClipPath(*path.platformPath(), Qt::IntersectClip);
 }
 
+void GraphicsContext::canvasClip(const Path& path)
+{
+    clip(path);
+}
+
 void GraphicsContext::clipOut(const Path& path)
 {
     if (paintingDisabled())
         return;
 
     QPainter* p = m_data->p();
-    QRectF clipBounds = p->clipPath().boundingRect();
     QPainterPath clippedOut = *path.platformPath();
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
-    newClip.addRect(clipBounds);
-    newClip.addPath(clippedOut);
-
-    p->setClipPath(newClip, Qt::IntersectClip);
+    if (p->hasClipping()) {
+        newClip.addRect(p->clipPath().boundingRect());
+        newClip.addPath(clippedOut);
+        p->setClipPath(newClip, Qt::IntersectClip);
+    } else {
+        newClip.addRect(p->window());
+        newClip.addPath(clippedOut & newClip);
+        p->setClipPath(newClip);
+    }
 }
 
 void GraphicsContext::translate(float x, float y)
@@ -1125,13 +1134,20 @@ void GraphicsContext::clipOut(const IntRect& rect)
         return;
 
     QPainter* p = m_data->p();
-    QRectF clipBounds = p->clipPath().boundingRect();
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
-    newClip.addRect(clipBounds);
-    newClip.addRect(QRect(rect));
-
-    p->setClipPath(newClip, Qt::IntersectClip);
+    if (p->hasClipping()) {
+        newClip.addRect(p->clipPath().boundingRect());
+        newClip.addRect(QRect(rect));
+        p->setClipPath(newClip, Qt::IntersectClip);
+    } else {
+        QRect clipOutRect(rect);
+        QRect window(p->window());
+        clipOutRect &= window;
+        newClip.addRect(window);
+        newClip.addRect(clipOutRect);
+        p->setClipPath(newClip);
+    }
 }
 
 void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
@@ -1140,13 +1156,20 @@ void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
         return;
 
     QPainter* p = m_data->p();
-    QRectF clipBounds = p->clipPath().boundingRect();
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
-    newClip.addRect(clipBounds);
-    newClip.addEllipse(QRect(rect));
-
-    p->setClipPath(newClip, Qt::IntersectClip);
+    if (p->hasClipping()) {
+        newClip.addRect(p->clipPath().boundingRect());
+        newClip.addEllipse(QRect(rect));
+        p->setClipPath(newClip, Qt::IntersectClip);
+    } else {
+        QRect clipOutRect(rect);
+        QRect window(p->window());
+        clipOutRect &= window;
+        newClip.addRect(window);
+        newClip.addEllipse(clipOutRect);
+        p->setClipPath(newClip);
+    }
 }
 
 void GraphicsContext::clipToImageBuffer(const FloatRect&, const ImageBuffer*)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
index 8851984ad4..f8403b7375 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
@@ -35,11 +35,6 @@
 #include <QtGui/QImageReader>
 #include <qdebug.h>
 
-namespace {
-    const  QImage::Format DesiredFormat = QImage::Format_ARGB32;
-    const  bool debugImageDecoderQt = false;
-}
-
 namespace WebCore {
 
 ImageDecoder* ImageDecoder::create(const SharedBuffer& data)
@@ -48,291 +43,205 @@ ImageDecoder* ImageDecoder::create(const SharedBuffer& data)
     if (data.size() < 4)
         return 0;
 
-    QByteArray bytes = QByteArray::fromRawData(data.data(), data.size());
-    QBuffer buffer(&bytes);
-    if (!buffer.open(QBuffer::ReadOnly))
-        return 0;
-
-    QString imageFormat = QString::fromLatin1(QImageReader::imageFormat(&buffer).toLower());
-    if (imageFormat.isEmpty())
-        return 0; // Image format not supported
-
-    return new ImageDecoderQt(imageFormat);
+    return new ImageDecoderQt;
 }
 
-ImageDecoderQt::ImageData::ImageData(const QImage& image, ImageState imageState, int duration) :
-    m_image(image), m_imageState(imageState), m_duration(duration)
+ImageDecoderQt::ImageDecoderQt()
+    :  m_buffer(0)
+    , m_reader(0)
+    , m_repetitionCount(cAnimationNone)
 {
 }
 
-// Context, maintains IODevice on a data buffer.
-class ImageDecoderQt::ReadContext {
-public:
-
-    enum LoadMode {
-        // Load images incrementally. This is still experimental and
-        // will cause the image plugins to report errors.
-        // Also note that as of Qt 4.2.2, the JPEG loader does not return error codes
-        // on "preliminary end of data".
-        LoadIncrementally,
-            // Load images only if  all data have been received
-            LoadComplete };
-
-    ReadContext(SharedBuffer* data, LoadMode loadMode, ImageList &target);
-
-    enum ReadResult { ReadEOF, ReadFailed, ReadPartial, ReadComplete };
-
-    // Append data and read out all images. Returns the result
-    // of the last read operation, so, even if  ReadPartial is returned,
-    // a few images might have been read.
-    ReadResult read(bool allDataReceived);
-
-    QImageReader *reader() { return &m_reader; }
-
-private:
-    enum IncrementalReadResult { IncrementalReadFailed, IncrementalReadPartial, IncrementalReadComplete };
-    // Incrementally read an image
-    IncrementalReadResult readImageLines(ImageData &);
-
-    const LoadMode m_loadMode;
+ImageDecoderQt::~ImageDecoderQt()
+{
+    delete m_reader;
+    delete m_buffer;
+}
 
-    QByteArray m_data;
-    QBuffer m_buffer;
-    QImageReader m_reader;
+void ImageDecoderQt::setData(SharedBuffer* data, bool allDataReceived)
+{
+    if (m_failed)
+        return;
 
-    ImageList &m_target;
+    // No progressive loading possible
+    if (!allDataReceived)
+        return;
 
-    // Detected data format of the stream
-    enum QImage::Format m_dataFormat;
-    QSize m_size;
+    // Cache our own new data.
+    ImageDecoder::setData(data, allDataReceived);
 
-};
+    // We expect to be only called once with allDataReceived
+    ASSERT(!m_buffer);
+    ASSERT(!m_reader);
 
-ImageDecoderQt::ReadContext::ReadContext(SharedBuffer* data, LoadMode loadMode, ImageList &target)
-    : m_loadMode(loadMode)
-    , m_data(data->data(), data->size())
-    , m_buffer(&m_data)
-    , m_reader(&m_buffer)
-    , m_target(target)
-    , m_dataFormat(QImage::Format_Invalid)
-{
-    m_buffer.open(QIODevice::ReadOnly);
+    // Attempt to load the data
+    QByteArray imageData = QByteArray::fromRawData(m_data->data(), m_data->size());
+    m_buffer = new QBuffer;
+    m_buffer->setData(imageData);
+    m_buffer->open(QBuffer::ReadOnly);
+    m_reader = new QImageReader(m_buffer, m_format);
 }
 
-
-ImageDecoderQt::ReadContext::ReadResult
-        ImageDecoderQt::ReadContext::read(bool allDataReceived)
+bool ImageDecoderQt::isSizeAvailable()
 {
-    // Complete mode: Read only all all data received
-    if (m_loadMode == LoadComplete && !allDataReceived)
-        return ReadPartial;
-
-    // Attempt to read out all images
-    while (true) {
-        if (m_target.empty() || m_target.back().m_imageState == ImageComplete) {
-            // Start a new image.
-            if (!m_reader.canRead())
-                return ReadEOF;
-
-            // Attempt to construct an empty image of the matching size and format
-            // for efficient reading
-            QImage newImage = m_dataFormat != QImage::Format_Invalid  ?
-                          QImage(m_size, m_dataFormat) : QImage();
-            m_target.push_back(ImageData(newImage));
-        }
+    if (!ImageDecoder::isSizeAvailable() && m_reader)
+        internalDecodeSize();
 
-        // read chunks
-        switch (readImageLines(m_target.back())) {
-        case IncrementalReadFailed:
-            m_target.pop_back();
-            return ReadFailed;
-        case IncrementalReadPartial:
-            return ReadPartial;
-        case IncrementalReadComplete:
-            m_target.back().m_imageState = ImageComplete;
-            //store for next
-            m_dataFormat = m_target.back().m_image.format();
-            m_size = m_target.back().m_image.size();
-            const bool supportsAnimation = m_reader.supportsAnimation();
-
-            if (debugImageDecoderQt)
-                qDebug() << "readImage(): #" << m_target.size() << " complete, " << m_size
-                    << " format " << m_dataFormat <<  " supportsAnimation=" <<  supportsAnimation;
-            // No point in readinfg further
-            if (!supportsAnimation)
-                return ReadComplete;
-
-            break;
-        }
-    }
-    return ReadComplete;
+    return ImageDecoder::isSizeAvailable();
 }
 
-
-
-ImageDecoderQt::ReadContext::IncrementalReadResult
-        ImageDecoderQt::ReadContext::readImageLines(ImageData &imageData)
+size_t ImageDecoderQt::frameCount()
 {
-    // TODO: Implement incremental reading here,
-    // set state to reflect complete header, etc.
-    // For now, we read the whole image.
-
-    const qint64 startPos = m_buffer.pos();
-    // Oops, failed. Rewind.
-    if (!m_reader.read(&imageData.m_image)) {
-        m_buffer.seek(startPos);
-        const bool gotHeader = imageData.m_image.size().width();
-
-        if (debugImageDecoderQt)
-            qDebug() << "readImageLines(): read() failed: " << m_reader.errorString()
-                << " got header=" << gotHeader;
-        // [Experimental] Did we manage to read the header?
-        if (gotHeader) {
-            imageData.m_imageState = ImageHeaderValid;
-            return IncrementalReadPartial;
+    if (m_frameBufferCache.isEmpty() && m_reader) {
+        if (m_reader->supportsAnimation()) {
+            int imageCount = m_reader->imageCount();
+
+            // Fixup for Qt decoders... imageCount() is wrong
+            // and jumpToNextImage does not work either... so
+            // we will have to parse everything...
+            if (imageCount == 0)
+                forceLoadEverything();
+            else
+                m_frameBufferCache.resize(imageCount);
+        } else {
+            m_frameBufferCache.resize(1);
         }
-        return IncrementalReadFailed;
     }
-    imageData.m_duration = m_reader.nextImageDelay();
-    return IncrementalReadComplete;
-}
 
-ImageDecoderQt::ImageDecoderQt(const QString& imageFormat)
-    : m_hasAlphaChannel(false)
-    , m_imageFormat(imageFormat)
-{
+    return m_frameBufferCache.size();
 }
 
-ImageDecoderQt::~ImageDecoderQt()
+int ImageDecoderQt::repetitionCount() const
 {
-}
+    if (m_reader && m_reader->supportsAnimation())
+        m_repetitionCount = qMax(0, m_reader->loopCount());
 
-bool ImageDecoderQt::hasFirstImageHeader() const
-{
-    return  !m_imageList.empty() && m_imageList[0].m_imageState >= ImageHeaderValid;
+    return m_repetitionCount;
 }
 
-void ImageDecoderQt::reset()
+String ImageDecoderQt::filenameExtension() const
 {
-    m_hasAlphaChannel = false;
-    m_failed = false;
-    m_imageList.clear();
-    m_pixmapCache.clear();
-    m_loopCount = cAnimationNone;
-}
+    return String(m_format.constData(), m_format.length());
+};
 
-void ImageDecoderQt::setData(SharedBuffer* data, bool allDataReceived)
+RGBA32Buffer* ImageDecoderQt::frameBufferAtIndex(size_t index)
 {
-    reset();
-    ReadContext readContext(data, ReadContext::LoadComplete, m_imageList);
-
-    if (debugImageDecoderQt)
-        qDebug() << " setData " << data->size() << " image bytes, complete=" << allDataReceived;
-
-    const  ReadContext::ReadResult readResult =  readContext.read(allDataReceived);
-
-    if (hasFirstImageHeader())
-        m_hasAlphaChannel = m_imageList[0].m_image.hasAlphaChannel();
-
-    if (debugImageDecoderQt)
-        qDebug()  << " read returns " << readResult;
-
-    switch (readResult) {
-    case ReadContext::ReadFailed:
-        m_failed = true;
-        break;
-    case ReadContext::ReadEOF:
-    case ReadContext::ReadPartial:
-    case ReadContext::ReadComplete:
-        // Did we read anything - try to set the size.
-        if (hasFirstImageHeader()) {
-            QSize imgSize = m_imageList[0].m_image.size();
-            setSize(imgSize.width(), imgSize.height());
-
-            if (readContext.reader()->supportsAnimation()) {
-                if (readContext.reader()->loopCount() != -1)
-                    m_loopCount = readContext.reader()->loopCount();
-                else
-                    m_loopCount = 0; //loop forever
-            }
-        }
-        break;
+    // In case the ImageDecoderQt got recreated we don't know
+    // yet how many images we are going to have and need to
+    // find that out now.
+    int count = m_frameBufferCache.size();
+    if (!m_failed && count == 0) {
+        internalDecodeSize();
+        count = frameCount();
     }
-}
 
+    if (index >= static_cast<size_t>(count))
+        return 0;
 
-bool ImageDecoderQt::isSizeAvailable()
-{
-    if (debugImageDecoderQt)
-        qDebug() << " ImageDecoderQt::isSizeAvailable() returns" << ImageDecoder::isSizeAvailable();
-    return ImageDecoder::isSizeAvailable();
+    RGBA32Buffer& frame = m_frameBufferCache[index];
+    if (frame.status() != RGBA32Buffer::FrameComplete && m_reader)
+        internalReadImage(index);
+    return &frame;
 }
 
-size_t ImageDecoderQt::frameCount() const
+void ImageDecoderQt::clearFrameBufferCache(size_t index)
 {
-    if (debugImageDecoderQt)
-        qDebug() << " ImageDecoderQt::frameCount() returns" << m_imageList.size();
-    return m_imageList.size();
-}
+    // Currently QImageReader will be asked to read everything. This
+    // might change when we read gif images on demand. For now we
+    // can have a rather simple implementation.
+    if (index > m_frameBufferCache.size())
+        return;
 
-int ImageDecoderQt::repetitionCount() const
-{
-    if (debugImageDecoderQt)
-        qDebug() << " ImageDecoderQt::repetitionCount() returns" << m_loopCount;
-    return m_loopCount;
+    for (size_t i = 0; i < index; ++index)
+        m_frameBufferCache[index].clear();
 }
 
-bool ImageDecoderQt::supportsAlpha() const
+void ImageDecoderQt::internalDecodeSize()
 {
-    return m_hasAlphaChannel;
+    ASSERT(m_reader);
+
+    // If we have a QSize() something failed
+    QSize size = m_reader->size();
+    if (size.isEmpty())
+        return failRead();
+
+    m_format = m_reader->format();
+    setSize(size.width(), size.height());
 }
 
-int ImageDecoderQt::duration(size_t index) const
+void ImageDecoderQt::internalReadImage(size_t frameIndex)
 {
-    if (index >= static_cast<size_t>(m_imageList.size()))
-        return 0;
-    return  m_imageList[index].m_duration;
+    ASSERT(m_reader);
+
+    if (m_reader->supportsAnimation())
+        m_reader->jumpToImage(frameIndex);
+    else if (frameIndex != 0)
+        return failRead();
+
+    internalHandleCurrentImage(frameIndex);
+
+    // Attempt to return some memory
+    for (int i = 0; i < m_frameBufferCache.size(); ++i)
+        if (m_frameBufferCache[i].status() != RGBA32Buffer::FrameComplete)
+            return;
+
+    delete m_reader;
+    delete m_buffer;
+    m_buffer = 0;
+    m_reader = 0;
 }
 
-String ImageDecoderQt::filenameExtension() const
+void ImageDecoderQt::internalHandleCurrentImage(size_t frameIndex)
 {
-    if (debugImageDecoderQt)
-           qDebug() << " ImageDecoderQt::filenameExtension() returns" << m_imageFormat;
-    return m_imageFormat;
-};
+    // Now get the QImage from Qt and place it in the RGBA32Buffer
+    QImage img;
+    if (!m_reader->read(&img))
+        return failRead();
 
-RGBA32Buffer* ImageDecoderQt::frameBufferAtIndex(size_t)
-{
-    Q_ASSERT("use imageAtIndex instead");
-    return 0;
+    // now into the RGBA32Buffer - even if the image is not
+    QSize imageSize = img.size();
+    RGBA32Buffer* const buffer = &m_frameBufferCache[frameIndex];
+    buffer->setRect(m_reader->currentImageRect());
+    buffer->setStatus(RGBA32Buffer::FrameComplete);
+    buffer->setDuration(m_reader->nextImageDelay());
+    buffer->setDecodedImage(img);
 }
 
-QPixmap* ImageDecoderQt::imageAtIndex(size_t index) const
-{
-    if (debugImageDecoderQt)
-        qDebug() << "ImageDecoderQt::imageAtIndex(" << index << ')';
+// The QImageIOHandler is not able to tell us how many frames
+// we have and we need to parse every image. We do this by
+// increasing the m_frameBufferCache by one and try to parse
+// the image. We stop when QImage::read fails and then need
+// to resize the m_frameBufferCache to the final size and update
+// the m_failed. In case we failed to decode the first image
+// we want to keep m_failed set to true.
 
-    if (index >= static_cast<size_t>(m_imageList.size()))
-        return 0;
+// TODO: Do not increment the m_frameBufferCache.size() by one but more than one
+void ImageDecoderQt::forceLoadEverything()
+{
+    int imageCount = 0;
 
-    if (!m_pixmapCache.contains(index)) {
-        m_pixmapCache.insert(index,
-                             QPixmap::fromImage(m_imageList[index].m_image));
+    do {
+        m_frameBufferCache.resize(++imageCount);
+        internalHandleCurrentImage(imageCount - 1);
+    } while(!m_failed);
 
-        // store null image since the converted pixmap is already in pixmap cache
-        Q_ASSERT(m_imageList[index].m_imageState == ImageComplete);
-        m_imageList[index].m_image = QImage();
-    }
-    return  &m_pixmapCache[index];
+    // If we failed decoding the first image we actually
+    // have no images and need to keep m_failed set to
+    // true otherwise we want to reset it and forget about
+    // the last attempt to decode a image.
+    m_frameBufferCache.resize(imageCount - 1);
+    m_failed = imageCount == 1;
 }
 
-void ImageDecoderQt::clearFrame(size_t index)
+void ImageDecoderQt::failRead()
 {
-    if (m_imageList.size() < (int)index)
-        m_imageList[index].m_image = QImage();
-    m_pixmapCache.take(index);
+    setFailed();
+    delete m_reader;
+    delete m_buffer;
+    m_reader = 0;
+    m_buffer = 0;
 }
-
 }
 
 // vim: ts=4 sw=4 et
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h
index 59751c5ddc..d11b938497 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h
@@ -28,10 +28,11 @@
 #define ImageDecoderQt_h
 
 #include "ImageDecoder.h"
-#include <QtGui/QImage>
+#include <QtGui/QImageReader>
 #include <QtGui/QPixmap>
 #include <QtCore/QList>
 #include <QtCore/QHash>
+#include <QtCore/QBuffer>
 
 namespace WebCore {
 
@@ -39,51 +40,35 @@ namespace WebCore {
 class ImageDecoderQt : public ImageDecoder
 {
 public:
-    ImageDecoderQt(const QString& imageFormat);
+    ImageDecoderQt();
     ~ImageDecoderQt();
 
     virtual void setData(SharedBuffer* data, bool allDataReceived);
     virtual bool isSizeAvailable();
-    virtual size_t frameCount() const;
+    virtual size_t frameCount();
     virtual int repetitionCount() const;
     virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
 
-    QPixmap* imageAtIndex(size_t index) const;
-    virtual bool supportsAlpha() const;
-    int duration(size_t index) const;
     virtual String filenameExtension() const;
 
-    void clearFrame(size_t index);
+    virtual void clearFrameBufferCache(size_t clearBeforeFrame);
 
 private:
     ImageDecoderQt(const ImageDecoderQt&);
     ImageDecoderQt &operator=(const ImageDecoderQt&);
 
-    class ReadContext;
-    void reset();
-    bool hasFirstImageHeader() const;
-
-    enum ImageState {
-        // Started image reading
-        ImagePartial,
-            // Header (size / alpha) are known
-            ImageHeaderValid,
-            // Image is complete
-            ImageComplete };
-
-    struct ImageData {
-        ImageData(const QImage& image, ImageState imageState = ImagePartial, int duration=0);
-        QImage m_image;
-        ImageState m_imageState;
-        int m_duration;
-    };
-
-    bool m_hasAlphaChannel;
-    typedef QList<ImageData> ImageList;
-    mutable ImageList m_imageList;
-    mutable QHash<int, QPixmap> m_pixmapCache;
-    int m_loopCount;
-    QString m_imageFormat;
+private:
+    void internalDecodeSize();
+    void internalReadImage(size_t);
+    void internalHandleCurrentImage(size_t);
+    void forceLoadEverything();
+    void failRead();
+
+private:
+    QByteArray m_format;
+    QBuffer* m_buffer;
+    QImageReader* m_reader;
+    mutable int m_repetitionCount;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp
index 5d40e26adf..da6ddacbfe 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -76,6 +76,7 @@ bool FrameData::clear(bool clearMetadata)
         m_haveMetadata = false;
 
     if (m_frame) {
+        delete m_frame;
         m_frame = 0;
         return true;
     }
diff --git a/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h b/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h
index 2df3df989d..5692de71d4 100644
--- a/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2008-2009 Torch Mobile, Inc.
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,6 +38,8 @@
 
 #if PLATFORM(SKIA)
 #include "NativeImageSkia.h"
+#elif PLATFORM(QT)
+#include <QImage>
 #endif
 
 namespace WebCore {
@@ -54,7 +57,7 @@ namespace WebCore {
             DisposeOverwriteBgcolor,   // Clear frame to transparent
             DisposeOverwritePrevious,  // Clear frame to previous framebuffer contents
         };
-#if PLATFORM(SKIA)
+#if PLATFORM(SKIA) || PLATFORM(QT)
         typedef uint32_t PixelData;
 #else
         typedef unsigned PixelData;
@@ -126,6 +129,11 @@ namespace WebCore {
             setRGBA(getAddr(x, y), r, g, b, a);
         }
 
+#if PLATFORM(QT)
+        void setDecodedImage(const QImage& image);
+        QImage decodedImage() const { return m_image; }
+#endif
+
     private:
         RGBA32Buffer& operator=(const RGBA32Buffer& other);
 
@@ -136,6 +144,8 @@ namespace WebCore {
         {
 #if PLATFORM(SKIA)
             return m_bitmap.getAddr32(x, y);
+#elif PLATFORM(QT)
+            return reinterpret_cast<QRgb*>(m_image.scanLine(y)) + x;
 #else
             return m_bytes.data() + (y * width()) + x;
 #endif
@@ -159,6 +169,10 @@ namespace WebCore {
 
 #if PLATFORM(SKIA)
         NativeImageSkia m_bitmap;
+#elif PLATFORM(QT)
+        mutable QImage m_image;
+        bool m_hasAlpha;
+        IntSize m_size;
 #else
         Vector<PixelData> m_bytes;
         IntSize m_size;       // The size of the buffer.  This should be the
diff --git a/src/3rdparty/webkit/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp b/src/3rdparty/webkit/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
new file mode 100644
index 0000000000..da6ab380cb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Google, Inc.
+ * Copyright (C) 2009 Holger Hans Peter Freyther
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ImageDecoder.h"
+
+#include <QPixmap>
+#include <stdio.h>
+
+namespace WebCore {
+
+RGBA32Buffer::RGBA32Buffer()
+    : m_status(FrameEmpty)
+    , m_hasAlpha(false)
+    , m_size()
+    , m_duration(0)
+    , m_disposalMethod(DisposeNotSpecified)
+{
+}
+
+// The image must not have format 8888 pre multiplied...
+void RGBA32Buffer::setDecodedImage(const QImage& image)
+{
+    m_image = image;
+    m_size = image.size();
+    m_hasAlpha = image.hasAlphaChannel();
+}
+
+void RGBA32Buffer::clear()
+{
+    m_image = QImage();
+    m_status = FrameEmpty;
+    // NOTE: Do not reset other members here; clearFrameBufferCache()
+    // calls this to free the bitmap data, but other functions like
+    // initFrameBuffer() and frameComplete() may still need to read
+    // other metadata out of this frame later.
+}
+
+void RGBA32Buffer::zeroFill()
+{
+    m_image.fill(0);
+}
+
+void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
+{
+    if (this == &other)
+        return;
+
+    m_image = other.m_image;
+    m_size = other.m_size;
+    m_hasAlpha = other.m_hasAlpha;
+}
+
+bool RGBA32Buffer::setSize(int newWidth, int newHeight)
+{
+    // This function should only be called once, it will leak memory
+    // otherwise.
+    ASSERT(width() == 0 && height() == 0);
+
+    m_size = IntSize(newWidth, newHeight);
+    m_image = QImage(newWidth, newHeight, QImage::Format_ARGB32_Premultiplied);
+    if (m_image.isNull()) {
+        // Allocation failure, maybe the bitmap was too big.
+        setStatus(FrameComplete);
+        return false;
+    }
+
+    // Zero the image.
+    zeroFill();
+
+    return true;
+}
+
+QPixmap* RGBA32Buffer::asNewNativeImage() const
+{
+    QPixmap pix = QPixmap::fromImage(m_image);
+    m_image = QImage();
+
+    return new QPixmap(pix);
+}
+
+bool RGBA32Buffer::hasAlpha() const
+{
+    return m_hasAlpha;
+}
+
+void RGBA32Buffer::setHasAlpha(bool alpha)
+{
+    m_hasAlpha = alpha;
+}
+
+void RGBA32Buffer::setStatus(FrameStatus status)
+{
+    m_status = status;
+}
+
+RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
+{
+    if (this == &other)
+        return *this;
+
+    copyBitmapData(other);
+    setRect(other.rect());
+    setStatus(other.status());
+    setDuration(other.duration());
+    setDisposalMethod(other.disposalMethod());
+    return *this;
+}
+
+int RGBA32Buffer::width() const
+{
+    return m_size.width();
+}
+
+int RGBA32Buffer::height() const
+{
+    return m_size.height();
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
index 78fb6594c0..f4321ad263 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
@@ -107,11 +107,15 @@ static String utiTypeFromCocoaType(NSString *type)
 static void addHTMLClipboardTypesForCocoaType(HashSet<String>& resultTypes, NSString *cocoaType, NSPasteboard *pasteboard)
 {
     // UTI may not do these right, so make sure we get the right, predictable result
-    if ([cocoaType isEqualToString:NSStringPboardType])
+    if ([cocoaType isEqualToString:NSStringPboardType]) {
         resultTypes.add("text/plain");
-    else if ([cocoaType isEqualToString:NSURLPboardType])
+        return;
+    }
+    if ([cocoaType isEqualToString:NSURLPboardType]) {
         resultTypes.add("text/uri-list");
-    else if ([cocoaType isEqualToString:NSFilenamesPboardType]) {
+        return;
+    }
+    if ([cocoaType isEqualToString:NSFilenamesPboardType]) {
         // If file list is empty, add nothing.
         // Note that there is a chance that the file list count could have changed since we grabbed the types array.
         // However, this is not really an issue for us doing a sanity check here.
@@ -122,12 +126,15 @@ static void addHTMLClipboardTypesForCocoaType(HashSet<String>& resultTypes, NSSt
             resultTypes.add("text/uri-list");
             resultTypes.add("Files");
         }
-    } else if (String utiType = utiTypeFromCocoaType(cocoaType))
+        return;
+    }
+    String utiType = utiTypeFromCocoaType(cocoaType);
+    if (!utiType.isEmpty()) {
         resultTypes.add(utiType);
-    else {
-        // No mapping, just pass the whole string though
-        resultTypes.add(cocoaType);
+        return;
     }
+    // No mapping, just pass the whole string though
+    resultTypes.add(cocoaType);
 }
 
 void ClipboardMac::clearData(const String& type)
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ThemeMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ThemeMac.mm
index e7e12ac83b..fd2f944736 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ThemeMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ThemeMac.mm
@@ -311,6 +311,14 @@ static const IntSize* buttonSizes()
     return sizes;
 }
 
+#if ENABLE(DATALIST)
+static const IntSize* listButtonSizes()
+{
+    static const IntSize sizes[3] = { IntSize(21, 21), IntSize(19, 18), IntSize(17, 16) };
+    return sizes;
+}
+#endif
+
 static const int* buttonMargins(NSControlSize controlSize)
 {
     static const int margins[3][4] =
@@ -333,6 +341,13 @@ static NSButtonCell* button(ControlPart part, ControlStates states, const IntRec
     }
 
     // Set the control size based off the rectangle we're painting into.
+    const IntSize* sizes = buttonSizes();
+#if ENABLE(DATALIST)
+    if (part == ListButtonPart) {
+        [buttonCell setBezelStyle:NSRoundedDisclosureBezelStyle];
+        sizes = listButtonSizes();
+    } else
+#endif
     if (part == SquareButtonPart || zoomedRect.height() > buttonSizes()[NSRegularControlSize].height() * zoomFactor) {
         // Use the square button
         if ([buttonCell bezelStyle] != NSShadowlessSquareBezelStyle)
@@ -362,7 +377,11 @@ static void paintButton(ControlPart part, ControlStates states, GraphicsContext*
     LocalCurrentGraphicsContext localContext(context);
 
     NSControlSize controlSize = [buttonCell controlSize];
+#if ENABLE(DATALIST)
+    IntSize zoomedSize = (part == ListButtonPart ? listButtonSizes() : buttonSizes())[controlSize];
+#else
     IntSize zoomedSize = buttonSizes()[controlSize];
+#endif
     zoomedSize.setWidth(zoomedRect.width()); // Buttons don't ever constrain width, so the zoomed width can just be honored.
     zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
     IntRect inflatedRect = zoomedRect;
@@ -442,6 +461,10 @@ LengthSize ThemeMac::controlSize(ControlPart part, const Font& font, const Lengt
         case PushButtonPart:
             // Height is reset to auto so that specified heights can be ignored.
             return sizeFromFont(font, LengthSize(zoomedSize.width(), Length()), zoomFactor, buttonSizes());
+#if ENABLE(DATALIST)
+        case ListButtonPart:
+            return sizeFromFont(font, LengthSize(zoomedSize.width(), Length()), zoomFactor, listButtonSizes());
+#endif
         default:
             return zoomedSize;
     }
@@ -453,6 +476,7 @@ LengthSize ThemeMac::minimumControlSize(ControlPart part, const Font& font, floa
         case SquareButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
+        case ListButtonPart:
             return LengthSize(Length(0, Fixed), Length(static_cast<int>(15 * zoomFactor), Fixed));
         default:
             return Theme::minimumControlSize(part, font, zoomFactor);
@@ -465,6 +489,7 @@ LengthBox ThemeMac::controlBorder(ControlPart part, const Font& font, const Leng
         case SquareButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
+        case ListButtonPart:
             return LengthBox(0, zoomedBox.right().value(), 0, zoomedBox.left().value());
         default:
             return Theme::controlBorder(part, font, zoomedBox, zoomFactor);
@@ -548,6 +573,7 @@ void ThemeMac::paint(ControlPart part, ControlStates states, GraphicsContext* co
         case DefaultButtonPart:
         case ButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
             paintButton(part, states, context, zoomedRect, zoomFactor, scrollView);
             break;
         default:
diff --git a/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.cpp b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.cpp
index 407ed5bd90..ec78372640 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.cpp
@@ -43,13 +43,19 @@ static ProtectionSpaceToCredentialMap& protectionSpaceToCredentialMap()
     return map;
 }
 
-typedef HashMap<String, HashMap<String, Credential> > OriginToDefaultBasicCredentialMap;
-static OriginToDefaultBasicCredentialMap& originToDefaultBasicCredentialMap()
+static HashSet<String>& originsWithCredentials()
 {
-    DEFINE_STATIC_LOCAL(OriginToDefaultBasicCredentialMap, map, ());
+    DEFINE_STATIC_LOCAL(HashSet<String>, set, ());
+    return set;
+}
+
+typedef HashMap<String, ProtectionSpace> PathToDefaultProtectionSpaceMap;
+static PathToDefaultProtectionSpaceMap& pathToDefaultProtectionSpaceMap()
+{
+    DEFINE_STATIC_LOCAL(PathToDefaultProtectionSpaceMap, map, ());
     return map;
 }
-    
+
 static String originStringFromURL(const KURL& url)
 {
     if (url.port())
@@ -58,32 +64,37 @@ static String originStringFromURL(const KURL& url)
     return url.protocol() + "://" + url.host() + "/";
 }
 
+static String protectionSpaceMapKeyFromURL(const KURL& url)
+{
+    ASSERT(url.isValid());
+
+    // Remove the last path component that is not a directory to determine the subtree for which credentials will apply.
+    // We keep a leading slash, but remove a trailing one.
+    String directoryURL = url.string().substring(0, url.pathEnd());
+    unsigned directoryURLPathStart = url.pathStart();
+    ASSERT(directoryURL[directoryURLPathStart] == '/');
+    if (directoryURL.length() > directoryURLPathStart + 1) {
+        int index = directoryURL.reverseFind('/');
+        ASSERT(index > 0);
+        directoryURL = directoryURL.substring(0, (static_cast<unsigned>(index) != directoryURLPathStart) ? index : directoryURLPathStart + 1);
+    }
+    ASSERT(directoryURL.length() == directoryURLPathStart + 1 || directoryURL[directoryURL.length() - 1] != '/');
+
+    return directoryURL;
+}
+
 void CredentialStorage::set(const Credential& credential, const ProtectionSpace& protectionSpace, const KURL& url)
 {
     ASSERT(url.protocolInHTTPFamily());
     ASSERT(url.isValid());
 
     protectionSpaceToCredentialMap().set(protectionSpace, credential);
-    
+    originsWithCredentials().add(originStringFromURL(url));
+
     ProtectionSpaceAuthenticationScheme scheme = protectionSpace.authenticationScheme();
-    if (url.protocolInHTTPFamily() && (scheme == ProtectionSpaceAuthenticationSchemeHTTPBasic || scheme == ProtectionSpaceAuthenticationSchemeDefault)) {
-        String origin = originStringFromURL(url);
-        
-        HashMap<String, Credential> pathToCredentialMap;
-        pair<HashMap<String, HashMap<String, Credential> >::iterator, bool> result = originToDefaultBasicCredentialMap().add(origin, pathToCredentialMap);
-        
-        // Remove the last path component that is not a directory to determine the subpath for which this credential applies.
-        // We keep a leading slash, but remove a trailing one.
-        String path = url.path();
-        ASSERT(path.length() > 0);
-        ASSERT(path[0] == '/');
-        if (path.length() > 1) {
-            int index = path.reverseFind('/');
-            path = path.substring(0, index ? index : 1);
-        }
-        ASSERT(path.length() == 1 || path[path.length() - 1] != '/');
-        
-        result.first->second.set(path, credential);
+    if (scheme == ProtectionSpaceAuthenticationSchemeHTTPBasic || scheme == ProtectionSpaceAuthenticationSchemeDefault) {
+        // The map can contain both a path and its subpath - while redundant, this makes lookups faster.
+        pathToDefaultProtectionSpaceMap().set(protectionSpaceMapKeyFromURL(url), protectionSpace);
     }
 }
 
@@ -92,33 +103,53 @@ Credential CredentialStorage::get(const ProtectionSpace& protectionSpace)
     return protectionSpaceToCredentialMap().get(protectionSpace);
 }
 
-Credential CredentialStorage::getDefaultAuthenticationCredential(const KURL& url)
+static PathToDefaultProtectionSpaceMap::iterator findDefaultProtectionSpaceForURL(const KURL& url)
 {
     ASSERT(url.protocolInHTTPFamily());
-    String origin = originStringFromURL(url);
-    const HashMap<String, Credential>& pathToCredentialMap(originToDefaultBasicCredentialMap().get(origin));
-    if (pathToCredentialMap.isEmpty())
-        return Credential();
-    
-    // Check to see if there is a stored credential for the subpath ancestry of this url.
-    String path = url.path();
-    Credential credential = pathToCredentialMap.get(path);
-    while (credential.isEmpty() && !path.isNull()) {
-        int index = path.reverseFind('/');
-        if (index == 0) {
-            credential = pathToCredentialMap.get("/");
-            break;
-        } else if (index == -1) {
-            // This case should never happen, as all HTTP URL paths should start with a leading /
-            ASSERT_NOT_REACHED();
-            credential = pathToCredentialMap.get(path);
-            break;
-        } else {
-            path = path.substring(0, index);
-            credential = pathToCredentialMap.get(path);
-        }
+    ASSERT(url.isValid());
+
+    PathToDefaultProtectionSpaceMap& map = pathToDefaultProtectionSpaceMap();
+
+    // Don't spend time iterating the path for origins that don't have any credentials.
+    if (!originsWithCredentials().contains(originStringFromURL(url)))
+        return map.end();
+
+    String directoryURL = protectionSpaceMapKeyFromURL(url);
+    unsigned directoryURLPathStart = url.pathStart();
+    while (true) {
+        PathToDefaultProtectionSpaceMap::iterator iter = map.find(directoryURL);
+        if (iter != map.end())
+            return iter;
+
+        if (directoryURL.length() == directoryURLPathStart + 1)  // path is "/" already, cannot shorten it any more
+            return map.end();
+
+        int index = directoryURL.reverseFind('/', -2);
+        ASSERT(index > 0);
+        directoryURL = directoryURL.substring(0, (static_cast<unsigned>(index) == directoryURLPathStart) ? index + 1 : index);
+        ASSERT(directoryURL.length() > directoryURLPathStart);
+        ASSERT(directoryURL.length() == directoryURLPathStart + 1 || directoryURL[directoryURL.length() - 1] != '/');
     }
-    return credential;
+}
+
+bool CredentialStorage::set(const Credential& credential, const KURL& url)
+{
+    ASSERT(url.protocolInHTTPFamily());
+    ASSERT(url.isValid());
+    PathToDefaultProtectionSpaceMap::iterator iter = findDefaultProtectionSpaceForURL(url);
+    if (iter == pathToDefaultProtectionSpaceMap().end())
+        return false;
+    ASSERT(originsWithCredentials().contains(originStringFromURL(url)));
+    protectionSpaceToCredentialMap().set(iter->second, credential);
+    return true;
+}
+
+Credential CredentialStorage::get(const KURL& url)
+{
+    PathToDefaultProtectionSpaceMap::iterator iter = findDefaultProtectionSpaceForURL(url);
+    if (iter == pathToDefaultProtectionSpaceMap().end())
+        return Credential();
+    return protectionSpaceToCredentialMap().get(iter->second);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.h b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.h
index 737efa6427..5086f69f65 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.h
@@ -36,7 +36,11 @@ class CredentialStorage {
 public:
     static void set(const Credential&, const ProtectionSpace&, const KURL&);
     static Credential get(const ProtectionSpace&);
-    static Credential getDefaultAuthenticationCredential(const KURL&);
+
+    // These methods work for authentication schemes that support sending credentials without waiting for a request. E.g., for HTTP Basic authentication scheme
+    // a client should assume that all paths at or deeper than the depth of a known protected resource share are within the same protection space.
+    static bool set(const Credential&, const KURL&); // Returns true if the URL corresponds to a known protection space, so credentials could be updated.
+    static Credential get(const KURL&);
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.cpp b/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.cpp
index ff470a0235..07c66e8155 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.cpp
@@ -45,7 +45,7 @@ auto_ptr<CrossThreadHTTPHeaderMapData> HTTPHeaderMap::copyData() const
 
     HTTPHeaderMap::const_iterator end_it = end();
     for (HTTPHeaderMap::const_iterator it = begin(); it != end_it; ++it) {
-        data->append(make_pair(it->first.string().copy(), it->second.copy()));
+        data->append(make_pair(it->first.string().crossThreadString(), it->second.crossThreadString()));
     }
     return data;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.cpp
index 370650f6ad..97435bad52 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.cpp
@@ -34,10 +34,10 @@ ResourceError ResourceErrorBase::copy() const
     lazyInit();
 
     ResourceError errorCopy;
-    errorCopy.m_domain = m_domain.copy();
+    errorCopy.m_domain = m_domain.crossThreadString();
     errorCopy.m_errorCode = m_errorCode;
-    errorCopy.m_failingURL = m_failingURL.copy();
-    errorCopy.m_localizedDescription = m_localizedDescription.copy();
+    errorCopy.m_failingURL = m_failingURL.crossThreadString();
+    errorCopy.m_localizedDescription = m_localizedDescription.crossThreadString();
     errorCopy.m_isNull = m_isNull;
     errorCopy.m_isCancellation = m_isCancellation;
     return errorCopy;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
index a651a3f6db..4c77999f4a 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
@@ -73,13 +73,13 @@ auto_ptr<CrossThreadResourceRequestData> ResourceRequestBase::copyData() const
     data->m_cachePolicy = cachePolicy();
     data->m_timeoutInterval = timeoutInterval();
     data->m_firstPartyForCookies = firstPartyForCookies().copy();
-    data->m_httpMethod = httpMethod().copy();
+    data->m_httpMethod = httpMethod().crossThreadString();
     data->m_httpHeaders.adopt(httpHeaderFields().copyData());
 
     data->m_responseContentDispositionEncodingFallbackArray.reserveInitialCapacity(m_responseContentDispositionEncodingFallbackArray.size());
     size_t encodingArraySize = m_responseContentDispositionEncodingFallbackArray.size();
     for (size_t index = 0; index < encodingArraySize; ++index) {
-        data->m_responseContentDispositionEncodingFallbackArray.append(m_responseContentDispositionEncodingFallbackArray[index].copy());
+        data->m_responseContentDispositionEncodingFallbackArray.append(m_responseContentDispositionEncodingFallbackArray[index].crossThreadString());
     }
     if (m_httpBody)
         data->m_httpBody = m_httpBody->deepCopy();
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
index 7f8a4e2f56..fd442252f8 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
@@ -108,12 +108,12 @@ auto_ptr<CrossThreadResourceResponseData> ResourceResponseBase::copyData() const
 {
     auto_ptr<CrossThreadResourceResponseData> data(new CrossThreadResourceResponseData());
     data->m_url = url().copy();
-    data->m_mimeType = mimeType().copy();
+    data->m_mimeType = mimeType().crossThreadString();
     data->m_expectedContentLength = expectedContentLength();
-    data->m_textEncodingName = textEncodingName().copy();
-    data->m_suggestedFilename = suggestedFilename().copy();
+    data->m_textEncodingName = textEncodingName().crossThreadString();
+    data->m_suggestedFilename = suggestedFilename().crossThreadString();
     data->m_httpStatusCode = httpStatusCode();
-    data->m_httpStatusText = httpStatusText().copy();
+    data->m_httpStatusText = httpStatusText().crossThreadString();
     data->m_httpHeaders.adopt(httpHeaderFields().copyData());
     data->m_lastModifiedDate = lastModifiedDate();
     return data;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 3303b34a60..202346d254 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -112,23 +112,11 @@ qint64 FormDataIODevice::writeData(const char*, qint64)
     return -1;
 }
 
-void FormDataIODevice::setParent(QNetworkReply* reply)
-{
-    QIODevice::setParent(reply);
-
-    connect(reply, SIGNAL(finished()), SLOT(slotFinished()), Qt::QueuedConnection);
-}
-
 bool FormDataIODevice::isSequential() const
 {
     return true;
 }
 
-void FormDataIODevice::slotFinished()
-{
-    deleteLater();
-}
-
 QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode loadMode)
     : QObject(0)
     , m_reply(0)
@@ -224,9 +212,7 @@ void QNetworkReplyHandler::finish()
     if (m_shouldFinish)
         return;
 
-    // FIXME: Investigate if this check should be moved into sendResponseIfNeeded()
-    if (!m_reply->error())
-        sendResponseIfNeeded();
+    sendResponseIfNeeded();
 
     if (!m_resourceHandle)
         return;
@@ -236,19 +222,20 @@ void QNetworkReplyHandler::finish()
         m_reply = 0;
         return;
     }
+
     QNetworkReply* oldReply = m_reply;
+
     if (m_redirected) {
         resetState();
         start();
     } else if (!m_reply->error() || ignoreHttpError(m_reply, m_responseDataSent)) {
         client->didFinishLoading(m_resourceHandle);
     } else {
-        int code = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-
         QUrl url = m_reply->url();
+        int httpStatusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
 
-        if (code) {
-            ResourceError error("HTTP", code, url.toString(), m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toString());
+        if (httpStatusCode) {
+            ResourceError error("HTTP", httpStatusCode, url.toString(), m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toString());
             client->didFail(m_resourceHandle, error);
         } else {
             ResourceError error("QtNetwork", m_reply->error(), url.toString(), m_reply->errorString());
@@ -267,6 +254,9 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     if (m_shouldSendResponse)
         return;
 
+    if (m_reply->error())
+        return;
+
     if (m_responseSent || !m_resourceHandle)
         return;
     m_responseSent = true;
@@ -290,40 +280,34 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     }
 
     KURL url(m_reply->url());
-    String suggestedFilename = filenameFromHTTPContentDisposition(QString::fromAscii(m_reply->rawHeader("Content-Disposition")));
-
-    if (suggestedFilename.isEmpty())
-        suggestedFilename = url.lastPathComponent();
-
     ResourceResponse response(url, mimeType,
                               m_reply->header(QNetworkRequest::ContentLengthHeader).toLongLong(),
-                              encoding,
-                              suggestedFilename);
+                              encoding, String());
 
-    const bool isLocalFileReply = (m_reply->url().scheme() == QLatin1String("file"));
-    int statusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-    if (!isLocalFileReply) {
-        response.setHTTPStatusCode(statusCode);
-        response.setHTTPStatusText(m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toByteArray().constData());
+    if (url.isLocalFile()) {
+        client->didReceiveResponse(m_resourceHandle, response);
+        return;
     }
-    else if (m_reply->error() == QNetworkReply::ContentNotFoundError)
-        response.setHTTPStatusCode(404);
 
+    // The status code is equal to 0 for protocols not in the HTTP family.
+    int statusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
 
-    /* Fill in the other fields
-     * For local file requests remove the content length and the last-modified
-     * headers as required by fast/dom/xmlhttprequest-get.xhtml
-     */
-    foreach (const QByteArray& headerName, m_reply->rawHeaderList()) {
-        if (isLocalFileReply
-            && (headerName == "Content-Length" || headerName == "Last-Modified"))
-            continue;
+    if (url.protocolInHTTPFamily()) {
+        String suggestedFilename = filenameFromHTTPContentDisposition(QString::fromAscii(m_reply->rawHeader("Content-Disposition")));
 
-        response.setHTTPHeaderField(QString::fromAscii(headerName), QString::fromAscii(m_reply->rawHeader(headerName)));
-    }
+        if (!suggestedFilename.isEmpty())
+            response.setSuggestedFilename(suggestedFilename);
+        else
+            response.setSuggestedFilename(url.lastPathComponent());
 
-    if (isLocalFileReply)
-        response.setHTTPHeaderField(QString::fromAscii("Cache-Control"), QString::fromAscii("no-cache"));
+        response.setHTTPStatusCode(statusCode);
+        response.setHTTPStatusText(m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toByteArray().constData());
+
+        // Add remaining headers.
+        foreach (const QByteArray& headerName, m_reply->rawHeaderList()) {
+            response.setHTTPHeaderField(QString::fromAscii(headerName), QString::fromAscii(m_reply->rawHeader(headerName)));
+        }
+    }
 
     QUrl redirection = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
     if (redirection.isValid()) {
@@ -339,9 +323,13 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
         client->willSendRequest(m_resourceHandle, newRequest, response);
         m_redirected = true;
         m_request = newRequest.toNetworkRequest();
-    } else {
-        client->didReceiveResponse(m_resourceHandle, response);
+
+        ResourceHandleInternal* d = m_resourceHandle->getInternal();
+        emit d->m_frame->page()->networkRequestStarted(d->m_frame, &m_request);
+        return;
     }
+
+    client->didReceiveResponse(m_resourceHandle, response);
 }
 
 void QNetworkReplyHandler::forwardData()
@@ -379,6 +367,8 @@ void QNetworkReplyHandler::start()
 
     QNetworkAccessManager* manager = d->m_frame->page()->networkAccessManager();
 
+    emit d->m_frame->page()->networkRequestStarted(d->m_frame, &m_request);
+
     const QUrl url = m_request.url();
     const QString scheme = url.scheme();
     // Post requests on files and data don't really make sense, but for
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
index 545119e8b2..fccc4a6980 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -96,16 +96,12 @@ public:
     FormDataIODevice(FormData*);
     ~FormDataIODevice();
 
-    void setParent(QNetworkReply*);
     bool isSequential() const;
 
 protected:
     qint64 readData(char*, qint64);
     qint64 writeData(const char*, qint64);
 
-private Q_SLOTS:
-    void slotFinished();
-
 private:
     void moveToNextElement();
 
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
index 666ad188c5..9d2c452ff0 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
@@ -239,8 +239,6 @@ static CachedImage* getCachedImage(Element* element)
 void ClipboardQt::declareAndWriteDragImage(Element* element, const KURL& url, const String& title, Frame* frame)
 {
     ASSERT(frame);
-    Q_UNUSED(url);
-    Q_UNUSED(title);
 
     //WebCore::writeURL(m_writableDataObject.get(), url, title, true, false);
     if (!m_writableData)
@@ -262,8 +260,10 @@ void ClipboardQt::declareAndWriteDragImage(Element* element, const KURL& url, co
         return;
 
     QList<QUrl> urls;
+    urls.append(url);
     urls.append(fullURL);
 
+    m_writableData->setText(title);
     m_writableData->setUrls(urls);
 #ifndef QT_NO_CLIPBOARD
     if (!isForDragging())
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp b/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp
index 77cac57e34..ca3ca9dff1 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp
@@ -33,6 +33,7 @@
 #include "PlatformString.h"
 
 #include <QCoreApplication>
+#include <QLocale>
 
 namespace WebCore {
 
@@ -53,7 +54,8 @@ String resetButtonDefaultLabel()
 
 String defaultLanguage()
 {
-    return "en";
+    QLocale locale;
+    return locale.name().replace("_", "-");
 }
 
 String searchableIndexIntroduction()
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
index 935882a917..37ea681b34 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
@@ -217,7 +217,7 @@ static int windowsKeyCodeForKeyEvent(unsigned int keycode, bool isKeypad = false
         case Qt::Key_F9:
             return VK_F9;
         case Qt::Key_F10:
-            return VK_F11;
+            return VK_F10;
         case Qt::Key_F11:
             return VK_F11;
         case Qt::Key_F12:
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PlatformScreenQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PlatformScreenQt.cpp
index 7ba8350104..8221760885 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PlatformScreenQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PlatformScreenQt.cpp
@@ -62,7 +62,7 @@ int screenDepthPerComponent(Widget* w)
         QWebPageClient* client = w->root()->hostWindow()->platformPageClient();
 
         if (client) {
-            QWidget* view = QWidget::find(client->winId());
+            QWidget* view = client->ownerWidget();
             if (view)
                 return view->depth();
         }
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp
index b44f2ec274..f6ec4f78cc 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp
@@ -92,7 +92,7 @@ void PopupMenu::show(const IntRect& r, FrameView* v, int index)
     rect.moveTopLeft(v->contentsToWindow(r.topLeft()));
     rect.setHeight(m_popup->sizeHint().height());
 
-    m_popup->setParent(QWidget::find(client->winId()));
+    m_popup->setParent(client->ownerWidget());
     m_popup->setGeometry(rect);
     m_popup->setCurrentIndex(index);
     m_popup->exec();
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/QWebPageClient.h b/src/3rdparty/webkit/WebCore/platform/qt/QWebPageClient.h
index 37941ebeab..28ef724517 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/QWebPageClient.h
+++ b/src/3rdparty/webkit/WebCore/platform/qt/QWebPageClient.h
@@ -32,35 +32,45 @@ class QWebPageClient {
 public:
     virtual void scroll(int dx, int dy, const QRect&) = 0;
     virtual void update(const QRect&) = 0;
-
     virtual void setInputMethodEnabled(bool enable) = 0;
 #if QT_VERSION >= 0x040600
     virtual void setInputMethodHint(Qt::InputMethodHint hint, bool enable) = 0;
 #endif
     inline void resetCursor()
     {
+#ifndef QT_NO_CURSOR
         if (!cursor().bitmap() && cursor().shape() == m_lastCursor.shape())
             return;
         updateCursor(m_lastCursor);
+#endif
     }
 
     inline void setCursor(const QCursor& cursor)
     {
+#ifndef QT_NO_CURSOR
         m_lastCursor = cursor;
         if (!cursor.bitmap() && cursor.shape() == this->cursor().shape())
             return;
         updateCursor(cursor);
+#endif
     }
 
+    virtual QPalette palette() const = 0;
     virtual int screenNumber() const = 0;
-    virtual WId winId() const = 0;
+    virtual QWidget* ownerWidget() const = 0;
+
+    virtual QObject* pluginParent() const = 0;
 
 protected:
+#ifndef QT_NO_CURSOR
     virtual QCursor cursor() const = 0;
     virtual void updateCursor(const QCursor& cursor) = 0;
+#endif
 
 private:
+#ifndef QT_NO_CURSOR
     QCursor m_lastCursor;
+#endif
 };
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
index f505d0cb8f..b61d356032 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
@@ -44,6 +44,7 @@
 #include "Page.h"
 #include "RenderBox.h"
 #include "RenderTheme.h"
+#include "UserAgentStyleSheets.h"
 #include "qwebpage.h"
 
 #include <QApplication>
@@ -771,13 +772,7 @@ ControlPart RenderThemeQt::applyTheme(QStyleOption& option, RenderObject* o) con
 
 String RenderThemeQt::extraMediaControlsStyleSheet()
 {
-    QFile platformStyleSheet(QLatin1String(":/webcore/css/mediaControls-extras.css"));
-    if (platformStyleSheet.open(QFile::ReadOnly)) {
-        QByteArray sheetData = platformStyleSheet.readAll();
-        return QString::fromUtf8(sheetData.constData(), sheetData.length());
-    }
-
-    return String();
+    return String(mediaControlsQtUserAgentStyleSheet, sizeof(mediaControlsQtUserAgentStyleSheet));
 }
 
 // Helper class to transform the painter's world matrix to the object's content area, scaled to 0,0,100,100
diff --git a/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.cpp b/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.cpp
index 7e178f9f4d..0ad643e4ca 100644
--- a/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.cpp
@@ -32,10 +32,10 @@
 namespace WebCore {
 
 SQLValue::SQLValue(const SQLValue& val)
+    : m_type(val.m_type)
+    , m_number(val.m_number)
+    , m_string(val.m_string.threadsafeCopy())
 {
-    m_number = val.m_number;
-    m_string = val.m_string.copy();
-    m_type = val.m_type;
 }
 
 String SQLValue::string() const
@@ -43,7 +43,7 @@ String SQLValue::string() const
     ASSERT(m_type == StringValue);
 
     // Must return a copy since ref-shared Strings are not thread safe
-    return m_string.copy();
+    return m_string.threadsafeCopy();
 }
 
 double SQLValue::number() const
diff --git a/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.h b/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.h
index 7d85051a3c..0f854fc89f 100644
--- a/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.h
+++ b/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.h
@@ -38,9 +38,9 @@ namespace WebCore {
     public:
         enum Type { NullValue, NumberValue, StringValue };
 
-        SQLValue() : m_type(NullValue) { }
+        SQLValue() : m_type(NullValue), m_number(0.0) { }
         SQLValue(double number) : m_type(NumberValue), m_number(number) { }
-        SQLValue(const String& s) : m_type(StringValue), m_string(s) { }
+        SQLValue(const String& s) : m_type(StringValue), m_number(0.0), m_string(s) { }
         SQLValue(const SQLValue&);
 
         Type type() const { return m_type; }
diff --git a/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.h b/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.h
index d313435818..99822545e8 100644
--- a/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.h
+++ b/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.h
@@ -24,8 +24,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef SQLDatabase_h
-#define SQLDatabase_h
+#ifndef SQLiteDatabase_h
+#define SQLiteDatabase_h
 
 #include "PlatformString.h"
 #include <wtf/Threading.h>
diff --git a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp
index 409439e5b0..17d7832b25 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp
@@ -65,7 +65,9 @@ struct CStringTranslator {
 
     static void translate(StringImpl*& location, const char* const& c, unsigned hash)
     {
-        location = new StringImpl(c, strlen(c), hash); 
+        location = StringImpl::create(c).releaseRef(); 
+        location->setHash(hash);
+        location->setInTable();
     }
 };
 
@@ -140,7 +142,9 @@ struct UCharBufferTranslator {
 
     static void translate(StringImpl*& location, const UCharBuffer& buf, unsigned hash)
     {
-        location = new StringImpl(buf.s, buf.length, hash); 
+        location = StringImpl::create(buf.s, buf.length).releaseRef(); 
+        location->setHash(hash);
+        location->setInTable();
     }
 };
 
@@ -164,7 +168,9 @@ struct HashAndCharactersTranslator {
 
     static void translate(StringImpl*& location, const HashAndCharacters& buffer, unsigned hash)
     {
-        location = new StringImpl(buffer.characters, buffer.length, hash); 
+        location = StringImpl::create(buffer.characters, buffer.length).releaseRef();
+        location->setHash(hash);
+        location->setInTable();
     }
 };
 
@@ -222,6 +228,16 @@ void AtomicString::remove(StringImpl* r)
 {
     stringTable().remove(r);
 }
+    
+AtomicString AtomicString::lower() const
+{
+    // Note: This is a hot function in the Dromaeo benchmark.
+    StringImpl* impl = this->impl();
+    RefPtr<StringImpl> newImpl = impl->lower();
+    if (LIKELY(newImpl == impl))
+        return *this;
+    return AtomicString(newImpl);
+}
 
 #if USE(JSC)
 PassRefPtr<StringImpl> AtomicString::add(const JSC::Identifier& identifier)
diff --git a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h
index 3307a2d325..8805f4c7dc 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h
@@ -83,6 +83,9 @@ public:
     bool endsWith(const String& s, bool caseSensitive = true) const
         { return m_string.endsWith(s, caseSensitive); }
     
+    AtomicString lower() const;
+    AtomicString upper() const { return AtomicString(impl()->upper()); }
+    
     int toInt(bool* ok = 0) const { return m_string.toInt(ok); }
     double toDouble(bool* ok = 0) const { return m_string.toDouble(ok); }
     float toFloat(bool* ok = 0) const { return m_string.toFloat(ok); }
diff --git a/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h b/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
index b9b4078732..8d19c175f6 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
@@ -193,16 +193,13 @@ public:
 
     bool percentage(int& percentage) const;
 
-    // Makes a deep copy. Helpful only if you need to use a String on another thread.
+    // Returns a StringImpl suitable for use on another thread.
+    String crossThreadString() const;
+    // Makes a deep copy. Helpful only if you need to use a String on another thread
+    // (use crossThreadString if the method call doesn't need to be threadsafe).
     // Since the underlying StringImpl objects are immutable, there's no other reason
     // to ever prefer copy() over plain old assignment.
-    String copy() const;
-
-    // Makes a deep copy like copy() but only for a substring.
-    // (This ensures that you always get something suitable for a thread while subtring
-    // may not.  For example, in the empty string case, StringImpl::substring returns
-    // empty() which is not safe for another thread.)
-    String substringCopy(unsigned pos, unsigned len  = UINT_MAX) const;
+    String threadsafeCopy() const;
 
     bool isNull() const { return !m_impl; }
     bool isEmpty() const;
diff --git a/src/3rdparty/webkit/WebCore/platform/text/String.cpp b/src/3rdparty/webkit/WebCore/platform/text/String.cpp
index e892ef6126..bef2674cde 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/String.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/String.cpp
@@ -263,13 +263,6 @@ String String::substring(unsigned pos, unsigned len) const
     return m_impl->substring(pos, len);
 }
 
-String String::substringCopy(unsigned pos, unsigned len) const
-{
-    if (!m_impl) 
-        return String();
-    return m_impl->substringCopy(pos, len);
-}
-
 String String::lower() const
 {
     if (!m_impl)
@@ -590,11 +583,18 @@ float String::toFloat(bool* ok) const
     return m_impl->toFloat(ok);
 }
 
-String String::copy() const
+String String::threadsafeCopy() const
+{
+    if (!m_impl)
+        return String();
+    return m_impl->threadsafeCopy();
+}
+
+String String::crossThreadString() const
 {
     if (!m_impl)
         return String();
-    return m_impl->copy();
+    return m_impl->crossThreadString();
 }
 
 bool String::isEmpty() const
diff --git a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp
index 8b749c725b..5cf4ced911 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp
@@ -57,7 +57,7 @@ static inline void deleteUCharVector(const UChar* p)
 }
 
 // Some of the factory methods create buffers using fastMalloc.
-// We must ensure that ll allocations of StringImpl are allocated using
+// We must ensure that all allocations of StringImpl are allocated using
 // fastMalloc so that we don't have mis-matched frees. We accomplish 
 // this by overriding the new and delete operators.
 void* StringImpl::operator new(size_t size, void* address)
@@ -79,10 +79,9 @@ void StringImpl::operator delete(void* address)
 
 // This constructor is used only to create the empty string.
 StringImpl::StringImpl()
-    : m_length(0)
-    , m_data(0)
+    : m_data(0)
+    , m_length(0)
     , m_hash(0)
-    , m_bufferIsInternal(false)
 {
     // Ensure that the hash is computed so that AtomicStringHash can call existingHash()
     // with impunity. The empty string is special because it is never entered into
@@ -90,97 +89,20 @@ StringImpl::StringImpl()
     hash();
 }
 
-// This is one of the most common constructors, but it's also used for the copy()
-// operation. Because of that, it's the one constructor that doesn't assert the
-// length is non-zero, since we support copying the empty string.
 inline StringImpl::StringImpl(const UChar* characters, unsigned length)
-    : m_length(length)
+    : m_data(characters)
+    , m_length(length)
     , m_hash(0)
-    , m_bufferIsInternal(false)
 {
-    UChar* data = newUCharVector(length);
-    memcpy(data, characters, length * sizeof(UChar));
-    m_data = data;
-}
-
-inline StringImpl::StringImpl(const StringImpl& str, WithTerminatingNullCharacter)
-    : m_length(str.m_length)
-    , m_hash(str.m_hash)
-    , m_bufferIsInternal(false)
-{
-    m_sharedBufferAndFlags.setFlag(HasTerminatingNullCharacter);
-    UChar* data = newUCharVector(str.m_length + 1);
-    memcpy(data, str.m_data, str.m_length * sizeof(UChar));
-    data[str.m_length] = 0;
-    m_data = data;
-}
-
-inline StringImpl::StringImpl(const char* characters, unsigned length)
-    : m_length(length)
-    , m_hash(0)
-    , m_bufferIsInternal(false)
-{
-    ASSERT(characters);
-    ASSERT(length);
-
-    UChar* data = newUCharVector(length);
-    for (unsigned i = 0; i != length; ++i) {
-        unsigned char c = characters[i];
-        data[i] = c;
-    }
-    m_data = data;
-}
-
-inline StringImpl::StringImpl(UChar* characters, unsigned length, AdoptBuffer)
-    : m_length(length)
-    , m_data(characters)
-    , m_hash(0)
-    , m_bufferIsInternal(false)
-{
-    ASSERT(characters);
-    ASSERT(length);
-}
-
-// This constructor is only for use by AtomicString.
-StringImpl::StringImpl(const UChar* characters, unsigned length, unsigned hash)
-    : m_length(length)
-    , m_hash(hash)
-    , m_bufferIsInternal(false)
-{
-    ASSERT(hash);
-    ASSERT(characters);
-    ASSERT(length);
-
-    setInTable();
-    UChar* data = newUCharVector(length);
-    memcpy(data, characters, length * sizeof(UChar));
-    m_data = data;
-}
-
-// This constructor is only for use by AtomicString.
-StringImpl::StringImpl(const char* characters, unsigned length, unsigned hash)
-    : m_length(length)
-    , m_hash(hash)
-    , m_bufferIsInternal(false)
-{
-    ASSERT(hash);
     ASSERT(characters);
     ASSERT(length);
-
-    setInTable();
-    UChar* data = newUCharVector(length);
-    for (unsigned i = 0; i != length; ++i) {
-        unsigned char c = characters[i];
-        data[i] = c;
-    }
-    m_data = data;
 }
 
 StringImpl::~StringImpl()
 {
     if (inTable())
         AtomicString::remove(this);
-    if (!m_bufferIsInternal) {
+    if (!bufferIsInternal()) {
         SharedUChar* sharedBuffer = m_sharedBufferAndFlags.get();
         if (sharedBuffer)
             sharedBuffer->deref();
@@ -218,15 +140,6 @@ PassRefPtr<StringImpl> StringImpl::substring(unsigned start, unsigned length)
     return create(m_data + start, length);
 }
 
-PassRefPtr<StringImpl> StringImpl::substringCopy(unsigned start, unsigned length)
-{
-    start = min(start, m_length);
-    length = min(length, m_length - start);
-    if (!length)
-        return adoptRef(new StringImpl);
-    return create(m_data + start, length);
-}
-
 UChar32 StringImpl::characterStartingAt(unsigned i)
 {
     if (U16_IS_SINGLE(m_data[i]))
@@ -236,46 +149,38 @@ UChar32 StringImpl::characterStartingAt(unsigned i)
     return 0;
 }
 
-bool StringImpl::isLower()
+PassRefPtr<StringImpl> StringImpl::lower()
 {
-    // Do a faster loop for the case where all the characters are ASCII.
-    bool allLower = true;
+    // Note: This is a hot function in the Dromaeo benchmark, specifically the
+    // no-op code path up through the first 'return' statement.
+    
+    // First scan the string for uppercase and non-ASCII characters:
     UChar ored = 0;
-    for (unsigned i = 0; i < m_length; i++) {
-        UChar c = m_data[i];
-        allLower = allLower && isASCIILower(c);
-        ored |= c;
-    }
-    if (!(ored & ~0x7F))
-        return allLower;
-
-    // Do a slower check for cases that include non-ASCII characters.
-    allLower = true;
-    unsigned i = 0;
-    while (i < m_length) {
-        UChar32 character;
-        U16_NEXT(m_data, i, m_length, character)
-        allLower = allLower && Unicode::isLower(character);
+    bool noUpper = true;
+    const UChar *end = m_data + m_length;
+    for (const UChar* chp = m_data; chp != end; chp++) {
+        if (UNLIKELY(isASCIIUpper(*chp)))
+            noUpper = false;
+        ored |= *chp;
     }
-    return allLower;
-}
+    
+    // Nothing to do if the string is all ASCII with no uppercase.
+    if (noUpper && !(ored & ~0x7F))
+        return this;
 
-PassRefPtr<StringImpl> StringImpl::lower()
-{
-    UChar* data;
-    PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
     int32_t length = m_length;
+    UChar* data;
+    RefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
 
-    // Do a faster loop for the case where all the characters are ASCII.
-    UChar ored = 0;
-    for (int i = 0; i < length; i++) {
-        UChar c = m_data[i];
-        ored |= c;
-        data[i] = toASCIILower(c);
-    }
-    if (!(ored & ~0x7F))
+    if (!(ored & ~0x7F)) {
+        // Do a faster loop for the case where all the characters are ASCII.
+        for (int i = 0; i < length; i++) {
+            UChar c = m_data[i];
+            data[i] = toASCIILower(c);
+        }
         return newImpl;
-
+    }
+    
     // Do a slower implementation for cases that include non-ASCII characters.
     bool error;
     int32_t realLength = Unicode::toLower(data, length, m_data, m_length, &error);
@@ -290,6 +195,9 @@ PassRefPtr<StringImpl> StringImpl::lower()
 
 PassRefPtr<StringImpl> StringImpl::upper()
 {
+    // This function could be optimized for no-op cases the way lower() is,
+    // but in empirical testing, few actual calls to upper() are no-ops, so
+    // it wouldn't be worth the extra time for pre-scanning.
     UChar* data;
     PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
     int32_t length = m_length;
@@ -374,6 +282,8 @@ PassRefPtr<StringImpl> StringImpl::stripWhiteSpace()
     while (end && isSpaceOrNewline(m_data[end]))
         end--;
 
+    if (!start && end == m_length - 1)
+        return this;
     return create(m_data + start, end + 1 - start);
 }
 
@@ -416,12 +326,16 @@ PassRefPtr<StringImpl> StringImpl::simplifyWhiteSpace()
     const UChar* from = m_data;
     const UChar* fromend = from + m_length;
     int outc = 0;
+    bool changedToSpace = false;
     
     UChar* to = data.characters();
     
     while (true) {
-        while (from != fromend && isSpaceOrNewline(*from))
+        while (from != fromend && isSpaceOrNewline(*from)) {
+            if (*from != ' ')
+                changedToSpace = true;
             from++;
+        }
         while (from != fromend && !isSpaceOrNewline(*from))
             to[outc++] = *from++;
         if (from != fromend)
@@ -433,6 +347,9 @@ PassRefPtr<StringImpl> StringImpl::simplifyWhiteSpace()
     if (outc > 0 && to[outc - 1] == ' ')
         outc--;
     
+    if (static_cast<unsigned>(outc) == m_length && !changedToSpace)
+        return this;
+    
     data.shrink(outc);
     
     return adopt(data);
@@ -985,7 +902,7 @@ PassRefPtr<StringImpl> StringImpl::adopt(StringBuffer& buffer)
     unsigned length = buffer.length();
     if (length == 0)
         return empty();
-    return adoptRef(new StringImpl(buffer.release(), length, AdoptBuffer()));
+    return adoptRef(new StringImpl(buffer.release(), length));
 }
 
 PassRefPtr<StringImpl> StringImpl::adopt(Vector<UChar>& vector)
@@ -993,7 +910,7 @@ PassRefPtr<StringImpl> StringImpl::adopt(Vector<UChar>& vector)
     size_t size = vector.size();
     if (size == 0)
         return empty();
-    return adoptRef(new StringImpl(vector.releaseBuffer(), size, AdoptBuffer()));
+    return adoptRef(new StringImpl(vector.releaseBuffer(), size));
 }
 
 PassRefPtr<StringImpl> StringImpl::createUninitialized(unsigned length, UChar*& data)
@@ -1007,10 +924,9 @@ PassRefPtr<StringImpl> StringImpl::createUninitialized(unsigned length, UChar*&
     // struct as well as the data which it contains. This removes one 
     // heap allocation from this call.
     size_t size = sizeof(StringImpl) + length * sizeof(UChar);
-    char* buffer = static_cast<char*>(fastMalloc(size));
-    data = reinterpret_cast<UChar*>(buffer + sizeof(StringImpl));
-    StringImpl* string = new (buffer) StringImpl(data, length, AdoptBuffer());
-    string->m_bufferIsInternal = true;
+    StringImpl* string = static_cast<StringImpl*>(fastMalloc(size));
+    data = reinterpret_cast<UChar*>(string + 1);
+    string = new (string) StringImpl(data, length);
     return adoptRef(string);
 }
 
@@ -1051,7 +967,7 @@ PassRefPtr<StringImpl> StringImpl::create(const JSC::UString& str)
 {
     SharedUChar* sharedBuffer = const_cast<JSC::UString*>(&str)->rep()->sharedBuffer();
     if (sharedBuffer) {
-        PassRefPtr<StringImpl> impl = adoptRef(new StringImpl(const_cast<UChar*>(str.data()), str.size(), AdoptBuffer()));
+        PassRefPtr<StringImpl> impl = adoptRef(new StringImpl(str.data(), str.size()));
         sharedBuffer->ref();
         impl->m_sharedBufferAndFlags.set(sharedBuffer);
         return impl;
@@ -1071,18 +987,43 @@ JSC::UString StringImpl::ustring()
 
 PassRefPtr<StringImpl> StringImpl::createWithTerminatingNullCharacter(const StringImpl& string)
 {
-    return adoptRef(new StringImpl(string, WithTerminatingNullCharacter()));
+    // Use createUninitialized instead of 'new StringImpl' so that the string and its buffer
+    // get allocated in a single malloc block.
+    UChar* data;
+    int length = string.m_length;
+    RefPtr<StringImpl> terminatedString = createUninitialized(length + 1, data);
+    memcpy(data, string.m_data, length * sizeof(UChar));
+    data[length] = 0;
+    terminatedString->m_length--;
+    terminatedString->m_hash = string.m_hash;
+    terminatedString->m_sharedBufferAndFlags.setFlag(HasTerminatingNullCharacter);
+    return terminatedString.release();
 }
 
-PassRefPtr<StringImpl> StringImpl::copy()
+PassRefPtr<StringImpl> StringImpl::threadsafeCopy() const
 {
-    // Using the constructor directly to make sure that per-thread empty string instance isn't returned.
-    return adoptRef(new StringImpl(m_data, m_length));
+    // Special-case empty strings to make sure that per-thread empty string instance isn't returned.
+    if (m_length == 0)
+        return adoptRef(new StringImpl);
+    return create(m_data, m_length);
+}
+
+PassRefPtr<StringImpl> StringImpl::crossThreadString()
+{
+    SharedUChar* shared = sharedBuffer();
+    if (shared) {
+        RefPtr<StringImpl> impl = adoptRef(new StringImpl(m_data, m_length));
+        impl->m_sharedBufferAndFlags.set(shared->crossThreadCopy().releaseRef());
+        return impl.release();
+    }
+
+    // If no shared buffer is available, create a copy.
+    return threadsafeCopy();
 }
 
 StringImpl::SharedUChar* StringImpl::sharedBuffer()
 {
-    if (m_length < minLengthToShare || m_bufferIsInternal)
+    if (m_length < minLengthToShare || bufferIsInternal())
         return 0;
 
     if (!m_sharedBufferAndFlags.get())
diff --git a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h
index 8b4e82d8b1..dac25b289d 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h
@@ -47,7 +47,6 @@ typedef const struct __CFString * CFStringRef;
 
 namespace WebCore {
 
-class AtomicString;
 class StringBuffer;
 
 struct CStringTranslator;
@@ -60,26 +59,19 @@ enum TextCaseSensitivity { TextCaseSensitive, TextCaseInsensitive };
 typedef bool (*CharacterMatchFunctionPtr)(UChar);
 
 class StringImpl : public RefCounted<StringImpl> {
-    friend class AtomicString;
     friend struct CStringTranslator;
     friend struct HashAndCharactersTranslator;
     friend struct UCharBufferTranslator;
 private:
     friend class ThreadGlobalData;
     StringImpl();
+    
+    // This adopts the UChar* without copying the buffer.
     StringImpl(const UChar*, unsigned length);
-    StringImpl(const char*, unsigned length);
-
-    struct AdoptBuffer { };
-    StringImpl(UChar*, unsigned length, AdoptBuffer);
-
-    struct WithTerminatingNullCharacter { };
-    StringImpl(const StringImpl&, WithTerminatingNullCharacter);
-
-    // For AtomicString.
-    StringImpl(const UChar*, unsigned length, unsigned hash);
-    StringImpl(const char*, unsigned length, unsigned hash);
 
+    // For use only by AtomicString's XXXTranslator helpers.
+    void setHash(unsigned hash) { ASSERT(!m_hash); m_hash = hash; }
+    
     typedef CrossThreadRefCounted<OwnFastMallocPtr<UChar> > SharedUChar;
 
 public:
@@ -114,15 +106,12 @@ public:
     static unsigned computeHash(const UChar*, unsigned len);
     static unsigned computeHash(const char*);
     
-    // Makes a deep copy. Helpful only if you need to use a String on another thread.
+    // Returns a StringImpl suitable for use on another thread.
+    PassRefPtr<StringImpl> crossThreadString();
+    // Makes a deep copy. Helpful only if you need to use a String on another thread
+    // (use crossThreadString if the method call doesn't need to be threadsafe).
     // Since StringImpl objects are immutable, there's no other reason to make a copy.
-    PassRefPtr<StringImpl> copy();
-
-    // Makes a deep copy like copy() but only for a substring.
-    // (This ensures that you always get something suitable for a thread while subtring
-    // may not.  For example, in the empty string case, substring returns empty() which
-    // is not safe for another thread.)
-    PassRefPtr<StringImpl> substringCopy(unsigned pos, unsigned len  = UINT_MAX);
+    PassRefPtr<StringImpl> threadsafeCopy() const;
 
     PassRefPtr<StringImpl> substring(unsigned pos, unsigned len = UINT_MAX);
 
@@ -146,7 +135,6 @@ public:
     double toDouble(bool* ok = 0);
     float toFloat(bool* ok = 0);
 
-    bool isLower();
     PassRefPtr<StringImpl> lower();
     PassRefPtr<StringImpl> upper();
     PassRefPtr<StringImpl> secure(UChar aChar);
@@ -166,7 +154,7 @@ public:
     int reverseFind(UChar, int index);
     int reverseFind(StringImpl*, int index, bool caseSensitive = true);
     
-    bool startsWith(StringImpl* m_data, bool caseSensitive = true) { return reverseFind(m_data, 0, caseSensitive) == 0; }
+    bool startsWith(StringImpl* str, bool caseSensitive = true) { return reverseFind(str, 0, caseSensitive) == 0; }
     bool endsWith(StringImpl*, bool caseSensitive = true);
 
     PassRefPtr<StringImpl> replace(UChar, UChar);
@@ -196,21 +184,22 @@ private:
     void* operator new(size_t size, void* address);
 
     static PassRefPtr<StringImpl> createStrippingNullCharactersSlowCase(const UChar*, unsigned length);
+    
+    // The StringImpl struct and its data may be allocated within a single heap block.
+    // In this case, the m_data pointer is an "internal buffer", and does not need to be deallocated.
+    bool bufferIsInternal() { return m_data == reinterpret_cast<const UChar*>(this + 1); }
 
     enum StringImplFlags {
         HasTerminatingNullCharacter,
         InTable,
     };
 
-    unsigned m_length;
     const UChar* m_data;
+    unsigned m_length;
     mutable unsigned m_hash;
     PtrAndFlags<SharedUChar, StringImplFlags> m_sharedBufferAndFlags;
-
-    // In some cases, we allocate the StringImpl struct and its data
-    // within a single heap buffer. In this case, the m_data pointer
-    // is an "internal buffer", and does not need to be deallocated.
-    bool m_bufferIsInternal;
+    // There is a fictitious variable-length UChar array at the end, which is used
+    // as the internal buffer by the createUninitialized and create methods.
 };
 
 bool equal(StringImpl*, StringImpl*);
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp
index 5d82511580..d3e2965b95 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -129,6 +129,10 @@ static TextEncodingNameMap* textEncodingNameMap;
 static TextCodecMap* textCodecMap;
 static bool didExtendTextCodecMaps;
 
+static const char* const textEncodingNameBlacklist[] = {
+    "UTF-7"
+};
+
 #if ERROR_DISABLED
 
 static inline void checkExistingName(const char*, const char*) { }
@@ -171,6 +175,30 @@ static void addToTextCodecMap(const char* name, NewTextCodecFunction function, c
     textCodecMap->add(atomicName, TextCodecFactory(function, additionalData));
 }
 
+static void pruneBlacklistedCodecs()
+{
+    size_t blacklistedCodecListLength = sizeof(textEncodingNameBlacklist) / sizeof(textEncodingNameBlacklist[0]);
+    for (size_t i = 0; i < blacklistedCodecListLength; ++i) {
+        const char* atomicName = textEncodingNameMap->get(textEncodingNameBlacklist[i]);
+        if (!atomicName)
+            continue;
+
+        Vector<const char*> names;
+        TextEncodingNameMap::const_iterator it = textEncodingNameMap->begin();
+        TextEncodingNameMap::const_iterator end = textEncodingNameMap->end();
+        for (; it != end; ++it) {
+            if (it->second == atomicName)
+                names.append(it->first);
+        }
+
+        size_t length = names.size();
+        for (size_t j = 0; j < length; ++j)
+            textEncodingNameMap->remove(names[j]);
+
+        textCodecMap->remove(atomicName);
+    }
+}
+
 static void buildBaseTextCodecMaps()
 {
     ASSERT(isMainThread());
@@ -221,6 +249,8 @@ static void extendTextCodecMaps()
     TextCodecWince::registerExtendedEncodingNames(addToTextEncodingNameMap);
     TextCodecWince::registerExtendedCodecs(addToTextCodecMap);
 #endif
+
+    pruneBlacklistedCodecs();
 }
 
 PassOwnPtr<TextCodec> newTextCodec(const TextEncoding& encoding)
diff --git a/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp b/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp
index e3515221dc..b3f75ccd20 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp
@@ -104,7 +104,7 @@ String TextCodecQt::decode(const char* bytes, size_t length, bool flush, bool /*
 #endif
     const char* buf = bytes;
     const char* end = buf + length;
-    String unicode;
+    String unicode(""); // a non-null string is expected
 
     while (buf < end) {
         int size = end - buf;
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginDataNone.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginDataNone.cpp
index 28e39673e0..3b98383ccf 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginDataNone.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginDataNone.cpp
@@ -27,18 +27,14 @@
 #include "config.h"
 #include "PluginData.h"
 
-#include "NotImplemented.h"
-
 namespace WebCore {
 
 void PluginData::initPlugins()
 {
-    notImplemented();
 }
 
 void PluginData::refresh()
 {
-    notImplemented();
 }
 
 };
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp
index f40ed952b9..c7979d14ad 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp
@@ -320,7 +320,7 @@ void PluginDatabase::clear()
     m_preferredPlugins.clear();
 }
 
-#if !PLATFORM(WIN_OS) || PLATFORM(WX)
+#if (!PLATFORM(SYMBIAN)) && (!PLATFORM(WIN_OS) || PLATFORM(WX))
 // For Safari/Win the following three methods are implemented
 // in PluginDatabaseWin.cpp, but if we can use WebCore constructs
 // for the logic we should perhaps move it here under XP_WIN?
@@ -355,6 +355,8 @@ Vector<String> PluginDatabase::defaultPluginDirectories()
     paths.append("/usr/lib/netscape/plugins-libc6");
     paths.append("/usr/lib64/netscape/plugins");
     paths.append("/usr/lib64/mozilla/plugins");
+    paths.append("/usr/lib/nsbrowser/plugins");
+    paths.append("/usr/lib64/nsbrowser/plugins");
 
     String mozHome(getenv("MOZILLA_HOME"));
     mozHome.append("/plugins");
@@ -426,6 +428,6 @@ void PluginDatabase::getPluginPathsInDirectories(HashSet<String>& paths) const
     }
 }
 
-#endif // !PLATFORM(WIN_OS)
+#endif // !PLATFORM(SYMBIAN) && !PLATFORM(WIN_OS)
 
 }
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
index 612a9d7e6f..19337f0d44 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
@@ -113,6 +113,7 @@ PluginPackage::PluginPackage(const String& path, const time_t& lastModified)
     m_parentDirectory = m_path.left(m_path.length() - m_fileName.length() - 1);
 }
 
+#if !PLATFORM(SYMBIAN)
 void PluginPackage::unload()
 {
     if (!m_isLoaded)
@@ -125,6 +126,7 @@ void PluginPackage::unload()
 
     unloadWithoutShutdown();
 }
+#endif //!PLATFORM(SYMBIAN)
 
 void PluginPackage::unloadWithoutShutdown()
 {
@@ -183,6 +185,7 @@ void PluginPackage::determineQuirks(const String& mimeType)
 #if PLATFORM(QT)
             m_quirks.add(PluginQuirkRequiresGtkToolKit);
 #endif
+            m_quirks.add(PluginQuirkRequiresDefaultScreenDepth);
         } else {
             // Flash 9 and older requests windowless plugins if we return a mozilla user agent
             m_quirks.add(PluginQuirkWantsMozillaUserAgent);
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h
index 3afc57f9dd..d409ab60b8 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h
@@ -36,6 +36,11 @@
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
 
+#if PLATFORM(SYMBIAN)
+class QPluginLoader;
+class NPInterface;
+#endif
+
 namespace WebCore {
     typedef HashMap<String, String> MIMEToDescriptionsMap;
     typedef HashMap<String, Vector<String> > MIMEToExtensionsMap;
@@ -70,9 +75,17 @@ namespace WebCore {
         int compare(const PluginPackage&) const;
         PluginQuirkSet quirks() const { return m_quirks; }
         const PlatformModuleVersion& version() const { return m_moduleVersion; }
+#if PLATFORM(SYMBIAN)
+        NPInterface* npInterface() const { return m_npInterface; }
+#endif // PLATFORM(SYMBIAN)
 
     private:
         PluginPackage(const String& path, const time_t& lastModified);
+
+#if PLATFORM(SYMBIAN)
+        NPInterface* m_npInterface;
+        QPluginLoader* m_pluginLoader;
+#endif // PLATFORM(SYMBIAN)
         bool fetchInfo();
         bool isPluginBlacklisted();
         void determineQuirks(const String& mimeType);
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginPackageNone.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginPackageNone.cpp
index 487450a35a..b943d88af9 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginPackageNone.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginPackageNone.cpp
@@ -26,52 +26,20 @@
 #include "config.h"
 #include "PluginPackage.h"
 
-#include "CString.h"
-#include "MIMETypeRegistry.h"
-#include "NotImplemented.h"
-#include "npruntime_impl.h"
-#include "PluginDatabase.h"
-#include "PluginDebug.h"
-
 namespace WebCore {
 
 void PluginPackage::determineQuirks(const String&)
 {
-    notImplemented();
 }
 
 bool PluginPackage::fetchInfo()
 {
-    notImplemented();
     return false;
 }
 
 bool PluginPackage::load()
 {
-    notImplemented();
-    return false;
-}
-
-#if !ENABLE(PLUGIN_PACKAGE_SIMPLE_HASH)
-unsigned PluginPackage::hash() const
-{ 
-    notImplemented();
-
-    return 0;
-}
-
-bool PluginPackage::equal(const PluginPackage&, const PluginPackage&)
-{
-    notImplemented();
     return false;
 }
 
-int PluginPackage::compareFileVersion(const PlatformModuleVersion&) const
-{
-    notImplemented();
-    return 0;
-}
-
-#endif
-
 }
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginQuirkSet.h b/src/3rdparty/webkit/WebCore/plugins/PluginQuirkSet.h
index b652c6e328..de29baf8a1 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginQuirkSet.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginQuirkSet.h
@@ -46,6 +46,7 @@ namespace WebCore {
         PluginQuirkDontSetNullWindowHandleOnDestroy = 1 << 10,
         PluginQuirkDontAllowMultipleInstances = 1 << 11,
         PluginQuirkRequiresGtkToolKit = 1 << 12,
+        PluginQuirkRequiresDefaultScreenDepth = 1 << 13
     };
 
     class PluginQuirkSet {
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
index 28572a45cf..8320bc4867 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
@@ -53,6 +53,7 @@
 #include "JSDOMBinding.h"
 #include "ScriptController.h"
 #include "ScriptValue.h"
+#include "SecurityOrigin.h"
 #include "PluginDatabase.h"
 #include "PluginDebug.h"
 #include "PluginMainThreadScheduler.h"
@@ -123,12 +124,12 @@ void PluginView::setFrameRect(const IntRect& rect)
 
     updatePluginWidget();
 
-#if PLATFORM(WIN_OS)
-    // On Windows, always call plugin to change geometry.
+#if PLATFORM(WIN_OS) || PLATFORM(SYMBIAN)
+    // On Windows and Symbian, always call plugin to change geometry.
     setNPWindowRect(rect);
 #elif XP_UNIX
-    // On Unix, only call plugin if it's full-page.
-    if (m_mode == NP_FULL)
+    // On Unix, multiple calls to setNPWindow() in windowed mode causes Flash to crash
+    if (m_mode == NP_FULL || !m_isWindowed)
         setNPWindowRect(rect);
 #endif
 }
@@ -147,6 +148,12 @@ void PluginView::handleEvent(Event* event)
         handleMouseEvent(static_cast<MouseEvent*>(event));
     else if (event->isKeyboardEvent())
         handleKeyboardEvent(static_cast<KeyboardEvent*>(event));
+#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
+    else if (event->type() == eventNames().DOMFocusOutEvent)
+        handleFocusOutEvent();
+    else if (event->type() == eventNames().DOMFocusInEvent)
+        handleFocusInEvent();
+#endif
 }
 
 void PluginView::init()
@@ -234,7 +241,13 @@ bool PluginView::start()
     if (!platformStart())
         m_status = PluginStatusCanNotLoadPlugin;
 
-    return (m_status == PluginStatusLoadedSuccessfully);
+    if (m_status != PluginStatusLoadedSuccessfully)
+        return false;
+
+    if (parentFrame()->page())
+        parentFrame()->page()->didStartPlugin(this);
+
+    return true;
 }
 
 PluginView::~PluginView()
@@ -274,6 +287,9 @@ void PluginView::stop()
     if (!m_isStarted)
         return;
 
+    if (parentFrame()->page())
+        parentFrame()->page()->didStopPlugin(this);
+
     LOG(Plugins, "PluginView::stop(): Stopping plug-in '%s'", m_plugin->name().utf8().data());
 
     HashSet<RefPtr<PluginStream> > streams = m_streams;
@@ -434,7 +450,7 @@ void PluginView::performRequest(PluginRequest* request)
     
     // Executing a script can cause the plugin view to be destroyed, so we keep a reference to the parent frame.
     RefPtr<Frame> parentFrame = m_parentFrame;
-    JSValue result = m_parentFrame->loader()->executeScript(jsString, request->shouldAllowPopups()).jsValue();
+    JSValue result = m_parentFrame->script()->executeScript(jsString, request->shouldAllowPopups()).jsValue();
 
     if (targetFrameName.isNull()) {
         String resultString;
@@ -501,9 +517,8 @@ NPError PluginView::load(const FrameLoadRequest& frameLoadRequest, bool sendNoti
         // For security reasons, only allow JS requests to be made on the frame that contains the plug-in.
         if (!targetFrameName.isNull() && m_parentFrame->tree()->find(targetFrameName) != m_parentFrame)
             return NPERR_INVALID_PARAM;
-    } else if (!FrameLoader::canLoad(url, String(), m_parentFrame->document())) {
+    } else if (!SecurityOrigin::canLoad(url, String(), m_parentFrame->document()))
             return NPERR_GENERIC_ERROR;
-    }
 
     PluginRequest* request = new PluginRequest(frameLoadRequest, sendNotification, notifyData, arePopupsAllowed());
     scheduleRequest(request);
@@ -803,12 +818,18 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     , m_drawingModel(NPDrawingModel(-1))
     , m_eventModel(NPEventModel(-1))
 #endif
-#if defined(Q_WS_X11)
+#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
     , m_hasPendingGeometryChange(false)
+    , m_drawable(0)
+    , m_visual(0)
+    , m_colormap(0)
+    , m_pluginDisplay(0)
 #endif
     , m_loadManually(loadManually)
     , m_manualStream(0)
     , m_isJavaScriptPaused(false)
+    , m_isHalted(false)
+    , m_hasBeenHalted(false)
 {
     if (!m_plugin) {
         m_status = PluginStatusCanNotFindPlugin;
@@ -1214,4 +1235,10 @@ const char* PluginView::userAgentStatic()
 }
 #endif
 
+
+Node* PluginView::node() const
+{
+    return m_element;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginView.h b/src/3rdparty/webkit/WebCore/plugins/PluginView.h
index 54c10652ad..1477561aa8 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginView.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginView.h
@@ -29,6 +29,7 @@
 
 #include "CString.h"
 #include "FrameLoadRequest.h"
+#include "HaltablePlugin.h"
 #include "IntRect.h"
 #include "KURL.h"
 #include "PlatformString.h"
@@ -106,7 +107,7 @@ namespace WebCore {
         virtual void didFail(const ResourceError&) = 0;
     };
 
-    class PluginView : public Widget, private PluginStreamClient, public PluginManualLoader {
+    class PluginView : public Widget, private PluginStreamClient, public PluginManualLoader, private HaltablePlugin {
     public:
         static PassRefPtr<PluginView> create(Frame* parentFrame, const IntSize&, Element*, const KURL&, const Vector<String>& paramNames, const Vector<String>& paramValues, const String& mimeType, bool loadManually);
         virtual ~PluginView();
@@ -193,6 +194,14 @@ namespace WebCore {
         void didFinishLoading();
         void didFail(const ResourceError&);
 
+        // HaltablePlugin
+        virtual void halt();
+        virtual void restart();
+        virtual Node* node() const;
+
+        bool isHalted() const { return m_isHalted; }
+        bool hasBeenHalted() const { return m_hasBeenHalted; }
+
         static bool isCallingPlugin();
 
         bool start();
@@ -249,6 +258,10 @@ namespace WebCore {
 
         void handleKeyboardEvent(KeyboardEvent*);
         void handleMouseEvent(MouseEvent*);
+#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
+        void handleFocusInEvent();
+        void handleFocusOutEvent();
+#endif
 
         int m_mode;
         int m_paramCount;
@@ -295,12 +308,13 @@ public:
         void setPlatformPluginWidget(PlatformPluginWidget widget) { m_window = widget; }
 #else
 public:
+        void setPlatformPluginWidget(PlatformPluginWidget widget) { setPlatformWidget(widget); }
         PlatformPluginWidget platformPluginWidget() const { return platformWidget(); }
 #endif
 
 private:
 
-#if defined(XP_UNIX) || defined(Q_WS_X11)
+#if defined(XP_UNIX) || defined(Q_WS_X11) || PLATFORM(SYMBIAN)
         void setNPWindowIfNeeded();
 #elif defined(XP_MACOSX)
         NP_CGContext m_npCgContext;
@@ -313,8 +327,14 @@ private:
         Point globalMousePosForPlugin() const;
 #endif
 
-#if defined(Q_WS_X11)
+#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
         bool m_hasPendingGeometryChange;
+        Pixmap m_drawable;
+        Visual* m_visual;
+        Colormap m_colormap;
+        Display* m_pluginDisplay;
+
+        void initXEvent(XEvent* event);
 #endif
 
         IntRect m_clipRect; // The clip rect to apply to a windowed plug-in
@@ -325,6 +345,9 @@ private:
 
         bool m_isJavaScriptPaused;
 
+        bool m_isHalted;
+        bool m_hasBeenHalted;
+
         static PluginView* s_currentPluginView;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp
index b694214975..725af82e55 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp
@@ -26,114 +26,98 @@
 #include "config.h"
 #include "PluginView.h"
 
-#include "NotImplemented.h"
-#include "PluginPackage.h"
-
 using namespace WTF;
 
 namespace WebCore {
 
 void PluginView::setFocus()
 {
-    notImplemented();
 }
 
 void PluginView::show()
 {
-    notImplemented();
 }
 
 void PluginView::hide()
 {
-    notImplemented();
 }
 
 void PluginView::paint(GraphicsContext*, const IntRect&)
 {
-    notImplemented();
 }
 
 void PluginView::handleKeyboardEvent(KeyboardEvent*)
 {
-    notImplemented();
 }
 
 void PluginView::handleMouseEvent(MouseEvent*)
 {
-    notImplemented();
 }
 
 void PluginView::setParent(ScrollView*)
 {
-    notImplemented();
 }
 
 void PluginView::setNPWindowRect(const IntRect&)
 {
-    notImplemented();
 }
 
 NPError PluginView::handlePostReadFile(Vector<char>&, uint32, const char*)
 {
-    notImplemented();
-
     return 0;
 }
 
 NPError PluginView::getValue(NPNVariable, void*)
 {
-    notImplemented();
     return 0;
 }
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
 NPError PluginView::getValueStatic(NPNVariable variable, void* value)
 {
-    notImplemented();
     return 0;
 }
 #endif
 
 void PluginView::invalidateRect(NPRect*)
 {
-    notImplemented();
 }
 
 void PluginView::invalidateRect(const IntRect&)
 {
-    notImplemented();
 }
 
 void PluginView::invalidateRegion(NPRegion)
 {
-    notImplemented();
 }
 
 void PluginView::forceRedraw()
 {
-    notImplemented();
 }
 
 bool PluginView::platformStart()
 {
-    notImplemented();
-
     return true;
 }
 
 void PluginView::platformDestroy()
 {
-    notImplemented();
 }
 
 void PluginView::setParentVisible(bool)
 {
-    notImplemented();
 }
 
 void PluginView::updatePluginWidget()
 {
-    notImplemented();
+}
+
+void PluginView::halt()
+{
+}
+
+void PluginView::restart()
+{
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp b/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp
index d242fb8707..325bc4d6cd 100644
--- a/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp
@@ -159,7 +159,8 @@ bool PluginPackage::fetchInfo()
             plist = readPListFile(path.get(), /*createFile*/ true, m_module);
         }
 
-        mimeDict = (CFDictionaryRef)CFDictionaryGetValue(plist.get(), CFSTR("WebPluginMIMETypes"));
+        if (plist)
+            mimeDict = (CFDictionaryRef)CFDictionaryGetValue(plist.get(), CFSTR("WebPluginMIMETypes"));
     }
 
     if (!mimeDict)
diff --git a/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp b/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp
index 226aab698f..6521c84efc 100644
--- a/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp
@@ -174,8 +174,8 @@ bool PluginView::platformStart()
 
 #if PLATFORM(QT)
     if (QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient()) {
-        if (QWidget* window = QWidget::find(client->winId())) {
-            setPlatformPluginWidget(window);
+        if (QWidget* widget = client->ownerWidget()) {
+            setPlatformPluginWidget(widget);
         }
     }
 #endif
@@ -692,6 +692,14 @@ NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const c
     return NPERR_NO_ERROR;
 }
 
+void PluginView::halt()
+{
+}
+
+void PluginView::restart()
+{
+}
+
 } // namespace WebCore
 
 #else
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginContainerQt.cpp b/src/3rdparty/webkit/WebCore/plugins/qt/PluginContainerQt.cpp
index 59ab5bc064..cb894a7bf6 100644
--- a/src/3rdparty/webkit/WebCore/plugins/qt/PluginContainerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginContainerQt.cpp
@@ -73,6 +73,7 @@ PluginContainerQt::PluginContainerQt(PluginView* view, QWidget* parent)
 PluginContainerQt::~PluginContainerQt()
 {
     delete m_clientWrapper;
+    m_pluginView->setPlatformPluginWidget(0);
 }
 
 void PluginContainerQt::on_clientClosed()
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp b/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp
index 7f5a7b9506..811992444c 100644
--- a/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp
@@ -80,6 +80,16 @@ bool PluginPackage::fetchInfo()
     return true;
 }
 
+static NPError staticPluginQuirkRequiresGtkToolKit_NPN_GetValue(NPP instance, NPNVariable variable, void* value)
+{
+    if (variable == NPNVToolkit) {
+        *static_cast<uint32*>(value) = 2;
+        return NPERR_NO_ERROR;
+    }
+
+    return NPN_GetValue(instance, variable, value);
+}
+
 bool PluginPackage::load()
 {
     if (m_isLoaded) {
@@ -111,6 +121,12 @@ bool PluginPackage::load()
 
     initializeBrowserFuncs();
 
+    if (m_path.contains("npwrapper.")) {
+        // nspluginwrapper relies on the toolkit value to know if glib is available
+        // It does so in NP_Initialize with a null instance, therefore it is done this way:
+        m_browserFuncs.getvalue = staticPluginQuirkRequiresGtkToolKit_NPN_GetValue;
+    }
+
 #if defined(XP_UNIX)
     npErr = NP_Initialize(&m_browserFuncs, &m_pluginFuncs);
 #else
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp b/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
index 908e7074c1..28637a11af 100644
--- a/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
+ * Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +31,8 @@
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
+#include "FloatPoint.h"
+#include "FocusController.h"
 #include "Frame.h"
 #include "FrameLoadRequest.h"
 #include "FrameLoader.h"
@@ -57,12 +60,20 @@
 #include "runtime.h"
 #include "runtime_root.h"
 #include "QWebPageClient.h"
+#include <QApplication>
+#include <QDesktopWidget>
 #include <QKeyEvent>
+#include <QPainter>
 #include <QWidget>
 #include <QX11Info>
 #include <runtime/JSLock.h>
 #include <runtime/JSValue.h>
 #include <X11/X.h>
+#ifndef QT_NO_XRENDER
+#define Bool int
+#define Status int
+#include <X11/extensions/Xrender.h>
+#endif
 
 using JSC::ExecState;
 using JSC::Interpreter;
@@ -80,7 +91,7 @@ using namespace HTMLNames;
 
 void PluginView::updatePluginWidget()
 {
-    if (!parent() || !m_isWindowed || !platformPluginWidget())
+    if (!parent())
         return;
 
     ASSERT(parent()->isFrameView());
@@ -96,6 +107,15 @@ void PluginView::updatePluginWidget()
     if (m_windowRect == oldWindowRect && m_clipRect == oldClipRect)
         return;
 
+    if (!m_isWindowed && m_windowRect.size() != oldWindowRect.size()) {
+        if (m_drawable)
+            XFreePixmap(QX11Info::display(), m_drawable);
+
+        m_drawable = XCreatePixmap(QX11Info::display(), QX11Info::appRootWindow(), m_windowRect.width(), m_windowRect.height(), 
+                                   ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth);
+        QApplication::syncX(); // make sure that the server knows about the Drawable
+    }
+
     // do not call setNPWindowIfNeeded immediately, will be called on paint()
     m_hasPendingGeometryChange = true;
 
@@ -150,8 +170,67 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     if (context->paintingDisabled())
         return;
 
-    if (m_isWindowed && platformPluginWidget())
-        setNPWindowIfNeeded();
+    setNPWindowIfNeeded();
+
+    if (m_isWindowed || !m_drawable)
+        return;
+
+    const bool syncX = m_pluginDisplay && m_pluginDisplay != QX11Info::display();
+
+    QPainter* painter = context->platformContext();
+
+    QPixmap qtDrawable = QPixmap::fromX11Pixmap(m_drawable, QPixmap::ExplicitlyShared);
+    const int drawableDepth = ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth;
+    ASSERT(drawableDepth == qtDrawable.depth());
+
+    if (m_isTransparent && drawableDepth != 32) {
+        // Attempt content propagation for drawable with no alpha by copying over from the backing store
+        QPoint offset;
+        QPaintDevice* backingStoreDevice =  QPainter::redirected(painter->device(), &offset);
+        offset = -offset; // negating the offset gives us the offset of the view within the backing store pixmap
+
+        const bool hasValidBackingStore = backingStoreDevice && backingStoreDevice->devType() == QInternal::Pixmap;
+        QPixmap* backingStorePixmap = static_cast<QPixmap*>(backingStoreDevice);
+
+        // We cannot grab contents from the backing store when painting on QGraphicsView items
+        // (because backing store contents are already transformed). What we really mean to do 
+        // here is to check if we are painting on QWebView, but let's be a little permissive :)
+        QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+        const bool backingStoreHasUntransformedContents = client && qobject_cast<QWidget*>(client->pluginParent());
+
+        if (hasValidBackingStore && backingStorePixmap->depth() == drawableDepth 
+            && backingStoreHasUntransformedContents) {
+            GC gc = XDefaultGC(QX11Info::display(), QX11Info::appScreen());
+            XCopyArea(QX11Info::display(), backingStorePixmap->handle(), m_drawable, gc,
+                offset.x() + m_windowRect.x() + m_clipRect.x(), offset.y() + m_windowRect.y() + m_clipRect.y(),
+                m_clipRect.width(), m_clipRect.height(), m_clipRect.x(), m_clipRect.y());
+        } else { // no backing store, clean the pixmap because the plugin thinks its transparent
+            QPainter painter(&qtDrawable);
+            painter.fillRect(m_clipRect, Qt::white);
+        }
+
+        if (syncX)
+            QApplication::syncX();
+    }
+
+    XEvent xevent;
+    memset(&xevent, 0, sizeof(XEvent));
+    XGraphicsExposeEvent& exposeEvent = xevent.xgraphicsexpose;
+    exposeEvent.type = GraphicsExpose;
+    exposeEvent.display = QX11Info::display();
+    exposeEvent.drawable = m_drawable;
+    exposeEvent.x = m_clipRect.x();
+    exposeEvent.y = m_clipRect.y();
+    exposeEvent.width = m_clipRect.x() + m_clipRect.width(); // flash bug? it thinks width is the right
+    exposeEvent.height = m_clipRect.y() + m_clipRect.height(); // flash bug? it thinks height is the bottom
+
+    dispatchNPEvent(xevent);
+
+    if (syncX)
+        XSync(m_pluginDisplay, False); // sync changes by plugin
+
+    painter->drawPixmap(frameRect().x() + m_clipRect.x(), frameRect().y() + m_clipRect.y(), qtDrawable,
+        m_clipRect.x(), m_clipRect.y(), m_clipRect.width(), m_clipRect.height());
 }
 
 // TODO: Unify across ports.
@@ -161,45 +240,55 @@ bool PluginView::dispatchNPEvent(NPEvent& event)
         return false;
 
     PluginView::setCurrentPluginView(this);
-    JSC::JSLock::DropAllLocks dropAllLocks(false);
-
+    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
     setCallingPlugin(true);
-    bool accepted = m_plugin->pluginFuncs();
+    bool accepted = m_plugin->pluginFuncs()->event(m_instance, &event);
     setCallingPlugin(false);
+    PluginView::setCurrentPluginView(0);
 
     return accepted;
 }
 
-void setSharedXEventFields(XEvent& xEvent, QWidget* hostWindow)
+void setSharedXEventFields(XEvent* xEvent, QWidget* ownerWidget)
 {
-    xEvent.xany.serial = 0; // we are unaware of the last request processed by X Server
-    xEvent.xany.send_event = false;
-    xEvent.xany.display = hostWindow->x11Info().display();
-    // NOTE: event.xany.window doesn't always respond to the .window property of other XEvent's
+    xEvent->xany.serial = 0; // we are unaware of the last request processed by X Server
+    xEvent->xany.send_event = false;
+    xEvent->xany.display = QX11Info::display();
+    // NOTE: event->xany.window doesn't always respond to the .window property of other XEvent's
     // but does in the case of KeyPress, KeyRelease, ButtonPress, ButtonRelease, and MotionNotify
     // events; thus, this is right:
-    xEvent.xany.window = hostWindow->window()->handle();
+    xEvent->xany.window = ownerWidget ? ownerWidget->window()->handle() : 0;
 }
 
-void setXKeyEventSpecificFields(XEvent& xEvent, KeyboardEvent* event)
+void PluginView::initXEvent(XEvent* xEvent)
+{
+    memset(xEvent, 0, sizeof(XEvent));
+
+    QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+    QWidget* ownerWidget = client ? client->ownerWidget() : 0;
+    setSharedXEventFields(xEvent, ownerWidget);
+}
+
+void setXKeyEventSpecificFields(XEvent* xEvent, KeyboardEvent* event)
 {
     QKeyEvent* qKeyEvent = event->keyEvent()->qtEvent();
 
-    xEvent.xkey.root = QX11Info::appRootWindow();
-    xEvent.xkey.subwindow = 0; // we have no child window
-    xEvent.xkey.time = event->timeStamp();
-    xEvent.xkey.state = qKeyEvent->nativeModifiers();
-    xEvent.xkey.keycode = qKeyEvent->nativeScanCode();
-    xEvent.xkey.same_screen = true;
+    xEvent->type = (event->type() == eventNames().keydownEvent) ? 2 : 3; // ints as Qt unsets KeyPress and KeyRelease
+    xEvent->xkey.root = QX11Info::appRootWindow();
+    xEvent->xkey.subwindow = 0; // we have no child window
+    xEvent->xkey.time = event->timeStamp();
+    xEvent->xkey.state = qKeyEvent->nativeModifiers();
+    xEvent->xkey.keycode = qKeyEvent->nativeScanCode();
+    xEvent->xkey.same_screen = true;
 
     // NOTE: As the XEvents sent to the plug-in are synthesized and there is not a native window
     // corresponding to the plug-in rectangle, some of the members of the XEvent structures are not
     // set to their normal Xserver values. e.g. Key events don't have a position.
     // source: https://developer.mozilla.org/en/NPEvent
-    xEvent.xkey.x = 0;
-    xEvent.xkey.y = 0;
-    xEvent.xkey.x_root = 0;
-    xEvent.xkey.y_root = 0;
+    xEvent->xkey.x = 0;
+    xEvent->xkey.y = 0;
+    xEvent->xkey.x_root = 0;
+    xEvent->xkey.y_root = 0;
 }
 
 void PluginView::handleKeyboardEvent(KeyboardEvent* event)
@@ -207,25 +296,147 @@ void PluginView::handleKeyboardEvent(KeyboardEvent* event)
     if (m_isWindowed)
         return;
 
-    if (event->type() != "keydown" && event->type() != "keyup")
+    if (event->type() != eventNames().keydownEvent && event->type() != eventNames().keyupEvent)
         return;
 
-    XEvent npEvent; // On UNIX NPEvent is a typedef for XEvent.
-
-    npEvent.type = (event->type() == "keydown") ? 2 : 3; // ints as Qt unsets KeyPress and KeyRelease
-    QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
-    QWidget* window = QWidget::find(client->winId());
-    setSharedXEventFields(npEvent, window);
-    setXKeyEventSpecificFields(npEvent, event);
+    XEvent npEvent;
+    initXEvent(&npEvent);
+    setXKeyEventSpecificFields(&npEvent, event);
 
     if (!dispatchNPEvent(npEvent))
         event->setDefaultHandled();
 }
 
+static unsigned int inputEventState(MouseEvent* event)
+{
+    unsigned int state = 0;
+    if (event->ctrlKey())
+        state |= ControlMask;
+    if (event->shiftKey())
+        state |= ShiftMask;
+    if (event->altKey())
+        state |= Mod1Mask;
+    if (event->metaKey())
+        state |= Mod4Mask;
+    return state;
+}
+
+static void setXButtonEventSpecificFields(XEvent* xEvent, MouseEvent* event, const IntPoint& postZoomPos)
+{
+    XButtonEvent& xbutton = xEvent->xbutton;
+    xbutton.type = event->type() == eventNames().mousedownEvent ? ButtonPress : ButtonRelease;
+    xbutton.root = QX11Info::appRootWindow();
+    xbutton.subwindow = 0;
+    xbutton.time = event->timeStamp();
+    xbutton.x = postZoomPos.x();
+    xbutton.y = postZoomPos.y();
+    xbutton.x_root = event->screenX();
+    xbutton.y_root = event->screenY();
+    xbutton.state = inputEventState(event);
+    switch (event->button()) {
+    case MiddleButton:
+        xbutton.button = Button2;
+        break;
+    case RightButton:
+        xbutton.button = Button3;
+        break;
+    case LeftButton:
+    default:
+        xbutton.button = Button1;
+        break;
+    }
+    xbutton.same_screen = true;
+}
+
+static void setXMotionEventSpecificFields(XEvent* xEvent, MouseEvent* event, const IntPoint& postZoomPos)
+{
+    XMotionEvent& xmotion = xEvent->xmotion;
+    xmotion.type = MotionNotify;
+    xmotion.root = QX11Info::appRootWindow();
+    xmotion.subwindow = 0;
+    xmotion.time = event->timeStamp();
+    xmotion.x = postZoomPos.x();
+    xmotion.y = postZoomPos.y();
+    xmotion.x_root = event->screenX();
+    xmotion.y_root = event->screenY();
+    xmotion.state = inputEventState(event);
+    xmotion.is_hint = NotifyNormal;
+    xmotion.same_screen = true;
+}
+
+static void setXCrossingEventSpecificFields(XEvent* xEvent, MouseEvent* event, const IntPoint& postZoomPos)
+{
+    XCrossingEvent& xcrossing = xEvent->xcrossing;
+    xcrossing.type = event->type() == eventNames().mouseoverEvent ? EnterNotify : LeaveNotify;
+    xcrossing.root = QX11Info::appRootWindow();
+    xcrossing.subwindow = 0;
+    xcrossing.time = event->timeStamp();
+    xcrossing.x = postZoomPos.y();
+    xcrossing.y = postZoomPos.x();
+    xcrossing.x_root = event->screenX();
+    xcrossing.y_root = event->screenY();
+    xcrossing.state = inputEventState(event);
+    xcrossing.mode = NotifyNormal;
+    xcrossing.detail = NotifyDetailNone;
+    xcrossing.same_screen = true;
+    xcrossing.focus = false;
+}
+
 void PluginView::handleMouseEvent(MouseEvent* event)
 {
     if (m_isWindowed)
         return;
+
+    if (event->type() == eventNames().mousedownEvent) {
+        // Give focus to the plugin on click
+        if (Page* page = m_parentFrame->page())
+            page->focusController()->setActive(true);
+
+        focusPluginElement();
+    }
+
+    XEvent npEvent;
+    initXEvent(&npEvent);
+
+    IntPoint postZoomPos = roundedIntPoint(m_element->renderer()->absoluteToLocal(event->absoluteLocation()));
+
+    if (event->type() == eventNames().mousedownEvent || event->type() == eventNames().mouseupEvent)
+        setXButtonEventSpecificFields(&npEvent, event, postZoomPos);
+    else if (event->type() == eventNames().mousemoveEvent)
+        setXMotionEventSpecificFields(&npEvent, event, postZoomPos);
+    else if (event->type() == eventNames().mouseoutEvent || event->type() == eventNames().mouseoverEvent)
+        setXCrossingEventSpecificFields(&npEvent, event, postZoomPos);
+    else
+        return;
+
+    if (!dispatchNPEvent(npEvent))
+        event->setDefaultHandled();
+}
+
+void PluginView::handleFocusInEvent()
+{
+    XEvent npEvent;
+    initXEvent(&npEvent);
+
+    XFocusChangeEvent& event = npEvent.xfocus;
+    event.type = 9; /* int as Qt unsets FocusIn */
+    event.mode = NotifyNormal;
+    event.detail = NotifyDetailNone;
+
+    dispatchNPEvent(npEvent);
+}
+
+void PluginView::handleFocusOutEvent()
+{
+    XEvent npEvent;
+    initXEvent(&npEvent);
+
+    XFocusChangeEvent& event = npEvent.xfocus;
+    event.type = 10; /* int as Qt unsets FocusOut */
+    event.mode = NotifyNormal;
+    event.detail = NotifyDetailNone;
+
+    dispatchNPEvent(npEvent);
 }
 
 void PluginView::setParent(ScrollView* parent)
@@ -238,7 +449,8 @@ void PluginView::setParent(ScrollView* parent)
 
 void PluginView::setNPWindowRect(const IntRect&)
 {
-    // Ignored as we don't want to move immediately.
+    if (!m_isWindowed)
+        setNPWindowIfNeeded();
 }
 
 void PluginView::setNPWindowIfNeeded()
@@ -246,36 +458,53 @@ void PluginView::setNPWindowIfNeeded()
     if (!m_isStarted || !parent() || !m_plugin->pluginFuncs()->setwindow)
         return;
 
+    // If the plugin didn't load sucessfully, no point in calling setwindow
+    if (m_status != PluginStatusLoadedSuccessfully)
+        return;
+
     // On Unix, only call plugin if it's full-page or windowed
     if (m_mode != NP_FULL && m_mode != NP_EMBED)
         return;
 
+    // Check if the platformPluginWidget still exists
+    if (m_isWindowed && !platformPluginWidget())
+        return;
+
     if (!m_hasPendingGeometryChange)
         return;
     m_hasPendingGeometryChange = false;
 
-    ASSERT(platformPluginWidget());
-    platformPluginWidget()->setGeometry(m_windowRect);
-    // if setMask is set with an empty QRegion, no clipping will
-    // be performed, so in that case we hide the plugin view
-    platformPluginWidget()->setVisible(!m_clipRect.isEmpty());
-    platformPluginWidget()->setMask(QRegion(m_clipRect));
+    if (m_isWindowed) {
+        platformPluginWidget()->setGeometry(m_windowRect);
+        // if setMask is set with an empty QRegion, no clipping will
+        // be performed, so in that case we hide the plugin view
+        platformPluginWidget()->setVisible(!m_clipRect.isEmpty());
+        platformPluginWidget()->setMask(QRegion(m_clipRect));
+
+        m_npWindow.x = m_windowRect.x();
+        m_npWindow.y = m_windowRect.y();
+
+        m_npWindow.clipRect.left = m_clipRect.x();
+        m_npWindow.clipRect.top = m_clipRect.y();
+        m_npWindow.clipRect.right = m_clipRect.width();
+        m_npWindow.clipRect.bottom = m_clipRect.height();
+    } else {
+        m_npWindow.x = 0;
+        m_npWindow.y = 0;
+
+        m_npWindow.clipRect.left = 0;
+        m_npWindow.clipRect.top = 0;
+        m_npWindow.clipRect.right = 0;
+        m_npWindow.clipRect.bottom = 0;
+    }
 
     // FLASH WORKAROUND: Only set initially. Multiple calls to
-    // setNPWindow() cause the plugin to crash.
-    if (m_npWindow.width == -1 || m_npWindow.height == -1) {
+    // setNPWindow() cause the plugin to crash in windowed mode.
+    if (!m_isWindowed || m_npWindow.width == -1 || m_npWindow.height == -1) {
         m_npWindow.width = m_windowRect.width();
         m_npWindow.height = m_windowRect.height();
     }
 
-    m_npWindow.x = m_windowRect.x();
-    m_npWindow.y = m_windowRect.y();
-
-    m_npWindow.clipRect.left = m_clipRect.x();
-    m_npWindow.clipRect.top = m_clipRect.y();
-    m_npWindow.clipRect.right = m_clipRect.width();
-    m_npWindow.clipRect.bottom = m_clipRect.height();
-
     PluginView::setCurrentPluginView(this);
     JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
     setCallingPlugin(true);
@@ -340,6 +569,10 @@ NPError PluginView::getValueStatic(NPNVariable variable, void* value)
         *static_cast<NPBool*>(value) = true;
         return NPERR_NO_ERROR;
 
+    case NPNVSupportsWindowless:
+        *static_cast<NPBool*>(value) = true;
+        return NPERR_NO_ERROR;
+
     default:
         return NPERR_GENERIC_ERROR;
     }
@@ -351,13 +584,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 
     switch (variable) {
     case NPNVxDisplay:
-        if (platformPluginWidget())
-            *(void **)value = platformPluginWidget()->x11Info().display();
-        else {
-            QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
-            QWidget* window = QWidget::find(client->winId());
-            *(void **)value = window->x11Info().display();
-        }
+        *(void **)value = QX11Info::display();
         return NPERR_NO_ERROR;
 
     case NPNVxtAppContext:
@@ -402,7 +629,8 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 
     case NPNVnetscapeWindow: {
         void* w = reinterpret_cast<void*>(value);
-        *((XID *)w) = m_parentFrame->view()->hostWindow()->platformPageClient()->winId();
+        QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+        *((XID *)w) = client ? client->ownerWidget()->winId() : 0;
         return NPERR_NO_ERROR;
     }
 
@@ -419,7 +647,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 
 void PluginView::invalidateRect(const IntRect& rect)
 {
-    if (platformWidget()) {
+    if (m_isWindowed) {
         platformWidget()->update(rect);
         return;
     }
@@ -429,17 +657,88 @@ void PluginView::invalidateRect(const IntRect& rect)
 
 void PluginView::invalidateRect(NPRect* rect)
 {
-    notImplemented();
+    if (!rect) {
+        invalidate();
+        return;
+    }
+    IntRect r(rect->left, rect->top, rect->right + rect->left, rect->bottom + rect->top);
+    invalidateWindowlessPluginRect(r);
 }
 
 void PluginView::invalidateRegion(NPRegion region)
 {
-    notImplemented();
+    invalidate();
 }
 
 void PluginView::forceRedraw()
 {
-    notImplemented();
+    invalidate();
+}
+
+static Display *getPluginDisplay()
+{
+    // The plugin toolkit might run using a different X connection. At the moment, we only
+    // support gdk based plugins (like flash) that use a different X connection.
+    // The code below has the same effect as this one:
+    // Display *gdkDisplay = gdk_x11_display_get_xdisplay(gdk_display_get_default());
+    QLibrary library("libgdk-x11-2.0");
+    if (!library.load())
+        return 0;
+
+    typedef void *(*gdk_display_get_default_ptr)();
+    gdk_display_get_default_ptr gdk_display_get_default = (gdk_display_get_default_ptr)library.resolve("gdk_display_get_default");
+    if (!gdk_display_get_default)
+        return 0;
+
+    typedef void *(*gdk_x11_display_get_xdisplay_ptr)(void *);
+    gdk_x11_display_get_xdisplay_ptr gdk_x11_display_get_xdisplay = (gdk_x11_display_get_xdisplay_ptr)library.resolve("gdk_x11_display_get_xdisplay");
+    if (!gdk_x11_display_get_xdisplay)
+        return 0;
+
+    return (Display*)gdk_x11_display_get_xdisplay(gdk_display_get_default());
+}
+
+static void getVisualAndColormap(int depth, Visual **visual, Colormap *colormap)
+{
+    *visual = 0;
+    *colormap = 0;
+
+#ifndef QT_NO_XRENDER
+    static const bool useXRender = qgetenv("QT_X11_NO_XRENDER").isNull(); // Should also check for XRender >= 0.5
+#else
+    static const bool useXRender = false;
+#endif
+
+    if (!useXRender && depth == 32)
+        return;
+
+    int nvi;
+    XVisualInfo templ;
+    templ.screen  = QX11Info::appScreen();
+    templ.depth   = depth;
+    templ.c_class = TrueColor;
+    XVisualInfo* xvi = XGetVisualInfo(QX11Info::display(), VisualScreenMask | VisualDepthMask | VisualClassMask, &templ, &nvi);
+
+    if (!xvi)
+        return;
+
+#ifndef QT_NO_XRENDER
+    if (depth == 32) {
+        for (int idx = 0; idx < nvi; ++idx) {
+            XRenderPictFormat* format = XRenderFindVisualFormat(QX11Info::display(), xvi[idx].visual);
+            if (format->type == PictTypeDirect && format->direct.alphaMask) {
+                 *visual = xvi[idx].visual;
+                 break;
+            }
+         }
+    } else
+#endif // QT_NO_XRENDER
+        *visual = xvi[0].visual;
+
+    XFree(xvi);
+
+    if (*visual)
+        *colormap = XCreateColormap(QX11Info::display(), QX11Info::appRootWindow(), *visual, AllocNone);
 }
 
 bool PluginView::platformStart()
@@ -456,30 +755,65 @@ bool PluginView::platformStart()
         PluginView::setCurrentPluginView(0);
     }
 
-    if (m_needsXEmbed) {
+    if (m_isWindowed) {
         QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
-        setPlatformWidget(new PluginContainerQt(this, QWidget::find(client->winId())));
+        if (m_needsXEmbed && client) {
+            setPlatformWidget(new PluginContainerQt(this, client->ownerWidget()));
+            // sync our XEmbed container window creation before sending the xid to plugins.
+            QApplication::syncX();
+        } else {
+            notImplemented();
+            m_status = PluginStatusCanNotLoadPlugin;
+            return false;
+        }
     } else {
-        notImplemented();
-        return false;
+        setPlatformWidget(0);
+        m_pluginDisplay = getPluginDisplay();
     }
 
     show();
 
-    NPSetWindowCallbackStruct *wsi = new NPSetWindowCallbackStruct();
-
+    NPSetWindowCallbackStruct* wsi = new NPSetWindowCallbackStruct();
     wsi->type = 0;
 
-    wsi->display = platformPluginWidget()->x11Info().display();
-    wsi->visual = (Visual*)platformPluginWidget()->x11Info().visual();
-    wsi->depth = platformPluginWidget()->x11Info().depth();
-    wsi->colormap = platformPluginWidget()->x11Info().colormap();
-    m_npWindow.ws_info = wsi;
+    if (m_isWindowed) {
+        const QX11Info* x11Info = &platformPluginWidget()->x11Info();
+
+        wsi->display = x11Info->display();
+        wsi->visual = (Visual*)x11Info->visual();
+        wsi->depth = x11Info->depth();
+        wsi->colormap = x11Info->colormap();
+
+        m_npWindow.type = NPWindowTypeWindow;
+        m_npWindow.window = (void*)platformPluginWidget()->winId();
+        m_npWindow.width = -1;
+        m_npWindow.height = -1;
+    } else {
+        const QX11Info* x11Info = &QApplication::desktop()->x11Info();
+
+        if (x11Info->depth() == 32 || !m_plugin->quirks().contains(PluginQuirkRequiresDefaultScreenDepth)) {
+            getVisualAndColormap(32, &m_visual, &m_colormap);
+            wsi->depth = 32;
+        }
+
+        if (!m_visual) {
+            getVisualAndColormap(x11Info->depth(), &m_visual, &m_colormap);
+            wsi->depth = x11Info->depth();
+        }
+
+        wsi->display = x11Info->display();
+        wsi->visual = m_visual;
+        wsi->colormap = m_colormap;
 
-    m_npWindow.type = NPWindowTypeWindow;
-    m_npWindow.window = (void*)platformPluginWidget()->winId();
-    m_npWindow.width = -1;
-    m_npWindow.height = -1;
+        m_npWindow.type = NPWindowTypeDrawable;
+        m_npWindow.window = 0; // Not used?
+        m_npWindow.x = 0;
+        m_npWindow.y = 0;
+        m_npWindow.width = -1;
+        m_npWindow.height = -1;
+    }
+
+    m_npWindow.ws_info = wsi;
 
     if (!(m_plugin->quirks().contains(PluginQuirkDeferFirstSetWindowCall))) {
         updatePluginWidget();
@@ -493,6 +827,20 @@ void PluginView::platformDestroy()
 {
     if (platformPluginWidget())
         delete platformPluginWidget();
+
+    if (m_drawable)
+        XFreePixmap(QX11Info::display(), m_drawable);
+
+    if (m_colormap)
+        XFreeColormap(QX11Info::display(), m_colormap);
+}
+
+void PluginView::halt()
+{
+}
+
+void PluginView::restart()
+{
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.cpp b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.cpp
new file mode 100644
index 0000000000..aece0e48b4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.cpp
@@ -0,0 +1,77 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "PluginContainerSymbian.h"
+
+#include "FocusController.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "Page.h"
+#include "PlatformKeyboardEvent.h"
+#include "PluginView.h"
+
+#include <QApplication>
+#include <QWidget>
+
+using namespace WebCore;
+
+PluginContainerSymbian::PluginContainerSymbian(PluginView* view, QWidget* parent)
+    : m_parent(parent)
+    , m_pluginView(view)
+    , m_hasPendingGeometryChange(false)
+{
+    setParent(m_parent);
+}
+
+PluginContainerSymbian::~PluginContainerSymbian()
+{
+}
+
+void PluginContainerSymbian::requestGeometry(const QRect& rect, const QRegion& clip)
+{
+    if (m_windowRect != rect || m_clipRegion != clip) {
+        m_windowRect = rect;
+        m_clipRegion = clip;
+        m_hasPendingGeometryChange = true;
+    }
+}
+
+void PluginContainerSymbian::adjustGeometry()
+{
+    if (m_hasPendingGeometryChange) {
+        setGeometry(m_windowRect);
+        setMask(m_clipRegion);
+        m_hasPendingGeometryChange = false;
+    }
+}
+
+void PluginContainerSymbian::focusInEvent(QFocusEvent* event)
+{
+    if (Page* page = m_pluginView->parentFrame()->page())
+        page->focusController()->setActive(true);
+
+    m_pluginView->focusPluginElement();
+}
+
+void PluginContainerSymbian::focusOutEvent(QFocusEvent*)
+{
+    if (Page* page = m_pluginView->parentFrame()->page())
+        page->focusController()->setActive(false);
+}
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.h b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.h
new file mode 100644
index 0000000000..fce4a7160a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.h
@@ -0,0 +1,50 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef PluginContainerSymbian_h
+#define PluginContainerSymbian_h
+
+#include <QWidget>
+
+namespace WebCore {
+
+    class PluginView;
+
+    class PluginContainerSymbian : public QWidget {
+        Q_OBJECT
+    public:
+        PluginContainerSymbian(PluginView*, QWidget* parent);
+        ~PluginContainerSymbian();
+
+        void requestGeometry(const QRect&, const QRegion& clip = QRegion());
+        void adjustGeometry();
+
+    protected:
+        virtual void focusInEvent(QFocusEvent*);
+        virtual void focusOutEvent(QFocusEvent*);
+    private:
+        PluginView* m_pluginView;
+        QWidget* m_parent;
+        QRect m_windowRect;
+        QRegion m_clipRegion;
+        bool m_hasPendingGeometryChange;
+    };
+}
+
+#endif // PluginContainerSymbian_h
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginDatabaseSymbian.cpp b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginDatabaseSymbian.cpp
new file mode 100644
index 0000000000..2e092966eb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginDatabaseSymbian.cpp
@@ -0,0 +1,79 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#include "config.h"
+#include "PluginDatabase.h"
+
+#include <QFileInfo>
+#include <f32file.h>
+
+static const char QTPLUGIN_FILTER[] = "*.qtplugin";
+static const char QT_PLUGIN_FOLDER[] = ":\\resource\\qt\\plugins\\npqtplugins\\";
+
+namespace WebCore {
+
+Vector<String> PluginDatabase::defaultPluginDirectories()
+{
+    Vector<String> directories;
+    //find the installation drive
+    TDriveList drivelist;
+    TChar driveLetter;
+    RFs fsSession;
+    
+    if (fsSession.Connect() == KErrNone && fsSession.DriveList(drivelist) == KErrNone) {
+        for (TInt driveNumber = EDriveA; driveNumber <= EDriveZ; driveNumber++) {
+            if (drivelist[driveNumber] && fsSession.DriveToChar(driveNumber, driveLetter) == KErrNone) {
+                QString driveStringValue(QChar((uint)driveLetter.GetUpperCase()));
+                QString stubDirPath;
+                stubDirPath.append(driveStringValue);
+                stubDirPath.append(QT_PLUGIN_FOLDER);
+                if (QFileInfo(stubDirPath).exists())
+                    directories.append(stubDirPath);
+            }
+        }
+    }
+
+    fsSession.Close();
+    return directories;
+}
+
+bool PluginDatabase::isPreferredPluginDirectory(const String& path)
+{
+    return true;
+}
+
+void PluginDatabase::getPluginPathsInDirectories(HashSet<String>& paths) const
+{
+    // FIXME: This should be a case insensitive set.
+    HashSet<String> uniqueFilenames;
+
+    String fileNameFilter(QTPLUGIN_FILTER);
+
+    Vector<String>::const_iterator dirsEnd = m_pluginDirectories.end();
+    for (Vector<String>::const_iterator dIt = m_pluginDirectories.begin(); dIt != dirsEnd; ++dIt) {
+        Vector<String> pluginPaths = listDirectory(*dIt, fileNameFilter);
+        Vector<String>::const_iterator pluginsEnd = pluginPaths.end();
+        for (Vector<String>::const_iterator pIt = pluginPaths.begin(); pIt != pluginsEnd; ++pIt) {
+            if (!fileExists(*pIt))
+                continue;
+            paths.add(*pIt);
+        }
+    }
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginPackageSymbian.cpp b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginPackageSymbian.cpp
new file mode 100644
index 0000000000..d5c7533f63
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginPackageSymbian.cpp
@@ -0,0 +1,177 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#include "config.h"
+#include "PluginPackage.h"
+
+#include "CString.h"
+#include "MIMETypeRegistry.h"
+#include "npinterface.h"
+#include "npruntime_impl.h"
+#include "PluginDatabase.h"
+#include "PluginDebug.h"
+#include <QPluginLoader>
+
+namespace WebCore {
+
+bool PluginPackage::fetchInfo()
+{
+    if (!load())
+        return false;
+
+    char* buf = 0;
+    NPError err = m_pluginFuncs.getvalue(0, NPPVpluginNameString, (void *)&buf);
+    m_name = buf;
+    err = m_pluginFuncs.getvalue(0, NPPVpluginDescriptionString, (void *)&buf);
+    m_description = buf;
+
+    determineModuleVersionFromDescription();
+
+    String s = m_npInterface->NP_GetMIMEDescription();
+    Vector<String> types;
+    s.split(UChar('|'), false, types);  // <MIME1>;<ext1,ext2,ext3,...>;<Description>|<MIME2>|<MIME3>|...
+
+    for (int i = 0; i < types.size(); ++i) {
+        Vector<String> mime;
+        types[i].split(UChar(';'), true, mime);  // <MIME1>;<ext1,ext2,ext3,...>;<Description>
+        if (mime.size() > 0) {
+            Vector<String> exts;
+            if (mime.size() > 1)
+                mime[1].split(UChar(','), false, exts); // <ext1,ext2,ext3,...>
+            
+            m_mimeToExtensions.add(mime[0], exts); // <MIME>,<ext1,ext2,ext3>
+            if (mime.size() > 2)
+                m_mimeToDescriptions.add(mime[0], mime[2]); // <MIME>,<Description>
+        }
+    }
+    unload();
+    return true;
+}
+
+bool PluginPackage::load()
+{
+    if (m_isLoaded) {
+        m_loadCount++;
+        return true;
+    }
+
+    m_pluginLoader = new QPluginLoader(m_path);
+    if (!m_pluginLoader->load()) {
+        delete m_pluginLoader;
+        m_pluginLoader = 0;
+        return false;
+    }
+
+    QObject* plugin = m_pluginLoader->instance();
+    if (!plugin) {
+        m_pluginLoader->unload();
+        delete m_pluginLoader;
+        m_pluginLoader = 0;
+        return false;
+    }
+
+    // Plugin instance created
+    // Cast plugin to NPInterface,
+    m_npInterface = qobject_cast<NPInterface*>(plugin);
+    if (!m_npInterface) {
+        m_pluginLoader->unload();
+        delete m_pluginLoader;
+        m_pluginLoader = 0;
+        return false;
+    }
+
+    m_isLoaded = true;
+    
+    NPError npErr;
+    memset(&m_pluginFuncs, 0, sizeof(m_pluginFuncs));
+    m_pluginFuncs.size = sizeof(m_pluginFuncs);
+    m_browserFuncs.size = sizeof(m_browserFuncs);
+    m_browserFuncs.version = NP_VERSION_MINOR;
+    m_browserFuncs.geturl = NPN_GetURL;
+    m_browserFuncs.posturl = NPN_PostURL;
+    m_browserFuncs.requestread = NPN_RequestRead;
+    m_browserFuncs.newstream = NPN_NewStream;
+    m_browserFuncs.write = NPN_Write;
+    m_browserFuncs.destroystream = NPN_DestroyStream;
+    m_browserFuncs.status = NPN_Status;
+    m_browserFuncs.uagent = NPN_UserAgent;
+    m_browserFuncs.memalloc = NPN_MemAlloc;
+    m_browserFuncs.memfree = NPN_MemFree;
+    m_browserFuncs.memflush = NPN_MemFlush;
+    m_browserFuncs.reloadplugins = NPN_ReloadPlugins;
+    m_browserFuncs.geturlnotify = NPN_GetURLNotify;
+    m_browserFuncs.posturlnotify = NPN_PostURLNotify;
+    m_browserFuncs.getvalue = NPN_GetValue;
+    m_browserFuncs.setvalue = NPN_SetValue;
+    m_browserFuncs.invalidaterect = NPN_InvalidateRect;
+    m_browserFuncs.invalidateregion = NPN_InvalidateRegion;
+    m_browserFuncs.forceredraw = NPN_ForceRedraw;
+    m_browserFuncs.getJavaEnv = NPN_GetJavaEnv;
+    m_browserFuncs.getJavaPeer = NPN_GetJavaPeer;
+    m_browserFuncs.pushpopupsenabledstate = NPN_PushPopupsEnabledState;
+    m_browserFuncs.poppopupsenabledstate = NPN_PopPopupsEnabledState;
+    m_browserFuncs.releasevariantvalue = _NPN_ReleaseVariantValue;
+    m_browserFuncs.getstringidentifier = _NPN_GetStringIdentifier;
+    m_browserFuncs.getstringidentifiers = _NPN_GetStringIdentifiers;
+    m_browserFuncs.getintidentifier = _NPN_GetIntIdentifier;
+    m_browserFuncs.identifierisstring = _NPN_IdentifierIsString;
+    m_browserFuncs.utf8fromidentifier = _NPN_UTF8FromIdentifier;
+    m_browserFuncs.createobject = _NPN_CreateObject;
+    m_browserFuncs.retainobject = _NPN_RetainObject;
+    m_browserFuncs.releaseobject = _NPN_ReleaseObject;
+    m_browserFuncs.invoke = _NPN_Invoke;
+    m_browserFuncs.invokeDefault = _NPN_InvokeDefault;
+    m_browserFuncs.evaluate = _NPN_Evaluate;
+    m_browserFuncs.getproperty = _NPN_GetProperty;
+    m_browserFuncs.setproperty = _NPN_SetProperty;
+    m_browserFuncs.removeproperty = _NPN_RemoveProperty;
+    m_browserFuncs.hasproperty = _NPN_HasMethod;
+    m_browserFuncs.hasmethod = _NPN_HasProperty;
+    m_browserFuncs.setexception = _NPN_SetException;
+    m_browserFuncs.enumerate = _NPN_Enumerate;
+    m_browserFuncs.construct = _NPN_Construct;
+
+    npErr = m_npInterface->NP_Initialize(&m_browserFuncs, &m_pluginFuncs);
+    if (npErr != NPERR_NO_ERROR) {
+        m_pluginLoader->unload();
+        delete m_pluginLoader;
+        m_pluginLoader = 0;
+        return false;
+    }
+
+    m_loadCount++;
+    return true;
+}
+
+void PluginPackage::unload()
+{
+    if (!m_isLoaded)
+        return;
+
+    if (--m_loadCount > 0)
+        return;
+        
+    m_isLoaded = false;
+    m_npInterface->NP_Shutdown();
+
+    m_pluginLoader->unload();
+    delete m_pluginLoader;
+    m_pluginLoader = 0;
+}
+}
+
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginViewSymbian.cpp b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginViewSymbian.cpp
new file mode 100644
index 0000000000..14e25b1d1c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginViewSymbian.cpp
@@ -0,0 +1,462 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#include "config.h"
+#include "PluginView.h"
+
+#include "Document.h"
+#include "DocumentLoader.h"
+#include "Element.h"
+#include "FocusController.h"
+#include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "FrameLoader.h"
+#include "FrameTree.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "HTMLNames.h"
+#include "HTMLPlugInElement.h"
+#include "Image.h"
+#include "JSDOMBinding.h"
+#include "KeyboardEvent.h"
+#include "MouseEvent.h"
+#include "NotImplemented.h"
+#include "npfunctions.h"
+#include "npinterface.h"
+#include "Page.h"
+#include "PlatformKeyboardEvent.h"
+#include "PlatformMouseEvent.h"
+#include "PluginContainerSymbian.h"
+#include "PluginDebug.h"
+#include "PluginMainThreadScheduler.h"
+#include "PluginPackage.h"
+#include "RenderLayer.h"
+#include "ScriptController.h"
+#include "Settings.h"
+#include "npruntime_impl.h"
+#include "runtime.h"
+#include "runtime_root.h"
+#include "QWebPageClient.h"
+#include <QKeyEvent>
+#include <QPixmap.h>
+#include <QRegion>
+#include <QVector>
+#include <QWidget>
+#include <runtime/JSLock.h>
+#include <runtime/JSValue.h>
+
+using JSC::ExecState;
+using JSC::Interpreter;
+using JSC::JSLock;
+using JSC::JSObject;
+using JSC::UString;
+
+using namespace std;
+
+using namespace WTF;
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+void PluginView::updatePluginWidget()
+{
+    if (!parent())
+        return;
+    ASSERT(parent()->isFrameView());
+    FrameView* frameView = static_cast<FrameView*>(parent());
+    IntRect oldWindowRect = m_windowRect;
+    IntRect oldClipRect = m_clipRect;
+    
+    m_windowRect = IntRect(frameView->contentsToWindow(frameRect().location()), frameRect().size());
+    m_clipRect = windowClipRect();
+    m_clipRect.move(-m_windowRect.x(), -m_windowRect.y());
+    if (m_windowRect == oldWindowRect && m_clipRect == oldClipRect)
+        return;
+
+    // in order to move/resize the plugin window at the same time as the rest of frame
+    // during e.g. scrolling, we set the mask and geometry in the paint() function, but
+    // as paint() isn't called when the plugin window is outside the frame which can
+    // be caused by a scroll, we need to move/resize immediately.
+    if (!m_windowRect.intersects(frameView->frameRect()))
+        setNPWindowIfNeeded();
+}
+
+void PluginView::setFocus()
+{
+    if (platformPluginWidget())
+        platformPluginWidget()->setFocus(Qt::OtherFocusReason);
+    else
+        Widget::setFocus();
+}
+
+void PluginView::show()
+{
+    setSelfVisible(true);
+
+    if (isParentVisible() && platformPluginWidget())
+        platformPluginWidget()->setVisible(true);
+}
+
+void PluginView::hide()
+{
+    setSelfVisible(false);
+
+    if (isParentVisible() && platformPluginWidget())
+        platformPluginWidget()->setVisible(false);
+}
+
+void PluginView::paint(GraphicsContext* context, const IntRect& rect)
+{
+    if (!m_isStarted) {
+        paintMissingPluginIcon(context, rect);
+        return;
+    }
+    
+    if (context->paintingDisabled())
+        return;
+    m_npWindow.ws_info = (void*)(context->platformContext());
+    setNPWindowIfNeeded();
+
+    if (m_isWindowed && platformPluginWidget())
+        static_cast<PluginContainerSymbian*>(platformPluginWidget())->adjustGeometry();
+
+    if (m_isWindowed)
+        return;
+
+    context->save();
+    IntRect clipRect(rect);
+    clipRect.intersect(frameRect());
+    context->clip(clipRect);
+    context->translate(frameRect().location().x(), frameRect().location().y());
+
+    QPaintEvent ev(rect);
+    QEvent& npEvent = ev;
+    dispatchNPEvent(npEvent);
+
+    context->restore();
+}
+
+// TODO: Unify across ports.
+bool PluginView::dispatchNPEvent(NPEvent& event)
+{
+    if (!m_plugin->pluginFuncs()->event)
+        return false;
+
+    PluginView::setCurrentPluginView(this);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+
+    setCallingPlugin(true);
+    bool accepted = m_plugin->pluginFuncs()->event(m_instance, &event);
+    setCallingPlugin(false);
+    PluginView::setCurrentPluginView(0);
+
+    return accepted;
+}
+
+void PluginView::handleKeyboardEvent(KeyboardEvent* event)
+{
+    if (m_isWindowed)
+        return;
+
+    QEvent& npEvent = *(event->keyEvent()->qtEvent());
+    if (!dispatchNPEvent(npEvent))
+        event->setDefaultHandled();
+}
+
+void PluginView::handleMouseEvent(MouseEvent* event)
+{
+    if (m_isWindowed)
+        return;
+
+    if (event->type() == eventNames().mousedownEvent) {
+        // Give focus to the plugin on click
+        if (Page* page = m_parentFrame->page())
+            page->focusController()->setActive(true);
+
+        focusPluginElement();
+    }
+
+    QEvent::Type type;
+    if (event->type() == eventNames().mousedownEvent)
+        type = QEvent::MouseButtonPress;
+    else if (event->type() == eventNames().mousemoveEvent)
+        type = QEvent::MouseMove;
+    else if (event->type() == eventNames().mouseupEvent)
+        type = QEvent::MouseButtonRelease;
+    else
+        return;
+
+    QPoint position(event->offsetX(), event->offsetY());
+    Qt::MouseButton button;
+    switch (event->which()) {
+    case 1:
+        button = Qt::LeftButton;
+        break;
+    case 2:
+        button = Qt::MidButton;
+        break;
+    case 3:
+        button = Qt::RightButton;
+        break;
+    default:
+        button = Qt::NoButton;
+    }
+    Qt::KeyboardModifiers modifiers = 0;
+    if (event->ctrlKey())
+        modifiers |= Qt::ControlModifier;
+    if (event->altKey())
+        modifiers |= Qt::AltModifier;
+    if (event->shiftKey())
+        modifiers |= Qt::ShiftModifier;
+    if (event->metaKey())
+        modifiers |= Qt::MetaModifier;
+    QMouseEvent mouseEvent(type, position, button, button, modifiers); 
+    QEvent& npEvent = mouseEvent;
+    if (!dispatchNPEvent(npEvent))
+        event->setDefaultHandled();
+}
+
+void PluginView::setParent(ScrollView* parent)
+{
+    Widget::setParent(parent);
+
+    if (parent)
+        init();
+}
+
+void PluginView::setNPWindowRect(const IntRect&)
+{
+    if (!m_isWindowed)
+        setNPWindowIfNeeded();
+}
+
+void PluginView::setNPWindowIfNeeded()
+{
+    if (!m_isStarted || !parent() || !m_plugin->pluginFuncs()->setwindow)
+        return;
+    if (m_isWindowed) {
+        ASSERT(platformPluginWidget());
+        platformPluginWidget()->setGeometry(m_windowRect);
+        // if setMask is set with an empty QRegion, no clipping will
+        // be performed, so in that case we hide the plugin view
+        platformPluginWidget()->setVisible(!m_clipRect.isEmpty());
+        platformPluginWidget()->setMask(QRegion(m_clipRect));
+
+        m_npWindow.x = m_windowRect.x();
+        m_npWindow.y = m_windowRect.y();
+
+        m_npWindow.clipRect.left = m_clipRect.x();
+        m_npWindow.clipRect.top = m_clipRect.y();
+        m_npWindow.clipRect.right = m_clipRect.width();
+        m_npWindow.clipRect.bottom = m_clipRect.height();
+    
+    } else {
+        // always call this method before painting.
+        m_npWindow.x = 0;
+        m_npWindow.y = 0;
+    
+        m_npWindow.clipRect.left = 0;
+        m_npWindow.clipRect.top = 0;
+        m_npWindow.clipRect.right = m_windowRect.width();
+        m_npWindow.clipRect.bottom = m_windowRect.height();
+        m_npWindow.window = 0;
+    }
+
+    m_npWindow.width = m_windowRect.width();
+    m_npWindow.height = m_windowRect.height();
+    if (m_npWindow.x < 0 || m_npWindow.y < 0 || m_npWindow.width <= 0 || m_npWindow.height <= 0)
+        return;
+    
+    PluginView::setCurrentPluginView(this);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    setCallingPlugin(true);
+    m_plugin->pluginFuncs()->setwindow(m_instance, &m_npWindow);
+    setCallingPlugin(false);
+    PluginView::setCurrentPluginView(0);
+}
+
+void PluginView::setParentVisible(bool visible)
+{
+    if (isParentVisible() == visible)
+        return;
+
+    Widget::setParentVisible(visible);
+
+    if (isSelfVisible() && platformPluginWidget())
+        platformPluginWidget()->setVisible(visible);
+}
+
+NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const char* buf)
+{
+    notImplemented();
+    return NPERR_NO_ERROR;
+}
+
+NPError PluginView::getValueStatic(NPNVariable variable, void* value)
+{
+    LOG(Plugins, "PluginView::getValueStatic(%s)", prettyNameForNPNVariable(variable).data());
+
+    switch (variable) {
+    case NPNVjavascriptEnabledBool:
+        *static_cast<NPBool*>(value) = true;
+        return NPERR_NO_ERROR;
+
+    case NPNVSupportsWindowless:
+        *static_cast<NPBool*>(value) = true;
+        return NPERR_NO_ERROR;
+
+    default:
+        return NPERR_GENERIC_ERROR;
+    }
+}
+
+NPError PluginView::getValue(NPNVariable variable, void* value)
+{
+    LOG(Plugins, "PluginView::getValue(%s)", prettyNameForNPNVariable(variable).data());
+
+    switch (variable) {
+    case NPNVWindowNPObject: {
+        if (m_isJavaScriptPaused)
+            return NPERR_GENERIC_ERROR;
+
+        NPObject* windowScriptObject = m_parentFrame->script()->windowScriptNPObject();
+
+        // Return value is expected to be retained, as described here: <http://www.mozilla.org/projects/plugin/npruntime.html>
+        if (windowScriptObject)
+            _NPN_RetainObject(windowScriptObject);
+
+        void** v = (void**)value;
+        *v = windowScriptObject;
+            
+        return NPERR_NO_ERROR;
+    }
+
+    case NPNVPluginElementNPObject: {
+        if (m_isJavaScriptPaused)
+            return NPERR_GENERIC_ERROR;
+
+        NPObject* pluginScriptObject = 0;
+
+        if (m_element->hasTagName(appletTag) || m_element->hasTagName(embedTag) || m_element->hasTagName(objectTag))
+            pluginScriptObject = static_cast<HTMLPlugInElement*>(m_element)->getNPObject();
+
+        // Return value is expected to be retained, as described here: <http://www.mozilla.org/projects/plugin/npruntime.html>
+        if (pluginScriptObject)
+            _NPN_RetainObject(pluginScriptObject);
+
+        void** v = (void**)value;
+        *v = pluginScriptObject;
+
+        return NPERR_NO_ERROR;
+    }        
+    default:
+        return getValueStatic(variable, value);
+    }
+}
+
+void PluginView::invalidateRect(const IntRect& rect)
+{
+    if (m_isWindowed) {
+        platformWidget()->update(rect);
+        return;
+    }
+    
+    invalidateWindowlessPluginRect(rect);
+}
+    
+void PluginView::invalidateRect(NPRect* rect)
+{
+    if (m_isWindowed)
+        return;
+    if (!rect) {
+        invalidate();
+        return;
+    }
+    IntRect r(rect->left, rect->top, rect->right - rect->left, rect->bottom - rect->top);
+    m_invalidRects.append(r);
+    if (!m_invalidateTimer.isActive())
+        m_invalidateTimer.startOneShot(0.001);
+}
+
+void PluginView::invalidateRegion(NPRegion region)
+{
+    if (m_isWindowed)
+        return;
+    
+    if (!region) 
+        return;
+    
+    QVector<QRect> rects = region->rects();
+    for (int i = 0; i < rects.size(); ++i) {
+        const QRect& qRect = rects.at(i);
+        m_invalidRects.append(qRect);
+        if (!m_invalidateTimer.isActive())
+            m_invalidateTimer.startOneShot(0.001);
+    }
+}
+
+void PluginView::forceRedraw()
+{
+    if (m_isWindowed)
+        return;
+    invalidate();
+}
+
+bool PluginView::platformStart()
+{
+    ASSERT(m_isStarted);
+    ASSERT(m_status == PluginStatusLoadedSuccessfully);
+    
+    show();
+
+    if (m_isWindowed) {
+        QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+        // FIXME this will not work for QGraphicsView.
+        // But we cannot use winId because it will create a window and on S60,
+        // QWidgets should not create a window. 
+        Q_ASSERT(qobject_cast<QWidget*>(client->pluginParent()));
+        setPlatformWidget(new PluginContainerSymbian(this, 
+            qobject_cast<QWidget*>(client->pluginParent())));
+        m_npWindow.type = NPWindowTypeWindow;
+        m_npWindow.window = (void*)platformPluginWidget();
+
+    } else {
+        setPlatformWidget(0);
+        m_npWindow.type = NPWindowTypeDrawable;
+        m_npWindow.window = 0; // Not used?
+    }    
+    setNPWindowIfNeeded();
+    
+    return true;
+}
+
+void PluginView::platformDestroy()
+{
+    delete platformPluginWidget();
+}
+
+void PluginView::halt()
+{
+}
+
+void PluginView::restart()
+{
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/npinterface.h b/src/3rdparty/webkit/WebCore/plugins/symbian/npinterface.h
new file mode 100644
index 0000000000..0f0b6ca220
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/npinterface.h
@@ -0,0 +1,37 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#ifndef npinterface_H
+#define npinterface_H
+
+#include "npfunctions.h"
+#include <QtPlugin>
+
+class NPInterface {
+public:
+    virtual NPError NP_Initialize(NPNetscapeFuncs* aNPNFuncs, NPPluginFuncs* aNPPFuncs) = 0;
+    virtual void NP_Shutdown() = 0;
+    virtual char* NP_GetMIMEDescription() = 0;
+};
+
+
+QT_BEGIN_NAMESPACE
+Q_DECLARE_INTERFACE(NPInterface, "com.nokia.qts60.webplugin/1.0");
+QT_END_NAMESPACE
+
+#endif // npinterface_H
diff --git a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
index 21ac2a4e61..e1bf8d62ab 100644
--- a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
@@ -29,6 +29,7 @@
 
 #include "PluginView.h"
 
+#include "BitmapImage.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -52,6 +53,7 @@
 #include "PluginMessageThrottlerWin.h"
 #include "PluginPackage.h"
 #include "PluginMainThreadScheduler.h"
+#include "RenderWidget.h"
 #include "JSDOMBinding.h"
 #include "ScriptController.h"
 #include "PluginDatabase.h"
@@ -75,6 +77,7 @@
 
 #if PLATFORM(QT)
 #include "QWebPageClient.h"
+#include <QWidget>
 #endif
 
 static inline HWND windowHandleForPageClient(PlatformPageClient client)
@@ -82,7 +85,7 @@ static inline HWND windowHandleForPageClient(PlatformPageClient client)
 #if PLATFORM(QT)
     if (!client)
         return 0;
-    return client->winId();
+    return client->ownerWidget()->winId();
 #else
     return client;
 #endif
@@ -1008,8 +1011,42 @@ bool PluginView::platformStart()
 
 void PluginView::platformDestroy()
 {
-    if (platformPluginWidget())
-        DestroyWindow(platformPluginWidget());
+    if (!platformPluginWidget())
+        return;
+
+    DestroyWindow(platformPluginWidget());
+    setPlatformPluginWidget(0);
+}
+
+void PluginView::halt()
+{
+    ASSERT(!m_isHalted);
+    ASSERT(m_isStarted);
+
+#if !PLATFORM(QT)
+    // Show a screenshot of the plug-in.
+    OwnPtr<HBITMAP> nodeImage(m_parentFrame->nodeImage(m_element));
+    toRenderWidget(m_element->renderer())->showSubstituteImage(BitmapImage::create(nodeImage.get()));
+#endif
+
+    m_isHalted = true;
+    m_hasBeenHalted = true;
+
+    stop();
+    platformDestroy();
+}
+
+void PluginView::restart()
+{
+    ASSERT(!m_isStarted);
+    ASSERT(m_isHalted);
+
+    // Clear any substitute image.
+    toRenderWidget(m_element->renderer())->showSubstituteImage(0);
+
+    m_isHalted = false;
+    m_haveUpdatedPluginWidget = false;
+    start();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp b/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp
index 22a11b9781..f546abb113 100644
--- a/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp
@@ -63,11 +63,17 @@ void CounterNode::recount()
     for (CounterNode* c = this; c; c = c->m_nextSibling) {
         int oldCount = c->m_countInParent;
         int newCount = c->computeCountInParent();
-        c->m_countInParent = newCount;
         if (oldCount == newCount)
             break;
-        if (c->m_renderer->isCounter())
-            c->m_renderer->setNeedsLayoutAndPrefWidthsRecalc();
+        c->m_countInParent = newCount;
+        // m_renderer contains the parent of the render node
+        // corresponding to a CounterNode. Let's find the counter
+        // child and make this re-layout.
+        for (RenderObject* o = c->m_renderer->firstChild(); o; o = o->nextSibling())
+            if (!o->documentBeingDestroyed() && o->isCounter()) {
+                o->setNeedsLayoutAndPrefWidthsRecalc();
+                break;
+            }
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
index 599129b340..baea956bc0 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
@@ -429,7 +429,7 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
                 }
                 lineHeight = baseline + baselineToBottom;
             } else if (parentLineHeight.isPercent()) {
-                lineHeight = parentLineHeight.calcMinValue(curr->renderer()->style()->fontSize());
+                lineHeight = parentLineHeight.calcMinValue(curr->renderer()->style()->fontSize(), true);
                 baseline = 0;
                 for (size_t i = 0; i < usedFonts.size(); ++i) {
                     int halfLeading = (lineHeight - usedFonts[i]->ascent() - usedFonts[i]->descent()) / 2;
@@ -578,28 +578,23 @@ void InlineFlowBox::computeVerticalOverflow(int lineTop, int lineBottom, bool st
             
             topVisualOverflow = min(curr->y() + childOverflowTop, topVisualOverflow);
             bottomVisualOverflow = max(curr->y() + text->height() + childOverflowBottom, bottomVisualOverflow);
-        } else {
-            // Only include overflow from inline flows and replaced inlines if they do not paint themselves.
-            bool childIsSelfPainting = curr->boxModelObject()->hasSelfPaintingLayer();
-            if (curr->renderer()->isRenderInline()) {
-                InlineFlowBox* flow = static_cast<InlineFlowBox*>(curr);
-                flow->computeVerticalOverflow(lineTop, lineBottom, strictMode);
-                if (!childIsSelfPainting) {
-                    topLayoutOverflow = min(topLayoutOverflow, flow->topLayoutOverflow());
-                    bottomLayoutOverflow = max(bottomLayoutOverflow, flow->bottomLayoutOverflow());
-                    topVisualOverflow = min(topVisualOverflow, flow->topVisualOverflow());
-                    bottomVisualOverflow = max(bottomVisualOverflow, flow->bottomVisualOverflow());
-                }
-            } else if (!childIsSelfPainting){
-                RenderBox* box = toRenderBox(curr->renderer());
-                int boxY = curr->y();
-                int childTopOverflow = box->hasOverflowClip() ? 0 : box->topLayoutOverflow();
-                int childBottomOverflow = box->hasOverflowClip() ? curr->height() : box->bottomLayoutOverflow();
-                topLayoutOverflow = min(boxY + childTopOverflow, topLayoutOverflow);
-                bottomLayoutOverflow = max(boxY + childBottomOverflow, bottomLayoutOverflow);
-                topVisualOverflow = min(boxY + box->topVisualOverflow(), topVisualOverflow);
-                bottomVisualOverflow = max(boxY + box->bottomVisualOverflow(), bottomVisualOverflow);
-            }
+        } else  if (curr->renderer()->isRenderInline()) {
+            InlineFlowBox* flow = static_cast<InlineFlowBox*>(curr);
+            flow->computeVerticalOverflow(lineTop, lineBottom, strictMode);
+            topLayoutOverflow = min(topLayoutOverflow, flow->topLayoutOverflow());
+            bottomLayoutOverflow = max(bottomLayoutOverflow, flow->bottomLayoutOverflow());
+            topVisualOverflow = min(topVisualOverflow, flow->topVisualOverflow());
+            bottomVisualOverflow = max(bottomVisualOverflow, flow->bottomVisualOverflow());
+        } else if (!curr->boxModelObject()->hasSelfPaintingLayer()){
+            // Only include overflow from replaced inlines if they do not paint themselves.
+            RenderBox* box = toRenderBox(curr->renderer());
+            int boxY = curr->y();
+            int childTopOverflow = box->hasOverflowClip() ? 0 : box->topLayoutOverflow();
+            int childBottomOverflow = box->hasOverflowClip() ? curr->height() : box->bottomLayoutOverflow();
+            topLayoutOverflow = min(boxY + childTopOverflow, topLayoutOverflow);
+            bottomLayoutOverflow = max(boxY + childBottomOverflow, bottomLayoutOverflow);
+            topVisualOverflow = min(boxY + box->topVisualOverflow(), topVisualOverflow);
+            bottomVisualOverflow = max(boxY + box->bottomVisualOverflow(), bottomVisualOverflow);
         }
     }
     
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
index 29e2e5761f..73b9a3a998 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
@@ -46,6 +46,16 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+HTMLMediaElement* toParentMediaElement(RenderObject* o)
+{
+    Node* node = o->node();
+    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
+    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
+        return 0;
+
+    return static_cast<HTMLMediaElement*>(mediaNode);
+}
+
 // FIXME: These constants may need to be tweaked to better match the seeking in the QuickTime plug-in.
 static const float cSeekRepeatDelay = 0.1f;
 static const float cStepTime = 0.07f;
@@ -138,7 +148,7 @@ bool MediaControlElement::rendererIsNeeded(RenderStyle* style)
     ASSERT(document()->page());
 
     return HTMLDivElement::rendererIsNeeded(style) && parent() && parent()->renderer()
-        && document()->page()->theme()->shouldRenderMediaControlPart(style->appearance(), m_mediaElement);
+        && (!style->hasAppearance() || document()->page()->theme()->shouldRenderMediaControlPart(style->appearance(), m_mediaElement));
 }
     
 void MediaControlElement::attach()
@@ -366,7 +376,7 @@ bool MediaControlInputElement::rendererIsNeeded(RenderStyle* style)
     ASSERT(document()->page());
 
     return HTMLInputElement::rendererIsNeeded(style) && parent() && parent()->renderer()
-        && document()->page()->theme()->shouldRenderMediaControlPart(style->appearance(), m_mediaElement);
+        && (!style->hasAppearance() || document()->page()->theme()->shouldRenderMediaControlPart(style->appearance(), m_mediaElement));
 }
 
 void MediaControlInputElement::attach()
@@ -646,12 +656,12 @@ MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(Documen
 void MediaControlFullscreenButtonElement::defaultEventHandler(Event* event)
 {
     if (event->type() == eventNames().clickEvent) {
+        m_mediaElement->enterFullscreen();
         event->setDefaultHandled();
     }
     HTMLInputElement::defaultEventHandler(event);
 }
 
-
 // ----------------------------
 
 MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(Document* document, PseudoId pseudo, HTMLMediaElement* element)
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
index f692485de7..e562bb5159 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
@@ -66,6 +66,8 @@ enum MediaControlElementType {
     MediaVolumeSliderThumb
 };
 
+HTMLMediaElement* toParentMediaElement(RenderObject*);
+
 class MediaControlShadowRootElement : public HTMLDivElement {
 public:
     MediaControlShadowRootElement(Document*, HTMLMediaElement*);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp
index f40709912d..e05c8b4733 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp
@@ -64,7 +64,7 @@ int RenderBR::lineHeight(bool firstLine, bool /*isRootLineBox*/) const
             return s->font().lineSpacing();
         }
         if (lh.isPercent())
-            return lh.calcMinValue(s->fontSize());
+            return lh.calcMinValue(s->fontSize(), true);
         return lh.value();
     }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp
index ae0d76df40..237478dfd0 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp
@@ -774,7 +774,9 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     // Repaint with our new bounds if they are different from our old bounds.
     bool didFullRepaint = repainter.repaintAfterLayout();
     if (!didFullRepaint && repaintTop != repaintBottom && (style()->visibility() == VISIBLE || enclosingLayer()->hasVisibleContent())) {
-        IntRect repaintRect(leftVisibleOverflow(), repaintTop, rightVisibleOverflow() - leftVisibleOverflow(), repaintBottom - repaintTop);
+        int repaintLeft = min(leftVisualOverflow(), leftLayoutOverflow());
+        int repaintRight = max(rightVisualOverflow(), rightLayoutOverflow());
+        IntRect repaintRect(repaintLeft, repaintTop, repaintRight - repaintLeft, repaintBottom - repaintTop);
 
         // FIXME: Deal with multiple column repainting.  We have to split the repaint
         // rect up into multiple rects if it spans columns.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
index c8d30372a1..1df82a4093 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
@@ -139,6 +139,8 @@ void RenderBox::styleWillChange(StyleDifference diff, const RenderStyle* newStyl
             markContainingBlocksForLayout();
             if (style()->position() == StaticPosition)
                 repaint();
+            else if (newStyle->position() == AbsolutePosition || newStyle->position() == FixedPosition)
+                parent()->setChildNeedsLayout(true);
             if (isFloating() && !isPositioned() && (newStyle->position() == AbsolutePosition || newStyle->position() == FixedPosition))
                 removeFloatingOrPositionedChildFromBlockLists();
         }
@@ -961,10 +963,10 @@ void RenderBox::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool
         transformState.move(containerOffset.width(), containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
 
     if (containerSkipped) {
-        // There can't be a transfrom between repaintContainer and o, because transforms create containers, so it should be safe
+        // There can't be a transform between repaintContainer and o, because transforms create containers, so it should be safe
         // to just subtract the delta between the repaintContainer and o.
-        IntSize repaintContainerOffset = repaintContainer->offsetFromContainer(o);
-        transformState.move(-repaintContainerOffset.width(), -repaintContainerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+        IntSize containerOffset = repaintContainer->offsetFromAncestorContainer(o);
+        transformState.move(-containerOffset.width(), -containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
         return;
     }
     
@@ -1201,7 +1203,7 @@ void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, In
 
     if (containerSkipped) {
         // If the repaintContainer is below o, then we need to map the rect into repaintContainer's coordinates.
-        IntSize containerOffset = repaintContainer->offsetFromContainer(o);
+        IntSize containerOffset = repaintContainer->offsetFromAncestorContainer(o);
         rect.move(-containerOffset);
         return;
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp
index 67e5cbaf78..17c6dad211 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp
@@ -143,13 +143,19 @@ static bool findPlaceForCounter(RenderObject* object, const AtomicString& counte
     RenderObject* resetCandidate = isReset ? object->parent() : previousSiblingOrParent(object);
     RenderObject* prevCounterCandidate = object;
     CounterNode* candidateCounter = 0;
+    // When a reset counter is chosen as candidateCounter, we'll
+    // decide the new node should be a child of the reset node or a
+    // sibling or the reset node. This flag controls it.
+    bool createChildForReset = true;
     while ((prevCounterCandidate = prevCounterCandidate->previousInPreOrder())) {
         CounterNode* c = counter(prevCounterCandidate, counterName, false);
         if (prevCounterCandidate == resetCandidate) {
-            if (!candidateCounter)
+            if (!candidateCounter) {
                 candidateCounter = c;
+                createChildForReset = true;
+            }
             if (candidateCounter) {
-                if (candidateCounter->isReset()) {
+                if (createChildForReset && candidateCounter->isReset()) {
                     parent = candidateCounter;
                     previousSibling = 0;
                 } else {
@@ -160,10 +166,19 @@ static bool findPlaceForCounter(RenderObject* object, const AtomicString& counte
             }
             resetCandidate = previousSiblingOrParent(resetCandidate);
         } else if (c) {
-            if (c->isReset())
-                candidateCounter = 0;
-            else if (!candidateCounter)
+            if (c->isReset()) {
+                if (c->parent()) {
+                    // The new node may be the next sibling of this reset node.
+                    createChildForReset = false;
+                    candidateCounter = c;
+                } else {
+                    createChildForReset = true;
+                    candidateCounter = 0;
+                }
+            } else if (!candidateCounter) {
+                createChildForReset = true;
                 candidateCounter = c;
+            }
         }
     }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
index 51c3073165..4206b1cf1c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
@@ -227,7 +227,7 @@ bool RenderImage::setImageSizeForAltText(CachedImage* newImage /* = 0 */)
         imageHeight = paddingHeight;
     }
   
-    if (newImage) {
+    if (newImage && newImage->image()) {
         // imageSize() returns 0 for the error image.  We need the true size of the
         // error image, so we have to get it by grabbing image() directly.
         imageWidth += newImage->image()->width() * style()->effectiveZoom();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
index a5e973eb57..05d29d0d8c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
@@ -697,7 +697,7 @@ void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
 
     if (containerSkipped) {
         // If the repaintContainer is below o, then we need to map the rect into repaintContainer's coordinates.
-        IntSize containerOffset = repaintContainer->offsetFromContainer(o);
+        IntSize containerOffset = repaintContainer->offsetFromAncestorContainer(o);
         rect.move(-containerOffset);
         return;
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
index 95db43a1a8..fea61c9feb 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
@@ -311,12 +311,19 @@ void RenderLayer::updateLayerPositions(UpdateLayerPositionsFlags flags)
     if (m_reflection)
         m_reflection->layout();
 
+#if USE(ACCELERATED_COMPOSITING)
+    // Clear the IsCompositingUpdateRoot flag once we've found the first compositing layer in this update.
+    bool isUpdateRoot = (flags & IsCompositingUpdateRoot);
+    if (isComposited())
+        flags &= ~IsCompositingUpdateRoot;
+#endif
+
     for (RenderLayer* child = firstChild(); child; child = child->nextSibling())
         child->updateLayerPositions(flags);
 
 #if USE(ACCELERATED_COMPOSITING)
     if ((flags & UpdateCompositingLayers) && isComposited())
-        backing()->updateAfterLayout(RenderLayerBacking::CompositingChildren);
+        backing()->updateAfterLayout(RenderLayerBacking::CompositingChildren, isUpdateRoot);
 #endif
         
     // With all our children positioned, now update our marquee if we need to.
@@ -662,21 +669,20 @@ RenderLayer* RenderLayer::enclosingTransformedAncestor() const
     return curr;
 }
 
+static inline const RenderLayer* compositingContainer(const RenderLayer* layer)
+{
+    return layer->isNormalFlowOnly() ? layer->parent() : layer->stackingContext();
+}
+
 #if USE(ACCELERATED_COMPOSITING)
 RenderLayer* RenderLayer::enclosingCompositingLayer(bool includeSelf) const
 {
     if (includeSelf && isComposited())
         return const_cast<RenderLayer*>(this);
 
-    // Compositing layers are parented according to stacking order and overflow list,
-    // so we have to check whether the parent is a stacking context, or whether 
-    // the child is overflow-only.
-    bool inNormalFlowList = isNormalFlowOnly();
-    for (RenderLayer* curr = parent(); curr; curr = curr->parent()) {
-        if (curr->isComposited() && (inNormalFlowList || curr->isStackingContext()))
-            return curr;
-        
-        inNormalFlowList = curr->isNormalFlowOnly();
+    for (const RenderLayer* curr = compositingContainer(this); curr; curr = compositingContainer(curr)) {
+        if (curr->isComposited())
+            return const_cast<RenderLayer*>(curr);
     }
          
     return 0;
@@ -1140,8 +1146,10 @@ void RenderLayer::scrollToOffset(int x, int y, bool updateScrollbars, bool repai
 
 #if USE(ACCELERATED_COMPOSITING)
     if (compositor()->inCompositingMode()) {
-        if (RenderLayer* compositingAncestor = ancestorCompositingLayer())
-            compositingAncestor->backing()->updateAfterLayout(RenderLayerBacking::AllDescendants);
+        if (RenderLayer* compositingAncestor = ancestorCompositingLayer()) {
+            bool isUpdateRoot = true;
+            compositingAncestor->backing()->updateAfterLayout(RenderLayerBacking::AllDescendants, isUpdateRoot);
+        }
     }
 #endif
     
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
index 9d2212bfae..a274638586 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
@@ -298,10 +298,11 @@ public:
     enum UpdateLayerPositionsFlag {
         DoFullRepaint = 1,
         CheckForRepaint = 1 << 1,
-        UpdateCompositingLayers = 1 << 2,
+        IsCompositingUpdateRoot = 1 << 2,
+        UpdateCompositingLayers = 1 << 3,
     };
     typedef unsigned UpdateLayerPositionsFlags;
-    void updateLayerPositions(UpdateLayerPositionsFlags = DoFullRepaint | UpdateCompositingLayers);
+    void updateLayerPositions(UpdateLayerPositionsFlags = DoFullRepaint | IsCompositingUpdateRoot | UpdateCompositingLayers);
 
     void updateTransform();
 
@@ -327,6 +328,7 @@ public:
     Vector<RenderLayer*>* normalFlowList() const { return m_normalFlowList; }
 
     bool hasVisibleContent() const { return m_hasVisibleContent; }
+    bool hasVisibleDescendant() const { return m_hasVisibleDescendant; }
     void setHasVisibleContent(bool);
     void dirtyVisibleContentStatus();
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
index 941817cbd4..d7248d49f0 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
@@ -89,8 +89,8 @@ void RenderLayerBacking::createGraphicsLayer()
         m_graphicsLayer->setName("Anonymous Node");
 #endif  // NDEBUG
 
-    updateLayerOpacity();
-    updateLayerTransform();
+    updateLayerOpacity(renderer()->style());
+    updateLayerTransform(renderer()->style());
 }
 
 void RenderLayerBacking::destroyGraphicsLayer()
@@ -104,15 +104,13 @@ void RenderLayerBacking::destroyGraphicsLayer()
     m_maskLayer = 0;
 }
 
-void RenderLayerBacking::updateLayerOpacity()
+void RenderLayerBacking::updateLayerOpacity(const RenderStyle* style)
 {
-    m_graphicsLayer->setOpacity(compositingOpacity(renderer()->opacity()));
+    m_graphicsLayer->setOpacity(compositingOpacity(style->opacity()));
 }
 
-void RenderLayerBacking::updateLayerTransform()
+void RenderLayerBacking::updateLayerTransform(const RenderStyle* style)
 {
-    RenderStyle* style = renderer()->style();
-
     // FIXME: This could use m_owningLayer->transform(), but that currently has transform-origin
     // baked into it, and we don't want that.
     TransformationMatrix t;
@@ -148,7 +146,7 @@ void RenderLayerBacking::updateCompositedBounds()
     setCompositedBounds(layerBounds);
 }
 
-void RenderLayerBacking::updateAfterLayout(UpdateDepth updateDepth)
+void RenderLayerBacking::updateAfterLayout(UpdateDepth updateDepth, bool isUpdateRoot)
 {
     RenderLayerCompositor* layerCompositor = compositor();
     if (!layerCompositor->compositingLayersNeedRebuild()) {
@@ -162,7 +160,7 @@ void RenderLayerBacking::updateAfterLayout(UpdateDepth updateDepth)
         updateCompositedBounds();
         layerCompositor->updateCompositingDescendantGeometry(m_owningLayer, m_owningLayer, updateDepth);
         
-        if (!m_owningLayer->parent()) {
+        if (isUpdateRoot) {
             updateGraphicsLayerGeometry();
             layerCompositor->updateRootLayerPosition();
         }
@@ -219,11 +217,11 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     // Set transform property, if it is not animating. We have to do this here because the transform
     // is affected by the layer dimensions.
     if (!renderer()->animation()->isAnimatingPropertyOnRenderer(renderer(), CSSPropertyWebkitTransform))
-        updateLayerTransform();
+        updateLayerTransform(renderer()->style());
 
     // Set opacity, if it is not animating.
     if (!renderer()->animation()->isAnimatingPropertyOnRenderer(renderer(), CSSPropertyOpacity))
-        updateLayerOpacity();
+        updateLayerOpacity(renderer()->style());
     
     RenderStyle* style = renderer()->style();
     m_graphicsLayer->setPreserves3D(style->transformStyle3D() == TransformStyle3DPreserve3D);
@@ -886,7 +884,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
     if (paintingRoot && !renderer()->isDescendantOf(paintingRoot))
         paintingRootForRenderer = paintingRoot;
 
-    bool shouldPaint = m_owningLayer->hasVisibleContent() && m_owningLayer->isSelfPaintingLayer();
+    bool shouldPaint = (m_owningLayer->hasVisibleContent() || m_owningLayer->hasVisibleDescendant()) && m_owningLayer->isSelfPaintingLayer();
 
     if (shouldPaint && (paintingPhase & GraphicsLayerPaintBackground)) {
         // If this is the root then we need to send in a bigger bounding box
@@ -1082,8 +1080,11 @@ bool RenderLayerBacking::startTransition(double beginTime, int property, const R
             opacityVector.insert(new FloatAnimationValue(0, compositingOpacity(fromStyle->opacity())));
             opacityVector.insert(new FloatAnimationValue(1, compositingOpacity(toStyle->opacity())));
             // The boxSize param is only used for transform animations (which can only run on RenderBoxes), so we pass an empty size here.
-            if (m_graphicsLayer->addAnimation(opacityVector, IntSize(), opacityAnim, String(), beginTime))
+            if (m_graphicsLayer->addAnimation(opacityVector, IntSize(), opacityAnim, String(), beginTime)) {
+                // To ensure that the correct opacity is visible when the animation ends, also set the final opacity.
+                updateLayerOpacity(toStyle);
                 didAnimate = true;
+            }
         }
     }
 
@@ -1093,8 +1094,11 @@ bool RenderLayerBacking::startTransition(double beginTime, int property, const R
             KeyframeValueList transformVector(AnimatedPropertyWebkitTransform);
             transformVector.insert(new TransformAnimationValue(0, &fromStyle->transform()));
             transformVector.insert(new TransformAnimationValue(1, &toStyle->transform()));
-            if (m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), transformAnim, String(), beginTime))
+            if (m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), transformAnim, String(), beginTime)) {
+                // To ensure that the correct transform is visible when the animation ends, also set the final opacity.
+                updateLayerTransform(toStyle);
                 didAnimate = true;
+            }
         }
     }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h
index e12aa5845e..17bcaf707f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h
@@ -54,7 +54,7 @@ public:
     RenderLayer* owningLayer() const { return m_owningLayer; }
 
     enum UpdateDepth { CompositingChildren, AllDescendants };
-    void updateAfterLayout(UpdateDepth);
+    void updateAfterLayout(UpdateDepth, bool isUpdateRoot);
     
     // Returns true if layer configuration changed.
     bool updateGraphicsLayerConfiguration();
@@ -140,8 +140,8 @@ private:
     // Result is perspective origin in pixels.
     FloatPoint computePerspectiveOrigin(const IntRect& borderBox) const;
 
-    void updateLayerOpacity();
-    void updateLayerTransform();
+    void updateLayerOpacity(const RenderStyle*);
+    void updateLayerTransform(const RenderStyle*);
 
     // Return the opacity value that this layer should use for compositing.
     float compositingOpacity(float rendererOpacity) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
index bcd1f08145..5201287eb9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
@@ -535,6 +535,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
 
 void RenderLayerCompositor::setCompositingParent(RenderLayer* childLayer, RenderLayer* parentLayer)
 {
+    ASSERT(!parentLayer || childLayer->ancestorCompositingLayer() == parentLayer);
     ASSERT(childLayer->isComposited());
 
     // It's possible to be called with a parent that isn't yet composited when we're doing
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp
index f94f7ce1d4..0edfdef31b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp
@@ -508,7 +508,7 @@ bool RenderListBox::listIndexIsVisible(int index)
     return index >= m_indexOffset && index < m_indexOffset + numVisibleItems();
 }
 
-bool RenderListBox::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
+bool RenderListBox::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier, Node**)
 {
     return m_vBar && m_vBar->scroll(direction, granularity, multiplier);
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h
index e5454e5653..aafb87e957 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h
@@ -68,7 +68,7 @@ private:
 
     virtual bool isPointInOverflowControl(HitTestResult&, int x, int y, int tx, int ty);
 
-    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
+    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f, Node** stopNode = 0);
 
     virtual void calcPrefWidths();
     virtual int baselinePosition(bool firstLine, bool isRootLineBox) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp
index 0ce0642ece..9cc1493f52 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp
@@ -37,7 +37,7 @@ using namespace std;
  
 namespace WebCore {
 
-#if !defined(NDEBUG) && defined(USE_DEBUG_SAFARI_THEME)
+#ifdef DEBUG_ALL
 SOFT_LINK_DEBUG_LIBRARY(SafariTheme)
 #else
 SOFT_LINK_LIBRARY(SafariTheme)
@@ -82,16 +82,6 @@ void RenderMediaControls::adjustMediaSliderThumbSize(RenderObject* o)
     o->style()->setHeight(Length(static_cast<int>(mediaSliderThumbHeight * zoomLevel), Fixed));
 }
 
-static HTMLMediaElement* parentMediaElement(RenderObject* o)
-{
-    Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
-        return 0;
-
-    return static_cast<HTMLMediaElement*>(mediaNode);
-}
-
 bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     ASSERT(SafariThemeLibrary());
@@ -121,7 +111,7 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
             paintThemePart(SafariTheme::MediaSeekForwardButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
             break;
         case MediaSlider: {
-            if (HTMLMediaElement* mediaElement = parentMediaElement(o))
+            if (HTMLMediaElement* mediaElement = toParentMediaElement(o))
                 STPaintProgressIndicator(SafariTheme::MediaType, paintInfo.context->platformContext(), r, NSRegularControlSize, 0, mediaElement->percentLoaded());
             break;
         }
@@ -159,4 +149,3 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
 #endif  // #if ENABLE(VIDEO)
 
 } // namespace WebCore
-
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.cpp
new file mode 100644
index 0000000000..ed20ecf691
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -0,0 +1,287 @@
+/*
+ * Copyright (C) 2009 Apple Inc.
+ * Copyright (C) 2009 Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RenderMediaControlsChromium.h"
+
+#include "Gradient.h"
+#include "GraphicsContext.h"
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+
+namespace WebCore {
+
+#if ENABLE(VIDEO)
+
+typedef WTF::HashMap<const char*, Image*> MediaControlImageMap;
+static MediaControlImageMap* gMediaControlImageMap = 0;
+
+static Image* platformResource(const char* name)
+{
+    if (!gMediaControlImageMap)
+        gMediaControlImageMap = new MediaControlImageMap();
+    if (Image* image = gMediaControlImageMap->get(name))
+        return image;
+    if (Image* image = Image::loadPlatformResource(name).releaseRef()) {
+        gMediaControlImageMap->set(name, image);
+        return image;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+static bool paintMediaButton(GraphicsContext* context, const IntRect& rect, Image* image)
+{
+    IntRect imageRect = image->rect();
+    context->drawImage(image, rect);
+    return true;
+}
+
+static bool paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+      return false;
+
+    static Image* soundFull = platformResource("mediaSoundFull");
+    static Image* soundNone = platformResource("mediaSoundNone");
+    static Image* soundDisabled = platformResource("mediaSoundDisabled");
+
+    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE || !mediaElement->hasAudio())
+        return paintMediaButton(paintInfo.context, rect, soundDisabled);
+
+    return paintMediaButton(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
+}
+
+static bool paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    static Image* mediaPlay = platformResource("mediaPlay");
+    static Image* mediaPause = platformResource("mediaPause");
+    static Image* mediaPlayDisabled = platformResource("mediaPlayDisabled");
+
+    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_EMPTY ||
+        mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE)
+        return paintMediaButton(paintInfo.context, rect, mediaPlayDisabled);
+
+    return paintMediaButton(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
+}
+
+static bool paintMediaSlider(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    RenderStyle* style = object->style();
+    GraphicsContext* context = paintInfo.context;
+
+    // Draw the border of the time bar.
+    // FIXME: this should be a rounded rect but need to fix GraphicsContextSkia first.
+    // https://bugs.webkit.org/show_bug.cgi?id=30143
+    context->save();
+    context->setShouldAntialias(true);
+    context->setStrokeStyle(SolidStroke);
+    context->setStrokeColor(style->borderLeftColor());
+    context->setStrokeThickness(style->borderLeftWidth());
+    context->setFillColor(style->backgroundColor());
+    context->drawRect(rect);
+    context->restore();
+
+    // Draw the buffered ranges.
+    // FIXME: Draw multiple ranges if there are multiple buffered ranges.
+    IntRect bufferedRect = rect;
+    bufferedRect.inflate(-style->borderLeftWidth());
+    bufferedRect.setWidth((bufferedRect.width() * mediaElement->percentLoaded()));
+
+    // Don't bother drawing an empty area.
+    if (!bufferedRect.isEmpty()) {
+        IntPoint sliderTopLeft = bufferedRect.location();
+        IntPoint sliderTopRight = sliderTopLeft;
+        sliderTopRight.move(0, bufferedRect.height());
+
+        RefPtr<Gradient> gradient = Gradient::create(sliderTopLeft, sliderTopRight);
+        Color startColor = object->style()->color();
+        gradient->addColorStop(0.0, startColor);
+        gradient->addColorStop(1.0, Color(startColor.red() / 2, startColor.green() / 2, startColor.blue() / 2, startColor.alpha()));
+
+        context->save();
+        context->setStrokeStyle(NoStroke);
+        context->setFillGradient(gradient);
+        context->fillRect(bufferedRect);
+        context->restore();
+    }
+
+    return true;
+}
+
+static bool paintMediaSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    if (!object->parent()->isSlider())
+        return false;
+
+    static Image* mediaSliderThumb = platformResource("mediaSliderThumb");
+    return paintMediaButton(paintInfo.context, rect, mediaSliderThumb);
+}
+
+static bool paintMediaVolumeSlider(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    GraphicsContext* context = paintInfo.context;
+    Color originalColor = context->strokeColor();
+    if (originalColor != Color::white)
+        context->setStrokeColor(Color::white);
+
+    int x = rect.x() + rect.width() / 2;
+    context->drawLine(IntPoint(x, rect.y()),  IntPoint(x, rect.y() + rect.height()));
+
+    if (originalColor != Color::white)
+        context->setStrokeColor(originalColor);
+    return true;
+}
+
+static bool paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    if (!object->parent()->isSlider())
+        return false;
+
+    static Image* mediaVolumeSliderThumb = platformResource("mediaVolumeSliderThumb");
+    return paintMediaButton(paintInfo.context, rect, mediaVolumeSliderThumb);
+}
+
+static bool paintMediaTimelineContainer(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    if (!rect.isEmpty()) {
+        GraphicsContext* context = paintInfo.context;
+        Color originalColor = context->strokeColor();
+        float originalThickness = context->strokeThickness();
+        StrokeStyle originalStyle = context->strokeStyle();
+
+        context->setStrokeStyle(SolidStroke);
+
+        // Draw the left border using CSS defined width and color.
+        context->setStrokeThickness(object->style()->borderLeftWidth());
+        context->setStrokeColor(object->style()->borderLeftColor().rgb());
+        context->drawLine(IntPoint(rect.x() + 1, rect.y()),
+                          IntPoint(rect.x() + 1, rect.y() + rect.height()));
+
+        // Draw the right border using CSS defined width and color.
+        context->setStrokeThickness(object->style()->borderRightWidth());
+        context->setStrokeColor(object->style()->borderRightColor().rgb());
+        context->drawLine(IntPoint(rect.x() + rect.width() - 1, rect.y()),
+                          IntPoint(rect.x() + rect.width() - 1, rect.y() + rect.height()));
+
+        context->setStrokeColor(originalColor);
+        context->setStrokeThickness(originalThickness);
+        context->setStrokeStyle(originalStyle);
+    }
+    return true;
+}
+
+bool RenderMediaControlsChromium::shouldRenderMediaControlPart(ControlPart part, Element* e)
+{
+    UNUSED_PARAM(e);
+
+    switch (part) {
+    case MediaMuteButtonPart:
+    case MediaPlayButtonPart:
+    case MediaSliderPart:
+    case MediaSliderThumbPart:
+    case MediaVolumeSliderContainerPart:
+    case MediaVolumeSliderPart:
+    case MediaVolumeSliderThumbPart:
+    case MediaControlsBackgroundPart:
+    case MediaCurrentTimePart:
+    case MediaTimeRemainingPart:
+        return true;
+    }
+    return false;
+}
+
+bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType part, RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    switch (part) {
+    case MediaMuteButton:
+    case MediaUnMuteButton:
+        return paintMediaMuteButton(object, paintInfo, rect);
+    case MediaPauseButton:
+    case MediaPlayButton:
+        return paintMediaPlayButton(object, paintInfo, rect);
+    case MediaSlider:
+        return paintMediaSlider(object, paintInfo, rect);
+    case MediaSliderThumb:
+        return paintMediaSliderThumb(object, paintInfo, rect);
+    case MediaVolumeSlider:
+        return paintMediaVolumeSlider(object, paintInfo, rect);
+    case MediaVolumeSliderThumb:
+        return paintMediaVolumeSliderThumb(object, paintInfo, rect);
+    case MediaTimelineContainer:
+        return paintMediaTimelineContainer(object, paintInfo, rect);
+    case MediaFullscreenButton:
+    case MediaSeekBackButton:
+    case MediaSeekForwardButton:
+    case MediaVolumeSliderContainer:
+    case MediaCurrentTimeDisplay:
+    case MediaTimeRemainingDisplay:
+    case MediaControlsPanel:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+    return false;
+}
+
+void RenderMediaControlsChromium::adjustMediaSliderThumbSize(RenderObject* object)
+{
+    static Image* mediaSliderThumb = platformResource("mediaSliderThumb");
+    static Image* mediaVolumeSliderThumb = platformResource("mediaVolumeSliderThumb");
+
+    Image* thumbImage = 0;
+    if (object->style()->appearance() == MediaSliderThumbPart)
+        thumbImage = mediaSliderThumb;
+    else if (object->style()->appearance() == MediaVolumeSliderThumbPart)
+        thumbImage = mediaVolumeSliderThumb;
+
+    float zoomLevel = object->style()->effectiveZoom();
+    if (thumbImage) {
+        object->style()->setWidth(Length(static_cast<int>(thumbImage->width() * zoomLevel), Fixed));
+        object->style()->setHeight(Length(static_cast<int>(thumbImage->height() * zoomLevel), Fixed));
+    }
+}
+
+#endif  // #if ENABLE(VIDEO)
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.h b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.h
new file mode 100644
index 0000000000..d6d986cde0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc.
+ * Copyright (C) 2009 Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderMediaControlsChromium_h
+#define RenderMediaControlsChromium_h
+
+#include "RenderObject.h"
+#include "MediaControlElements.h"
+
+namespace WebCore {
+
+class HTMLMediaElement;
+class RenderMediaControlsChromium {
+public:
+    static bool shouldRenderMediaControlPart(ControlPart, Element*);
+    static bool paintMediaControlsPart(MediaControlElementType, RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    static void adjustMediaSliderThumbSize(RenderObject*);
+};
+
+} // namespace WebCore
+
+#endif // RenderMediaControlsChromium_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
index b7f59e1139..a10ffd9609 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
@@ -1568,7 +1568,7 @@ void RenderObject::styleWillChange(StyleDifference diff, const RenderStyle* newS
             // For changes in float styles, we need to conceivably remove ourselves
             // from the floating objects list.
             toRenderBox(this)->removeFloatingOrPositionedChildFromBlockLists();
-        else if (isPositioned() && (newStyle->position() != AbsolutePosition && newStyle->position() != FixedPosition))
+        else if (isPositioned() && (m_style->position() != newStyle->position()))
             // For changes in positioning styles, we need to conceivably remove ourselves
             // from the positioned objects list.
             toRenderBox(this)->removeFloatingOrPositionedChildFromBlockLists();
@@ -1755,6 +1755,23 @@ IntSize RenderObject::offsetFromContainer(RenderObject* o) const
     return offset;
 }
 
+IntSize RenderObject::offsetFromAncestorContainer(RenderObject* container) const
+{
+    IntSize offset;
+    const RenderObject* currContainer = this;
+    do {
+        RenderObject* nextContainer = currContainer->container();
+        ASSERT(nextContainer);  // This means we reached the top without finding container.
+        if (!nextContainer)
+            break;
+        ASSERT(!currContainer->hasTransform());
+        offset += currContainer->offsetFromContainer(nextContainer);
+        currContainer = nextContainer;
+    } while (currContainer != container);
+
+    return offset;
+}
+
 IntRect RenderObject::localCaretRect(InlineBox*, int, int* extraWidthToEndOfLine)
 {
     if (extraWidthToEndOfLine)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
index 367eaa6a8b..e358c981ac 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
@@ -541,6 +541,8 @@ public:
 
     // Return the offset from the container() renderer (excluding transforms)
     virtual IntSize offsetFromContainer(RenderObject*) const;
+    // Return the offset from an object up the container() chain. Asserts that none of the intermediate objects have transforms.
+    IntSize offsetFromAncestorContainer(RenderObject*) const;
     
     virtual void absoluteRects(Vector<IntRect>&, int, int) { }
     // FIXME: useTransforms should go away eventually
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
index 199c0da0cd..e2c8e7d8af 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
@@ -249,7 +249,8 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
                 return;
         }
 
-        bool success = frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
+        bool success = o->dispatchBeforeLoadEvent(url) &&
+                       frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
         if (!success && m_hasFallbackContent)
             o->renderFallbackContent();
     } else if (node()->hasTagName(embedTag)) {
@@ -283,7 +284,8 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
 
         }
 
-        frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
+        if (o->dispatchBeforeLoadEvent(url))
+            frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
     }
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)        
     else if (node()->hasTagName(videoTag) || node()->hasTagName(audioTag)) {
@@ -306,7 +308,9 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
         }
 
         serviceType = "application/x-media-element-proxy-plugin";
-        frame->loader()->requestObject(this, url, nullAtom, serviceType, paramNames, paramValues);
+        
+        if (o->dispatchBeforeLoadEvent(url))
+            frame->loader()->requestObject(this, url, nullAtom, serviceType, paramNames, paramValues);
     }
 #endif
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp
index 247acda86d..442af39401 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp
@@ -50,7 +50,7 @@ static const int defaultTrackLength = 129;
 struct SliderRange {
     bool isIntegral;
     double minimum;
-    double maximum;
+    double maximum;  // maximum must be >= minimum.
 
     explicit SliderRange(HTMLInputElement*);
     double clampValue(double value);
@@ -80,12 +80,8 @@ SliderRange::SliderRange(HTMLInputElement* element)
 
     isIntegral = !equalIgnoringCase(element->getAttribute(precisionAttr), "float");
 
-    // FIXME: This treats maximum strings that can't be parsed as 0, but perhaps 100 would be more appropriate.
-    const AtomicString& maxString = element->getAttribute(maxAttr);
-    maximum = maxString.isNull() ? 100.0 : maxString.toDouble();
-
-    // If the maximum is smaller, use it as the minimum.
-    minimum = min(element->getAttribute(minAttr).toDouble(), maximum);
+    maximum = element->rangeMaximum();
+    minimum = element->rangeMinimum();
 }
 
 double SliderRange::clampValue(double value)
@@ -96,12 +92,14 @@ double SliderRange::clampValue(double value)
 
 double SliderRange::valueFromElement(HTMLInputElement* element, bool* wasClamped)
 {
-    String valueString = element->value();
-    double oldValue = valueString.isNull() ? (minimum + maximum) / 2 : valueString.toDouble();
+    double oldValue;
+    bool parseSuccess = HTMLInputElement::formStringToDouble(element->value(), &oldValue);
+    if (!parseSuccess)
+        oldValue = (minimum + maximum) / 2;
     double newValue = clampValue(oldValue);
 
     if (wasClamped)
-        *wasClamped = valueString.isNull() || newValue != oldValue;
+        *wasClamped = !parseSuccess || newValue != oldValue;
 
     return newValue;
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
index 8478432fb0..a49e092b1b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -45,7 +45,9 @@ RenderTextControlMultiLine::~RenderTextControlMultiLine()
 void RenderTextControlMultiLine::subtreeHasChanged()
 {
     RenderTextControl::subtreeHasChanged();
-    static_cast<Element*>(node())->setFormControlValueMatchesRenderer(false);
+    HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(node());
+    textArea->setFormControlValueMatchesRenderer(false);
+    textArea->updateValidity();
 
     if (!node()->focused())
         return;
@@ -53,7 +55,7 @@ void RenderTextControlMultiLine::subtreeHasChanged()
     node()->dispatchEvent(Event::create(eventNames().inputEvent, true, false));
 
     if (Frame* frame = document()->frame())
-        frame->textDidChangeInTextArea(static_cast<Element*>(node()));
+        frame->textDidChangeInTextArea(textArea);
 }
 
 bool RenderTextControlMultiLine::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
index 8d8ba97259..be800a7310 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -808,12 +808,12 @@ void RenderTextControlSingleLine::setScrollTop(int newTop)
         innerTextElement()->setScrollTop(newTop);
 }
 
-bool RenderTextControlSingleLine::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
+bool RenderTextControlSingleLine::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier, Node** stopNode)
 {
     RenderLayer* layer = innerTextElement()->renderBox()->layer();
     if (layer && layer->scroll(direction, granularity, multiplier))
         return true;
-    return RenderBlock::scroll(direction, granularity, multiplier);
+    return RenderBlock::scroll(direction, granularity, multiplier, stopNode);
 }
 
 PassRefPtr<Scrollbar> RenderTextControlSingleLine::createScrollbar(ScrollbarClient* client, ScrollbarOrientation orientation, ScrollbarControlSize controlSize)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
index 4a17918db4..e30ff0d3d1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
@@ -72,7 +72,7 @@ private:
     virtual int scrollHeight() const;
     virtual void setScrollLeft(int);
     virtual void setScrollTop(int);
-    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
+    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f, Node** stopNode = 0);
 
     int textBlockWidth() const;
     virtual int preferredContentWidth(float charWidth) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
index b5826cd2db..5ee01e445a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
@@ -85,6 +85,7 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
     
 #if USE(NEW_THEME)
     switch (part) {
+        case ListButtonPart:
         case CheckboxPart:
         case RadioPart:
         case PushButtonPart:
@@ -171,6 +172,7 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
             return adjustRadioStyle(selector, style, e);
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
             return adjustButtonStyle(selector, style, e);
@@ -227,6 +229,7 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
             m_theme->paint(part, controlStatesForRenderer(o), const_cast<GraphicsContext*>(paintInfo.context), r, o->style()->effectiveZoom(), o->view()->frameView());
@@ -245,6 +248,7 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
             return paintRadio(o, paintInfo, r);
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
             return paintButton(o, paintInfo, r);
@@ -335,6 +339,7 @@ bool RenderTheme::paintBorderOnly(RenderObject* o, const RenderObject::PaintInfo
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
         case MenulistPart:
@@ -369,6 +374,7 @@ bool RenderTheme::paintDecorations(RenderObject* o, const RenderObject::PaintInf
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
         case MenulistPart:
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
index 9f412a0f79..61b5e8f39c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
@@ -121,6 +121,7 @@ protected:
     virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
 #if ENABLE(VIDEO)
+    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
     virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
index 695f9fa442..bcfcd577c6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -29,7 +29,6 @@
 #import "Document.h"
 #import "Element.h"
 #import "FrameView.h"
-#import "Gradient.h"
 #import "GraphicsContext.h"
 #import "HTMLInputElement.h"
 #import "HTMLMediaElement.h"
@@ -38,6 +37,7 @@
 #import "LocalCurrentGraphicsContext.h"
 #import "MediaControlElements.h"
 #import "RenderMedia.h"
+#import "RenderMediaControlsChromium.h"
 #import "RenderSlider.h"
 #import "RenderView.h"
 #import "SharedBuffer.h"
@@ -1251,20 +1251,6 @@ bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObjec
     return false;
 }
 
-#if ENABLE(VIDEO)
-static Image* mediaSliderThumbImage()
-{
-    static Image* mediaSliderThumb = Image::loadPlatformResource("mediaSliderThumb").releaseRef();
-    return mediaSliderThumb;
-}
-  
-static Image* mediaVolumeSliderThumbImage()
-{
-    static Image* mediaVolumeSliderThumb = Image::loadPlatformResource("mediaVolumeSliderThumb").releaseRef();
-    return mediaVolumeSliderThumb;
-}
-#endif
-
 void RenderThemeChromiumMac::adjustSliderThumbSize(RenderObject* o) const
 {
     static const int sliderThumbWidth = 15;
@@ -1277,16 +1263,7 @@ void RenderThemeChromiumMac::adjustSliderThumbSize(RenderObject* o) const
     }
 
 #if ENABLE(VIDEO)
-    Image* thumbImage = 0;
-    if (o->style()->appearance() == MediaSliderThumbPart)
-        thumbImage = mediaSliderThumbImage();
-    else if (o->style()->appearance() == MediaVolumeSliderThumbPart)
-        thumbImage = mediaVolumeSliderThumbImage();
-  
-    if (thumbImage) {
-        o->style()->setWidth(Length(thumbImage->width(), Fixed));
-        o->style()->setHeight(Length(thumbImage->height(), Fixed));
-    }
+    RenderMediaControlsChromium::adjustMediaSliderThumbSize(o);
 #endif
 }
 
@@ -1537,173 +1514,44 @@ bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, cons
 }
 
 #if ENABLE(VIDEO)
-// Attempt to retrieve a HTMLMediaElement from a Node. Returns 0 if one cannot be found.
-static HTMLMediaElement* mediaElementParent(Node* node)
-{
-    if (!node)
-        return 0;
-    Node* mediaNode = node->shadowAncestorNode();
-    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
-        return 0;
-
-    return static_cast<HTMLMediaElement*>(mediaNode);
-}
-
-bool RenderThemeChromiumMac::paintMediaButtonInternal(GraphicsContext* context, const IntRect& rect, Image* image)
+bool RenderThemeChromiumMac::shouldRenderMediaControlPart(ControlPart part, Element* e)
 {
-    // Create a destination rectangle for the image that is centered in the drawing rectangle, rounded left, and down.
-    IntRect imageRect = image->rect();
-    imageRect.setY(rect.y() + (rect.height() - image->height() + 1) / 2);
-    imageRect.setX(rect.x() + (rect.width() - image->width() + 1) / 2);
-
-    context->drawImage(image, imageRect);
-    return true;
+    return RenderMediaControlsChromium::shouldRenderMediaControlPart(part, e);
 }
 
 bool RenderThemeChromiumMac::paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    static Image* mediaPlay = Image::loadPlatformResource("mediaPlay").releaseRef();
-    static Image* mediaPause = Image::loadPlatformResource("mediaPause").releaseRef();
-    static Image* mediaPlayDisabled = Image::loadPlatformResource("mediaPlayDisabled").releaseRef();
-
-    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE)
-        return paintMediaButtonInternal(paintInfo.context, rect, mediaPlayDisabled);
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaPlayButton, object, paintInfo, rect);
 }
 
 bool RenderThemeChromiumMac::paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    static Image* soundFull = Image::loadPlatformResource("mediaSoundFull").releaseRef();
-    static Image* soundNone = Image::loadPlatformResource("mediaSoundNone").releaseRef();
-    static Image* soundDisabled = Image::loadPlatformResource("mediaSoundDisabled").releaseRef();
-
-    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE || !mediaElement->hasAudio())
-        return paintMediaButtonInternal(paintInfo.context, rect, soundDisabled);
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->muted() ? soundNone : soundFull);
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaMuteButton, object, paintInfo, rect);
 }
 
 bool RenderThemeChromiumMac::paintMediaSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    RenderStyle* style = object->style();    
-    GraphicsContext* context = paintInfo.context;
-    context->save();
-    
-    context->setShouldAntialias(true);
-
-    IntSize topLeftRadius = style->borderTopLeftRadius();
-    IntSize topRightRadius = style->borderTopRightRadius();
-    IntSize bottomLeftRadius = style->borderBottomLeftRadius();
-    IntSize bottomRightRadius = style->borderBottomRightRadius();
-    float borderWidth = style->borderLeftWidth();
-
-    // Draw the border of the time bar.
-    context->setStrokeColor(style->borderLeftColor());
-    context->setStrokeThickness(borderWidth);
-    context->setFillColor(style->backgroundColor());
-    context->addPath(Path::createRoundedRectangle(rect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius));
-    context->drawPath();
-    
-    // Draw the buffered ranges.
-    // FIXME: Draw multiple ranges if there are multiple buffered ranges.
-    FloatRect bufferedRect = rect;
-    bufferedRect.inflate(-1.0 - borderWidth);
-    bufferedRect.setWidth(bufferedRect.width() * mediaElement->percentLoaded());
-    bufferedRect = context->roundToDevicePixels(bufferedRect);
-   
-    // Don't bother drawing an empty area.
-    if (bufferedRect.width() > 0 && bufferedRect.height() > 0) {
-        FloatPoint sliderTopLeft = bufferedRect.location();
-        FloatPoint sliderTopRight = sliderTopLeft;
-        sliderTopRight.move(0.0f, bufferedRect.height());
-        
-        RefPtr<Gradient> gradient = Gradient::create(sliderTopLeft, sliderTopRight);
-        Color startColor = object->style()->color();
-        gradient->addColorStop(0.0, startColor);
-        gradient->addColorStop(1.0, Color(startColor.red() / 2, startColor.green() / 2, startColor.blue() / 2, startColor.alpha()));
- 
-        context->setFillGradient(gradient);
-        context->addPath(Path::createRoundedRectangle(bufferedRect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius));
-        context->fillPath();
-    }
-    
-    context->restore();    
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSlider, object, paintInfo, rect);
 }
 
 bool RenderThemeChromiumMac::paintMediaVolumeSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    GraphicsContext* context = paintInfo.context;
-    Color originalColor = context->strokeColor();
-    if (originalColor != Color::white)
-        context->setStrokeColor(Color::white);
-
-    int x = rect.x() + rect.width() / 2;
-    context->drawLine(IntPoint(x, rect.y()),  IntPoint(x, rect.y() + rect.height()));
-    
-    if (originalColor != Color::white)
-        context->setStrokeColor(originalColor);
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSlider, object, paintInfo, rect);
 }
 
 bool RenderThemeChromiumMac::paintMediaSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    if (!object->parent()->isSlider())
-        return false;
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaSliderThumbImage());
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSliderThumb, object, paintInfo, rect);
 }
 
 bool RenderThemeChromiumMac::paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    if (!object->parent()->isSlider())
-        return false;
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaVolumeSliderThumbImage());
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSliderThumb, object, paintInfo, rect);
 }
 
 bool RenderThemeChromiumMac::paintMediaControlsBackground(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    if (!rect.isEmpty())
-    {
-        GraphicsContext* context = paintInfo.context;
-        Color originalColor = context->strokeColor();
- 
-        // Draws the left border, it is always 1px wide.
-        context->setStrokeColor(object->style()->borderLeftColor());
-        context->drawLine(IntPoint(rect.x() + 1, rect.y()),
-                          IntPoint(rect.x() + 1, rect.y() + rect.height()));
-                         
-
-        // Draws the right border, it is always 1px wide.
-        context->setStrokeColor(object->style()->borderRightColor());
-        context->drawLine(IntPoint(rect.x() + rect.width() - 1, rect.y()),
-                          IntPoint(rect.x() + rect.width() - 1, rect.y() + rect.height()));
-        
-        context->setStrokeColor(originalColor);
-    }
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaTimelineContainer, object, paintInfo, rect);
 }
     
 String RenderThemeChromiumMac::extraMediaControlsStyleSheet()
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
index 4f486d5363..fb42bb7af5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -33,6 +33,7 @@
 #include "MediaControlElements.h"
 #include "PlatformContextSkia.h"
 #include "RenderBox.h"
+#include "RenderMediaControlsChromium.h"
 #include "RenderObject.h"
 #include "RenderSlider.h"
 #include "ScrollbarTheme.h"
@@ -96,20 +97,6 @@ static void drawBox(SkCanvas* canvas, const IntRect& rect, const SkPaint& paint)
     drawVertLine(canvas, rect.x(), rect.y(), bottom, paint);
 }
 
-#if ENABLE(VIDEO)
-// Attempt to retrieve a HTMLMediaElement from a Node. Returns NULL if one cannot be found.
-static HTMLMediaElement* mediaElementParent(Node* node)
-{
-    if (!node)
-        return 0;
-    Node* mediaNode = node->shadowAncestorNode();
-    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
-        return 0;
-
-    return static_cast<HTMLMediaElement*>(mediaNode);
-}
-#endif
-
 // We aim to match IE here.
 // -IE uses a font based on the encoding as the default font for form controls.
 // -Gecko uses MS Shell Dlg (actually calls GetStockObject(DEFAULT_GUI_FONT),
@@ -486,42 +473,10 @@ bool RenderThemeChromiumSkia::paintSearchFieldResultsButton(RenderObject* o, con
     return false;
 }
 
-bool RenderThemeChromiumSkia::paintMediaButtonInternal(GraphicsContext* context, const IntRect& rect, Image* image)
-{
-    // Create a destination rectangle for the image that is centered in the drawing rectangle, rounded left, and down.
-    IntRect imageRect = image->rect();
-    imageRect.setY(rect.y() + (rect.height() - image->height() + 1) / 2);
-    imageRect.setX(rect.x() + (rect.width() - image->width() + 1) / 2);
-
-    context->drawImage(image, imageRect);
-    return true;
-}
-
 bool RenderThemeChromiumSkia::paintMediaControlsBackground(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    if (!rect.isEmpty())
-    {
-        SkCanvas* canvas = paintInfo.context->platformContext()->canvas();
-        SkPaint paint;
-
-        // Draws the left border, it is always 1px wide.
-        paint.setColor(object->style()->borderLeftColor().rgb());
-        canvas->drawLine(rect.x() + 1, rect.y(),
-                         rect.x() + 1, rect.y() + rect.height(),
-                         paint);
-
-        // Draws the right border, it is always 1px wide.
-        paint.setColor(object->style()->borderRightColor().rgb());
-        canvas->drawLine(rect.x() + rect.width() - 1, rect.y(),
-                         rect.x() + rect.width() - 1, rect.y() + rect.height(),
-                         paint);
-    }
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaTimelineContainer, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -533,62 +488,7 @@ bool RenderThemeChromiumSkia::paintMediaControlsBackground(RenderObject* object,
 bool RenderThemeChromiumSkia::paintMediaSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    SkCanvas* canvas = paintInfo.context->platformContext()->canvas();
-    SkRect backgroundRect;
-    backgroundRect.set(rect.x(), rect.y(), rect.x() + rect.width(), rect.y() + rect.height());
-
-    SkPaint paint;
-    paint.setAntiAlias(true);
-
-    // Draw the border of the time bar. The border only has one single color,
-    // width and radius. So use the property of the left border.
-    SkColor borderColor = object->style()->borderLeftColor().rgb();
-    int borderWidth = object->style()->borderLeftWidth();
-    IntSize borderRadius = object->style()->borderTopLeftRadius();
-    paint.setStyle(SkPaint::kStroke_Style);
-    paint.setStrokeWidth(borderWidth);
-    paint.setColor(borderColor);
-    canvas->drawRoundRect(backgroundRect, borderRadius.width(), borderRadius.height(), paint);
-
-    // Draw the background of the time bar.
-    SkColor backgroundColor = object->style()->backgroundColor().rgb();
-    paint.setStyle(SkPaint::kFill_Style);
-    paint.setColor(backgroundColor);
-    canvas->drawRoundRect(backgroundRect, borderRadius.width(), borderRadius.height(), paint);
-
-    if (backgroundRect.width() >= 3 && backgroundRect.height() >= 3)
-    {
-        // Draw the buffered ranges.
-        // FIXME: Draw multiple ranges if there are multiple buffered ranges.
-        SkRect bufferedRect;
-        bufferedRect.set(backgroundRect.fLeft + 2, backgroundRect.fTop + 2,
-                         backgroundRect.fRight - 1, backgroundRect.fBottom - 1);
-        int width = static_cast<int>(bufferedRect.width() * mediaElement->percentLoaded());
-        bufferedRect.fRight = bufferedRect.fLeft + width;
-
-        SkPoint points[2] = { { 0, bufferedRect.fTop }, { 0, bufferedRect.fBottom } };
-        SkColor startColor = object->style()->color().rgb();
-        SkColor endColor = SkColorSetRGB(SkColorGetR(startColor) / 2,
-                                         SkColorGetG(startColor) / 2,
-                                         SkColorGetB(startColor) / 2);
-        SkColor colors[2] = { startColor, endColor };
-        SkShader* gradient = SkGradientShader::CreateLinear(points, colors, 0,
-                                                            sizeof(points) / sizeof(points[0]),
-                                                            SkShader::kMirror_TileMode, 0);
-
-        paint.reset();
-        paint.setShader(gradient);
-        paint.setAntiAlias(true);
-        // Check for round rect with zero width or height, otherwise Skia will assert
-        if (bufferedRect.width() > 0 && bufferedRect.height() > 0)
-            canvas->drawRoundRect(bufferedRect, borderRadius.width(), borderRadius.height(), paint);
-        gradient->unref();
-    }
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSlider, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -600,17 +500,7 @@ bool RenderThemeChromiumSkia::paintMediaSliderTrack(RenderObject* object, const
 bool RenderThemeChromiumSkia::paintMediaVolumeSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    SkCanvas* canvas = paintInfo.context->platformContext()->canvas();
-    SkPaint paint;
-    paint.setColor(SK_ColorWHITE);
-
-    int x = rect.x() + rect.width() / 2;
-    canvas->drawLine(x, rect.y(), x, rect.y() + rect.height(), paint);
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSlider, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -619,31 +509,10 @@ bool RenderThemeChromiumSkia::paintMediaVolumeSliderTrack(RenderObject* object,
 #endif
 }
 
-static Image* mediaSliderThumbImage()
-{
-    static Image* mediaSliderThumb = Image::loadPlatformResource("mediaSliderThumb").releaseRef();
-    return mediaSliderThumb;
-}
-
-static Image* mediaVolumeSliderThumbImage()
-{
-    static Image* mediaVolumeSliderThumb = Image::loadPlatformResource("mediaVolumeSliderThumb").releaseRef();
-    return mediaVolumeSliderThumb;
-}
-
 void RenderThemeChromiumSkia::adjustSliderThumbSize(RenderObject* object) const
 {
 #if ENABLE(VIDEO)
-    Image* thumbImage = 0;
-    if (object->style()->appearance() == MediaSliderThumbPart)
-        thumbImage = mediaSliderThumbImage();
-    else if (object->style()->appearance() == MediaVolumeSliderThumbPart)
-        thumbImage = mediaVolumeSliderThumbImage();
-
-    if (thumbImage) {
-        object->style()->setWidth(Length(thumbImage->width(), Fixed));
-        object->style()->setHeight(Length(thumbImage->height(), Fixed));
-    }
+    RenderMediaControlsChromium::adjustMediaSliderThumbSize(object);
 #else
     UNUSED_PARAM(object);
 #endif
@@ -652,10 +521,7 @@ void RenderThemeChromiumSkia::adjustSliderThumbSize(RenderObject* object) const
 bool RenderThemeChromiumSkia::paintMediaSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    if (!object->parent()->isSlider())
-        return false;
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaSliderThumbImage());
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSliderThumb, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -667,10 +533,7 @@ bool RenderThemeChromiumSkia::paintMediaSliderThumb(RenderObject* object, const
 bool RenderThemeChromiumSkia::paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    if (!object->parent()->isSlider())
-        return false;
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaVolumeSliderThumbImage());
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSliderThumb, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -682,18 +545,7 @@ bool RenderThemeChromiumSkia::paintMediaVolumeSliderThumb(RenderObject* object,
 bool RenderThemeChromiumSkia::paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    static Image* mediaPlay = Image::loadPlatformResource("mediaPlay").releaseRef();
-    static Image* mediaPause = Image::loadPlatformResource("mediaPause").releaseRef();
-    static Image* mediaPlayDisabled = Image::loadPlatformResource("mediaPlayDisabled").releaseRef();
-
-    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE)
-        return paintMediaButtonInternal(paintInfo.context, rect, mediaPlayDisabled);
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaPlayButton, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -705,18 +557,7 @@ bool RenderThemeChromiumSkia::paintMediaPlayButton(RenderObject* object, const R
 bool RenderThemeChromiumSkia::paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    static Image* soundFull = Image::loadPlatformResource("mediaSoundFull").releaseRef();
-    static Image* soundNone = Image::loadPlatformResource("mediaSoundNone").releaseRef();
-    static Image* soundDisabled = Image::loadPlatformResource("mediaSoundDisabled").releaseRef();
-
-    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE || !mediaElement->hasAudio())
-        return paintMediaButtonInternal(paintInfo.context, rect, soundDisabled);
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaMuteButton, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -744,8 +585,9 @@ bool RenderThemeChromiumSkia::paintMenuList(RenderObject* o, const RenderObject:
     paint.setAntiAlias(true);
     paint.setStyle(SkPaint::kFill_Style);
 
+    int arrowXPosition = (o->style()->direction() == RTL) ? rect.x() + 7 : right - 13;
     SkPath path;
-    path.moveTo(right - 13, middle - 3);
+    path.moveTo(arrowXPosition, middle - 3);
     path.rLineTo(6, 0);
     path.rLineTo(-3, 6);
     path.close();
@@ -871,13 +713,7 @@ int RenderThemeChromiumSkia::buttonInternalPaddingBottom() const
 #if ENABLE(VIDEO)
 bool RenderThemeChromiumSkia::shouldRenderMediaControlPart(ControlPart part, Element* e)
 {
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(e);
-    switch (part) {
-    case MediaMuteButtonPart:
-        return true;
-    default:
-        return RenderTheme::shouldRenderMediaControlPart(part, e);
-    }
+    return RenderMediaControlsChromium::shouldRenderMediaControlPart(part, e);
 }
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
index bbc54a7200..3b8698081f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
@@ -59,7 +59,7 @@ namespace WebCore {
 
         // System fonts.
         virtual void systemFont(int propId, FontDescription&) const;
-        virtual Color systemColor(int cssValueId) const;
+        virtual Color systemColor(int cssValueId) const;

 
         virtual void adjustSliderThumbSize(RenderObject*) const;
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
index 85f141f609..1d68c630c9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
@@ -132,6 +132,8 @@ protected:
 
     // Media controls
     virtual String extraMediaControlsStyleSheet();
+
+    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
 #endif
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
index 8e53088914..2ea3b8beaf 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
@@ -86,7 +86,7 @@ PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
     return safariTheme; // keep the reference of one.
 }
 
-#if !defined(NDEBUG) && defined(USE_DEBUG_SAFARI_THEME)
+#ifdef DEBUG_ALL
 SOFT_LINK_DEBUG_LIBRARY(SafariTheme)
 #else
 SOFT_LINK_LIBRARY(SafariTheme)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp
index ef78b07ee1..9af7137faf 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp
@@ -175,6 +175,12 @@ void RenderWidget::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
     }
 }
 
+void RenderWidget::showSubstituteImage(PassRefPtr<Image> prpImage)
+{
+    m_substituteImage = prpImage;
+    repaint();
+}
+
 void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
 {
     if (!shouldPaint(paintInfo, tx, ty))
@@ -222,7 +228,10 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
 
         // Tell the widget to paint now.  This is the only time the widget is allowed
         // to paint itself.  That way it will composite properly with z-indexed layers.
-        m_widget->paint(paintInfo.context, paintInfo.rect);
+        if (m_substituteImage)
+            paintInfo.context->drawImage(m_substituteImage.get(), m_widget->frameRect());
+        else
+            m_widget->paint(paintInfo.context, paintInfo.rect);
 
         if (m_widget->isFrameView() && paintInfo.overlapTestRequests && !static_cast<FrameView*>(m_widget.get())->useSlowRepaints()) {
             ASSERT(!paintInfo.overlapTestRequests->contains(this));
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h
index 098f69edef..78537fdfa5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h
@@ -40,6 +40,8 @@ public:
 
     void updateWidgetPosition();
 
+    void showSubstituteImage(PassRefPtr<Image>);
+
 protected:
     RenderWidget(Node*);
 
@@ -66,6 +68,7 @@ private:
     void deref(RenderArena*);
 
     RefPtr<Widget> m_widget;
+    RefPtr<Image> m_substituteImage;
     FrameView* m_frameView;
     int m_refCount;
 };
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
index fb6866fba8..0f295e4f5f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
@@ -220,7 +220,7 @@ FloatRect SVGRenderBase::filterBoundingBoxForRenderer(const RenderObject* object
 #if ENABLE(FILTERS)
     SVGResourceFilter* filter = getFilterById(object->document(), object->style()->svgStyle()->filter());
     if (filter)
-        return filter->filterBBoxForItemBBox(object->objectBoundingBox());
+        return filter->filterBoundingBox();
 #else
     UNUSED_PARAM(object);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h
index be5d1cf4a3..1e1688c105 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h
@@ -462,7 +462,7 @@ public:
             return font().lineSpacing();
 
         if (lh.isPercent())
-            return lh.calcMinValue(fontSize());
+            return lh.calcMinValue(fontSize(), true);
 
         return lh.value();
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h
index a47defb1f4..3010947ad7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h
@@ -72,6 +72,7 @@ enum PseudoId {
     MEDIA_CONTROLS_VOLUME_SLIDER, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER, MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, MEDIA_CONTROLS_SEEK_BACK_BUTTON,
     MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, MEDIA_CONTROLS_REWIND_BUTTON, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON,
     MEDIA_CONTROLS_STATUS_DISPLAY, SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER,
+    INPUT_LIST_BUTTON,
 
     FIRST_INTERNAL_PSEUDOID = FILE_UPLOAD_BUTTON
 };
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h
index 0e9dae463a..e50d349897 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h
@@ -65,7 +65,6 @@ namespace WebCore {
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(LineJoin, JoinStyle, joinStyle, MiterJoin)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EShapeRendering, ShapeRendering, shapeRendering, SR_AUTO)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(ETextAnchor, TextAnchor, textAnchor, TA_START)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(ETextRendering, TextRendering, textRendering, TR_AUTO)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EWritingMode, WritingMode, writingMode, WM_LRTB)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EGlyphOrientation, GlyphOrientationHorizontal, glyphOrientationHorizontal, GO_0DEG)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EGlyphOrientation, GlyphOrientationVertical, glyphOrientationVertical, GO_AUTO)
@@ -113,7 +112,6 @@ namespace WebCore {
                 return (_colorRendering == other._colorRendering) &&
                        (_imageRendering == other._imageRendering) &&
                        (_shapeRendering == other._shapeRendering) &&
-                       (_textRendering == other._textRendering) &&
                        (_clipRule == other._clipRule) &&
                        (_fillRule == other._fillRule) &&
                        (_capStyle == other._capStyle) &&
@@ -134,7 +132,6 @@ namespace WebCore {
             unsigned _colorRendering : 2; // EColorRendering
             unsigned _imageRendering : 2; // EImageRendering 
             unsigned _shapeRendering : 2; // EShapeRendering 
-            unsigned _textRendering : 2; // ETextRendering
             unsigned _clipRule : 1; // WindRule
             unsigned _fillRule : 1; // WindRule
             unsigned _capStyle : 2; // LineCap
@@ -190,7 +187,6 @@ namespace WebCore {
             svg_inherited_flags._fillRule = initialFillRule();
             svg_inherited_flags._imageRendering = initialImageRendering();
             svg_inherited_flags._shapeRendering = initialShapeRendering();
-            svg_inherited_flags._textRendering = initialTextRendering();
             svg_inherited_flags._textAnchor = initialTextAnchor();
             svg_inherited_flags._capStyle = initialCapStyle();
             svg_inherited_flags._joinStyle = initialJoinStyle();
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h
index b7bf0261d8..c0f5d4efea 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h
@@ -95,10 +95,6 @@ namespace WebCore {
         SR_AUTO, SR_OPTIMIZESPEED, SR_CRISPEDGES, SR_GEOMETRICPRECISION
     };
 
-    enum ETextRendering {
-        TR_AUTO, TR_OPTIMIZESPEED, TR_OPTIMIZELEGIBILITY, TR_GEOMETRICPRECISION
-    };
-
     enum EWritingMode {
         WM_LRTB, WM_LR, WM_RLTB, WM_RL, WM_TBRL, WM_TB
     };
diff --git a/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp b/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp
index 33660e7897..17a9407872 100644
--- a/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp
@@ -34,8 +34,8 @@
 namespace WebCore {
 
 ChangeVersionWrapper::ChangeVersionWrapper(const String& oldVersion, const String& newVersion)
-    : m_oldVersion(oldVersion.copy())
-    , m_newVersion(newVersion.copy())
+    : m_oldVersion(oldVersion.crossThreadString())
+    , m_newVersion(newVersion.crossThreadString())
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/storage/Database.cpp b/src/3rdparty/webkit/WebCore/storage/Database.cpp
index be0c4902c9..08ea289a3b 100644
--- a/src/3rdparty/webkit/WebCore/storage/Database.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/Database.cpp
@@ -89,6 +89,22 @@ static GuidVersionMap& guidToVersionMap()
     return map;
 }
 
+// NOTE: Caller must lock guidMutex().
+static inline void updateGuidVersionMap(int guid, String newVersion)
+{
+    // Ensure the the mutex is locked.
+    ASSERT(!guidMutex().tryLock());
+
+    // Note: It is not safe to put an empty string into the guidToVersionMap() map.
+    // That's because the map is cross-thread, but empty strings are per-thread.
+    // The copy() function makes a version of the string you can use on the current
+    // thread, but we need a string we can keep in a cross-thread data structure.
+    // FIXME: This is a quite-awkward restriction to have to program with.
+
+    // Map null string to empty string (see comment above).
+    guidToVersionMap().set(guid, newVersion.isEmpty() ? String() : newVersion.threadsafeCopy());
+}
+
 typedef HashMap<int, HashSet<Database*>*> GuidDatabaseMap;
 static GuidDatabaseMap& guidToDatabaseMap()
 {
@@ -134,7 +150,7 @@ PassRefPtr<Database> Database::openDatabase(Document* document, const String& na
 Database::Database(Document* document, const String& name, const String& expectedVersion)
     : m_transactionInProgress(false)
     , m_document(document)
-    , m_name(name.copy())
+    , m_name(name.crossThreadString())
     , m_guid(0)
     , m_expectedVersion(expectedVersion)
     , m_deleted(false)
@@ -149,8 +165,6 @@ Database::Database(Document* document, const String& name, const String& expecte
 
 #if USE(JSC)
     JSC::initializeThreading();
-    // Database code violates the normal JSCore contract by calling jsUnprotect from a secondary thread, and thus needs additional locking.
-    JSDOMWindow::commonJSGlobalData()->heap.setGCProtectNeedsLocking();
 #endif
 
     m_guid = guidForOriginAndName(m_securityOrigin->toString(), name);
@@ -177,20 +191,6 @@ Database::Database(Document* document, const String& name, const String& expecte
 
 Database::~Database()
 {
-    {
-        MutexLocker locker(guidMutex());
-
-        HashSet<Database*>* hashSet = guidToDatabaseMap().get(m_guid);
-        ASSERT(hashSet);
-        ASSERT(hashSet->contains(this));
-        hashSet->remove(this);
-        if (hashSet->isEmpty()) {
-            guidToDatabaseMap().remove(m_guid);
-            delete hashSet;
-            guidToVersionMap().remove(m_guid);
-        }
-    }
-
     if (m_document->databaseThread())
         m_document->databaseThread()->unscheduleDatabaseTasks(this);
 
@@ -245,7 +245,7 @@ bool Database::getVersionFromDatabase(String& version)
 
     m_databaseAuthorizer->disable();
 
-    bool result = retrieveTextResultFromDatabase(m_sqliteDatabase, getVersionQuery.copy(), version);
+    bool result = retrieveTextResultFromDatabase(m_sqliteDatabase, getVersionQuery.threadsafeCopy(), version);
     if (!result)
         LOG_ERROR("Failed to retrieve version from database %s", databaseDebugName().ascii().data());
 
@@ -277,11 +277,13 @@ static bool setTextValueInDatabase(SQLiteDatabase& db, const String& query, cons
 
 bool Database::setVersionInDatabase(const String& version)
 {
+    // The INSERT will replace an existing entry for the database with the new version number, due to the UNIQUE ON CONFLICT REPLACE
+    // clause in the CREATE statement (see Database::performOpenAndVerify()).
     DEFINE_STATIC_LOCAL(String, setVersionQuery, ("INSERT INTO " + databaseInfoTableName() + " (key, value) VALUES ('" + databaseVersionKey() + "', ?);"));
 
     m_databaseAuthorizer->disable();
 
-    bool result = setTextValueInDatabase(m_sqliteDatabase, setVersionQuery.copy(), version);
+    bool result = setTextValueInDatabase(m_sqliteDatabase, setVersionQuery.threadsafeCopy(), version);
     if (!result)
         LOG_ERROR("Failed to set version %s in database (%s)", version.ascii().data(), setVersionQuery.ascii().data());
 
@@ -330,6 +332,20 @@ void Database::close()
         m_sqliteDatabase.close();
         m_document->databaseThread()->recordDatabaseClosed(this);
         m_opened = false;
+
+        {
+            MutexLocker locker(guidMutex());
+
+            HashSet<Database*>* hashSet = guidToDatabaseMap().get(m_guid);
+            ASSERT(hashSet);
+            ASSERT(hashSet->contains(this));
+            hashSet->remove(this);
+            if (hashSet->isEmpty()) {
+                guidToDatabaseMap().remove(m_guid);
+                delete hashSet;
+                guidToVersionMap().remove(m_guid);
+            }
+        }
     }
 }
 
@@ -449,15 +465,9 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
     {
         MutexLocker locker(guidMutex());
 
-        // Note: It is not safe to put an empty string into the guidToVersionMap() map.
-        // That's because the map is cross-thread, but empty strings are per-thread.
-        // The copy() function makes a version of the string you can use on the current
-        // thread, but we need a string we can keep in a cross-thread data structure.
-        // FIXME: This is a quite-awkward restriction to have to program with.
-
         GuidVersionMap::iterator entry = guidToVersionMap().find(m_guid);
         if (entry != guidToVersionMap().end()) {
-            // Map null string to empty string (see comment above).
+            // Map null string to empty string (see updateGuidVersionMap()).
             currentVersion = entry->second.isNull() ? String("") : entry->second;
             LOG(StorageAPI, "Current cached version for guid %i is %s", m_guid, currentVersion.ascii().data());
         } else {
@@ -488,8 +498,7 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
                 currentVersion = m_expectedVersion;
             }
 
-            // Map empty string to null string (see comment above).
-            guidToVersionMap().set(m_guid, currentVersion.isEmpty() ? String() : currentVersion.copy());
+            updateGuidVersionMap(m_guid, currentVersion);
         }
     }
 
@@ -607,7 +616,7 @@ String Database::version() const
     if (m_deleted)
         return String();
     MutexLocker locker(guidMutex());
-    return guidToVersionMap().get(m_guid).copy();
+    return guidToVersionMap().get(m_guid).threadsafeCopy();
 }
 
 void Database::deliverPendingCallback(void* context)
@@ -632,18 +641,21 @@ Vector<String> Database::tableNames()
 
 void Database::setExpectedVersion(const String& version)
 {
-    m_expectedVersion = version.copy();
+    m_expectedVersion = version.threadsafeCopy();
+    // Update the in memory database version map.
+    MutexLocker locker(guidMutex());
+    updateGuidVersionMap(m_guid, version);
 }
 
 PassRefPtr<SecurityOrigin> Database::securityOriginCopy() const
 {
-    return m_securityOrigin->copy();
+    return m_securityOrigin->threadsafeCopy();
 }
 
 String Database::stringIdentifier() const
 {
     // Return a deep copy for ref counting thread safety
-    return m_name.copy();
+    return m_name.threadsafeCopy();
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
index 491e6f177d..265cd0d51c 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
@@ -762,7 +762,7 @@ void DatabaseTracker::scheduleNotifyDatabaseChanged(SecurityOrigin* origin, cons
 {
     MutexLocker locker(notificationMutex());
 
-    notificationQueue().append(pair<SecurityOrigin*, String>(origin, name.copy()));
+    notificationQueue().append(pair<SecurityOrigin*, String>(origin, name.crossThreadString()));
     scheduleForNotification();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
index 4cea845d6a..12cc083bed 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
@@ -33,16 +33,18 @@
 
 namespace WebCore {
 
-LocalStorageTask::LocalStorageTask(Type type, PassRefPtr<StorageAreaSync> area)
+LocalStorageTask::LocalStorageTask(Type type, StorageAreaSync* area)
     : m_type(type)
     , m_area(area)
+    , m_thread(0)
 {
     ASSERT(m_area);
     ASSERT(m_type == AreaImport || m_type == AreaSync);
 }
 
-LocalStorageTask::LocalStorageTask(Type type, PassRefPtr<LocalStorageThread> thread)
+LocalStorageTask::LocalStorageTask(Type type, LocalStorageThread* thread)
     : m_type(type)
+    , m_area(0)
     , m_thread(thread)
 {
     ASSERT(m_thread);
@@ -57,11 +59,9 @@ void LocalStorageTask::performTask()
 {
     switch (m_type) {
         case AreaImport:
-            ASSERT(m_area);
             m_area->performImport();
             break;
         case AreaSync:
-            ASSERT(m_area);
             m_area->performSync();
             break;
         case TerminateThread:
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
index 726b41f064..f03d851c76 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
@@ -44,19 +44,19 @@ namespace WebCore {
 
         ~LocalStorageTask();
 
-        static PassRefPtr<LocalStorageTask> createImport(PassRefPtr<StorageAreaSync> area) { return adoptRef(new LocalStorageTask(AreaImport, area)); }
-        static PassRefPtr<LocalStorageTask> createSync(PassRefPtr<StorageAreaSync> area) { return adoptRef(new LocalStorageTask(AreaSync, area)); }
-        static PassRefPtr<LocalStorageTask> createTerminate(PassRefPtr<LocalStorageThread> thread) { return adoptRef(new LocalStorageTask(TerminateThread, thread)); }
+        static PassRefPtr<LocalStorageTask> createImport(StorageAreaSync* area) { return adoptRef(new LocalStorageTask(AreaImport, area)); }
+        static PassRefPtr<LocalStorageTask> createSync(StorageAreaSync* area) { return adoptRef(new LocalStorageTask(AreaSync, area)); }
+        static PassRefPtr<LocalStorageTask> createTerminate(LocalStorageThread* thread) { return adoptRef(new LocalStorageTask(TerminateThread, thread)); }
 
         void performTask();
 
     private:
-        LocalStorageTask(Type, PassRefPtr<StorageAreaSync>);
-        LocalStorageTask(Type, PassRefPtr<LocalStorageThread>);
+        LocalStorageTask(Type, StorageAreaSync*);
+        LocalStorageTask(Type, LocalStorageThread*);
 
         Type m_type;
-        RefPtr<StorageAreaSync> m_area;
-        RefPtr<LocalStorageThread> m_thread;
+        StorageAreaSync* m_area;
+        LocalStorageThread* m_thread;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
index c85d5e6102..78640a92f7 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
@@ -86,13 +86,13 @@ void* LocalStorageThread::localStorageThread()
     return 0;
 }
 
-void LocalStorageThread::scheduleImport(PassRefPtr<StorageAreaSync> area)
+void LocalStorageThread::scheduleImport(StorageAreaSync* area)
 {
     ASSERT(!m_queue.killed() && m_threadID);
     m_queue.append(LocalStorageTask::createImport(area));
 }
 
-void LocalStorageThread::scheduleSync(PassRefPtr<StorageAreaSync> area)
+void LocalStorageThread::scheduleSync(StorageAreaSync* area)
 {
     ASSERT(!m_queue.killed() && m_threadID);
     m_queue.append(LocalStorageTask::createSync(area));
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
index b903fb9318..e9e2b58862 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
@@ -45,8 +45,8 @@ namespace WebCore {
 
         bool start();
 
-        void scheduleImport(PassRefPtr<StorageAreaSync>);
-        void scheduleSync(PassRefPtr<StorageAreaSync>);
+        void scheduleImport(StorageAreaSync*);
+        void scheduleSync(StorageAreaSync*);
 
         // Called from the main thread to synchronously shut down this thread
         void terminate();
diff --git a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
index b757f70e61..20bb34d1f5 100644
--- a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
@@ -79,7 +79,7 @@ void OriginQuotaManager::addDatabase(SecurityOrigin* origin, const String& datab
     OriginUsageRecord* usageRecord = m_usageMap.get(origin);
     ASSERT(usageRecord);
 
-    usageRecord->addDatabase(databaseIdentifier.copy(), fullPath.copy());
+    usageRecord->addDatabase(databaseIdentifier.threadsafeCopy(), fullPath.threadsafeCopy());
 }
 
 void OriginQuotaManager::removeDatabase(SecurityOrigin* origin, const String& databaseIdentifier)
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLError.h b/src/3rdparty/webkit/WebCore/storage/SQLError.h
index a17efa9243..4414e6b7f5 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLError.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLError.h
@@ -41,10 +41,10 @@ public:
     static PassRefPtr<SQLError> create(unsigned code, const String& message) { return adoptRef(new SQLError(code, message)); }
 
     unsigned code() const { return m_code; }
-    String message() const { return m_message.copy(); }
+    String message() const { return m_message.threadsafeCopy(); }
 
 private:
-    SQLError(unsigned code, const String& message) : m_code(code), m_message(message.copy()) { }
+    SQLError(unsigned code, const String& message) : m_code(code), m_message(message.threadsafeCopy()) { }
     unsigned m_code;
     String m_message;
 };
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp b/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp
index 970f757b70..b4eb9ef442 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp
@@ -50,7 +50,7 @@ PassRefPtr<SQLStatement> SQLStatement::create(const String& statement, const Vec
 }
 
 SQLStatement::SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly)
-    : m_statement(statement.copy())
+    : m_statement(statement.crossThreadString())
     , m_arguments(arguments)
     , m_statementCallback(callback)
     , m_statementErrorCallback(errorCallback)
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
index dabbac2dd1..149b384c56 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
@@ -232,8 +232,9 @@ void SQLTransaction::openTransactionAndPreflight()
         return;
     }
 
-    // Set the maximum usage for this transaction
-    m_database->m_sqliteDatabase.setMaximumSize(m_database->maximumSize());
+    // Set the maximum usage for this transaction if this transactions is not read-only
+    if (!m_readOnly)
+        m_database->m_sqliteDatabase.setMaximumSize(m_database->maximumSize());
 
     ASSERT(!m_sqliteTransaction);
     m_sqliteTransaction.set(new SQLiteTransaction(m_database->m_sqliteDatabase, m_readOnly));
@@ -307,7 +308,10 @@ void SQLTransaction::runStatements()
             // FIXME - Another place that needs fixing up after <rdar://problem/5628468> is addressed.
             // See ::openTransactionAndPreflight() for discussion
 
-            // Reset the maximum size here, as it was increased to allow us to retry this statement
+            // Reset the maximum size here, as it was increased to allow us to retry this statement.
+            // m_shouldRetryCurrentStatement is set to true only when a statement exceeds
+            // the quota, which can happen only in a read-write transaction. Therefore, there
+            // is no need to check here if the transaction is read-write.
             m_database->m_sqliteDatabase.setMaximumSize(m_database->maximumSize());
         } else {
             // If the current statement has already been run, failed due to quota constraints, and we're not retrying it,
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageArea.h b/src/3rdparty/webkit/WebCore/storage/StorageArea.h
index e0f7f0637f..a64d44a035 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageArea.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageArea.h
@@ -31,7 +31,7 @@
 #include "PlatformString.h"
 
 #include <wtf/PassRefPtr.h>
-#include <wtf/Threading.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
@@ -42,7 +42,7 @@ namespace WebCore {
     enum StorageType { LocalStorage, SessionStorage };
 
     // This interface is required for Chromium since these actions need to be proxied between processes.
-    class StorageArea : public ThreadSafeShared<StorageArea> {
+    class StorageArea : public RefCounted<StorageArea> {
     public:
         virtual ~StorageArea() { }
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp
index 66447d3e99..612cb5fde2 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp
@@ -28,16 +28,11 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "DOMWindow.h"
-#include "EventNames.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
-#include "Page.h"
-#include "PageGroup.h"
-#include "SecurityOrigin.h"
 #include "Settings.h"
-#include "StorageEvent.h"
 #include "StorageAreaSync.h"
+#include "StorageEventDispatcher.h"
 #include "StorageMap.h"
 #include "StorageSyncManager.h"
 
@@ -45,22 +40,24 @@ namespace WebCore {
 
 StorageAreaImpl::~StorageAreaImpl()
 {
+    ASSERT(isMainThread());
 }
 
-PassRefPtr<StorageAreaImpl> StorageAreaImpl::create(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager)
+PassRefPtr<StorageAreaImpl> StorageAreaImpl::create(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager, unsigned quota)
 {
-    return adoptRef(new StorageAreaImpl(storageType, origin, syncManager));
+    return adoptRef(new StorageAreaImpl(storageType, origin, syncManager, quota));
 }
 
-StorageAreaImpl::StorageAreaImpl(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager)
+StorageAreaImpl::StorageAreaImpl(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager, unsigned quota)
     : m_storageType(storageType)
     , m_securityOrigin(origin)
-    , m_storageMap(StorageMap::create())
+    , m_storageMap(StorageMap::create(quota))
     , m_storageSyncManager(syncManager)
 #ifndef NDEBUG
     , m_isShutdown(false)
 #endif
 {
+    ASSERT(isMainThread());
     ASSERT(m_securityOrigin);
     ASSERT(m_storageMap);
 
@@ -87,6 +84,7 @@ StorageAreaImpl::StorageAreaImpl(StorageAreaImpl* area)
     , m_isShutdown(area->m_isShutdown)
 #endif
 {
+    ASSERT(isMainThread());
     ASSERT(m_securityOrigin);
     ASSERT(m_storageMap);
     ASSERT(!m_isShutdown);
@@ -137,15 +135,14 @@ void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionC
         return;
     }
 
-    // FIXME: For LocalStorage where a disk quota will be enforced, here is where we need to do quota checking.
-    //        If we decide to enforce a memory quota for SessionStorage, this is where we'd do that, also.
-    // if (<over quota>) {
-    //     ec = QUOTA_EXCEEDED_ERR;
-    //     return;
-    // }
-
     String oldValue;
-    RefPtr<StorageMap> newMap = m_storageMap->setItem(key, value, oldValue);
+    bool quotaException;
+    RefPtr<StorageMap> newMap = m_storageMap->setItem(key, value, oldValue, quotaException);
+
+    if (quotaException) {
+        ec = QUOTA_EXCEEDED_ERR;
+        return;
+    }
 
     if (newMap)
         m_storageMap = newMap.release();
@@ -154,7 +151,7 @@ void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionC
     if (oldValue != value) {
         if (m_storageAreaSync)
             m_storageAreaSync->scheduleItemForSync(key, value);
-        dispatchStorageEvent(key, oldValue, value, frame);
+        StorageEventDispatcher::dispatch(key, oldValue, value, m_storageType, m_securityOrigin.get(), frame);
     }
 }
 
@@ -175,7 +172,7 @@ void StorageAreaImpl::removeItem(const String& key, Frame* frame)
     if (!oldValue.isNull()) {
         if (m_storageAreaSync)
             m_storageAreaSync->scheduleItemForSync(key, String());
-        dispatchStorageEvent(key, oldValue, String(), frame);
+        StorageEventDispatcher::dispatch(key, oldValue, String(), m_storageType, m_securityOrigin.get(), frame);
     }
 }
 
@@ -187,11 +184,12 @@ void StorageAreaImpl::clear(Frame* frame)
     if (privateBrowsingEnabled(frame))
         return;
 
-    m_storageMap = StorageMap::create();
+    unsigned quota = m_storageMap->quota();
+    m_storageMap = StorageMap::create(quota);
 
     if (m_storageAreaSync)
         m_storageAreaSync->scheduleClear();
-    dispatchStorageEvent(String(), String(), String(), frame);
+    StorageEventDispatcher::dispatch(String(), String(), String(), m_storageType, m_securityOrigin.get(), frame);
 }
 
 bool StorageAreaImpl::contains(const String& key) const
@@ -229,45 +227,6 @@ void StorageAreaImpl::blockUntilImportComplete() const
         m_storageAreaSync->blockUntilImportComplete();
 }
 
-void StorageAreaImpl::dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame)
-{
-#if PLATFORM(CHROMIUM)
-    // FIXME: Events are currently broken in Chromium.
-    return;
-#endif
-
-    Page* page = sourceFrame->page();
-    if (!page)
-        return;
-
-    // We need to copy all relevant frames from every page to a vector since sending the event to one frame might mutate the frame tree
-    // of any given page in the group or mutate the page group itself.
-    Vector<RefPtr<Frame> > frames;
-    if (m_storageType == SessionStorage) {
-        // Send events only to our page.
-        for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-            if (frame->document()->securityOrigin()->equal(securityOrigin()))
-                frames.append(frame);
-        }
-
-        for (unsigned i = 0; i < frames.size(); ++i)
-            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
-    } else {
-        // Send events to every page.
-        const HashSet<Page*>& pages = page->group().pages();
-        HashSet<Page*>::const_iterator end = pages.end();
-        for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
-            for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-                if (frame->document()->securityOrigin()->equal(securityOrigin()))
-                    frames.append(frame);
-            }
-        }
-
-        for (unsigned i = 0; i < frames.size(); ++i)
-            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->localStorage()));
-    }
-}
-
 }
 
 #endif // ENABLE(DOM_STORAGE)
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h
index a7cc9f6b77..fe21a45906 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h
@@ -41,7 +41,7 @@ namespace WebCore {
 
     class StorageAreaImpl : public StorageArea {
     public:
-        static PassRefPtr<StorageAreaImpl> create(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>);
+        static PassRefPtr<StorageAreaImpl> create(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>, unsigned quota);
         virtual ~StorageAreaImpl();
 
         // The HTML5 DOM Storage API (and contains)
@@ -61,13 +61,11 @@ namespace WebCore {
         SecurityOrigin* securityOrigin();
 
     private:
-        StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>);
+        StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>, unsigned quota);
         StorageAreaImpl(StorageAreaImpl*);
 
         void blockUntilImportComplete() const;
 
-        void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
-
         StorageType m_storageType;
         RefPtr<SecurityOrigin> m_securityOrigin;
         RefPtr<StorageMap> m_storageMap;
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
index 2a642b45f3..ad41e2860b 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
@@ -57,6 +57,7 @@ StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManag
     , m_syncScheduled(false)
     , m_importComplete(false)
 {
+    ASSERT(isMainThread());
     ASSERT(m_storageArea);
     ASSERT(m_syncManager);
 
@@ -68,6 +69,7 @@ StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManag
 
 StorageAreaSync::~StorageAreaSync()
 {
+    ASSERT(isMainThread());
     ASSERT(!m_syncTimer.isActive());
 }
 
@@ -138,7 +140,7 @@ void StorageAreaSync::syncTimerFired(Timer<StorageAreaSync>*)
         }
 
         for (; it != end; ++it)
-            m_itemsPendingSync.set(it->first.copy(), it->second.copy());
+            m_itemsPendingSync.set(it->first.crossThreadString(), it->second.crossThreadString());
 
         if (!m_syncScheduled) {
             m_syncScheduled = true;
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp b/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp
index f3b3b70ef2..13ccfe98aa 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp
@@ -28,7 +28,6 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "DOMWindow.h"
 #include "Storage.h"
 
 namespace WebCore {
@@ -42,23 +41,22 @@ StorageEvent::StorageEvent()
 {
 }
 
-PassRefPtr<StorageEvent> StorageEvent::create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
+PassRefPtr<StorageEvent> StorageEvent::create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea)
 {
-    return adoptRef(new StorageEvent(type, key, oldValue, newValue, uri, source, storageArea));
+    return adoptRef(new StorageEvent(type, key, oldValue, newValue, uri, storageArea));
 }
 
-StorageEvent::StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
+StorageEvent::StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea)
     : Event(type, false, true)
     , m_key(key)
     , m_oldValue(oldValue)
     , m_newValue(newValue)
     , m_uri(uri)
-    , m_source(source)
     , m_storageArea(storageArea)
 {
 }
 
-void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
+void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea)
 {
     if (dispatched())
         return;
@@ -69,7 +67,6 @@ void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bo
     m_oldValue = oldValue;
     m_newValue = newValue;
     m_uri = uri;
-    m_source = source;
     m_storageArea = storageArea;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEvent.h b/src/3rdparty/webkit/WebCore/storage/StorageEvent.h
index 7e2bcff1b7..fa7535b27c 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageEvent.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEvent.h
@@ -33,37 +33,34 @@
 
 namespace WebCore {
 
-    class DOMWindow;
     class Storage;
 
     class StorageEvent : public Event {
     public:
         static PassRefPtr<StorageEvent> create();
-        static PassRefPtr<StorageEvent> create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
+        static PassRefPtr<StorageEvent> create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea);
 
         const String& key() const { return m_key; }
         const String& oldValue() const { return m_oldValue; }
         const String& newValue() const { return m_newValue; }
         const String& uri() const { return m_uri; }
-        DOMWindow* source() const { return m_source.get(); }
         Storage* storageArea() const { return m_storageArea.get(); }
 
-        void initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
+        void initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea);
 
         // Needed once we support init<blank>EventNS
-        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in Window sourceArg,  Storage storageAreaArg);
+        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, Storage storageAreaArg);
 
         virtual bool isStorageEvent() const { return true; }
 
     private:
         StorageEvent();
-        StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
+        StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea);
 
         String m_key;
         String m_oldValue;
         String m_newValue;
         String m_uri;
-        RefPtr<DOMWindow> m_source;
         RefPtr<Storage> m_storageArea;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl b/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl
index 5a3f993ba3..7c875618d2 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl
@@ -33,12 +33,11 @@ module storage {
         readonly attribute [ConvertNullStringTo=Null] DOMString oldValue;
         readonly attribute [ConvertNullStringTo=Null] DOMString newValue;
         readonly attribute DOMString uri;
-        readonly attribute DOMWindow source;
         readonly attribute Storage storageArea;
-        void initStorageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in [ConvertNullToNullString] DOMString oldValueArg, in [ConvertNullToNullString] DOMString newValueArg, in DOMString uriArg, in DOMWindow sourceArg, in Storage storageAreaArg);
+        void initStorageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in [ConvertNullToNullString] DOMString oldValueArg, in [ConvertNullToNullString] DOMString newValueArg, in DOMString uriArg, in Storage storageAreaArg);
 
         // Needed once we support init<blank>EventNS
-        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in DOMWindow sourceArg, in Storage storageAreaArg);
+        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in Storage storageAreaArg);
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEventDispatcher.cpp b/src/3rdparty/webkit/WebCore/storage/StorageEventDispatcher.cpp
new file mode 100644
index 0000000000..d2eab664a2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEventDispatcher.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StorageEventDispatcher.h"
+
+#if ENABLE(DOM_STORAGE)
+
+#include "DOMWindow.h"
+#include "EventNames.h"
+#include "Frame.h"
+#include "Page.h"
+#include "PageGroup.h"
+#include "SecurityOrigin.h"
+#include "StorageEvent.h"
+
+namespace WebCore {
+
+void StorageEventDispatcher::dispatch(const String& key, const String& oldValue, const String& newValue, StorageType storageType, SecurityOrigin* securityOrigin, Frame* sourceFrame)
+{
+    Page* page = sourceFrame->page();
+    if (!page)
+        return;
+
+    // We need to copy all relevant frames from every page to a vector since sending the event to one frame might mutate the frame tree
+    // of any given page in the group or mutate the page group itself.
+    Vector<RefPtr<Frame> > frames;
+    if (storageType == SessionStorage) {
+        // Send events only to our page.
+        for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+            if (frame->document()->securityOrigin()->equal(securityOrigin))
+                frames.append(frame);
+        }
+
+        for (unsigned i = 0; i < frames.size(); ++i)
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), frames[i]->domWindow()->sessionStorage()));
+    } else {
+        // Send events to every page.
+        const HashSet<Page*>& pages = page->group().pages();
+        HashSet<Page*>::const_iterator end = pages.end();
+        for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
+            for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+                if (frame->document()->securityOrigin()->equal(securityOrigin))
+                    frames.append(frame);
+            }
+        }
+
+        for (unsigned i = 0; i < frames.size(); ++i)
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), frames[i]->domWindow()->localStorage()));
+    }
+}
+
+}
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp b/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp
index 6ddf32395d..5498d9ee45 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp
@@ -30,20 +30,22 @@
 
 namespace WebCore {
 
-PassRefPtr<StorageMap> StorageMap::create()
+PassRefPtr<StorageMap> StorageMap::create(unsigned quota)
 {
-    return adoptRef(new StorageMap);
+    return adoptRef(new StorageMap(quota));
 }
 
-StorageMap::StorageMap()
+StorageMap::StorageMap(unsigned quota)
     : m_iterator(m_map.end())
     , m_iteratorIndex(UINT_MAX)
+    , m_quotaSize(quota)  // quota measured in bytes
+    , m_currentLength(0)
 {
 }
 
 PassRefPtr<StorageMap> StorageMap::copy()
 {
-    RefPtr<StorageMap> newMap = create();
+    RefPtr<StorageMap> newMap = create(m_quotaSize);
     newMap->m_map = m_map;
     return newMap.release();
 }
@@ -54,7 +56,7 @@ void StorageMap::invalidateIterator()
     m_iteratorIndex = UINT_MAX;
 }
 
-void StorageMap::setIteratorToIndex(unsigned index) const
+void StorageMap::setIteratorToIndex(unsigned index)
 {
     // FIXME: Once we have bidirectional iterators for HashMap we can be more intelligent about this.
     // The requested index will be closest to begin(), our current iterator, or end(), and we
@@ -82,7 +84,7 @@ unsigned StorageMap::length() const
     return m_map.size();
 }
 
-String StorageMap::key(unsigned index) const
+String StorageMap::key(unsigned index)
 {
     if (index >= length())
         return String();
@@ -96,27 +98,34 @@ String StorageMap::getItem(const String& key) const
     return m_map.get(key);
 }
 
-PassRefPtr<StorageMap> StorageMap::setItem(const String& key, const String& value, String& oldValue)
+PassRefPtr<StorageMap> StorageMap::setItem(const String& key, const String& value, String& oldValue, bool& quotaException)
 {
     ASSERT(!value.isNull());
+    quotaException = false;
 
     // Implement copy-on-write semantics here.  We're guaranteed that the only refs of StorageMaps belong to Storage objects
     // so if more than one Storage object refs this map, copy it before mutating it.
     if (refCount() > 1) {
         RefPtr<StorageMap> newStorageMap = copy();
-        newStorageMap->setItem(key, value, oldValue);
+        newStorageMap->setItem(key, value, oldValue, quotaException);
         return newStorageMap.release();
     }
 
-    pair<HashMap<String, String>::iterator, bool> addResult = m_map.add(key, value);
+    // Quota tracking.  If the quota is enabled and this would go over it, bail.
+    oldValue = m_map.get(key);
+    unsigned newLength = m_currentLength + value.length() - oldValue.length();
+    bool overQuota = newLength > m_quotaSize / sizeof(UChar);
+    bool overflow = (newLength > m_currentLength) != (value.length() > oldValue.length());
+    ASSERT(!overflow);  // If we're debugging, make a fuss.  But it's still worth checking this in the following if statement.
+    if (m_quotaSize != noQuota && (overflow || overQuota)) {
+        quotaException = true;
+        return 0;
+    }
+    m_currentLength = newLength;
 
-    if (addResult.second) {
-        // There was no "oldValue" so null it out.
-        oldValue = String();
-    } else {
-        oldValue = addResult.first->second;
+    pair<HashMap<String, String>::iterator, bool> addResult = m_map.add(key, value);
+    if (!addResult.second)
         addResult.first->second = value;
-    }
 
     invalidateIterator();
 
@@ -137,6 +146,10 @@ PassRefPtr<StorageMap> StorageMap::removeItem(const String& key, String& oldValu
     if (!oldValue.isNull())
         invalidateIterator();
 
+    // Update quota.
+    ASSERT(m_currentLength - oldValue.length() <= m_currentLength);
+    m_currentLength -= oldValue.length();
+
     return 0;
 }
 
@@ -145,14 +158,18 @@ bool StorageMap::contains(const String& key) const
     return m_map.contains(key);
 }
 
-void StorageMap::importItem(const String& key, const String& value) const
+void StorageMap::importItem(const String& key, const String& value)
 {
     // Be sure to copy the keys/values as items imported on a background thread are destined
     // to cross a thread boundary
-    pair<HashMap<String, String>::iterator, bool> result = m_map.add(key.copy(), String());
+    pair<HashMap<String, String>::iterator, bool> result = m_map.add(key.threadsafeCopy(), String());
 
     if (result.second)
-        result.first->second = value.copy();
+        result.first->second = value.threadsafeCopy();
+
+    // Update quota.
+    ASSERT(m_currentLength + value.length() >= m_currentLength);
+    m_currentLength += value.length();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageMap.h b/src/3rdparty/webkit/WebCore/storage/StorageMap.h
index afb90bb257..fa5f46c467 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageMap.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageMap.h
@@ -39,27 +39,35 @@ namespace WebCore {
 
     class StorageMap : public RefCounted<StorageMap> {
     public:
-        static PassRefPtr<StorageMap> create();
+        // Quota size mesured in bytes.
+        static PassRefPtr<StorageMap> create(unsigned quotaSize);
 
         unsigned length() const;
-        String key(unsigned index) const;
+        String key(unsigned index);
         String getItem(const String&) const;
-        PassRefPtr<StorageMap> setItem(const String& key, const String& value, String& oldValue);
+        PassRefPtr<StorageMap> setItem(const String& key, const String& value, String& oldValue, bool& quota_exception);
         PassRefPtr<StorageMap> removeItem(const String&, String& oldValue);
 
         bool contains(const String& key) const;
 
-        void importItem(const String& key, const String& value) const;
+        void importItem(const String& key, const String& value);
+
+        unsigned quota() const { return m_quotaSize; }
+
+        static const unsigned noQuota = UINT_MAX;
 
     private:
-        StorageMap();
+        StorageMap(unsigned quota);
         PassRefPtr<StorageMap> copy();
         void invalidateIterator();
-        void setIteratorToIndex(unsigned) const;
+        void setIteratorToIndex(unsigned);
+
+        HashMap<String, String> m_map;
+        HashMap<String, String>::iterator m_iterator;
+        unsigned m_iteratorIndex;
 
-        mutable HashMap<String, String> m_map;
-        mutable HashMap<String, String>::iterator m_iterator;
-        mutable unsigned m_iteratorIndex;
+        unsigned m_quotaSize;  // Measured in bytes.
+        unsigned m_currentLength;  // Measured in UChars.
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp
index 6fcae63ec3..6b8caebc00 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp
@@ -36,9 +36,9 @@
 
 namespace WebCore {
 
-PassRefPtr<StorageNamespace> StorageNamespace::localStorageNamespace(const String& path)
+PassRefPtr<StorageNamespace> StorageNamespace::localStorageNamespace(const String& path, unsigned quota)
 {
-    return StorageNamespaceImpl::localStorageNamespace(path);
+    return StorageNamespaceImpl::localStorageNamespace(path, quota);
 }
 
 PassRefPtr<StorageNamespace> StorageNamespace::sessionStorageNamespace()
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
index 6866746c42..0ac5f8628f 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
@@ -41,7 +41,7 @@ namespace WebCore {
     // This interface is required for Chromium since these actions need to be proxied between processes.
     class StorageNamespace : public RefCounted<StorageNamespace> {
     public:
-        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path);
+        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path, unsigned quota);
         static PassRefPtr<StorageNamespace> sessionStorageNamespace();
 
         virtual ~StorageNamespace() { }
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp
index d5af31f61f..19ff6b4832 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp
@@ -31,6 +31,7 @@
 #include "SecurityOriginHash.h"
 #include "StringHash.h"
 #include "StorageAreaImpl.h"
+#include "StorageMap.h"
 #include "StorageSyncManager.h"
 #include <wtf/StdLibExtras.h>
 
@@ -44,12 +45,12 @@ static LocalStorageNamespaceMap& localStorageNamespaceMap()
     return localStorageNamespaceMap;
 }
 
-PassRefPtr<StorageNamespace> StorageNamespaceImpl::localStorageNamespace(const String& path)
+PassRefPtr<StorageNamespace> StorageNamespaceImpl::localStorageNamespace(const String& path, unsigned quota)
 {
     const String lookupPath = path.isNull() ? String("") : path;
     LocalStorageNamespaceMap::iterator it = localStorageNamespaceMap().find(lookupPath);
     if (it == localStorageNamespaceMap().end()) {
-        RefPtr<StorageNamespace> storageNamespace = adoptRef(new StorageNamespaceImpl(LocalStorage, lookupPath));
+        RefPtr<StorageNamespace> storageNamespace = adoptRef(new StorageNamespaceImpl(LocalStorage, lookupPath, quota));
         localStorageNamespaceMap().set(lookupPath, storageNamespace.get());
         return storageNamespace.release();
     }
@@ -59,13 +60,14 @@ PassRefPtr<StorageNamespace> StorageNamespaceImpl::localStorageNamespace(const S
 
 PassRefPtr<StorageNamespace> StorageNamespaceImpl::sessionStorageNamespace()
 {
-    return adoptRef(new StorageNamespaceImpl(SessionStorage, String()));
+    return adoptRef(new StorageNamespaceImpl(SessionStorage, String(), StorageMap::noQuota));
 }
 
-StorageNamespaceImpl::StorageNamespaceImpl(StorageType storageType, const String& path)
+StorageNamespaceImpl::StorageNamespaceImpl(StorageType storageType, const String& path, unsigned quota)
     : m_storageType(storageType)
-    , m_path(path.copy())  // Copy makes it safe for our other thread to access the path.
+    , m_path(path.crossThreadString())
     , m_syncManager(0)
+    , m_quota(quota)
     , m_isShutdown(false)
 {
     if (m_storageType == LocalStorage && !m_path.isEmpty())
@@ -91,7 +93,7 @@ PassRefPtr<StorageNamespace> StorageNamespaceImpl::copy()
     ASSERT(!m_isShutdown);
     ASSERT(m_storageType == SessionStorage);
 
-    StorageNamespaceImpl* newNamespace = new StorageNamespaceImpl(m_storageType, m_path);
+    StorageNamespaceImpl* newNamespace = new StorageNamespaceImpl(m_storageType, m_path, m_quota);
 
     StorageAreaMap::iterator end = m_storageAreaMap.end();
     for (StorageAreaMap::iterator i = m_storageAreaMap.begin(); i != end; ++i)
@@ -109,7 +111,7 @@ PassRefPtr<StorageArea> StorageNamespaceImpl::storageArea(PassRefPtr<SecurityOri
     if (storageArea = m_storageAreaMap.get(origin))
         return storageArea.release();
 
-    storageArea = StorageAreaImpl::create(m_storageType, origin, m_syncManager);
+    storageArea = StorageAreaImpl::create(m_storageType, origin, m_syncManager, m_quota);
     m_storageAreaMap.set(origin.release(), storageArea);
     return storageArea.release();
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h
index 05a12ad277..b81b55a73b 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h
@@ -42,7 +42,7 @@ namespace WebCore {
 
     class StorageNamespaceImpl : public StorageNamespace {
     public:
-        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path);
+        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path, unsigned quota);
         static PassRefPtr<StorageNamespace> sessionStorageNamespace();
 
         virtual ~StorageNamespaceImpl();
@@ -52,7 +52,7 @@ namespace WebCore {
         virtual void unlock();
 
     private:
-        StorageNamespaceImpl(StorageType, const String& path);
+        StorageNamespaceImpl(StorageType, const String& path, unsigned quota);
 
         typedef HashMap<RefPtr<SecurityOrigin>, RefPtr<StorageAreaImpl>, SecurityOriginHash> StorageAreaMap;
         StorageAreaMap m_storageAreaMap;
@@ -63,6 +63,7 @@ namespace WebCore {
         String m_path;
         RefPtr<StorageSyncManager> m_syncManager;
 
+        unsigned m_quota;  // The default quota for each new storage area.
         bool m_isShutdown;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
index 961b9b26d2..f9276ddae6 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
@@ -48,8 +48,9 @@ PassRefPtr<StorageSyncManager> StorageSyncManager::create(const String& path)
 }
 
 StorageSyncManager::StorageSyncManager(const String& path)
-    : m_path(path.copy())
+    : m_path(path.crossThreadString())
 {
+    ASSERT(isMainThread());
     ASSERT(!m_path.isEmpty());
     m_thread = LocalStorageThread::create();
     m_thread->start();
@@ -57,6 +58,7 @@ StorageSyncManager::StorageSyncManager(const String& path)
 
 StorageSyncManager::~StorageSyncManager()
 {
+    ASSERT(isMainThread());
 }
 
 String StorageSyncManager::fullDatabaseFilename(SecurityOrigin* origin)
@@ -85,7 +87,7 @@ bool StorageSyncManager::scheduleImport(PassRefPtr<StorageAreaSync> area)
     ASSERT(isMainThread());
 
     if (m_thread)
-        m_thread->scheduleImport(area);
+        m_thread->scheduleImport(area.get());
 
     return m_thread;
 }
@@ -95,7 +97,7 @@ void StorageSyncManager::scheduleSync(PassRefPtr<StorageAreaSync> area)
     ASSERT(isMainThread());
 
     if (m_thread)
-        m_thread->scheduleSync(area);
+        m_thread->scheduleSync(area.get());
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
index b8c817f766..fe35e3daaa 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
@@ -31,8 +31,8 @@
 #include "PlatformString.h"
 
 #include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
-#include <wtf/Threading.h>
 
 namespace WebCore {
 
@@ -40,7 +40,7 @@ namespace WebCore {
     class SecurityOrigin;
     class StorageAreaSync;
 
-    class StorageSyncManager : public ThreadSafeShared<StorageSyncManager> {
+    class StorageSyncManager : public RefCounted<StorageSyncManager> {
     public:
         static PassRefPtr<StorageSyncManager> create(const String& path);
         ~StorageSyncManager();
diff --git a/src/3rdparty/webkit/WebCore/svg/LinearGradientAttributes.h b/src/3rdparty/webkit/WebCore/svg/LinearGradientAttributes.h
index fc5946579b..0aefbac891 100644
--- a/src/3rdparty/webkit/WebCore/svg/LinearGradientAttributes.h
+++ b/src/3rdparty/webkit/WebCore/svg/LinearGradientAttributes.h
@@ -29,10 +29,10 @@
 namespace WebCore {
     struct LinearGradientAttributes : GradientAttributes {
         LinearGradientAttributes()
-            : m_x1(0.0)
-            , m_y1(0.0)
-            , m_x2(1.0)
-            , m_y2(0.0)
+            : m_x1()
+            , m_y1()
+            , m_x2(LengthModeWidth, "100%")
+            , m_y2()
             , m_x1Set(false)
             , m_y1Set(false)
             , m_x2Set(false)
@@ -40,15 +40,15 @@ namespace WebCore {
         {
         }
 
-        double x1() const { return m_x1; }
-        double y1() const { return m_y1; }
-        double x2() const { return m_x2; }
-        double y2() const { return m_y2; }
+        SVGLength x1() const { return m_x1; }
+        SVGLength y1() const { return m_y1; }
+        SVGLength x2() const { return m_x2; }
+        SVGLength y2() const { return m_y2; }
 
-        void setX1(double value) { m_x1 = value; m_x1Set = true; }
-        void setY1(double value) { m_y1 = value; m_y1Set = true; }
-        void setX2(double value) { m_x2 = value; m_x2Set = true; }
-        void setY2(double value) { m_y2 = value; m_y2Set = true; }
+        void setX1(const SVGLength& value) { m_x1 = value; m_x1Set = true; }
+        void setY1(const SVGLength& value) { m_y1 = value; m_y1Set = true; }
+        void setX2(const SVGLength& value) { m_x2 = value; m_x2Set = true; }
+        void setY2(const SVGLength& value) { m_y2 = value; m_y2Set = true; }
 
         bool hasX1() const { return m_x1Set; }
         bool hasY1() const { return m_y1Set; }
@@ -57,10 +57,10 @@ namespace WebCore {
 
     private:
         // Properties
-        double m_x1;
-        double m_y1;
-        double m_x2;
-        double m_y2;
+        SVGLength m_x1;
+        SVGLength m_y1;
+        SVGLength m_x2;
+        SVGLength m_y2;
 
         // Property states
         bool m_x1Set : 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/RadialGradientAttributes.h b/src/3rdparty/webkit/WebCore/svg/RadialGradientAttributes.h
index 273cd297a1..76457215a6 100644
--- a/src/3rdparty/webkit/WebCore/svg/RadialGradientAttributes.h
+++ b/src/3rdparty/webkit/WebCore/svg/RadialGradientAttributes.h
@@ -29,11 +29,11 @@
 namespace WebCore {
     struct RadialGradientAttributes : GradientAttributes {
         RadialGradientAttributes()
-            : m_cx(0.5)
-            , m_cy(0.5)
-            , m_r(0.5)
-            , m_fx(0.0)
-            , m_fy(0.0)
+            : m_cx(LengthModeWidth, "50%")
+            , m_cy(LengthModeWidth, "50%")
+            , m_r(LengthModeWidth, "50%")
+            , m_fx()
+            , m_fy()
             , m_cxSet(false)
             , m_cySet(false)
             , m_rSet(false)
@@ -42,17 +42,17 @@ namespace WebCore {
         {
         }
 
-        double cx() const { return m_cx; }
-        double cy() const { return m_cy; }
-        double r() const { return m_r; }
-        double fx() const { return m_fx; }
-        double fy() const { return m_fy; }
+        SVGLength cx() const { return m_cx; }
+        SVGLength cy() const { return m_cy; }
+        SVGLength r() const { return m_r; }
+        SVGLength fx() const { return m_fx; }
+        SVGLength fy() const { return m_fy; }
 
-        void setCx(double value) { m_cx = value; m_cxSet = true; }
-        void setCy(double value) { m_cy = value; m_cySet = true; }
-        void setR(double value) { m_r = value; m_rSet = true; }
-        void setFx(double value) { m_fx = value; m_fxSet = true; }
-        void setFy(double value) { m_fy = value; m_fySet = true; }
+        void setCx(const SVGLength& value) { m_cx = value; m_cxSet = true; }
+        void setCy(const SVGLength& value) { m_cy = value; m_cySet = true; }
+        void setR(const SVGLength& value) { m_r = value; m_rSet = true; }
+        void setFx(const SVGLength& value) { m_fx = value; m_fxSet = true; }
+        void setFy(const SVGLength& value) { m_fy = value; m_fySet = true; }
 
         bool hasCx() const { return m_cxSet; }
         bool hasCy() const { return m_cySet; }
@@ -62,11 +62,11 @@ namespace WebCore {
 
     private:
         // Properties
-        double m_cx;
-        double m_cy;
-        double m_r;
-        double m_fx;
-        double m_fy;
+        SVGLength m_cx;
+        SVGLength m_cy;
+        SVGLength m_r;
+        SVGLength m_fx;
+        SVGLength m_fy;
 
         // Property states
         bool m_cxSet : 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp
index 6bf7f91e9b..7cb7b3e917 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp
@@ -33,6 +33,7 @@
 #include "EventNames.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderTypes.h"
 #include "KeyboardEvent.h"
 #include "MappedAttribute.h"
 #include "MouseEvent.h"
@@ -53,6 +54,8 @@ SVGAElement::SVGAElement(const QualifiedName& tagName, Document *doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_target(this, SVGNames::targetAttr)
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -152,7 +155,7 @@ void SVGAElement::defaultEventHandler(Event* evt)
             }
 #endif
             if (document()->frame())
-                document()->frame()->loader()->urlSelected(document()->completeURL(url), target, evt, false, false, true);
+                document()->frame()->loader()->urlSelected(document()->completeURL(url), target, evt, false, false, true, SendReferrer);
         }
 
         evt->setDefaultHandled();
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAElement.h b/src/3rdparty/webkit/WebCore/svg/SVGAElement.h
index 8890ca4662..a3e59c5785 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAElement.h
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
                   2007 Eric Seidel <eric@webkit.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -60,11 +58,16 @@ namespace WebCore {
 
         virtual bool childShouldCreateRenderer(Node*) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGNames::aTagString, SVGNames::targetAttrString, String, Target, target)
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp
index 6ca45396d4..66062439ae 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp
@@ -67,6 +67,7 @@
 #include "SVGFELightElement.cpp"
 #include "SVGFEMergeElement.cpp"
 #include "SVGFEMergeNodeElement.cpp"
+#include "SVGFEMorphologyElement.cpp"
 #include "SVGFEOffsetElement.cpp"
 #include "SVGFEPointLightElement.cpp"
 #include "SVGFESpecularLightingElement.cpp"
@@ -149,3 +150,4 @@
 #include "SVGViewSpec.cpp"
 #include "SVGZoomAndPan.cpp"
 #include "SVGZoomEvent.cpp"
+#include "SynchronizablePropertyController.cpp"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.cpp
index d9da3f6386..f13edf582d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.cpp
@@ -35,6 +35,7 @@ namespace WebCore {
 
 SVGAltGlyphElement::SVGAltGlyphElement(const QualifiedName& tagName, Document* doc)
     : SVGTextPositioningElement(tagName, doc)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.h b/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.h
index 91c99e36a6..b5718808d2 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.h
@@ -47,8 +47,9 @@ namespace WebCore {
     
         SVGGlyphElement* glyphElement() const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
+    private:    
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGAltGlyphElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
index 6803055580..984046fbe3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
@@ -1,5 +1,6 @@
 /*
     Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
+    Copyright (C) Research In Motion Limited 2009. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -62,14 +63,16 @@ namespace WebCore {
     struct IsDerivedFromSVGElement;
 
     // Helper template used for synchronizing SVG <-> XML properties
-    template<typename OwnerElement, typename DecoratedType>
-    void synchronizeProperty(const OwnerElement* ownerElement, const QualifiedName& attributeName, DecoratedType baseValue);
+    template<typename OwnerType, typename DecoratedType, bool isDerivedFromSVGElement>
+    struct PropertySynchronizer;
 
     // Abstract base class
     class SVGAnimatedPropertyBase : public Noncopyable {
     public:
         virtual ~SVGAnimatedPropertyBase() { }
         virtual void synchronize() const = 0;
+        virtual void startAnimation() const = 0;
+        virtual void stopAnimation() = 0;
     };
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -124,6 +127,7 @@ namespace WebCore {
         // Tear offs only used by bindings, never in internal code
         PassRefPtr<TearOff> animatedTearOff() const;
 
+        void registerProperty();
         virtual void synchronize() const;
 
         void startAnimation() const;
@@ -140,6 +144,10 @@ namespace WebCore {
         const AtomicString& m_attributeIdentifier;
 
         mutable SynchronizableTypeWrapper<StorableType> m_value;
+
+#ifndef NDEBUG
+        bool m_registered;
+#endif
     };
 
     // SVGAnimatedPropertyTearOff implementation
@@ -186,8 +194,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeName.localName())
         , m_value()
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -198,8 +210,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeIdentifier)
         , m_value()
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -211,8 +227,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeName.localName())
         , m_value(arg1)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -225,8 +245,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeIdentifier)
         , m_value(arg1)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -239,8 +263,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeName.localName())
         , m_value(arg1, arg2)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -254,8 +282,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeIdentifier)
         , m_value(arg1, arg2)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -269,8 +301,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeName.localName())
         , m_value(arg1, arg2, arg3)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -285,20 +321,26 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeIdentifier)
         , m_value(arg1, arg2, arg3)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     typename SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::DecoratedType
     SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::value() const
     {
+        ASSERT(m_registered);
         return m_value;
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::setValue(typename SVGAnimatedProperty::DecoratedType newValue)
     {
+        ASSERT(m_registered);
         m_value = newValue;
         ownerElement()->setSynchronizedSVGAttributes(false);
     }
@@ -307,6 +349,7 @@ namespace WebCore {
     typename SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::DecoratedType
     SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::baseValue() const
     {
+        ASSERT(m_registered);
         const OwnerElement* ownerElement = this->ownerElement();
         SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions();
         if (extensions && extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier))
@@ -318,6 +361,7 @@ namespace WebCore {
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::setBaseValue(typename SVGAnimatedProperty::DecoratedType newValue)
     {
+        ASSERT(m_registered);
         const OwnerElement* ownerElement = this->ownerElement();
         SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions();
         if (extensions && extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier)) {
@@ -334,25 +378,38 @@ namespace WebCore {
     PassRefPtr<typename SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::TearOff>
     SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::animatedTearOff() const
     {
+        ASSERT(m_registered);
         return lookupOrCreateWrapper<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName, TearOff, OwnerElement>(*this, ownerElement(), m_attributeName, m_attributeIdentifier);
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
+    void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::registerProperty()
+    {
+        ASSERT(!m_registered);
+        ownerElement()->propertyController().registerProperty(m_attributeName, this);
+
+#ifndef NDEBUG
+        m_registered = true;
+#endif
+    }
+
+    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::synchronize() const
     {
+        ASSERT(m_registered);
         if (!m_value.needsSynchronization()) 
             return; 
 
-        synchronizeProperty<OwnerElement, DecoratedType>(ownerElement(), m_attributeName, baseValue());
+        PropertySynchronizer<OwnerElement, DecoratedType, IsDerivedFromSVGElement<OwnerType>::value>::synchronize(ownerElement(), m_attributeName, baseValue());
         m_value.setSynchronized(); 
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::startAnimation() const
     {
+        ASSERT(m_registered);
         const OwnerElement* ownerElement = this->ownerElement();
-        SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions();
-        if (extensions) {
+        if (SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions()) {
             ASSERT(!extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier));
             extensions->setBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier, m_value);
         }
@@ -361,12 +418,12 @@ namespace WebCore {
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::stopAnimation()
     {
+        ASSERT(m_registered);
         const OwnerElement* ownerElement = this->ownerElement();
-        SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions();
-        if (extensions) {
+        if (SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions()) {
             ASSERT(extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier));
             setValue(extensions->baseValue<DecoratedType>(ownerElement, m_attributeIdentifier));
-            extensions->removeBaseValue<AnimatedType>(ownerElement, m_attributeIdentifier);
+            extensions->removeBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier);
         }
     }
 
@@ -406,39 +463,37 @@ namespace WebCore {
         static const bool value = true;
     };
 
-    class SVGExternalResourcesRequired;
-    template<>
-    struct IsDerivedFromSVGElement<SVGExternalResourcesRequired> : Noncopyable {
-        static const bool value = false;
-    };
-
-    class SVGFitToViewBox;
+    class SVGViewSpec;
     template<>
-    struct IsDerivedFromSVGElement<SVGFitToViewBox> : Noncopyable {
+    struct IsDerivedFromSVGElement<SVGViewSpec> : Noncopyable {
         static const bool value = false;
     };
 
-    class SVGURIReference;
-    template<>
-    struct IsDerivedFromSVGElement<SVGURIReference> : Noncopyable {
-        static const bool value = false;
+    // PropertySynchronizer implementation
+    template<typename OwnerElement, typename DecoratedType>
+    struct PropertySynchronizer<OwnerElement, DecoratedType, true> : Noncopyable {
+        static void synchronize(const OwnerElement* ownerElement, const QualifiedName& attributeName, DecoratedType baseValue)
+        {
+            AtomicString value(SVGAnimatedTypeValue<DecoratedType>::toString(baseValue));
+
+            NamedNodeMap* namedAttrMap = ownerElement->attributes(false); 
+            Attribute* old = namedAttrMap->getAttributeItem(attributeName);
+            if (old && value.isNull()) 
+                namedAttrMap->removeAttribute(old->name()); 
+            else if (!old && !value.isNull()) 
+                namedAttrMap->addAttribute(const_cast<OwnerElement*>(ownerElement)->createAttribute(attributeName, value));
+            else if (old && !value.isNull()) 
+                old->setValue(value); 
+        }
     };
 
-    // Central function handling the main SVG<->XML synchronization part.
     template<typename OwnerElement, typename DecoratedType>
-    void synchronizeProperty(const OwnerElement* ownerElement, const QualifiedName& attributeName, DecoratedType baseValue)
-    {
-        AtomicString value(SVGAnimatedTypeValue<DecoratedType>::toString(baseValue));
-
-        NamedNodeMap* namedAttrMap = ownerElement->attributes(false); 
-        Attribute* old = namedAttrMap->getAttributeItem(attributeName);
-        if (old && value.isNull()) 
-            namedAttrMap->removeAttribute(old->name()); 
-        else if (!old && !value.isNull()) 
-            namedAttrMap->addAttribute(const_cast<OwnerElement*>(ownerElement)->createAttribute(attributeName, value));
-        else if (old && !value.isNull()) 
-            old->setValue(value); 
-    }
+    struct PropertySynchronizer<OwnerElement, DecoratedType, false> : Noncopyable {
+        static void synchronize(const OwnerElement*, const QualifiedName&, DecoratedType)
+        {
+            // no-op, for types not inheriting from Element, thus nothing to synchronize
+        }
+    };
 
     // Helper macro used to register animated properties within SVG* classes
     #define ANIMATED_PROPERTY_DECLARATIONS(OwnerType, ElementTag, AttributeTag, AnimatedType, UpperProperty, LowerProperty) \
@@ -451,8 +506,7 @@ namespace WebCore {
         void set##UpperProperty(DecoratedTypeFor##UpperProperty type) { m_##LowerProperty.setValue(type); } \
         DecoratedTypeFor##UpperProperty LowerProperty##BaseValue() const { return m_##LowerProperty.baseValue(); } \
         void set##UpperProperty##BaseValue(DecoratedTypeFor##UpperProperty type) { m_##LowerProperty.setBaseValue(type); } \
-        PassRefPtr<SVGAnimatedProperty##UpperProperty::TearOff> LowerProperty##Animated() const { return m_##LowerProperty.animatedTearOff(); } \
-        void synchronize##UpperProperty() const { m_##LowerProperty.synchronize(); }
+        PassRefPtr<SVGAnimatedProperty##UpperProperty::TearOff> LowerProperty##Animated() const { return m_##LowerProperty.animatedTearOff(); }
 
 };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedTemplate.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedTemplate.h
index 3f04c5bd8e..e7c49c157b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedTemplate.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedTemplate.h
@@ -158,7 +158,7 @@ namespace WebCore {
 
         if (!wrapper) {
             wrapper = Type::create(creator, element, attrName);
-            element->addSVGPropertySynchronizer(attrName, creator);
+            element->propertyController().setPropertyNeedsSynchronization(attrName);
             Type::wrapperCache()->set(key, wrapper.get());
         }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp
index cf945f858e..67e32e04d0 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp
@@ -52,7 +52,8 @@ namespace WebCore {
 SVGAnimationElement::SVGAnimationElement(const QualifiedName& tagName, Document* doc)
     : SVGSMILElement(tagName, doc)
     , SVGTests()
-    , SVGExternalResourcesRequired()
+    , SVGExternalResourcesRequired() 
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
     , m_animationValid(false)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h
index 1835a8db7e..b0b091b72b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h
@@ -1,12 +1,10 @@
 /*
-    Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
+    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
     Copyright (C) 2008 Cameron McCormack <cam@mcc.id.au>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -66,8 +64,6 @@ namespace WebCore {
         static bool attributeIsCSS(const String& attributeName);
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
- 
         enum CalcMode { CalcModeDiscrete, CalcModeLinear, CalcModePaced, CalcModeSpline };
         CalcMode calcMode() const;
         
@@ -109,6 +105,11 @@ namespace WebCore {
         float calculatePercentForSpline(float percent, unsigned splineIndex) const;
         
     protected:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGAnimationElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         bool m_animationValid;
 
         Vector<String> m_values;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp
index 0c48f5130e..23292991d6 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp
@@ -41,6 +41,7 @@ SVGCircleElement::SVGCircleElement(const QualifiedName& tagName, Document* doc)
     , m_cx(this, SVGNames::cxAttr, LengthModeWidth)
     , m_cy(this, SVGNames::cyAttr, LengthModeHeight)
     , m_r(this, SVGNames::rAttr, LengthModeOther)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.h b/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.h
index 598e51fa3a..69b015de9e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -47,13 +45,17 @@ namespace WebCore {
         virtual Path toPathData() const;
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
         virtual bool hasRelativeValues() const;
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGNames::circleTagString, SVGNames::cxAttrString, SVGLength, Cx, cx)
         ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGNames::circleTagString, SVGNames::cyAttrString, SVGLength, Cy, cy)
         ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGNames::circleTagString, SVGNames::rAttrString, SVGLength, R, r)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp
index 691e4d5baa..bbeac910b8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp
@@ -40,6 +40,7 @@ SVGClipPathElement::SVGClipPathElement(const QualifiedName& tagName, Document* d
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_clipPathUnits(this, SVGNames::clipPathUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.h b/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.h
index 4043554f89..60791591ca 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -49,12 +47,14 @@ namespace WebCore {
 
         virtual SVGResource* canvasResource();
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGClipPathElement, SVGNames::clipPathTagString, SVGNames::clipPathUnitsAttrString, int, ClipPathUnits, clipPathUnits)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGClipPathElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         RefPtr<SVGResourceClipper> m_clipper;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp
index 12e9e5da89..b282aa3c54 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp
@@ -40,6 +40,8 @@ SVGCursorElement::SVGCursorElement(const QualifiedName& tagName, Document* doc)
     , SVGURIReference()
     , m_x(this, SVGNames::xAttr, LengthModeWidth)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.h b/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.h
index ddafb76de9..ee919a4762 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -50,13 +48,18 @@ namespace WebCore {
 
         virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGNames::cursorTagString, SVGNames::xAttrString, SVGLength, X, x)
         ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGNames::cursorTagString, SVGNames::yAttrString, SVGLength, Y, y)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         HashSet<SVGElement*> m_clients;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.cpp
index b084bb282d..c03c09b26e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.cpp
@@ -34,6 +34,7 @@ SVGDefsElement::SVGDefsElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.h b/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.h
index c4cac62660..4bb206e4f2 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -43,8 +41,11 @@ namespace WebCore {
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
+    private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGDefsElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp
index 2169dd6032..a16493ada1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp
@@ -3,6 +3,7 @@
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
     Copyright (C) 2008 Alp Toker <alp@atoker.com>
+    Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -77,16 +78,6 @@ bool SVGElement::isSupported(StringImpl* feature, StringImpl* version) const
     return DOMImplementation::hasFeature(feature, version);
 }
 
-String SVGElement::id() const
-{
-    return getAttribute(idAttr);
-}
-
-void SVGElement::setId(const String& value, ExceptionCode&)
-{
-    setAttribute(idAttr, value);
-}
-
 String SVGElement::xmlbase() const
 {
     return getAttribute(XMLNames::baseAttr);
@@ -243,7 +234,7 @@ void SVGElement::insertedIntoDocument()
     StyledElement::insertedIntoDocument();
     SVGDocumentExtensions* extensions = document()->accessSVGExtensions();
 
-    String resourceId = SVGURIReference::getTarget(id());
+    String resourceId = SVGURIReference::getTarget(getAttribute(idAttr));
     if (extensions->isPendingResource(resourceId)) {
         std::auto_ptr<HashSet<SVGStyledElement*> > clients(extensions->removePendingResource(resourceId));
         if (clients->isEmpty())
@@ -279,10 +270,10 @@ void SVGElement::updateAnimatedSVGAttribute(const String& name) const
     m_synchronizingSVGAttributes = true;
 
     if (name.isEmpty()) {
-        invokeAllSVGPropertySynchronizers();
+        m_propertyController.synchronizeAllProperties();
         setSynchronizedSVGAttributes(true);
     } else
-        invokeSVGPropertySynchronizer(name);
+        m_propertyController.synchronizeProperty(name);
 
     m_synchronizingSVGAttributes = false;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElement.h b/src/3rdparty/webkit/WebCore/svg/SVGElement.h
index 3a17567050..b247a7472a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElement.h
@@ -25,6 +25,7 @@
 #if ENABLE(SVG)
 #include "StyledElement.h"
 #include "SVGAnimatedProperty.h"
+#include "SynchronizablePropertyController.h"
 
 namespace WebCore {
 
@@ -41,8 +42,6 @@ namespace WebCore {
         static PassRefPtr<SVGElement> create(const QualifiedName&, Document*);
         virtual ~SVGElement();
 
-        String id() const;
-        void setId(const String&, ExceptionCode&);
         String xmlbase() const;
         void setXmlbase(const String&, ExceptionCode&);
 
@@ -79,14 +78,11 @@ namespace WebCore {
 
         HashSet<SVGElementInstance*> instancesForElement() const;
 
-        void addSVGPropertySynchronizer(const QualifiedName& attrName, const SVGAnimatedPropertyBase& base) const
-        {
-            m_svgPropertyMap.set(attrName.localName(), &base);
-        }
-
         void setCursorElement(SVGCursorElement* cursorElement) { m_cursorElement = cursorElement; }
         void setCursorImageValue(CSSCursorImageValue* cursorImageValue) { m_cursorImageValue = cursorImageValue; }
 
+        SynchronizablePropertyController& propertyController() const { return m_propertyController; }
+
     protected:
         SVGElement(const QualifiedName&, Document*);
 
@@ -108,36 +104,13 @@ namespace WebCore {
 
         virtual void buildPendingResource() { }
 
-        // Inlined methods handling SVG property synchronization
-        void invokeSVGPropertySynchronizer(const String& name) const
-        {
-            if (m_svgPropertyMap.contains(name)) {
-                const SVGAnimatedPropertyBase* property = m_svgPropertyMap.get(name);
-                ASSERT(property);
-
-                property->synchronize();
-            }
-        }
-
-        void invokeAllSVGPropertySynchronizers() const
-        {
-            HashMap<String, const SVGAnimatedPropertyBase*>::const_iterator it = m_svgPropertyMap.begin();
-            const HashMap<String, const SVGAnimatedPropertyBase*>::const_iterator end = m_svgPropertyMap.end();
-            for (; it != end; ++it) {
-                const SVGAnimatedPropertyBase* property = it->second;
-                ASSERT(property);
-
-                property->synchronize();
-            }
-        }
-
         void mapInstanceToElement(SVGElementInstance*);
         void removeInstanceMapping(SVGElementInstance*);
 
         virtual bool haveLoadedRequiredResources();
 
         ContainerNode* m_shadowParent;
-        mutable HashMap<String, const SVGAnimatedPropertyBase*> m_svgPropertyMap;
+        mutable SynchronizablePropertyController m_propertyController;
 
         SVGCursorElement* m_cursorElement;
         CSSCursorImageValue* m_cursorImageValue;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGElement.idl
index a1f331f96a..e4112c1fac 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElement.idl
@@ -25,7 +25,7 @@
 module svg {
 
     interface [GenerateNativeConverter, Conditional=SVG] SVGElement : Element {
-                 attribute [ConvertNullToNullString] DOMString id
+                 attribute [ConvertNullToNullString, Reflect] DOMString id
                      setter raises(DOMException);
                  attribute [ConvertNullToNullString] DOMString xmlbase
                      setter raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp
index 6d56ff82a0..4c67ff3e44 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp
@@ -42,6 +42,7 @@ SVGEllipseElement::SVGEllipseElement(const QualifiedName& tagName, Document* doc
     , m_cy(this, SVGNames::cyAttr, LengthModeHeight)
     , m_rx(this, SVGNames::rxAttr, LengthModeWidth)
     , m_ry(this, SVGNames::ryAttr, LengthModeHeight)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }    
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.h b/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.h
index 8c7d3a1269..5b54fd5949 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -47,7 +45,6 @@ namespace WebCore {
         virtual Path toPathData() const;
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
         virtual bool hasRelativeValues() const;
 
     private:
@@ -55,6 +52,11 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGNames::ellipseTagString, SVGNames::cyAttrString, SVGLength, Cy, cy)
         ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGNames::ellipseTagString, SVGNames::rxAttrString, SVGLength, Rx, rx)
         ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGNames::ellipseTagString, SVGNames::ryAttrString, SVGLength, Ry, ry)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp
index 640f92e5b3..201ecbf920 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp
@@ -35,7 +35,6 @@ namespace WebCore {
 char SVGExternalResourcesRequiredIdentifier[] = "SVGExternalResourcesRequired";
 
 SVGExternalResourcesRequired::SVGExternalResourcesRequired()
-    : m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h
index e491e4b86b..f088c82684 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -32,16 +30,11 @@ namespace WebCore {
     extern char SVGExternalResourcesRequiredIdentifier[];
     class MappedAttribute;
 
-    // FIXME: This is wrong for several reasons:
-    // 1. externalResourcesRequired is not animateable according to SVG 1.1 section 5.9
-    // 2. externalResourcesRequired should just be part of SVGElement, and default to "false" for all elements
-    /*
-     SPEC: Note that the SVG DOM 
-     defines the attribute externalResourcesRequired as being of type SVGAnimatedBoolean, whereas the 
-     SVG language definition says that externalResourcesRequired is not animated. Because the SVG 
-     language definition states that externalResourcesRequired cannot be animated, the animVal will 
-     always be the same as the baseVal.
-     */
+    // Notes on a SVG 1.1 spec discrepancy:
+    // The SVG DOM defines the attribute externalResourcesRequired as being of type SVGAnimatedBoolean, whereas the 
+    // SVG language definition says that externalResourcesRequired is not animated. Because the SVG language definition
+    // states that externalResourcesRequired cannot be animated, the animVal will always be the same as the baseVal.
+    // FIXME: When implementing animVal support, make sure that animVal==baseVal for externalResourcesRequired
     class SVGExternalResourcesRequired {
     public:
         SVGExternalResourcesRequired();
@@ -50,12 +43,8 @@ namespace WebCore {
         bool parseMappedAttribute(MappedAttribute*);
         bool isKnownAttribute(const QualifiedName&);
 
-        virtual const SVGElement* contextElement() const = 0;
-
-    private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGExternalResourcesRequired, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+    protected:
+        virtual void setExternalResourcesRequiredBaseValue(SVGAnimatedTypeValue<bool>::DecoratedType type) = 0;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl
index 97a13fc5f7..d3179979e3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl
@@ -38,7 +38,7 @@ module svg {
 
         readonly attribute SVGAnimatedString      in1;
         readonly attribute SVGAnimatedString      in2;
-        readonly attribute SVGAnimatedEnumeration _operator;
+        readonly attribute SVGAnimatedEnumeration operator;
         readonly attribute SVGAnimatedNumber      k1;
         readonly attribute SVGAnimatedNumber      k2;
         readonly attribute SVGAnimatedNumber      k3;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp
index ae5ce94dc1..3d807994cc 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp
@@ -34,7 +34,6 @@ namespace WebCore {
 
 SVGFEFloodElement::SVGFEFloodElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_in1(this, SVGNames::inAttr)
 {
 }
 
@@ -42,28 +41,14 @@ SVGFEFloodElement::~SVGFEFloodElement()
 {
 }
 
-void SVGFEFloodElement::parseMappedAttribute(MappedAttribute* attr)
-{
-    const String& value = attr->value();
-    if (attr->name() == SVGNames::inAttr)
-        setIn1BaseValue(value);
-    else
-        SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
-}
-
 bool SVGFEFloodElement::build(SVGResourceFilter* filterResource)
 {
-    FilterEffect* input = filterResource->builder()->getEffectById(in1());
-
-    if (!input)
-        return false;
-
     RefPtr<RenderStyle> filterStyle = styleForRenderer();
 
     Color color = filterStyle->svgStyle()->floodColor();
     float opacity = filterStyle->svgStyle()->floodOpacity();
 
-    RefPtr<FilterEffect> effect = FEFlood::create(input, color, opacity);
+    RefPtr<FilterEffect> effect = FEFlood::create(color, opacity);
     filterResource->addFilterEffect(this, effect.release());
     
     return true;
@@ -71,6 +56,6 @@ bool SVGFEFloodElement::build(SVGResourceFilter* filterResource)
 
 }
 
-#endif // ENABLE(SVG)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 // vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h
index ca4e18b82e..e83fc94a29 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h
@@ -33,14 +33,10 @@ namespace WebCore {
         SVGFEFloodElement(const QualifiedName&, Document*);
         virtual ~SVGFEFloodElement();
 
-        virtual void parseMappedAttribute(MappedAttribute*);
         virtual bool build(SVGResourceFilter*);
-
-    private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEFloodElement, SVGNames::feFloodTagString, SVGNames::inAttrString, String, In1, in1)
     };
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 #endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl
index 814bbdfa5d..b3c3180024 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl
@@ -27,8 +27,5 @@ module svg {
 
     interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEFloodElement : SVGElement,
                                                     SVGFilterPrimitiveStandardAttributes {
-
-        readonly attribute SVGAnimatedString      in1;
-
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h
index 187c2129cc..c9bb61310b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h
@@ -24,7 +24,7 @@
 #define SVGFEGaussianBlurElement_h
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
-#include "SVGFEGaussianBlur.h"
+#include "FEGaussianBlur.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp
index 8122960479..269d6b2e38 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp
@@ -43,6 +43,8 @@ SVGFEImageElement::SVGFEImageElement(const QualifiedName& tagName, Document* doc
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h
index 67f3bd5e7d..7c6d89bad4 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -49,12 +47,17 @@ namespace WebCore {
         virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
         virtual bool build(SVGResourceFilter*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGNames::feImageTagString, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         CachedResourceHandle<CachedImage> m_cachedImage;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h
index f6e79fb1aa..92947a1f00 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h
@@ -39,9 +39,6 @@ namespace WebCore {
         virtual LightSource* lightSource() const = 0;
         virtual void parseMappedAttribute(MappedAttribute*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::azimuthAttrString, float, Azimuth, azimuth)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::elevationAttrString, float, Elevation, elevation)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp
index cb3a781716..8f4eed95c7 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp
@@ -45,6 +45,8 @@ bool SVGFEMergeElement::build(SVGResourceFilter* filterResource)
     for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
         if (n->hasTagName(SVGNames::feMergeNodeTag)) {
             FilterEffect* mergeEffect = filterResource->builder()->getEffectById(static_cast<SVGFEMergeNodeElement*>(n)->in1());
+            if (!mergeEffect)
+                return false;
             mergeInputs.append(mergeEffect);
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h
index 4633f98be9..cdec8d2152 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -36,9 +34,6 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEMergeNodeElement, SVGNames::feMergeNodeTagString, SVGNames::inAttrString, String, In1, in1)
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.cpp
new file mode 100644
index 0000000000..4a06188f52
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.cpp
@@ -0,0 +1,88 @@
+/*
+    Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "SVGFEMorphologyElement.h"
+
+#include "MappedAttribute.h"
+#include "SVGNames.h"
+#include "SVGParserUtilities.h"
+#include "SVGResourceFilter.h"
+
+namespace WebCore {
+
+char SVGRadiusXAttrIdentifier[] = "SVGRadiusXAttr";
+char SVGRadiusYAttrIdentifier[] = "SVGRadiusYAttr";
+
+SVGFEMorphologyElement::SVGFEMorphologyElement(const QualifiedName& tagName, Document* document)
+    : SVGFilterPrimitiveStandardAttributes(tagName, document)
+    , m_in1(this, SVGNames::inAttr)
+    , m__operator(this, SVGNames::operatorAttr, FEMORPHOLOGY_OPERATOR_ERODE)
+    , m_radiusX(this, SVGNames::radiusAttr)
+    , m_radiusY(this, SVGNames::radiusAttr)
+{
+}
+
+SVGFEMorphologyElement::~SVGFEMorphologyElement()
+{
+}
+
+void SVGFEMorphologyElement::setRadius(float, float)
+{
+    // FIXME: Needs an implementation.
+}
+
+void SVGFEMorphologyElement::parseMappedAttribute(MappedAttribute* attr)
+{
+    const String& value = attr->value();
+    if (attr->name() == SVGNames::operatorAttr) {
+        if (value == "erode")
+            set_operatorBaseValue(FEMORPHOLOGY_OPERATOR_ERODE);
+        else if (value == "dilate")
+            set_operatorBaseValue(FEMORPHOLOGY_OPERATOR_DILATE);
+    } else if (attr->name() == SVGNames::inAttr)
+        setIn1BaseValue(value);
+    else if (attr->name() == SVGNames::radiusAttr) {
+        float x, y;
+        if (parseNumberOptionalNumber(value, x, y)) {
+            setRadiusXBaseValue(x);
+            setRadiusYBaseValue(y);
+        }
+    } else
+        SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
+}
+
+bool SVGFEMorphologyElement::build(SVGResourceFilter* filterResource)
+{
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
+
+    if (!input1)
+        return false;
+
+    RefPtr<FilterEffect> effect = FEMorphology::create(input1, static_cast<MorphologyOperatorType>(_operator()), radiusX(), radiusY());
+    filterResource->addFilterEffect(this, effect.release());
+    
+    return true;
+}
+
+} //namespace WebCore
+
+#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.h
new file mode 100644
index 0000000000..6c1aec1e04
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.h
@@ -0,0 +1,52 @@
+/*
+    Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef SVGFEMorphologyElement_h
+#define SVGFEMorphologyElement_h
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "SVGFEMorphology.h"
+#include "SVGFilterPrimitiveStandardAttributes.h"
+
+namespace WebCore {
+
+    extern char SVGRadiusXAttrIdentifier[];
+    extern char SVGRadiusYAttrIdentifier[];
+
+    class SVGFEMorphologyElement : public SVGFilterPrimitiveStandardAttributes {
+    public:
+        SVGFEMorphologyElement(const QualifiedName&, Document*);
+        virtual ~SVGFEMorphologyElement();
+
+        void setRadius(float radiusX, float radiusY);
+
+        virtual void parseMappedAttribute(MappedAttribute*);
+        virtual bool build(SVGResourceFilter*);
+
+    private:
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGNames::inAttrString, String, In1, in1)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGNames::operatorAttrString, int, _operator, _operator)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGRadiusXAttrIdentifier, float, RadiusX, radiusX)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGRadiusYAttrIdentifier, float, RadiusY, radiusY)
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
+#endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.idl
new file mode 100644
index 0000000000..cce0e365a8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module svg {
+
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEMorphologyElement : SVGElement,
+                                                             SVGFilterPrimitiveStandardAttributes {
+        // Morphology Operators
+        const unsigned short SVG_MORPHOLOGY_OPERATOR_UNKNOWN  = 0;
+        const unsigned short SVG_MORPHOLOGY_OPERATOR_ERODE    = 1;
+        const unsigned short SVG_MORPHOLOGY_OPERATOR_DILATE   = 2;
+
+        readonly attribute SVGAnimatedString      in1;
+        readonly attribute SVGAnimatedEnumeration operator;
+        readonly attribute SVGAnimatedNumber      radiusX;
+        readonly attribute SVGAnimatedNumber      radiusY;
+
+        void setRadius(in float radiusX, in float radiusY);
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp
index 7703b6f8fa..db461796bd 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
     Copyright (C) 2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
+    Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
 
     This file is part of the KDE project
 
@@ -54,6 +55,8 @@ SVGFilterElement::SVGFilterElement(const QualifiedName& tagName, Document* doc)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight, "120%")
     , m_filterResX(this, SVGNames::filterResAttr)
     , m_filterResY(this, SVGNames::filterResAttr)
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
     // Spec: If the x/y attribute is not specified, the effect is as if a value of "-10%" were specified.
     // Spec: If the width/height attribute is not specified, the effect is as if a value of "120%" were specified.
@@ -100,39 +103,36 @@ void SVGFilterElement::parseMappedAttribute(MappedAttribute* attr)
     }
 }
 
-SVGResource* SVGFilterElement::canvasResource()
+void SVGFilterElement::buildFilter(const FloatRect& targetRect) const
 {
-    if (!attached())
-        return 0;
-
-    if (!m_filter)
-        m_filter = new SVGResourceFilter();
-
     bool filterBBoxMode = filterUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX;
-    m_filter->setFilterBoundingBoxMode(filterBBoxMode);
-
-    float _x, _y, _width, _height;
-
-    if (filterBBoxMode) {
-        _x = x().valueAsPercentage();
-        _y = y().valueAsPercentage();
-        _width = width().valueAsPercentage();
-        _height = height().valueAsPercentage();
-    } else {
-        m_filter->setXBoundingBoxMode(x().unitType() == LengthTypePercentage);
-        m_filter->setYBoundingBoxMode(y().unitType() == LengthTypePercentage);
-
-        _x = x().value(this);
-        _y = y().value(this);
-        _width = width().value(this);
-        _height = height().value(this);
-    } 
-
-    m_filter->setFilterRect(FloatRect(_x, _y, _width, _height));
-
     bool primitiveBBoxMode = primitiveUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX;
+
+    FloatRect filterBBox;
+    if (filterBBoxMode)
+        filterBBox = FloatRect(x().valueAsPercentage(),
+                               y().valueAsPercentage(),
+                               width().valueAsPercentage(),
+                               height().valueAsPercentage());
+    else
+        filterBBox = FloatRect(x().value(this),
+                               y().value(this),
+                               width().value(this),
+                               height().value(this));
+
+    FloatRect filterRect = filterBBox;
+    if (filterBBoxMode)
+        filterRect = FloatRect(targetRect.x() + filterRect.x() * targetRect.width(),
+                               targetRect.y() + filterRect.y() * targetRect.height(),
+                               filterRect.width() * targetRect.width(),
+                               filterRect.height() * targetRect.height());
+
+    m_filter->setFilterBoundingBox(filterRect);
+    m_filter->setFilterRect(filterBBox);
     m_filter->setEffectBoundingBoxMode(primitiveBBoxMode);
+    m_filter->setFilterBoundingBoxMode(filterBBoxMode);
 
+    // Add effects to the filter
     m_filter->builder()->clearEffects();
     for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
         SVGElement* element = 0;
@@ -147,12 +147,18 @@ SVGResource* SVGFilterElement::canvasResource()
             }
         }
     }
+}
 
+SVGResource* SVGFilterElement::canvasResource()
+{
+    if (!attached())
+        return 0;
+
+    if (!m_filter)
+        m_filter = SVGResourceFilter::create(this);
     return m_filter.get();
 }
 
 }
 
-#endif // ENABLE(SVG)
-
-// vim:ts=4:noet
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h
index 541ec14ac4..836c689364 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h
@@ -3,8 +3,6 @@
     Copyright (C) 2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -51,9 +49,6 @@ namespace WebCore {
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGNames::filterUnitsAttrString, int, FilterUnits, filterUnits)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGNames::primitiveUnitsAttrString, int, PrimitiveUnits, primitiveUnits)
@@ -64,7 +59,19 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGFilterResXIdentifier, long, FilterResX, filterResX)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGFilterResYIdentifier, long, FilterResY, filterResY)
 
-        RefPtr<SVGResourceFilter> m_filter;
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
+        mutable RefPtr<SVGResourceFilter> m_filter;
+
+    private:
+        friend class SVGResourceFilter;
+        void buildFilter(const FloatRect& targetRect) const;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
index 3eeb62500c..67c8bff5f9 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -77,8 +76,6 @@ void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(SVGResourceFilt
 
     ASSERT(resourceFilter);
 
-    float _x, _y, _width, _height;
-
     if (this->hasAttribute(SVGNames::xAttr))
         filterEffect->setHasX(true);
     if (this->hasAttribute(SVGNames::yAttr))
@@ -88,47 +85,19 @@ void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(SVGResourceFilt
     if (this->hasAttribute(SVGNames::heightAttr))
         filterEffect->setHasHeight(true);
 
-    if (resourceFilter->effectBoundingBoxMode()) {
-        _x = x().valueAsPercentage();
-        _y = y().valueAsPercentage();
-        _width = width().valueAsPercentage();
-        _height = height().valueAsPercentage();
-    } else {
-        // We need to resolve any percentages in filter rect space.
-        if (x().unitType() == LengthTypePercentage) {
-            filterEffect->setXBoundingBoxMode(true);
-            _x = x().valueAsPercentage();
-        } else {
-            filterEffect->setXBoundingBoxMode(false);
-            _x = x().value(this);
-        }
-
-        if (y().unitType() == LengthTypePercentage) {
-            filterEffect->setYBoundingBoxMode(true);
-            _y = y().valueAsPercentage();
-        } else {
-            filterEffect->setYBoundingBoxMode(false);
-            _y = y().value(this);
-        }
-
-        if (width().unitType() == LengthTypePercentage) {
-            filterEffect->setWidthBoundingBoxMode(true);
-            _width = width().valueAsPercentage();
-        } else {
-            filterEffect->setWidthBoundingBoxMode(false);
-            _width = width().value(this);
-        }
-
-        if (height().unitType() == LengthTypePercentage) {
-            filterEffect->setHeightBoundingBoxMode(true);
-            _height = height().valueAsPercentage();
-        } else {
-            filterEffect->setHeightBoundingBoxMode(false);
-            _height = height().value(this);
-        }
-    }
-
-    filterEffect->setSubRegion(FloatRect(_x, _y, _width, _height));
+    FloatRect effectBBox;
+    if (resourceFilter->effectBoundingBoxMode())
+        effectBBox = FloatRect(x().valueAsPercentage(),
+                               y().valueAsPercentage(),
+                               width().valueAsPercentage(),
+                               height().valueAsPercentage());
+    else
+        effectBBox = FloatRect(x().value(this),
+                               y().value(this),
+                               width().value(this),
+                               height().value(this));
+
+    filterEffect->setSubRegion(effectBBox);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
index 3cdbb3795c..cb8ec1c1e3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -50,7 +48,6 @@ namespace WebCore {
     protected:
         friend class SVGResourceFilter;
         void setStandardAttributes(SVGResourceFilter*, FilterEffect*) const;
-        virtual const SVGElement* contextElement() const { return this; }
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterPrimitiveStandardAttributes, SVGFilterPrimitiveStandardAttributesIdentifier, SVGNames::xAttrString, SVGLength, X, x)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp
index 847038c0ca..c566a8f89e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -25,6 +23,7 @@
 #if ENABLE(SVG)
 #include "SVGFitToViewBox.h"
 
+#include "Attr.h"
 #include "Document.h"
 #include "FloatRect.h"
 #include "MappedAttribute.h"
@@ -39,8 +38,6 @@ namespace WebCore {
 char SVGFitToViewBoxIdentifier[] = "SVGFitToViewBox";
 
 SVGFitToViewBox::SVGFitToViewBox()
-    : m_viewBox(this, SVGNames::viewBoxAttr)
-    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
 }
 
@@ -48,9 +45,8 @@ SVGFitToViewBox::~SVGFitToViewBox()
 {
 }
 
-bool SVGFitToViewBox::parseViewBox(const UChar*& c, const UChar* end, float& x, float& y, float& w, float& h, bool validate)
+bool SVGFitToViewBox::parseViewBox(Document* doc, const UChar*& c, const UChar* end, float& x, float& y, float& w, float& h, bool validate)
 {
-    Document* doc = contextElement()->document();
     String str(c, end - c);
 
     skipOptionalSpaces(c, end);
@@ -81,24 +77,22 @@ bool SVGFitToViewBox::parseViewBox(const UChar*& c, const UChar* end, float& x,
     return true;
 }
 
-TransformationMatrix SVGFitToViewBox::viewBoxToViewTransform(float viewWidth, float viewHeight) const
+TransformationMatrix SVGFitToViewBox::viewBoxToViewTransform(const FloatRect& viewBoxRect, SVGPreserveAspectRatio* preserveAspectRatio, float viewWidth, float viewHeight)
 {
-    FloatRect viewBoxRect = viewBox();
+    ASSERT(preserveAspectRatio);
     if (!viewBoxRect.width() || !viewBoxRect.height())
         return TransformationMatrix();
 
-    return preserveAspectRatio()->getCTM(viewBoxRect.x(),
-            viewBoxRect.y(), viewBoxRect.width(), viewBoxRect.height(),
-            0, 0, viewWidth, viewHeight);
+    return preserveAspectRatio->getCTM(viewBoxRect.x(), viewBoxRect.y(), viewBoxRect.width(), viewBoxRect.height(), 0, 0, viewWidth, viewHeight);
 }
 
-bool SVGFitToViewBox::parseMappedAttribute(MappedAttribute* attr)
+bool SVGFitToViewBox::parseMappedAttribute(Document* document, MappedAttribute* attr)
 {
     if (attr->name() == SVGNames::viewBoxAttr) {
         float x = 0.0f, y = 0.0f, w = 0.0f, h = 0.0f;
         const UChar* c = attr->value().characters();
         const UChar* end = c + attr->value().length();
-        if (parseViewBox(c, end, x, y, w, h))
+        if (parseViewBox(document, c, end, x, y, w, h))
             setViewBoxBaseValue(FloatRect(x, y, w, h));
         return true;
     } else if (attr->name() == SVGNames::preserveAspectRatioAttr) {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.h b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.h
index ac03df4bbe..503a0ef064 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -38,17 +36,17 @@ namespace WebCore {
         SVGFitToViewBox();
         virtual ~SVGFitToViewBox();
 
-        bool parseViewBox(const UChar*& start, const UChar* end, float& x, float& y, float& w, float& h, bool validate = true);
-        virtual TransformationMatrix viewBoxToViewTransform(float viewWidth, float viewHeight) const;
+        bool parseViewBox(Document*, const UChar*& start, const UChar* end, float& x, float& y, float& w, float& h, bool validate = true);
+        static TransformationMatrix viewBoxToViewTransform(const FloatRect& viewBoxRect, SVGPreserveAspectRatio*, float viewWidth, float viewHeight);
 
-        bool parseMappedAttribute(MappedAttribute*);
+        bool parseMappedAttribute(Document*, MappedAttribute*);
         bool isKnownAttribute(const QualifiedName&);
 
-        virtual const SVGElement* contextElement() const = 0;
+    protected:
+        virtual SVGAnimatedTypeValue<FloatRect>::DecoratedType viewBoxBaseValue() const = 0;
+        virtual void setViewBoxBaseValue(SVGAnimatedTypeValue<FloatRect>::DecoratedType type) = 0;
 
-    private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFitToViewBox, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFitToViewBox, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+        virtual SVGAnimatedTypeValue<SVGPreserveAspectRatio>::DecoratedType preserveAspectRatioBaseValue() const = 0;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFontElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFontElement.cpp
index 98321f44cf..7d62b8ccfa 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFontElement.cpp
@@ -39,7 +39,8 @@ namespace WebCore {
 using namespace SVGNames;
 
 SVGFontElement::SVGFontElement(const QualifiedName& tagName, Document* doc)
-    : SVGStyledElement(tagName, doc)
+    : SVGStyledElement(tagName, doc) 
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
     , m_isGlyphCacheValid(false)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFontElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFontElement.h
index 42468dad91..1fc51367ec 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFontElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFontElement.h
@@ -47,10 +47,12 @@ namespace WebCore {
 
         SVGMissingGlyphElement* firstMissingGlyphElement() const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFontElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         void ensureGlyphCache() const;
 
         typedef Vector<SVGHorizontalKerningPair> KerningPairVector;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp
index 5cfca8ae04..1e75741456 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp
@@ -43,6 +43,8 @@ SVGForeignObjectElement::SVGForeignObjectElement(const QualifiedName& tagName, D
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.h b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.h
index 14dbe6879b..1848e2ba7e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Apple Computer, Inc.
 
-    This file is part of the WebKit project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -48,14 +46,19 @@ namespace WebCore {
         bool childShouldCreateRenderer(Node*) const;
         virtual RenderObject* createRenderer(RenderArena* arena, RenderStyle* style);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::xAttrString, SVGLength, X, x)
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::yAttrString, SVGLength, Y, y)
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::widthAttrString, SVGLength, Width, width)
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::heightAttrString, SVGLength, Height, height)
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGGElement.cpp
index 2b50d74435..241f2645e2 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGElement.cpp
@@ -34,6 +34,7 @@ SVGGElement::SVGGElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGElement.h b/src/3rdparty/webkit/WebCore/svg/SVGGElement.h
index 8e3b368544..9cfb5a3637 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -47,10 +45,12 @@ namespace WebCore {
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGGElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         friend class SVGUseElement;
         TransformationMatrix localMatrix() const;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp
index 80342869b9..93e2cb4ca0 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp
@@ -48,6 +48,8 @@ SVGGradientElement::SVGGradientElement(const QualifiedName& tagName, Document* d
     , m_spreadMethod(this, SVGNames::spreadMethodAttr)
     , m_gradientUnits(this, SVGNames::gradientUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
     , m_gradientTransform(this, SVGNames::gradientTransformAttr, SVGTransformList::create(SVGNames::gradientTransformAttr))
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.h b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.h
index 2027258944..8413597126 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -60,12 +58,18 @@ namespace WebCore {
         Vector<SVGGradientStop> buildStops() const;
         mutable RefPtr<SVGPaintServerGradient> m_resource;
  
-        virtual const SVGElement* contextElement() const { return this; }
-
     protected:
         ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::spreadMethodAttrString, int, SpreadMethod, spreadMethod)
         ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::gradientUnitsAttrString, int, GradientUnits, gradientUnits)
         ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::gradientTransformAttrString, SVGTransformList, GradientTransform, gradientTransform)
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
index 299828f16d..e29846c095 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
@@ -45,7 +45,9 @@ SVGImageElement::SVGImageElement(const QualifiedName& tagName, Document* doc)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
-    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create()) 
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
     , m_imageLoader(this)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.h b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.h
index 1d242b556b..1bdcdbac89 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -61,7 +59,6 @@ namespace WebCore {
     protected:
         virtual bool haveLoadedRequiredResources();
         virtual bool hasRelativeValues() const;
-        virtual const SVGElement* contextElement() const { return this; }
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::xAttrString, SVGLength, X, x)
@@ -70,6 +67,14 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::heightAttrString, SVGLength, Height, height)
         ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         SVGImageLoader m_imageLoader;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp
index cb31178ccb..4f7b7e5f1b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp
@@ -42,6 +42,7 @@ SVGLineElement::SVGLineElement(const QualifiedName& tagName, Document* doc)
     , m_y1(this, SVGNames::y1Attr, LengthModeHeight)
     , m_x2(this, SVGNames::x2Attr, LengthModeWidth)
     , m_y2(this, SVGNames::y2Attr, LengthModeHeight)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLineElement.h b/src/3rdparty/webkit/WebCore/svg/SVGLineElement.h
index 2d89f5c9e1..a24e009cb8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLineElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLineElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -51,7 +49,6 @@ namespace WebCore {
         virtual bool supportsMarkers() const { return true; }
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
         virtual bool hasRelativeValues() const;
 
     private:
@@ -59,6 +56,11 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGNames::lineTagString, SVGNames::y1AttrString, SVGLength, Y1, y1)
         ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGNames::lineTagString, SVGNames::x2AttrString, SVGLength, X2, x2)
         ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGNames::lineTagString, SVGNames::y2AttrString, SVGLength, Y2, y2)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp
index 9927a506c9..f5c8ceeeb3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp
@@ -84,8 +84,15 @@ void SVGLinearGradientElement::buildGradient() const
 
     RefPtr<SVGPaintServerLinearGradient> linearGradient = WTF::static_pointer_cast<SVGPaintServerLinearGradient>(m_resource);
 
-    FloatPoint startPoint = FloatPoint::narrowPrecision(attributes.x1(), attributes.y1());
-    FloatPoint endPoint = FloatPoint::narrowPrecision(attributes.x2(), attributes.y2());
+    FloatPoint startPoint;
+    FloatPoint endPoint;
+    if (attributes.boundingBoxMode()) {
+        startPoint = FloatPoint(attributes.x1().valueAsPercentage(), attributes.y1().valueAsPercentage());
+        endPoint = FloatPoint(attributes.x2().valueAsPercentage(), attributes.y2().valueAsPercentage());
+    } else {
+        startPoint = FloatPoint(attributes.x1().value(this), attributes.y1().value(this));
+        endPoint = FloatPoint(attributes.x2().value(this), attributes.y2().value(this));
+    }
 
     RefPtr<Gradient> gradient = Gradient::create(startPoint, endPoint);
     gradient->setSpreadMethod(attributes.spreadMethod());
@@ -142,16 +149,16 @@ LinearGradientAttributes SVGLinearGradientElement::collectGradientProperties() c
             const SVGLinearGradientElement* linear = static_cast<const SVGLinearGradientElement*>(current);
 
             if (!attributes.hasX1() && current->hasAttribute(SVGNames::x1Attr))
-                attributes.setX1(linear->x1().valueAsPercentage());
+                attributes.setX1(linear->x1());
 
             if (!attributes.hasY1() && current->hasAttribute(SVGNames::y1Attr))
-                attributes.setY1(linear->y1().valueAsPercentage());
+                attributes.setY1(linear->y1());
 
             if (!attributes.hasX2() && current->hasAttribute(SVGNames::x2Attr))
-                attributes.setX2(linear->x2().valueAsPercentage());
+                attributes.setX2(linear->x2());
 
             if (!attributes.hasY2() && current->hasAttribute(SVGNames::y2Attr))
-                attributes.setY2(linear->y2().valueAsPercentage());
+                attributes.setY2(linear->y2());
         }
 
         processedGradients.add(current);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.cpp
index b3214ed97d..b8c862acad 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.cpp
@@ -31,6 +31,8 @@ namespace WebCore {
 
 SVGMPathElement::SVGMPathElement(const QualifiedName& qname, Document* doc)
     : SVGElement(qname, doc)
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -47,7 +49,7 @@ void SVGMPathElement::parseMappedAttribute(MappedAttribute* attr)
 
 SVGPathElement* SVGMPathElement::pathElement()
 {
-    Element* target = document()->getElementById(getTarget(SVGURIReference::href()));
+    Element* target = document()->getElementById(getTarget(href()));
     if (target && target->hasTagName(SVGNames::pathTag))
         return static_cast<SVGPathElement*>(target);
     return 0;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.h b/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.h
index 988ceadeab..ded6cdf830 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.h
@@ -1,28 +1,26 @@
 /*
- Copyright (C) 2007 Eric Seidel <eric@webkit.org>
- 
- This file is part of the WebKit project
- 
- This library is free software; you can redistribute it and/or
- modify it under the terms of the GNU Library General Public
- License as published by the Free Software Foundation; either
- version 2 of the License, or (at your option) any later version.
- 
- This library is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- Library General Public License for more details.
- 
- You should have received a copy of the GNU Library General Public License
- along with this library; see the file COPYING.LIB.  If not, write to
- the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- Boston, MA 02110-1301, USA.
- */
+    Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
 
 #ifndef SVGMPathElement_h
 #define SVGMPathElement_h
-#if ENABLE(SVG)
 
+#if ENABLE(SVG)
 #include "SVGURIReference.h"
 #include "SVGExternalResourcesRequired.h"
 
@@ -31,8 +29,8 @@ namespace WebCore {
     class SVGPathElement;
     
     class SVGMPathElement : public SVGElement,
-                                   SVGURIReference,
-                                   SVGExternalResourcesRequired {
+                            public SVGURIReference,
+                            public SVGExternalResourcesRequired {
     public:
         SVGMPathElement(const QualifiedName&, Document*);
         virtual ~SVGMPathElement();
@@ -41,13 +39,17 @@ namespace WebCore {
         
         SVGPathElement* pathElement();
         
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
+    private:
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMPathElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMPathElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
 #endif // SVGMPathElement_h
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp
index b09e718fe0..2e9692609e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp
@@ -50,6 +50,9 @@ SVGMarkerElement::SVGMarkerElement(const QualifiedName& tagName, Document* doc)
     , m_markerUnits(this, SVGNames::markerUnitsAttr, SVG_MARKERUNITS_STROKEWIDTH)
     , m_orientType(this, SVGNames::orientAttr, SVG_MARKER_ORIENT_ANGLE)
     , m_orientAngle(this, SVGNames::orientAttr, SVGAngle::create())
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
     // Spec: If the markerWidth/markerHeight attribute is not specified, the effect is as if a value of "3" were specified.
 }
@@ -63,6 +66,11 @@ SVGMarkerElement::~SVGMarkerElement()
         detach();
 }
 
+TransformationMatrix SVGMarkerElement::viewBoxToViewTransform(float viewWidth, float viewHeight) const
+{
+    return SVGFitToViewBox::viewBoxToViewTransform(viewBox(), preserveAspectRatio(), viewWidth, viewHeight);
+}
+
 void SVGMarkerElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == SVGNames::markerUnitsAttr) {
@@ -94,7 +102,7 @@ void SVGMarkerElement::parseMappedAttribute(MappedAttribute* attr)
             return;
         if (SVGExternalResourcesRequired::parseMappedAttribute(attr))
             return;
-        if (SVGFitToViewBox::parseMappedAttribute(attr))
+        if (SVGFitToViewBox::parseMappedAttribute(document(), attr))
             return;
 
         SVGStyledElement::parseMappedAttribute(attr);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.h b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.h
index e2e3493332..7e08a96f13 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.h
@@ -58,6 +58,8 @@ namespace WebCore {
         SVGMarkerElement(const QualifiedName&, Document*);
         virtual ~SVGMarkerElement();
 
+        TransformationMatrix viewBoxToViewTransform(float viewWidth, float viewHeight) const;
+
         void setOrientToAuto();
         void setOrientToAngle(PassRefPtr<SVGAngle>);
 
@@ -68,9 +70,6 @@ namespace WebCore {
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
         virtual SVGResource* canvasResource();
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGNames::refXAttrString, SVGLength, RefX, refX)
         ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGNames::refYAttrString, SVGLength, RefY, refY)
@@ -80,6 +79,15 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGOrientTypeAttrIdentifier, int, OrientType, orientType)
         ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGOrientAngleAttrIdentifier, SVGAngle, OrientAngle, orientAngle)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
+        // SVGFitToViewBox
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+ 
         RefPtr<SVGResourceMarker> m_marker;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp
index 6b75527617..127f6f42eb 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp
@@ -55,6 +55,8 @@ SVGMaskElement::SVGMaskElement(const QualifiedName& tagName, Document* doc)
     , m_y(this, SVGNames::yAttr, LengthModeHeight, "-10%")
     , m_width(this, SVGNames::widthAttr, LengthModeWidth, "120%")
     , m_height(this, SVGNames::heightAttr, LengthModeHeight, "120%")
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
     // Spec: If the x/y attribute is not specified, the effect is as if a value of "-10%" were specified.
     // Spec: If the width/height attribute is not specified, the effect is as if a value of "120%" were specified.
@@ -128,45 +130,45 @@ void SVGMaskElement::childrenChanged(bool changedByParser, Node* beforeChange, N
 PassOwnPtr<ImageBuffer> SVGMaskElement::drawMaskerContent(const FloatRect& targetRect, FloatRect& maskDestRect) const
 {    
     // Determine specified mask size
-    float xValue;
-    float yValue;
-    float widthValue;
-    float heightValue;
-
-    if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
-        xValue = x().valueAsPercentage() * targetRect.width();
-        yValue = y().valueAsPercentage() * targetRect.height();
-        widthValue = width().valueAsPercentage() * targetRect.width();
-        heightValue = height().valueAsPercentage() * targetRect.height();
-    } else {
-        xValue = x().value(this);
-        yValue = y().value(this);
-        widthValue = width().value(this);
-        heightValue = height().value(this);
-    } 
-
-    IntSize imageSize(lroundf(widthValue), lroundf(heightValue));
+    if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
+        maskDestRect = FloatRect(x().valueAsPercentage() * targetRect.width(),
+                                 y().valueAsPercentage() * targetRect.height(),
+                                 width().valueAsPercentage() * targetRect.width(),
+                                 height().valueAsPercentage() * targetRect.height());
+    else
+        maskDestRect = FloatRect(x().value(this),
+                                 y().value(this),
+                                 width().value(this),
+                                 height().value(this));
+
+    IntSize imageSize(lroundf(maskDestRect.width()), lroundf(maskDestRect.height()));
     clampImageBufferSizeToViewport(document()->view(), imageSize);
 
-    if (imageSize.width() < static_cast<int>(widthValue))
-        widthValue = imageSize.width();
+    if (imageSize.width() < static_cast<int>(maskDestRect.width()))
+        maskDestRect.setWidth(imageSize.width());
 
-    if (imageSize.height() < static_cast<int>(heightValue))
-        heightValue = imageSize.height();
+    if (imageSize.height() < static_cast<int>(maskDestRect.height()))
+        maskDestRect.setHeight(imageSize.height());
 
-    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(imageSize);
+    // FIXME: This changes color space to linearRGB, the default color space
+    // for masking operations in SVG. We need a switch for the other color-space
+    // attribute values sRGB, inherit and auto.
+    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(imageSize, LinearRGB);
     if (!maskImage)
         return 0;
 
-    maskDestRect = FloatRect(xValue, yValue, widthValue, heightValue);
+    FloatPoint maskContextLocation = maskDestRect.location();
     if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
         maskDestRect.move(targetRect.x(), targetRect.y());
 
+    if (maskContentUnits() != SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
+        maskContextLocation.move(targetRect.x(), targetRect.y());
+
     GraphicsContext* maskImageContext = maskImage->context();
     ASSERT(maskImageContext);
 
     maskImageContext->save();
-    maskImageContext->translate(-xValue, -yValue);
+    maskImageContext->translate(-maskContextLocation.x(), -maskContextLocation.y());
 
     if (maskContentUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
         maskImageContext->save();
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h
index f2b7ae5627..362c7301bc 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2005 Alexander Kellett <lypanov@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -54,9 +52,6 @@ namespace WebCore {
 
         PassOwnPtr<ImageBuffer> drawMaskerContent(const FloatRect& targetRect, FloatRect& maskRect) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::maskUnitsAttrString, int, MaskUnits, maskUnits)
         ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::maskContentUnitsAttrString, int, MaskContentUnits, maskContentUnits)
@@ -65,6 +60,14 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::widthAttrString, SVGLength, Width, width)
         ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::heightAttrString, SVGLength, Height, height)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         RefPtr<SVGResourceMasker> m_masker;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp
index 172cac17c5..70799298bd 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp
@@ -50,6 +50,7 @@ SVGPathElement::SVGPathElement(const QualifiedName& tagName, Document* doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_pathLength(this, SVGNames::pathLengthAttr, 0.0f)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.h b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.h
index 362a85baae..7ea010bd96 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -99,13 +97,15 @@ namespace WebCore {
 
         virtual bool supportsMarkers() const { return true; }
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         mutable RefPtr<SVGPathSegList> m_pathSegList;
 
         ANIMATED_PROPERTY_DECLARATIONS(SVGPathElement, SVGNames::pathTagString, SVGNames::pathLengthAttrString, float, PathLength, pathLength)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPathElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp
index befca85612..34b7db4397 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp
@@ -64,6 +64,10 @@ SVGPatternElement::SVGPatternElement(const QualifiedName& tagName, Document* doc
     , m_patternUnits(this, SVGNames::patternUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
     , m_patternContentUnits(this, SVGNames::patternContentUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
     , m_patternTransform(this, SVGNames::patternTransformAttr, SVGTransformList::create(SVGNames::patternTransformAttr))
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
 }
 
@@ -110,7 +114,7 @@ void SVGPatternElement::parseMappedAttribute(MappedAttribute* attr)
             return;
         if (SVGExternalResourcesRequired::parseMappedAttribute(attr))
             return;
-        if (SVGFitToViewBox::parseMappedAttribute(attr))
+        if (SVGFitToViewBox::parseMappedAttribute(document(), attr))
             return;
 
         SVGStyledElement::parseMappedAttribute(attr);
@@ -195,7 +199,7 @@ void SVGPatternElement::buildPattern(const FloatRect& targetRect) const
         }
     }
 
-    TransformationMatrix viewBoxCTM = viewBoxToViewTransform(patternBoundaries.width(), patternBoundaries.height()); 
+    TransformationMatrix viewBoxCTM = viewBoxToViewTransform(viewBox(), preserveAspectRatio(), patternBoundaries.width(), patternBoundaries.height()); 
     FloatRect patternBoundariesIncludingOverflow = patternBoundaries;
 
     // Apply objectBoundingBoxMode fixup for patternContentUnits, if viewBox is not set.
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.h b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.h
index 2e6399ccca..6a679afbd5 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -58,9 +56,6 @@ namespace WebCore {
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
         virtual SVGResource* canvasResource();
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::xAttrString, SVGLength, X, x)
         ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::yAttrString, SVGLength, Y, y)
@@ -70,6 +65,18 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::patternContentUnitsAttrString, int, PatternContentUnits, patternContentUnits)
         ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::patternTransformAttrString, SVGTransformList, PatternTransform, patternTransform)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
+        // SVGPatternElement
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+ 
         mutable RefPtr<SVGPaintServerPattern> m_resource;
 
     private:
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp
index db39c52164..62e53a330c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp
@@ -42,6 +42,7 @@ SVGPolyElement::SVGPolyElement(const QualifiedName& tagName, Document* doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , SVGAnimatedPoints()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -117,7 +118,7 @@ void SVGPolyElement::updateAnimatedSVGAttribute(const String& name) const
     if (name == SVGNames::pointsAttr.localName()) {
         m_synchronizingSVGAttributes = true;
 
-        synchronizeProperty<SVGPolyElement, SVGPointList*>(this, SVGNames::pointsAttr, m_points.get());
+        PropertySynchronizer<SVGPolyElement, SVGPointList*, true>::synchronize(this, SVGNames::pointsAttr, m_points.get());
         setSynchronizedSVGAttributes(true);
         m_synchronizingSVGAttributes = false;
         return;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.h b/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.h
index 8dd16cd1bc..2ffd150705 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -54,10 +52,12 @@ namespace WebCore {
 
         virtual void updateAnimatedSVGAttribute(const String&) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPolyElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         mutable RefPtr<SVGPointList> m_points;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp
index 23a8579846..a9b5cff5f1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp
@@ -92,29 +92,39 @@ void SVGRadialGradientElement::buildGradient() const
 
     RefPtr<SVGPaintServerRadialGradient> radialGradient = WTF::static_pointer_cast<SVGPaintServerRadialGradient>(m_resource);
 
-    double adjustedFocusX = attributes.fx();
-    double adjustedFocusY = attributes.fy();
+    FloatPoint focalPoint;
+    FloatPoint centerPoint;
+    float radius;
+    if (attributes.boundingBoxMode()) {
+        focalPoint = FloatPoint(attributes.fx().valueAsPercentage(), attributes.fy().valueAsPercentage());
+        centerPoint = FloatPoint(attributes.cx().valueAsPercentage(), attributes.cy().valueAsPercentage());
+        radius = attributes.r().valueAsPercentage();
+    } else {
+        focalPoint = FloatPoint(attributes.fx().value(this), attributes.fy().value(this));
+        centerPoint = FloatPoint(attributes.cx().value(this), attributes.cy().value(this));
+        radius = attributes.r().value(this);
+    }
+
+    float adjustedFocusX = focalPoint.x();
+    float adjustedFocusY = focalPoint.y();
 
-    double fdx = attributes.fx() - attributes.cx();
-    double fdy = attributes.fy() - attributes.cy();
+    float fdx = focalPoint.x() - centerPoint.x();
+    float fdy = focalPoint.y() - centerPoint.y();
 
     // Spec: If (fx, fy) lies outside the circle defined by (cx, cy) and
     // r, set (fx, fy) to the point of intersection of the line through
     // (fx, fy) and the circle.
-    if (sqrt(fdx * fdx + fdy * fdy) > attributes.r()) {
-        double angle = atan2(attributes.fy() * 100.0, attributes.fx() * 100.0);
-        adjustedFocusX = cos(angle) * attributes.r();
-        adjustedFocusY = sin(angle) * attributes.r();
+    if (sqrt(fdx * fdx + fdy * fdy) > radius) {
+        float angle = atan2f(focalPoint.y() * 100.0f, focalPoint.x() * 100.0f);
+        adjustedFocusX = cosf(angle) * radius;
+        adjustedFocusY = sinf(angle) * radius;
     }
 
-    FloatPoint focalPoint = FloatPoint::narrowPrecision(attributes.fx(), attributes.fy());
-    FloatPoint centerPoint = FloatPoint::narrowPrecision(attributes.cx(), attributes.cy());
-
     RefPtr<Gradient> gradient = Gradient::create(
-        FloatPoint::narrowPrecision(adjustedFocusX, adjustedFocusY),
+        FloatPoint(adjustedFocusX, adjustedFocusY),
         0.f, // SVG does not support a "focus radius"
         centerPoint,
-        narrowPrecisionToFloat(attributes.r()));
+        radius);
     gradient->setSpreadMethod(attributes.spreadMethod());
 
     Vector<SVGGradientStop> stops = attributes.stops();
@@ -134,7 +144,7 @@ void SVGRadialGradientElement::buildGradient() const
     radialGradient->setGradientTransform(attributes.gradientTransform());
     radialGradient->setGradientCenter(centerPoint);
     radialGradient->setGradientFocal(focalPoint);
-    radialGradient->setGradientRadius(narrowPrecisionToFloat(attributes.r()));
+    radialGradient->setGradientRadius(radius);
     radialGradient->setGradientStops(attributes.stops());
 }
 
@@ -166,19 +176,19 @@ RadialGradientAttributes SVGRadialGradientElement::collectGradientProperties() c
             const SVGRadialGradientElement* radial = static_cast<const SVGRadialGradientElement*>(current);
 
             if (!attributes.hasCx() && current->hasAttribute(SVGNames::cxAttr))
-                attributes.setCx(radial->cx().valueAsPercentage());
+                attributes.setCx(radial->cx());
 
             if (!attributes.hasCy() && current->hasAttribute(SVGNames::cyAttr))
-                attributes.setCy(radial->cy().valueAsPercentage());
+                attributes.setCy(radial->cy());
 
             if (!attributes.hasR() && current->hasAttribute(SVGNames::rAttr))
-                attributes.setR(radial->r().valueAsPercentage());
+                attributes.setR(radial->r());
 
             if (!attributes.hasFx() && current->hasAttribute(SVGNames::fxAttr))
-                attributes.setFx(radial->fx().valueAsPercentage());
+                attributes.setFx(radial->fx());
 
             if (!attributes.hasFy() && current->hasAttribute(SVGNames::fyAttr))
-                attributes.setFy(radial->fy().valueAsPercentage());
+                attributes.setFy(radial->fy());
         }
 
         processedGradients.add(current);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp
index bfb62056e8..966976a1a8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp
@@ -43,6 +43,7 @@ SVGRectElement::SVGRectElement(const QualifiedName& tagName, Document *doc)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
     , m_rx(this, SVGNames::rxAttr, LengthModeWidth)
     , m_ry(this, SVGNames::ryAttr, LengthModeHeight)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGRectElement.h b/src/3rdparty/webkit/WebCore/svg/SVGRectElement.h
index 2937c23e67..a4d859efc3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGRectElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGRectElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -47,7 +45,6 @@ namespace WebCore {
         virtual Path toPathData() const;
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
         virtual bool hasRelativeValues() const;
 
     private:
@@ -57,6 +54,11 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGNames::rectTagString, SVGNames::heightAttrString, SVGLength, Height, height)
         ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGNames::rectTagString, SVGNames::rxAttrString, SVGLength, Rx, rx)
         ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGNames::rectTagString, SVGNames::ryAttrString, SVGLength, Ry, ry)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp
index 29e72b8671..2d5008b6d5 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp
@@ -66,7 +66,10 @@ SVGSVGElement::SVGSVGElement(const QualifiedName& tagName, Document* doc)
     , m_x(this, SVGNames::xAttr, LengthModeWidth)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth, "100%")
-    , m_height(this, SVGNames::heightAttr, LengthModeHeight, "100%")
+    , m_height(this, SVGNames::heightAttr, LengthModeHeight, "100%") 
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
     , m_useCurrentView(false)
     , m_timeContainer(SMILTimeContainer::create(this))
     , m_viewSpec(0)
@@ -261,7 +264,7 @@ void SVGSVGElement::parseMappedAttribute(MappedAttribute* attr)
             return;
         if (SVGExternalResourcesRequired::parseMappedAttribute(attr))
             return;
-        if (SVGFitToViewBox::parseMappedAttribute(attr))
+        if (SVGFitToViewBox::parseMappedAttribute(document(), attr))
             return;
         if (SVGZoomAndPan::parseMappedAttribute(attr))
             return;
@@ -513,13 +516,8 @@ TransformationMatrix SVGSVGElement::viewBoxToViewTransform(float viewWidth, floa
             viewBoxRect = currentView()->viewBox();
     } else
         viewBoxRect = viewBox();
-    if (!viewBoxRect.width() || !viewBoxRect.height())
-        return TransformationMatrix();
-
-    TransformationMatrix ctm = preserveAspectRatio()->getCTM(viewBoxRect.x(),
-            viewBoxRect.y(), viewBoxRect.width(), viewBoxRect.height(),
-            0, 0, viewWidth, viewHeight);
 
+    TransformationMatrix ctm = SVGFitToViewBox::viewBoxToViewTransform(viewBoxRect, preserveAspectRatio(), viewWidth, viewHeight);
     if (useCurrentView() && currentView())
         return currentView()->transform()->concatenate().matrix() * ctm;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h
index 223ebf6252..f30e8f6832 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -128,13 +126,11 @@ namespace WebCore {
 
         virtual void svgAttributeChanged(const QualifiedName&);
 
-        virtual TransformationMatrix viewBoxToViewTransform(float viewWidth, float viewHeight) const;
+        TransformationMatrix viewBoxToViewTransform(float viewWidth, float viewHeight) const;
 
         void inheritViewAttributes(SVGViewElement*);
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
         friend class RenderSVGRoot;
         friend class RenderSVGViewportContainer;
 
@@ -148,6 +144,15 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGNames::svgTagString, SVGNames::widthAttrString, SVGLength, Width, width)
         ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGNames::svgTagString, SVGNames::heightAttrString, SVGLength, Height, height)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
+        // SVGFitToViewBox
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+ 
         virtual void documentWillBecomeInactive();
         virtual void documentDidBecomeActive();
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp
index 587542c493..c2f4a6eae9 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp
@@ -37,6 +37,8 @@ SVGScriptElement::SVGScriptElement(const QualifiedName& tagName, Document* doc,
     : SVGElement(tagName, doc)
     , SVGURIReference()
     , SVGExternalResourcesRequired()
+    , m_href(this, XLinkNames::hrefAttr) 
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
     , m_data(this, this)
 {
     m_data.setCreatedByParser(createdByParser);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h
index f2efc8e1dc..699c535fe5 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -60,7 +58,6 @@ namespace WebCore {
         virtual bool shouldExecuteAsJavaScript() const { return false; }
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
         virtual bool haveLoadedRequiredResources();
 
         virtual String sourceAttributeValue() const;
@@ -73,6 +70,15 @@ namespace WebCore {
         virtual void dispatchErrorEvent();
 
     private:
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGScriptElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGScriptElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
+    private:
         ScriptElementData m_data;
         String m_type;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.cpp
index 2867d002f7..a07b2a7ff3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.cpp
@@ -34,6 +34,7 @@ SVGSwitchElement::SVGSwitchElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.h b/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.h
index a2be835f5d..f5e9a0d19d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.h
@@ -1,9 +1,7 @@
 /*
-    Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
+    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -22,8 +20,8 @@
 
 #ifndef SVGSwitchElement_h
 #define SVGSwitchElement_h
-#if ENABLE(SVG)
 
+#if ENABLE(SVG)
 #include "SVGExternalResourcesRequired.h"
 #include "SVGLangSpace.h"
 #include "SVGStyledTransformableElement.h"
@@ -44,16 +42,14 @@ namespace WebCore {
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
-        mutable bool m_insideRenderSection;
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSwitchElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
 #endif
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.cpp
index 073a13d950..4155b0c2d1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.cpp
@@ -34,6 +34,9 @@ SVGSymbolElement::SVGSymbolElement(const QualifiedName& tagName, Document* doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , SVGFitToViewBox()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
 }
 
@@ -47,7 +50,7 @@ void SVGSymbolElement::parseMappedAttribute(MappedAttribute* attr)
         return;
     if (SVGExternalResourcesRequired::parseMappedAttribute(attr))
         return;
-    if (SVGFitToViewBox::parseMappedAttribute(attr))
+    if (SVGFitToViewBox::parseMappedAttribute(document(), attr))
         return;
 
     SVGStyledElement::parseMappedAttribute(attr);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.h b/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.h
index a6ccbce201..5c682027e2 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.h
@@ -1,9 +1,7 @@
 /*
-    Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
+    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -22,8 +20,8 @@
 
 #ifndef SVGSymbolElement_h
 #define SVGSymbolElement_h
-#if ENABLE(SVG)
 
+#if ENABLE(SVG)
 #include "SVGExternalResourcesRequired.h"
 #include "SVGFitToViewBox.h"
 #include "SVGLangSpace.h"
@@ -44,8 +42,15 @@ namespace WebCore {
     
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
+    private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSymbolElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+ 
+        // SVGFitToViewBox
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSymbolElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSymbolElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio) 
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.cpp
index 872e7c87ce..5b8640a7c8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.cpp
@@ -35,6 +35,7 @@ namespace WebCore {
 SVGTRefElement::SVGTRefElement(const QualifiedName& tagName, Document* doc)
     : SVGTextPositioningElement(tagName, doc)
     , SVGURIReference()
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.h b/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.h
index 88eeef1c71..71d40a0514 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -40,11 +38,11 @@ namespace WebCore {
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
         bool childShouldCreateRenderer(Node*) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         void updateReferencedText();
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGTRefElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp
index 86009c1150..933430413e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp
@@ -52,6 +52,7 @@ SVGTextContentElement::SVGTextContentElement(const QualifiedName& tagName, Docum
     , SVGExternalResourcesRequired()
     , m_textLength(this, SVGNames::textLengthAttr, LengthModeOther)
     , m_lengthAdjust(this, SVGNames::lengthAdjustAttr, LENGTHADJUST_SPACING)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h
index 9933b2c6d7..9b2c938292 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -66,12 +64,14 @@ namespace WebCore {
 
         bool isKnownAttribute(const QualifiedName&);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextContentElement, SVGTextContentElementIdentifier, SVGNames::textLengthAttrString, SVGLength, TextLength, textLength)
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextContentElement, SVGTextContentElementIdentifier, SVGNames::lengthAdjustAttrString, int, LengthAdjust, lengthAdjust)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGTextContentElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired) 
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp
index 54a4aa2924..ebbb628515 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp
@@ -41,6 +41,7 @@ SVGTextPathElement::SVGTextPathElement(const QualifiedName& tagName, Document* d
     , m_startOffset(this, SVGNames::startOffsetAttr, LengthModeOther)
     , m_method(this, SVGNames::methodAttr, SVG_TEXTPATH_METHODTYPE_ALIGN)
     , m_spacing(this, SVGNames::spacingAttr, SVG_TEXTPATH_SPACINGTYPE_EXACT)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.h b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.h
index 4e8899a3cd..1bfcc8b140 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -64,13 +62,13 @@ namespace WebCore {
 
         bool childShouldCreateRenderer(Node*) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::startOffsetAttrString, SVGLength, StartOffset, startOffset)
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::methodAttrString, int, Method, method)
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::spacingAttrString, int, Spacing, spacing)
+    
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp
index 8871229675..24febc3142 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp
@@ -30,7 +30,6 @@ namespace WebCore {
 char SVGURIReferenceIdentifier[] = "SVGURIReference";
 
 SVGURIReference::SVGURIReference()
-    : m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.h b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.h
index 35ac640886..812fb594f1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.h
@@ -1,5 +1,5 @@
 /*
-    Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+    Copyright (C) 2004, 2005, 2008, 2009 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
     This file is part of the KDE project
@@ -42,10 +42,8 @@ namespace WebCore {
 
         static String getTarget(const String& url);
 
-        virtual const SVGElement* contextElement() const = 0;
-
-    private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGURIReference, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+    protected:
+        virtual void setHrefBaseValue(SVGAnimatedTypeValue<String>::DecoratedType type) = 0;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp
index 0c2abe09ab..42517bdbff 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp
@@ -65,6 +65,8 @@ SVGUseElement::SVGUseElement(const QualifiedName& tagName, Document* doc)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -482,13 +484,7 @@ void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* ta
         targetInstance->appendChild(instancePtr.get());
 
         // Enter recursion, appending new instance tree nodes to the "instance" object.
-        if (element->hasChildNodes())
-            buildInstanceTree(element, instancePtr.get(), foundProblem);
-
-        // Spec: If the referenced object is itself a 'use', or if there are 'use' subelements within the referenced
-        // object, the instance tree will contain recursive expansion of the indirect references to form a complete tree.
-        if (element->hasTagName(SVGNames::useTag))
-            handleDeepUseReferencing(static_cast<SVGUseElement*>(element), instancePtr.get(), foundProblem);
+        buildInstanceTree(element, instancePtr.get(), foundProblem);
     }
 
     // Spec: If the referenced object is itself a 'use', or if there are 'use' subelements within the referenced
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.h b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.h
index 1e5b81c10f..45ca783f6a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -68,15 +66,20 @@ namespace WebCore {
         static void removeDisallowedElementsFromSubtree(Node* element);
         SVGElementInstance* instanceForShadowTreeElement(Node* element) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::xAttrString, SVGLength, X, x)
         ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::yAttrString, SVGLength, Y, y)
         ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::widthAttrString, SVGLength, Width, width)
         ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::heightAttrString, SVGLength, Height, height)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
     private:
         // Instance tree handling
         void buildInstanceTree(SVGElement* target, SVGElementInstance* targetInstance, bool& foundCycle);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp
index 61cb397536..af1d1fe97d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp
@@ -40,6 +40,9 @@ SVGViewElement::SVGViewElement(const QualifiedName& tagName, Document* doc)
     , SVGExternalResourcesRequired()
     , SVGFitToViewBox()
     , SVGZoomAndPan()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
 }
 
@@ -61,7 +64,7 @@ void SVGViewElement::parseMappedAttribute(MappedAttribute* attr)
         viewTarget()->reset(attr->value());
     else {
         if (SVGExternalResourcesRequired::parseMappedAttribute(attr)
-           || SVGFitToViewBox::parseMappedAttribute(attr)
+           || SVGFitToViewBox::parseMappedAttribute(document(), attr)
            || SVGZoomAndPan::parseMappedAttribute(attr))
             return;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGViewElement.h b/src/3rdparty/webkit/WebCore/svg/SVGViewElement.h
index 840dea9b5d..33d0ae35c1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGViewElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGViewElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -46,10 +44,16 @@ namespace WebCore {
 
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGViewElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+ 
+        // SVGFitToViewBox
+        ANIMATED_PROPERTY_DECLARATIONS(SVGViewElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGViewElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+ 
         mutable RefPtr<SVGStringList> m_viewTarget;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.cpp b/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.cpp
index b12b1c27f3..e6ded33b5e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.cpp
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -36,8 +34,10 @@ namespace WebCore {
 SVGViewSpec::SVGViewSpec(const SVGSVGElement* contextElement)
     : SVGFitToViewBox()
     , SVGZoomAndPan()
-    , m_transform(SVGTransformList::create(SVGNames::transformAttr))
     , m_contextElement(contextElement)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
+    , m_transform(SVGTransformList::create(SVGNames::transformAttr))
 {
 }
 
@@ -55,7 +55,7 @@ void SVGViewSpec::setViewBoxString(const String& viewBox)
     float x, y, w, h;
     const UChar* c = viewBox.characters();
     const UChar* end = c + viewBox.length();
-    if (!parseViewBox(c, end, x, y, w, h, false))
+    if (!parseViewBox(m_contextElement->document(), c, end, x, y, w, h, false))
         return;
     setViewBoxBaseValue(FloatRect(x, y, w, h));
 }
@@ -74,12 +74,7 @@ void SVGViewSpec::setViewTargetString(const String& viewTargetString)
 
 SVGElement* SVGViewSpec::viewTarget() const
 {
-    return static_cast<SVGElement*>(m_contextElement->ownerDocument()->getElementById(m_viewTargetString));
-}
-
-const SVGElement* SVGViewSpec::contextElement() const
-{
-    return m_contextElement;
+    return static_cast<SVGElement*>(m_contextElement->document()->getElementById(m_viewTargetString));
 }
 
 static const UChar svgViewSpec[] = {'s', 'v', 'g', 'V', 'i', 'e', 'w'};
@@ -111,7 +106,7 @@ bool SVGViewSpec::parseViewSpec(const String& viewSpec)
                     return false;
                 currViewSpec++;
                 float x, y, w, h;
-                if (!parseViewBox(currViewSpec, end, x, y, w, h, false))
+                if (!parseViewBox(m_contextElement->document(), currViewSpec, end, x, y, w, h, false))
                     return false;
                 setViewBoxBaseValue(FloatRect(x, y, w, h));
                 if (currViewSpec >= end || *currViewSpec != ')')
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.h b/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.h
index 8624089314..090b7ae8b3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -53,11 +51,16 @@ namespace WebCore {
         String viewTargetString() const { return m_viewTargetString; }
         SVGElement* viewTarget() const;
 
-        virtual const SVGElement* contextElement() const;
+        const SVGSVGElement* contextElement() const { return m_contextElement; }
 
     private:
-        mutable RefPtr<SVGTransformList> m_transform;
         const SVGSVGElement* m_contextElement;
+
+        // SVGFitToViewBox
+        ANIMATED_PROPERTY_DECLARATIONS(SVGViewSpec, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGViewSpec, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+
+        mutable RefPtr<SVGTransformList> m_transform;
         String m_viewTargetString;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.cpp b/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.cpp
new file mode 100644
index 0000000000..e969514f9a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.cpp
@@ -0,0 +1,163 @@
+/*
+    Copyright (C) Research In Motion Limited 2009. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "SynchronizablePropertyController.h"
+
+#include "NamedNodeMap.h"
+#include "Node.h"
+#include "SVGAnimatedProperty.h"
+
+namespace WebCore {
+
+SynchronizablePropertyController::SynchronizablePropertyController()
+{
+}
+
+void SynchronizablePropertyController::registerProperty(const QualifiedName& attrName, SVGAnimatedPropertyBase* base)
+{
+    // 'attrName' is ambigious. For instance in SVGMarkerElement both 'orientType' / 'orientAngle'
+    // SVG DOM objects are synchronized with the 'orient' attribute. This why we need a HashSet.
+    SynchronizableProperty property(base);
+
+    PropertyMap::iterator it = m_map.find(attrName.localName());
+    if (it == m_map.end()) {
+        Properties properties;
+        properties.add(property);
+        m_map.set(attrName.localName(), properties);
+        return;
+    }
+
+    Properties& properties = it->second;
+    ASSERT(!properties.isEmpty());
+
+    properties.add(property);
+}
+
+void SynchronizablePropertyController::setPropertyNeedsSynchronization(const QualifiedName& attrName)
+{
+    PropertyMap::iterator itProp = m_map.find(attrName.localName());
+    ASSERT(itProp != m_map.end());
+
+    Properties& properties = itProp->second;
+    ASSERT(!properties.isEmpty());
+
+    Properties::iterator it = properties.begin();
+    Properties::iterator end = properties.end();
+
+    for (; it != end; ++it) {
+        SynchronizableProperty& property = *it;
+        ASSERT(property.base);
+        property.shouldSynchronize = true;
+    }
+}
+
+void SynchronizablePropertyController::synchronizeProperty(const String& name)
+{
+    PropertyMap::iterator itProp = m_map.find(name);
+    if (itProp == m_map.end())
+        return;
+
+    Properties& properties = itProp->second;
+    ASSERT(!properties.isEmpty());
+
+    Properties::iterator it = properties.begin();
+    Properties::iterator end = properties.end();
+
+    for (; it != end; ++it) {
+        SynchronizableProperty& property = *it;
+        ASSERT(property.base);
+
+        if (!property.shouldSynchronize)
+            continue;
+
+        property.base->synchronize();
+    }
+}
+
+void SynchronizablePropertyController::synchronizeAllProperties()
+{
+    if (m_map.isEmpty())
+        return;
+
+    PropertyMap::iterator itProp = m_map.begin();
+    PropertyMap::iterator endProp = m_map.end();
+
+    for (; itProp != endProp; ++itProp) {
+        Properties& properties = itProp->second;
+        ASSERT(!properties.isEmpty());
+
+        Properties::iterator it = properties.begin();
+        Properties::iterator end = properties.end();
+
+        for (; it != end; ++it) {
+            SynchronizableProperty& property = *it;
+            ASSERT(property.base);
+
+            if (!property.shouldSynchronize)
+                continue;
+
+            property.base->synchronize();
+        }
+    }
+}
+
+void SynchronizablePropertyController::startAnimation(const String& name)
+{
+    PropertyMap::iterator itProp = m_map.find(name);
+    if (itProp == m_map.end())
+        return;
+
+    Properties& properties = itProp->second;
+    ASSERT(!properties.isEmpty());
+
+    Properties::iterator it = properties.begin();
+    Properties::iterator end = properties.end();
+
+    for (; it != end; ++it) {
+        SynchronizableProperty& property = *it;
+        ASSERT(property.base);
+        property.base->startAnimation();
+    }
+}
+
+void SynchronizablePropertyController::stopAnimation(const String& name)
+{
+    PropertyMap::iterator itProp = m_map.find(name);
+    if (itProp == m_map.end())
+        return;
+
+    Properties& properties = itProp->second;
+    ASSERT(!properties.isEmpty());
+
+    Properties::iterator it = properties.begin();
+    Properties::iterator end = properties.end();
+
+    for (; it != end; ++it) {
+        SynchronizableProperty& property = *it;
+        ASSERT(property.base);
+        property.base->stopAnimation();
+    }
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.h b/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.h
new file mode 100644
index 0000000000..b7f101b0fc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.h
@@ -0,0 +1,122 @@
+/*
+    Copyright (C) Research In Motion Limited 2009. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef SynchronizablePropertyController_h
+#define SynchronizablePropertyController_h
+
+#if ENABLE(SVG)
+#include "StringHash.h"
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class QualifiedName;
+class SVGAnimatedPropertyBase;
+
+struct SynchronizableProperty {
+    SynchronizableProperty()
+        : base(0)
+        , shouldSynchronize(false)
+    {
+    }
+
+    explicit SynchronizableProperty(SVGAnimatedPropertyBase* _base)
+        : base(_base)
+        , shouldSynchronize(false)
+    {
+    }
+
+    explicit SynchronizableProperty(WTF::HashTableDeletedValueType)
+        : base(reinterpret_cast<SVGAnimatedPropertyBase*>(-1))
+        , shouldSynchronize(false)
+    {
+    }
+
+    bool isHashTableDeletedValue() const
+    {
+        return base == reinterpret_cast<SVGAnimatedPropertyBase*>(-1);
+    }
+
+    bool operator==(const SynchronizableProperty& other) const
+    {
+        return base == other.base && shouldSynchronize == other.shouldSynchronize;
+    }
+
+    SVGAnimatedPropertyBase* base;
+    bool shouldSynchronize;
+};
+
+struct SynchronizablePropertyHash {
+    static unsigned hash(const SynchronizableProperty& key)
+    {
+        return StringImpl::computeHash(reinterpret_cast<const UChar*>(&key), sizeof(SynchronizableProperty) / sizeof(UChar));
+    }
+
+    static bool equal(const SynchronizableProperty& a, const SynchronizableProperty& b)
+    {
+        return a == b;
+    }
+
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+struct SynchronizablePropertyHashTraits : WTF::GenericHashTraits<SynchronizableProperty> {
+    static const bool emptyValueIsZero = true;
+
+    static void constructDeletedValue(SynchronizableProperty& slot)
+    {
+        new (&slot) SynchronizableProperty(WTF::HashTableDeletedValue);
+    }
+
+    static bool isDeletedValue(const SynchronizableProperty& value)
+    {
+        return value.isHashTableDeletedValue();
+    }
+};
+
+// Helper class used exclusively by SVGElement to keep track of all animatable properties within a SVGElement,
+// and wheter they are supposed to be synchronized or not (depending wheter AnimatedPropertyTearOff's have been created)
+class SynchronizablePropertyController : public Noncopyable {
+public:
+    void registerProperty(const QualifiedName&, SVGAnimatedPropertyBase*);
+    void setPropertyNeedsSynchronization(const QualifiedName&);
+
+    void synchronizeProperty(const String&);
+    void synchronizeAllProperties();
+
+    void startAnimation(const String&);
+    void stopAnimation(const String&);
+
+private:
+    friend class SVGElement;
+    SynchronizablePropertyController();
+
+private:
+    typedef HashSet<SynchronizableProperty, SynchronizablePropertyHash, SynchronizablePropertyHashTraits> Properties;
+    typedef HashMap<String, Properties> PropertyMap;
+
+    PropertyMap m_map;
+};
+
+};
+
+#endif // ENABLE(SVG)
+#endif // SynchronizablePropertyController_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
index bb68b82c93..0a506f85f5 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
@@ -239,14 +239,13 @@ bool SVGImage::dataChanged(bool allDataReceived)
         static DragClient* dummyDragClient = 0;
 #endif
         static InspectorClient* dummyInspectorClient = new EmptyInspectorClient;
-        static PluginHalterClient* dummyPluginHalterClient = new EmptyPluginHalterClient;
 
         m_chromeClient.set(new SVGImageChromeClient(this));
         
         // FIXME: If this SVG ends up loading itself, we might leak the world.
-        // THe comment said that the Cache code does not know about CachedImages
+        // The comment said that the Cache code does not know about CachedImages
         // holding Frames and won't know to break the cycle. But 
-        m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient, dummyPluginHalterClient));
+        m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient, 0));
         m_page->settings()->setJavaScriptEnabled(false);
         m_page->settings()->setPluginsEnabled(false);
 
@@ -256,7 +255,7 @@ bool SVGImage::dataChanged(bool allDataReceived)
         ResourceRequest fakeRequest(KURL(ParsedURLString, ""));
         FrameLoader* loader = frame->loader();
         loader->load(fakeRequest, false); // Make sure the DocumentLoader is created
-        loader->cancelContentPolicyCheck(); // cancel any policy checks
+        loader->policyChecker()->cancelCheck(); // cancel any policy checks
         loader->commitProvisionalLoad(0);
         loader->setResponseMIMEType("image/svg+xml");
         loader->begin(KURL()); // create the empty document
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp
index 4a4bdd5ccc..973743c1f2 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp
@@ -31,52 +31,44 @@
 #include "PlatformString.h"
 #include "SVGFilter.h"
 #include "SVGFilterBuilder.h"
+#include "SVGFilterElement.h"
 #include "SVGRenderTreeAsText.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
 namespace WebCore {
 
-SVGResourceFilter::SVGResourceFilter()
-    : m_filterBBoxMode(false)
+SVGResourceFilter::SVGResourceFilter(const SVGFilterElement* ownerElement)
+    : SVGResource()
+    , m_ownerElement(ownerElement)
+    , m_filterBBoxMode(false)
     , m_effectBBoxMode(false)
-    , m_xBBoxMode(false)
-    , m_yBBoxMode(false)
     , m_savedContext(0)
     , m_sourceGraphicBuffer(0)
 {
     m_filterBuilder.set(new SVGFilterBuilder());
 }
 
-void SVGResourceFilter::addFilterEffect(SVGFilterPrimitiveStandardAttributes* effectAttributes, PassRefPtr<FilterEffect> effect)
+SVGResourceFilter::~SVGResourceFilter()
 {
-    effectAttributes->setStandardAttributes(this, effect.get());
-    builder()->add(effectAttributes->result(), effect);
 }
 
-FloatRect SVGResourceFilter::filterBBoxForItemBBox(const FloatRect& itemBBox) const
+void SVGResourceFilter::addFilterEffect(SVGFilterPrimitiveStandardAttributes* effectAttributes, PassRefPtr<FilterEffect> effect)
 {
-    FloatRect filterBBox = filterRect();
-
-    if (filterBoundingBoxMode())
-        filterBBox = FloatRect(itemBBox.x() + filterBBox.x() * itemBBox.width(),
-                               itemBBox.y() + filterBBox.y() * itemBBox.height(),
-                               filterBBox.width() * itemBBox.width(),
-                               filterBBox.height() * itemBBox.height());
-
-    return filterBBox;
+    effectAttributes->setStandardAttributes(this, effect.get());
+    builder()->add(effectAttributes->result(), effect);
 }
 
 void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObject* object)
 {
-    m_itemBBox = object->objectBoundingBox();
-    m_filterBBox = filterBBoxForItemBBox(m_itemBBox);
+    FloatRect targetRect = object->objectBoundingBox();
+    m_ownerElement->buildFilter(targetRect);
 
     // clip sourceImage to filterRegion
-    FloatRect clippedSourceRect = m_itemBBox;
+    FloatRect clippedSourceRect = targetRect;
     clippedSourceRect.intersect(m_filterBBox);
 
     // prepare Filters
-    m_filter = SVGFilter::create(m_itemBBox, m_filterBBox, m_effectBBoxMode, m_filterBBoxMode);
+    m_filter = SVGFilter::create(targetRect, m_filterBBox, m_effectBBoxMode);
 
     FilterEffect* lastEffect = m_filterBuilder->lastEffect();
     if (lastEffect)
@@ -91,8 +83,8 @@ void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObj
         return;
 
     GraphicsContext* sourceGraphicContext = sourceGraphic->context();
-    sourceGraphicContext->translate(-m_itemBBox.x(), -m_itemBBox.y());
-    sourceGraphicContext->clearRect(FloatRect(FloatPoint(), m_itemBBox.size()));
+    sourceGraphicContext->translate(-targetRect.x(), -targetRect.y());
+    sourceGraphicContext->clearRect(FloatRect(FloatPoint(), targetRect.size()));
     m_sourceGraphicBuffer.set(sourceGraphic.release());
     m_savedContext = context;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h
index ee1efca482..86b11fe5b4 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h
@@ -43,11 +43,13 @@ class Filter;
 class FilterEffect;
 class GraphicsContext;
 class SVGFilterBuilder;
+class SVGFilterElement;
 class SVGFilterPrimitiveStandardAttributes;
 
 class SVGResourceFilter : public SVGResource {
 public:
-    SVGResourceFilter();
+    static PassRefPtr<SVGResourceFilter> create(const SVGFilterElement* ownerElement) { return adoptRef(new SVGResourceFilter(ownerElement)); }
+    virtual ~SVGResourceFilter();
     
     virtual SVGResourceType resourceType() const { return FilterResourceType; }
 
@@ -57,44 +59,31 @@ public:
     bool effectBoundingBoxMode() const { return m_effectBBoxMode; }
     void setEffectBoundingBoxMode(bool bboxMode) { m_effectBBoxMode = bboxMode; }
 
-    bool xBoundingBoxMode() const { return m_xBBoxMode; }
-    void setXBoundingBoxMode(bool bboxMode) { m_xBBoxMode = bboxMode; }
-
-    bool yBoundingBoxMode() const { return m_yBBoxMode; }
-    void setYBoundingBoxMode(bool bboxMode) { m_yBBoxMode = bboxMode; }
-
     FloatRect filterRect() const { return m_filterRect; }
     void setFilterRect(const FloatRect& rect) { m_filterRect = rect; }
 
     FloatRect filterBoundingBox() { return m_filterBBox; }
     void setFilterBoundingBox(const FloatRect& rect) { m_filterBBox = rect; }
 
-    FloatRect itemBoundingBox() { return m_itemBBox; }
-    void setItemBoundingBox(const FloatRect& rect) { m_itemBBox = rect; }
-
-    FloatRect filterBBoxForItemBBox(const FloatRect& itemBBox) const;
-
-    virtual TextStream& externalRepresentation(TextStream&) const;
-
     void prepareFilter(GraphicsContext*&, const RenderObject*);
     void applyFilter(GraphicsContext*&, const RenderObject*);
 
     void addFilterEffect(SVGFilterPrimitiveStandardAttributes*, PassRefPtr<FilterEffect>);
 
     SVGFilterBuilder* builder() { return m_filterBuilder.get(); }
+
+    virtual TextStream& externalRepresentation(TextStream&) const;
     
 private:
+    SVGResourceFilter(const SVGFilterElement*);
+
+    const SVGFilterElement* m_ownerElement;
 
     bool m_filterBBoxMode : 1;
     bool m_effectBBoxMode : 1;
 
-    bool m_xBBoxMode : 1;
-    bool m_yBBoxMode : 1;
-
     FloatRect m_filterRect;
-
     FloatRect m_filterBBox;
-    FloatRect m_itemBBox;
 
     OwnPtr<SVGFilterBuilder> m_filterBuilder;
     GraphicsContext* m_savedContext;
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp
index 3f4a6d7b26..668209fa6f 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp
@@ -31,17 +31,16 @@
 
 namespace WebCore {
 
-FEFlood::FEFlood(FilterEffect* in, const Color& floodColor, const float& floodOpacity)
+FEFlood::FEFlood(const Color& floodColor, const float& floodOpacity)
     : FilterEffect()
-    , m_in(in)
     , m_floodColor(floodColor)
     , m_floodOpacity(floodOpacity)
 {
 }
 
-PassRefPtr<FEFlood> FEFlood::create(FilterEffect* in, const Color& floodColor, const float& floodOpacity)
+PassRefPtr<FEFlood> FEFlood::create(const Color& floodColor, const float& floodOpacity)
 {
-    return adoptRef(new FEFlood(in, floodColor, floodOpacity));
+    return adoptRef(new FEFlood(floodColor, floodOpacity));
 }
 
 Color FEFlood::floodColor() const
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.h
index 21985db567..91795dd37d 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.h
@@ -31,7 +31,7 @@ namespace WebCore {
 
     class FEFlood : public FilterEffect {
     public:
-        static PassRefPtr<FEFlood> create(FilterEffect*, const Color&, const float&);
+        static PassRefPtr<FEFlood> create(const Color&, const float&);
 
         Color floodColor() const;
         void setFloodColor(const Color &);
@@ -44,9 +44,8 @@ namespace WebCore {
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
-        FEFlood(FilterEffect*, const Color&, const float&);
+        FEFlood(const Color&, const float&);
 
-        RefPtr<FilterEffect> m_in;
         Color m_floodColor;
         float m_floodOpacity;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp
deleted file mode 100644
index 601c39ec77..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
-    Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
-                  2004, 2005 Rob Buis <buis@kde.org>
-                  2005 Eric Seidel <eric@webkit.org>
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    aint with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(SVG) && ENABLE(FILTERS)
-#include "SVGFEGaussianBlur.h"
-#include "SVGRenderTreeAsText.h"
-#include "Filter.h"
-
-namespace WebCore {
-
-FEGaussianBlur::FEGaussianBlur(FilterEffect* in, const float& x, const float& y)
-    : FilterEffect()
-    , m_in(in)
-    , m_x(x)
-    , m_y(y)
-{
-}
-
-PassRefPtr<FEGaussianBlur> FEGaussianBlur::create(FilterEffect* in, const float& x, const float& y)
-{
-    return adoptRef(new FEGaussianBlur(in, x, y));
-}
-
-float FEGaussianBlur::stdDeviationX() const
-{
-    return m_x;
-}
-
-void FEGaussianBlur::setStdDeviationX(float x)
-{
-    m_x = x;
-}
-
-float FEGaussianBlur::stdDeviationY() const
-{
-    return m_y;
-}
-
-void FEGaussianBlur::setStdDeviationY(float y)
-{
-    m_y = y;
-}
-
-void FEGaussianBlur::apply(Filter*)
-{
-}
-
-void FEGaussianBlur::dump()
-{
-}
-
-TextStream& FEGaussianBlur::externalRepresentation(TextStream& ts) const
-{
-    ts << "[type=GAUSSIAN-BLUR] ";
-    FilterEffect::externalRepresentation(ts);
-    ts << " [std dev. x=" << stdDeviationX() << " y=" << stdDeviationY() << "]";
-    return ts;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
index 37677347fa..f7fc5d8070 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
@@ -28,7 +28,7 @@
 
 namespace WebCore {
 
-FEMorphology::FEMorphology(FilterEffect* in, MorphologyOperatorType type, const float& radiusX, const float& radiusY)
+FEMorphology::FEMorphology(FilterEffect* in, MorphologyOperatorType type, float radiusX, float radiusY)
     : FilterEffect()
     , m_in(in)
     , m_type(type)
@@ -37,7 +37,7 @@ FEMorphology::FEMorphology(FilterEffect* in, MorphologyOperatorType type, const
 {
 }
 
-PassRefPtr<FEMorphology> FEMorphology::create(FilterEffect* in, MorphologyOperatorType type, const float& radiusX, const float& radiusY)
+PassRefPtr<FEMorphology> FEMorphology::create(FilterEffect* in, MorphologyOperatorType type, float radiusX, float radiusY)
 {
     return adoptRef(new FEMorphology(in, type, radiusX, radiusY));
 }
@@ -88,8 +88,8 @@ static TextStream& operator<<(TextStream& ts, MorphologyOperatorType t)
             ts << "UNKNOWN"; break;
         case FEMORPHOLOGY_OPERATOR_ERODE:
             ts << "ERODE"; break;
-        case FEMORPHOLOGY_OPERATOR_DIALATE:
-            ts << "DIALATE"; break;
+        case FEMORPHOLOGY_OPERATOR_DILATE:
+            ts << "DILATE"; break;
     }
     return ts;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.h
index bdc2b9be27..6a321c8416 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.h
@@ -31,12 +31,12 @@ namespace WebCore {
     enum MorphologyOperatorType {
         FEMORPHOLOGY_OPERATOR_UNKNOWN = 0,
         FEMORPHOLOGY_OPERATOR_ERODE   = 1,
-        FEMORPHOLOGY_OPERATOR_DIALATE = 2
+        FEMORPHOLOGY_OPERATOR_DILATE  = 2
     };
 
     class FEMorphology : public FilterEffect {
     public:
-        PassRefPtr<FEMorphology> create(FilterEffect*, MorphologyOperatorType, const float&, const float&);  
+        static PassRefPtr<FEMorphology> create(FilterEffect*, MorphologyOperatorType, float radiusX, float radiusY);  
         MorphologyOperatorType morphologyOperator() const;
         void setMorphologyOperator(MorphologyOperatorType);
 
@@ -52,7 +52,7 @@ namespace WebCore {
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
-        FEMorphology(FilterEffect*, MorphologyOperatorType, const float&, const float&);
+        FEMorphology(FilterEffect*, MorphologyOperatorType, float radiusX, float radiusY);
         
         RefPtr<FilterEffect> m_in;
         MorphologyOperatorType m_type;
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.cpp
index c892ee9a85..6bfcf39436 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.cpp
@@ -24,12 +24,11 @@
 
 namespace WebCore {
 
-SVGFilter::SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode, bool filterBBoxMode)
+SVGFilter::SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode)
     : Filter()
     , m_itemBox(itemBox)
     , m_filterRect(filterRect)
     , m_effectBBoxMode(effectBBoxMode)
-    , m_filterBBoxMode(filterBBoxMode)
 {
 }
 
@@ -37,7 +36,6 @@ void SVGFilter::calculateEffectSubRegion(FilterEffect* effect)
 {
     FloatRect subRegionBBox = effect->subRegion();
     FloatRect useBBox = effect->unionOfChildEffectSubregions();
-
     FloatRect newSubRegion = subRegionBBox;
 
     if (m_effectBBoxMode) {
@@ -55,17 +53,17 @@ void SVGFilter::calculateEffectSubRegion(FilterEffect* effect)
         if (effect->hasHeight())
             newSubRegion.setHeight(subRegionBBox.height() * m_itemBox.height());
     } else {
-        if (effect->xBoundingBoxMode())
-            newSubRegion.setX(useBBox.x() + subRegionBBox.x() * useBBox.width());
+        if (!effect->hasX())
+            newSubRegion.setX(useBBox.x());
 
-        if (effect->yBoundingBoxMode())
-            newSubRegion.setY(useBBox.y() + subRegionBBox.y() * useBBox.height());
+        if (!effect->hasY())
+            newSubRegion.setY(useBBox.y());
 
-        if (effect->widthBoundingBoxMode())
-            newSubRegion.setWidth(subRegionBBox.width() * useBBox.width());
+        if (!effect->hasWidth())
+            newSubRegion.setWidth(useBBox.width());
 
-        if (effect->heightBoundingBoxMode())
-            newSubRegion.setHeight(subRegionBBox.height() * useBBox.height());
+        if (!effect->hasHeight())
+            newSubRegion.setHeight(useBBox.height());
     }
 
     // clip every filter effect to the filter region
@@ -74,9 +72,9 @@ void SVGFilter::calculateEffectSubRegion(FilterEffect* effect)
     effect->setSubRegion(newSubRegion);
 }
 
-PassRefPtr<SVGFilter> SVGFilter::create(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode, bool filterBBoxMode)
+PassRefPtr<SVGFilter> SVGFilter::create(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode)
 {
-    return adoptRef(new SVGFilter(itemBox, filterRect, effectBBoxMode, filterBBoxMode));
+    return adoptRef(new SVGFilter(itemBox, filterRect, effectBBoxMode));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.h
index d6e5f77dd3..f23d1ea999 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.h
@@ -33,7 +33,7 @@ namespace WebCore {
 
     class SVGFilter : public Filter {
     public:
-        static PassRefPtr<SVGFilter> create(const FloatRect&, const FloatRect&, bool, bool);
+        static PassRefPtr<SVGFilter> create(const FloatRect&, const FloatRect&, bool);
 
         bool effectBoundingBoxMode() { return m_effectBBoxMode; }
 
@@ -42,12 +42,11 @@ namespace WebCore {
         void calculateEffectSubRegion(FilterEffect*);
 
     private:
-        SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool itemBBoxMode, bool filterBBoxMode);
+        SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode);
 
         FloatRect m_itemBox;
         FloatRect m_filterRect;
         bool m_effectBBoxMode;
-        bool m_filterBBoxMode;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/svgtags.in b/src/3rdparty/webkit/WebCore/svg/svgtags.in
index 471c77bfe7..30a0e4cfd5 100644
--- a/src/3rdparty/webkit/WebCore/svg/svgtags.in
+++ b/src/3rdparty/webkit/WebCore/svg/svgtags.in
@@ -47,9 +47,7 @@ feGaussianBlur createWithNew
 feImage createWithNew
 feMerge createWithNew
 feMergeNode createWithNew
-#if 0
 feMorphology createWithNew
-#endif
 feOffset createWithNew
 fePointLight createWithNew
 feSpecularLighting createWithNew
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp b/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp
index dd89c14b69..f3bbdd7ffa 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp
@@ -86,6 +86,22 @@ static bool isValidProtocolString(const WebCore::String& protocol)
     return true;
 }
 
+#if USE(V8)
+
+static bool webSocketsAvailable = false;
+
+void WebSocket::setIsAvailable(bool available)
+{
+    webSocketsAvailable = available;
+}
+
+bool WebSocket::isAvailable()
+{
+    return webSocketsAvailable;
+}
+
+#endif
+
 WebSocket::WebSocket(ScriptExecutionContext* context)
     : ActiveDOMObject(context, this)
     , m_state(CONNECTING)
@@ -189,7 +205,7 @@ void WebSocket::didReceiveMessage(const String& msg)
         return;
     RefPtr<MessageEvent> evt = MessageEvent::create();
     // FIXME: origin, lastEventId, source, messagePort.
-    evt->initMessageEvent(eventNames().messageEvent, false, false, msg, "", "", 0, 0);
+    evt->initMessageEvent(eventNames().messageEvent, false, false, SerializedScriptValue::create(msg), "", "", 0, 0);
     scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, evt));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocket.h b/src/3rdparty/webkit/WebCore/websockets/WebSocket.h
index c5b7ee7d36..9ecbed741d 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocket.h
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocket.h
@@ -50,6 +50,10 @@ namespace WebCore {
 
     class WebSocket : public RefCounted<WebSocket>, public EventTarget, public ActiveDOMObject, public WebSocketChannelClient {
     public:
+#if USE(V8)
+        static void setIsAvailable(bool);
+        static bool isAvailable();
+#endif
         static PassRefPtr<WebSocket> create(ScriptExecutionContext* context) { return adoptRef(new WebSocket(context)); }
         virtual ~WebSocket();
 
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocket.idl b/src/3rdparty/webkit/WebCore/websockets/WebSocket.idl
index 04606fea27..c662940471 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocket.idl
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocket.idl
@@ -55,13 +55,13 @@ module websockets {
         void close();
 
         // EventTarget interface
-        // [Custom] void addEventListener(in DOMString type,
-        //   in EventListener listener,
-        //   in boolean useCapture);
-        // [Custom] void removeEventListener(in DOMString type,
-        //   in EventListener listener,
-        //   in boolean useCapture);
-        // boolean dispatchEvent(in Event evt)
-        //   raises(EventException);
+        [Custom] void addEventListener(in DOMString type,
+                                       in EventListener listener,
+                                       in boolean useCapture);
+        [Custom] void removeEventListener(in DOMString type,
+                                          in EventListener listener,
+                                          in boolean useCapture);
+        boolean dispatchEvent(in Event evt)
+            raises(EventException);
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLImageElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLImageElement.cpp
index d47868a446..e5772181e2 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLImageElement.cpp
@@ -94,13 +94,12 @@ void WMLImageElement::attach()
 {
     WMLElement::attach();
 
-    if (renderer() && renderer()->isImage()) {
+    if (renderer() && renderer()->isImage() && m_imageLoader.haveFiredBeforeLoadEvent()) {
         RenderImage* imageObj = toRenderImage(renderer());
         if (imageObj->hasImage())
             return;
-
         imageObj->setCachedImage(m_imageLoader.image());
-
+        
         // If we have no image at all because we have no src attribute, set
         // image height and width for the alt text instead.
         if (!m_imageLoader.image() && !imageObj->cachedImage())
diff --git a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.cpp b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.cpp
index 5206fd90c9..82dc4b3176 100644
--- a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.cpp
@@ -47,7 +47,7 @@ DedicatedWorkerContext::DedicatedWorkerContext(const KURL& url, const String& us
 }
 
 // FIXME: remove this when we update the ObjC bindings (bug #28774).
-void DedicatedWorkerContext::postMessage(const String& message, MessagePort* port, ExceptionCode& ec)
+void DedicatedWorkerContext::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, ExceptionCode& ec)
 {
     MessagePortArray ports;
     if (port)
@@ -55,12 +55,12 @@ void DedicatedWorkerContext::postMessage(const String& message, MessagePort* por
     postMessage(message, &ports, ec);
 }
 
-void DedicatedWorkerContext::postMessage(const String& message, ExceptionCode& ec)
+void DedicatedWorkerContext::postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode& ec)
 {
     postMessage(message, static_cast<MessagePortArray*>(0), ec);
 }
 
-void DedicatedWorkerContext::postMessage(const String& message, const MessagePortArray* ports, ExceptionCode& ec)
+void DedicatedWorkerContext::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, ExceptionCode& ec)
 {
     if (isClosing())
         return;
diff --git a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.h b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.h
index 7609fcdb30..74a39d90f0 100644
--- a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.h
@@ -55,10 +55,10 @@ namespace WebCore {
 
         // EventTarget
         virtual DedicatedWorkerContext* toDedicatedWorkerContext() { return this; }
-        void postMessage(const String&, ExceptionCode&);
-        void postMessage(const String&, const MessagePortArray*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, const MessagePortArray*, ExceptionCode&);
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
-        void postMessage(const String&, MessagePort*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, MessagePort*, ExceptionCode&);
 
         DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
 
diff --git a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl
index 899bbae45c..f421b9af8d 100644
--- a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl
+++ b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl
@@ -39,7 +39,7 @@ module threads {
     ] DedicatedWorkerContext : WorkerContext {
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        [Custom] void postMessage(in DOMString message, in [Optional] Array messagePorts)
+        [Custom] void postMessage(in any message, in [Optional] Array messagePorts)
             raises(DOMException);
 #else
         // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
diff --git a/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.cpp b/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.cpp
index 11106eeb19..8b1a480e09 100644
--- a/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.cpp
@@ -63,8 +63,13 @@ public:
     void setThread(PassRefPtr<SharedWorkerThread> thread) { m_thread = thread; }
     SharedWorkerThread* thread() { return m_thread.get(); }
     bool isClosing() const { return m_closing; }
-    KURL url() const { return m_url.copy(); }
-    String name() const { return m_name.copy(); }
+    KURL url() const
+    {
+        // Don't use m_url.copy() because it isn't a threadsafe method.
+        return KURL(ParsedURLString, m_url.string().threadsafeCopy());
+    }
+
+    String name() const { return m_name.threadsafeCopy(); }
     bool matches(const String& name, PassRefPtr<SecurityOrigin> origin, const KURL& urlToMatch) const;
 
     // WorkerLoaderProxy
@@ -102,7 +107,7 @@ private:
 
 SharedWorkerProxy::SharedWorkerProxy(const String& name, const KURL& url, PassRefPtr<SecurityOrigin> origin)
     : m_closing(false)
-    , m_name(name.copy())
+    , m_name(name.crossThreadString())
     , m_url(url.copy())
     , m_origin(origin)
 {
@@ -311,6 +316,12 @@ void DefaultSharedWorkerRepository::workerScriptLoaded(SharedWorkerProxy& proxy,
     proxy.thread()->runLoop().postTask(SharedWorkerConnectTask::create(port));
 }
 
+bool SharedWorkerRepository::isAvailable()
+{
+    // SharedWorkers are enabled on the default WebKit platform.
+    return true;
+}
+
 void SharedWorkerRepository::connect(PassRefPtr<SharedWorker> worker, PassOwnPtr<MessagePortChannel> port, const KURL& url, const String& name, ExceptionCode& ec)
 {
     DefaultSharedWorkerRepository::instance().connectToWorker(worker, port, url, name, ec);
@@ -379,8 +390,9 @@ void DefaultSharedWorkerRepository::connectToWorker(PassRefPtr<SharedWorker> wor
 PassRefPtr<SharedWorkerProxy> DefaultSharedWorkerRepository::getProxy(const String& name, const KURL& url)
 {
     // Look for an existing worker, and create one if it doesn't exist.
-    // Items in the cache are freed on another thread, so copy the URL before creating the origin, to make sure no references to external strings linger.
-    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url.copy());
+    // Items in the cache are freed on another thread, so do a threadsafe copy of the URL before creating the origin,
+    // to make sure no references to external strings linger.
+    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(KURL(ParsedURLString, url.string().threadsafeCopy()));
     for (unsigned i = 0; i < m_proxies.size(); i++) {
         if (!m_proxies[i]->isClosing() && m_proxies[i]->matches(name, origin, url))
             return m_proxies[i];
diff --git a/src/3rdparty/webkit/WebCore/workers/SharedWorkerRepository.h b/src/3rdparty/webkit/WebCore/workers/SharedWorkerRepository.h
index 96d2fb1f25..49f394198e 100644
--- a/src/3rdparty/webkit/WebCore/workers/SharedWorkerRepository.h
+++ b/src/3rdparty/webkit/WebCore/workers/SharedWorkerRepository.h
@@ -48,6 +48,9 @@ namespace WebCore {
     // Interface to a repository which manages references to the set of active shared workers.
     class SharedWorkerRepository {
     public:
+        // Returns true if the platform supports SharedWorkers, otherwise false.
+        static bool isAvailable();
+
         // Connects the passed SharedWorker object with the specified worker thread, creating a new thread if necessary.
         static void connect(PassRefPtr<SharedWorker>, PassOwnPtr<MessagePortChannel>, const KURL&, const String& name, ExceptionCode&);
 
diff --git a/src/3rdparty/webkit/WebCore/workers/SharedWorkerThread.cpp b/src/3rdparty/webkit/WebCore/workers/SharedWorkerThread.cpp
index ded48348d5..e59df4fd85 100644
--- a/src/3rdparty/webkit/WebCore/workers/SharedWorkerThread.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/SharedWorkerThread.cpp
@@ -45,7 +45,7 @@ PassRefPtr<SharedWorkerThread> SharedWorkerThread::create(const String& name, co
 
 SharedWorkerThread::SharedWorkerThread(const String& name, const KURL& url, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy)
     : WorkerThread(url, userAgent, sourceCode, workerLoaderProxy, workerReportingProxy)
-    , m_name(name.copy())
+    , m_name(name.crossThreadString())
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/workers/Worker.cpp b/src/3rdparty/webkit/WebCore/workers/Worker.cpp
index c2c25c1de8..864b7c6865 100644
--- a/src/3rdparty/webkit/WebCore/workers/Worker.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/Worker.cpp
@@ -70,7 +70,7 @@ Worker::~Worker()
 }
 
 // FIXME: remove this when we update the ObjC bindings (bug #28774).
-void Worker::postMessage(const String& message, MessagePort* port, ExceptionCode& ec)
+void Worker::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, ExceptionCode& ec)
 {
     MessagePortArray ports;
     if (port)
@@ -78,12 +78,12 @@ void Worker::postMessage(const String& message, MessagePort* port, ExceptionCode
     postMessage(message, &ports, ec);
 }
 
-void Worker::postMessage(const String& message, ExceptionCode& ec)
+void Worker::postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode& ec)
 {
     postMessage(message, static_cast<MessagePortArray*>(0), ec);
 }
 
-void Worker::postMessage(const String& message, const MessagePortArray* ports, ExceptionCode& ec)
+void Worker::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, ExceptionCode& ec)
 {
     // Disentangle the port in preparation for sending it to the remote context.
     OwnPtr<MessagePortChannelArray> channels = MessagePort::disentanglePorts(ports, ec);
diff --git a/src/3rdparty/webkit/WebCore/workers/Worker.h b/src/3rdparty/webkit/WebCore/workers/Worker.h
index 41d39a2700..6b8fa84733 100644
--- a/src/3rdparty/webkit/WebCore/workers/Worker.h
+++ b/src/3rdparty/webkit/WebCore/workers/Worker.h
@@ -58,10 +58,10 @@ namespace WebCore {
 
         virtual Worker* toWorker() { return this; }
 
-        void postMessage(const String&, ExceptionCode&);
-        void postMessage(const String&, const MessagePortArray*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, const MessagePortArray*, ExceptionCode&);
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
-        void postMessage(const String& message, MessagePort*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, ExceptionCode&);
 
         void terminate();
 
diff --git a/src/3rdparty/webkit/WebCore/workers/Worker.idl b/src/3rdparty/webkit/WebCore/workers/Worker.idl
index 9c9342b056..0382739907 100644
--- a/src/3rdparty/webkit/WebCore/workers/Worker.idl
+++ b/src/3rdparty/webkit/WebCore/workers/Worker.idl
@@ -35,11 +35,11 @@ module threads {
         attribute EventListener onmessage;
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        [Custom] void postMessage(in DOMString message, in [Optional] Array messagePorts)
+        [Custom] void postMessage(in SerialisedScriptValue message, in [Optional] Array messagePorts)
             raises(DOMException);
 #else
         // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
-        void postMessage(in DOMString message, in [Optional] MessagePort messagePort)
+        void postMessage(in SerializedScriptValue message, in [Optional] MessagePort messagePort)
             raises(DOMException);
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerContextProxy.h b/src/3rdparty/webkit/WebCore/workers/WorkerContextProxy.h
index d55452efaa..e1ca139a0f 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerContextProxy.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerContextProxy.h
@@ -53,7 +53,7 @@ namespace WebCore {
 
         virtual void terminateWorkerContext() = 0;
 
-        virtual void postMessageToWorkerContext(const String&, PassOwnPtr<MessagePortChannelArray>) = 0;
+        virtual void postMessageToWorkerContext(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>) = 0;
 
         virtual bool hasPendingActivity() const = 0;
 
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp
index 3d28f9e8ec..0b666945b2 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp
@@ -46,14 +46,14 @@ namespace WebCore {
 
 class MessageWorkerContextTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerContextTask> create(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
+    static PassRefPtr<MessageWorkerContextTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
     {
         return adoptRef(new MessageWorkerContextTask(message, channels));
     }
 
 private:
-    MessageWorkerContextTask(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
-        : m_message(message.copy())
+    MessageWorkerContextTask(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
+        : m_message(message->release())
         , m_channels(channels)
     {
     }
@@ -68,20 +68,20 @@ private:
     }
 
 private:
-    String m_message;
+    RefPtr<SerializedScriptValue> m_message;
     OwnPtr<MessagePortChannelArray> m_channels;
 };
 
 class MessageWorkerTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerTask> create(const String& message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
+    static PassRefPtr<MessageWorkerTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
     {
         return adoptRef(new MessageWorkerTask(message, channels, messagingProxy));
     }
 
 private:
-    MessageWorkerTask(const String& message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
-        : m_message(message.copy())
+    MessageWorkerTask(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
+        : m_message(message->release())
         , m_channels(channels)
         , m_messagingProxy(messagingProxy)
     {
@@ -98,7 +98,7 @@ private:
     }
 
 private:
-    String m_message;
+    RefPtr<SerializedScriptValue> m_message;
     OwnPtr<MessagePortChannelArray> m_channels;
     WorkerMessagingProxy* m_messagingProxy;
 };
@@ -112,9 +112,9 @@ public:
 
 private:
     WorkerExceptionTask(const String& errorMessage, int lineNumber, const String& sourceURL, WorkerMessagingProxy* messagingProxy)
-        : m_errorMessage(errorMessage.copy())
+        : m_errorMessage(errorMessage.crossThreadString())
         , m_lineNumber(lineNumber)
-        , m_sourceURL(sourceURL.copy())
+        , m_sourceURL(sourceURL.crossThreadString())
         , m_messagingProxy(messagingProxy)
     {
     }
@@ -240,12 +240,12 @@ void WorkerMessagingProxy::startWorkerContext(const KURL& scriptURL, const Strin
     thread->start();
 }
 
-void WorkerMessagingProxy::postMessageToWorkerObject(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
+void WorkerMessagingProxy::postMessageToWorkerObject(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
 {
     m_scriptExecutionContext->postTask(MessageWorkerTask::create(message, channels.release(), this));
 }
 
-void WorkerMessagingProxy::postMessageToWorkerContext(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
+void WorkerMessagingProxy::postMessageToWorkerContext(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
 {
     if (m_askedToTerminate)
         return;
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h
index 8ab0cb62a1..754102acf5 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h
@@ -54,13 +54,13 @@ namespace WebCore {
         // (Only use these methods in the worker object thread.)
         virtual void startWorkerContext(const KURL& scriptURL, const String& userAgent, const String& sourceCode);
         virtual void terminateWorkerContext();
-        virtual void postMessageToWorkerContext(const String&, PassOwnPtr<MessagePortChannelArray>);
+        virtual void postMessageToWorkerContext(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
         virtual bool hasPendingActivity() const;
         virtual void workerObjectDestroyed();
 
         // Implementations of WorkerObjectProxy.
         // (Only use these methods in the worker context thread.)
-        virtual void postMessageToWorkerObject(const String&, PassOwnPtr<MessagePortChannelArray>);
+        virtual void postMessageToWorkerObject(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
         virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL);
         virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, int lineNumber, const String& sourceURL);
         virtual void confirmMessageFromWorkerObject(bool hasPendingActivity);
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerObjectProxy.h b/src/3rdparty/webkit/WebCore/workers/WorkerObjectProxy.h
index 77a7d7d233..33e0bc335c 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerObjectProxy.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerObjectProxy.h
@@ -44,7 +44,7 @@ namespace WebCore {
     // A proxy to talk to the worker object.
     class WorkerObjectProxy : public WorkerReportingProxy {
     public:
-        virtual void postMessageToWorkerObject(const String&, PassOwnPtr<MessagePortChannelArray>) = 0;
+        virtual void postMessageToWorkerObject(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>) = 0;
 
         virtual void confirmMessageFromWorkerObject(bool hasPendingActivity) = 0;
         virtual void reportPendingActivity(bool hasPendingActivity) = 0;
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp
index 449dd78762..6a58d526cd 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp
@@ -77,7 +77,7 @@ public:
 private:
     Task(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
         : m_task(task)
-        , m_mode(mode.copy())
+        , m_mode(mode.crossThreadString())
     {
     }
 
@@ -205,7 +205,7 @@ void WorkerRunLoop::postTask(PassRefPtr<ScriptExecutionContext::Task> task)
 
 void WorkerRunLoop::postTaskForMode(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
-    m_messageQueue.append(Task::create(task, mode.copy()));
+    m_messageQueue.append(Task::create(task, mode.crossThreadString()));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp
index 22253bf272..467157b592 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp
@@ -71,8 +71,8 @@ private:
 
 WorkerThreadStartupData::WorkerThreadStartupData(const KURL& scriptURL, const String& userAgent, const String& sourceCode)
     : m_scriptURL(scriptURL.copy())
-    , m_userAgent(userAgent.copy())
-    , m_sourceCode(sourceCode.copy())
+    , m_userAgent(userAgent.crossThreadString())
+    , m_sourceCode(sourceCode.crossThreadString())
 {
 }
 
diff --git a/src/3rdparty/webkit/WebKit.pri b/src/3rdparty/webkit/WebKit.pri
index fd918c9310..2dba0d443b 100644
--- a/src/3rdparty/webkit/WebKit.pri
+++ b/src/3rdparty/webkit/WebKit.pri
@@ -31,7 +31,10 @@ building-libs {
     DEPENDPATH += $$PWD/WebKit/qt/Api
 }
 
-DEFINES += USE_SYSTEM_MALLOC
+!mac:!unix|symbian {
+    DEFINES += USE_SYSTEM_MALLOC
+}
+
 CONFIG(release, debug|release) {
     DEFINES += NDEBUG
 }
diff --git a/src/3rdparty/webkit/WebKit/ChangeLog b/src/3rdparty/webkit/WebKit/ChangeLog
index 2f8f18f39e..607a0397af 100644
--- a/src/3rdparty/webkit/WebKit/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/ChangeLog
@@ -1,3 +1,136 @@
+2009-10-19  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        set ENABLE_NOTIFICATIONS=1 for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=29949
+
+        * chromium/features.gypi:
+
+2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=30289
+
+        * chromium/features.gypi:
+        Turned on ENABLE_SHARED_WORKERS by default. This doesn't actually turn on
+        SharedWorkers yet, as Chromium overrides this flag in its feature_overrides.gypi.
+
+2009-10-12  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium Port - Windows
+        https://bugs.webkit.org/show_bug.cgi?id=29969
+
+        * chromium/DEPS: Added gtest dep required by windows and incremented some of the deps revisions.
+
+2009-10-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        accessibility/media-element.html crashes (and has incorrect result)
+        https://bugs.webkit.org/show_bug.cgi?id=30108
+
+        Fix up the accessibilty label for the newly added fullscreen button,
+        and update the test result accordingly.
+
+        * English.lproj/Localizable.strings:
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        * WebKit.xcodeproj/project.pbxproj: Add WebPluginHalterClient to the project.
+
+2009-10-05  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        One of the dependencies' SVN url was missing a @ before the revision number.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30101
+
+        * chromium/DEPS:
+
+2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
+
+        Reviewed by Simon Fraser
+        
+        Support fullscreen in MediaPlayer (Mac)
+        https://bugs.webkit.org/show_bug.cgi?id=26742
+
+        Add new files for video fullscreen.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-10-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add testing harness for Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30010
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-10-04  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Enable Web Sockets in chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=29917
+
+        * chromium/features.gypi:
+
+2009-10-02  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added gyp_webkit that does a subset of the things gyp_chromium does
+        plus some specialization for an upstream chromium build.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29986
+
+        * chromium/DEPS: Points to gyp_webkit instead of gyp_chromium.
+        * chromium/gyp_webkit: A new python file.
+
+2009-10-01  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Make it possible to override the list of feature defines when building
+        downstream.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29979
+
+        * chromium/features.gypi:
+
+2009-10-01  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added windows-specific dependencies, updated some revisions and
+        re-organized file to make revision tracking easier. Also removed
+        extensions/v8 dependency that is no longer needed upstream.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29973
+
+        * chromium/DEPS:
+
+2009-09-30  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        1. Keeping up with downstream revisions.
+        2. Turning off v8 snapshot build step.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29928
+
+        * chromium/DEPS
+
 2009-09-29  Brady Eidson  <beidson@apple.com>
 
         Reviewed by John Sullivan.
diff --git a/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig b/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig
index 3229ab5c64..6572d2c582 100644
--- a/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig
+++ b/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 1;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
index b11890de0c..7e485a020c 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
@@ -1,5 +1,6 @@
 /*
     Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -49,11 +50,16 @@ public:
     virtual void setInputMethodHint(Qt::InputMethodHint hint, bool enable);
 #endif
 
+#ifndef QT_NO_CURSOR
     virtual QCursor cursor() const;
     virtual void updateCursor(const QCursor& cursor);
+#endif
 
+    virtual QPalette palette() const;
     virtual int screenNumber() const;
-    virtual WId winId() const;
+    virtual QWidget* ownerWidget() const;
+
+    virtual QObject* pluginParent() const;
 
     void _q_doLoadProgress(int progress);
     void _q_doLoadFinished(bool success);
@@ -83,10 +89,7 @@ void QGraphicsWebViewPrivate::_q_doLoadFinished(bool success)
     if (q->title().isEmpty())
         emit q->urlChanged(q->url());
 
-    if (success)
-        emit q->loadFinished();
-    else
-        emit q->loadFailed();
+    emit q->loadFinished(success);
 }
 
 void QGraphicsWebViewPrivate::scroll(int dx, int dy, const QRect& rectToScroll)
@@ -99,11 +102,11 @@ void QGraphicsWebViewPrivate::update(const QRect & dirtyRect)
     q->update(QRectF(dirtyRect));
 }
 
+
 void QGraphicsWebViewPrivate::setInputMethodEnabled(bool enable)
 {
     q->setAttribute(Qt::WA_InputMethodEnabled, enable);
 }
-
 #if QT_VERSION >= 0x040600
 void QGraphicsWebViewPrivate::setInputMethodHint(Qt::InputMethodHint hint, bool enable)
 {
@@ -113,7 +116,7 @@ void QGraphicsWebViewPrivate::setInputMethodHint(Qt::InputMethodHint hint, bool
         q->setInputMethodHints(q->inputMethodHints() & ~hint);
 }
 #endif
-
+#ifndef QT_NO_CURSOR
 QCursor QGraphicsWebViewPrivate::cursor() const
 {
     return q->cursor();
@@ -123,6 +126,12 @@ void QGraphicsWebViewPrivate::updateCursor(const QCursor& cursor)
 {
     q->setCursor(cursor);
 }
+#endif
+
+QPalette QGraphicsWebViewPrivate::palette() const
+{
+    return q->palette();
+}
 
 int QGraphicsWebViewPrivate::screenNumber() const
 {
@@ -136,14 +145,15 @@ int QGraphicsWebViewPrivate::screenNumber() const
     return 0;
 }
 
-WId QGraphicsWebViewPrivate::winId() const
+QWidget* QGraphicsWebViewPrivate::ownerWidget() const
 {
     const QList<QGraphicsView*> views = q->scene()->views();
+    return views.value(0);
+}
 
-    if (!views.isEmpty())
-        return views.at(0)->winId();
-
-    return 0;
+QObject* QGraphicsWebViewPrivate::pluginParent() const
+{
+    return q;
 }
 
 void QGraphicsWebViewPrivate::_q_setStatusBarMessage(const QString& s)
@@ -185,8 +195,10 @@ QGraphicsWebView::QGraphicsWebView(QGraphicsItem* parent)
 */
 QGraphicsWebView::~QGraphicsWebView()
 {
-    if (d->page)
+    if (d->page) {
         d->page->d->view = 0;
+        d->page->d->client = 0; // unset the page client
+    }
 
     if (d->page && d->page->parent() == this)
         delete d->page;
@@ -239,21 +251,38 @@ bool QGraphicsWebView::event(QEvent* event)
     // Re-implemented in order to allows fixing event-related bugs in patch releases.
 
     if (d->page) {
+#ifndef QT_NO_CONTEXTMENU
+        if (event->type() == QEvent::GraphicsSceneContextMenu) {
+            if (!isEnabled())
+                return false;
+
+            QGraphicsSceneContextMenuEvent* ev = static_cast<QGraphicsSceneContextMenuEvent*>(event);
+            QContextMenuEvent fakeEvent(QContextMenuEvent::Reason(ev->reason()), ev->pos().toPoint());
+            if (d->page->swallowContextMenuEvent(&fakeEvent)) {
+                event->accept();
+                return true;
+            }
+            d->page->updatePositionDependentActions(fakeEvent.pos());
+        } else
+#endif // QT_NO_CONTEXTMENU
+        {
 #ifndef QT_NO_CURSOR
 #if QT_VERSION >= 0x040400
-        } else if (event->type() == QEvent::CursorChange) {
-            // An unsetCursor will set the cursor to Qt::ArrowCursor.
-            // Thus this cursor change might be a QWidget::unsetCursor()
-            // If this is not the case and it came from WebCore, the
-            // QWebPageClient already has set its cursor internally
-            // to Qt::ArrowCursor, so updating the cursor is always
-            // right, as it falls back to the last cursor set by
-            // WebCore.
-            // FIXME: Add a QEvent::CursorUnset or similar to Qt.
-            if (cursor().shape() == Qt::ArrowCursor)
-                d->resetCursor();
+            if (event->type() == QEvent::CursorChange) {
+                // An unsetCursor will set the cursor to Qt::ArrowCursor.
+                // Thus this cursor change might be a QWidget::unsetCursor()
+                // If this is not the case and it came from WebCore, the
+                // QWebPageClient already has set its cursor internally
+                // to Qt::ArrowCursor, so updating the cursor is always
+                // right, as it falls back to the last cursor set by
+                // WebCore.
+                // FIXME: Add a QEvent::CursorUnset or similar to Qt.
+                if (cursor().shape() == Qt::ArrowCursor)
+                    d->resetCursor();
+            }
 #endif
 #endif
+        }
     }
     return QGraphicsWidget::event(event);
 }
@@ -608,7 +637,6 @@ void QGraphicsWebView::hoverMoveEvent(QGraphicsSceneHoverEvent* ev)
         QMouseEvent me = QMouseEvent(QEvent::MouseMove,
                 ev->pos().toPoint(), Qt::NoButton,
                 Qt::NoButton, Qt::NoModifier);
-        d->page->setView(ev->widget());
         d->page->event(&me);
         ev->setAccepted(accepted);
     }
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
index a8478d86e5..26f7374a5f 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
@@ -95,8 +95,7 @@ public Q_SLOTS:
 
 Q_SIGNALS:
     void loadStarted();
-    void loadFinished();
-    void loadFailed();
+    void loadFinished(bool);
 
     void progressChanged(qreal);
     void interactivityChanged();
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
index 939d881c04..5b83870190 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
@@ -30,12 +30,14 @@
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "FrameView.h"
+#include "GraphicsContext.h"
 #include "HTMLElement.h"
 #include "JSGlobalObject.h"
 #include "JSHTMLElement.h"
 #include "JSObject.h"
 #include "NodeList.h"
 #include "PropertyNameArray.h"
+#include "RenderImage.h"
 #include "ScriptFunctionCall.h"
 #include "StaticNodeList.h"
 #include "qt_runtime.h"
@@ -45,6 +47,8 @@
 #include <parser/SourceCode.h>
 #include <wtf/Vector.h>
 
+#include <QPainter>
+
 using namespace WebCore;
 
 class QWebElementPrivate {
@@ -1411,3 +1415,38 @@ QWebElement QWebElement::enclosingElement(WebCore::Node* node)
     Returns true if this element points to a different underlying DOM object
     than \a o; otherwise returns false.
 */
+
+
+/*! 
+  Render the element into \a painter .
+*/
+void QWebElement::render(QPainter* painter)
+{
+    WebCore::Element* e = m_element;
+    Document* doc = e ? e->document() : 0;
+    if (!doc)
+        return;
+
+    Frame* frame = doc->frame();
+    if (!frame || !frame->view() || !frame->contentRenderer())
+        return;
+
+    FrameView* view = frame->view();
+
+    view->layoutIfNeededRecursive();
+
+    IntRect rect = e->getRect();
+
+    if (rect.size().isEmpty())
+        return;
+
+    GraphicsContext context(painter);
+
+    context.save();
+    context.translate(-rect.x(), -rect.y());
+    view->setNodeToDraw(e);
+    view->paintContents(&context, rect);
+    view->setNodeToDraw(0);
+    context.restore();
+}
+
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
index 3db46379de..351ccb4617 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
@@ -31,6 +31,10 @@ namespace WebCore {
     class Node;
 }
 
+QT_BEGIN_NAMESPACE
+class QPainter;
+QT_END_NAMESPACE
+
 class QWebFrame;
 class QWebElementPrivate;
 
@@ -133,6 +137,8 @@ public:
     QString styleProperty(const QString& name, StyleResolveStrategy strategy) const;
     void setStyleProperty(const QString& name, const QString& value);
 
+    void render(QPainter* painter);
+
 private:
     explicit QWebElement(WebCore::Element*);
     explicit QWebElement(WebCore::Node*);
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
index 780f862b75..d2c324d838 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
@@ -540,15 +540,26 @@ QUrl QWebFrame::url() const
 */
 QUrl QWebFrame::requestedUrl() const
 {
-    // In the following edge cases (where the failing document
-    // loader does not get commited by the frame loader) it is
-    // safer to rely on outgoingReferrer than originalRequest.
-    if (!d->frame->loader()->activeDocumentLoader()
-        || (!d->frameLoaderClient->m_loadError.isNull()
-        &&  !d->frame->loader()->outgoingReferrer().isEmpty()))
-        return QUrl(d->frame->loader()->outgoingReferrer());
+    // There are some possible edge cases to be handled here,
+    // apart from checking if activeDocumentLoader is valid:
+    //
+    // * Method can be called while processing an unsucessful load.
+    //   In this case, frameLoaderClient will hold the current error
+    //   (m_loadError), and we will make use of it to recover the 'failingURL'.
+    // * If the 'failingURL' holds a null'ed string though, we fallback
+    //   to 'outgoingReferrer' (it yet is safer than originalRequest).
+    FrameLoader* loader = d->frame->loader();
+    FrameLoaderClientQt* loaderClient = d->frameLoaderClient;
+
+    if (!loader->activeDocumentLoader()
+        || !loaderClient->m_loadError.isNull()) {
+        if (!loaderClient->m_loadError.failingURL().isNull())
+            return QUrl(loaderClient->m_loadError.failingURL());
+        else if (!loader->outgoingReferrer().isEmpty())
+            return QUrl(loader->outgoingReferrer());
+    }
 
-    return d->frame->loader()->originalRequest().url();
+    return loader->originalRequest().url();
 }
 /*!
     \since 4.6
@@ -710,7 +721,9 @@ void QWebFrame::load(const QNetworkRequest &req,
   script can be specified through the charset attribute of the HTML script tag. It is also possible
   for the encoding to be specified by web server.
 
-  \sa toHtml()
+  \note This method will not affect session or global history for the frame.
+
+  \sa toHtml(), setContent()
 */
 void QWebFrame::setHtml(const QString &html, const QUrl &baseUrl)
 {
@@ -718,7 +731,7 @@ void QWebFrame::setHtml(const QString &html, const QUrl &baseUrl)
     WebCore::ResourceRequest request(kurl);
     const QByteArray utf8 = html.toUtf8();
     WTF::RefPtr<WebCore::SharedBuffer> data = WebCore::SharedBuffer::create(utf8.constData(), utf8.length());
-    WebCore::SubstituteData substituteData(data, WebCore::String("text/html"), WebCore::String("utf-8"), kurl);
+    WebCore::SubstituteData substituteData(data, WebCore::String("text/html"), WebCore::String("utf-8"), KURL());
     d->frame->loader()->load(request, substituteData, false);
 }
 
@@ -731,7 +744,9 @@ void QWebFrame::setHtml(const QString &html, const QUrl &baseUrl)
 
   The \a data is loaded immediately; external objects are loaded asynchronously.
 
-  \sa toHtml()
+  \note This method will not affect session or global history for the frame.
+
+  \sa toHtml(), setHtml()
 */
 void QWebFrame::setContent(const QByteArray &data, const QString &mimeType, const QUrl &baseUrl)
 {
@@ -741,11 +756,10 @@ void QWebFrame::setContent(const QByteArray &data, const QString &mimeType, cons
     QString actualMimeType = mimeType;
     if (actualMimeType.isEmpty())
         actualMimeType = QLatin1String("text/html");
-    WebCore::SubstituteData substituteData(buffer, WebCore::String(actualMimeType), WebCore::String(), kurl);
+    WebCore::SubstituteData substituteData(buffer, WebCore::String(actualMimeType), WebCore::String(), KURL());
     d->frame->loader()->load(request, substituteData, false);
 }
 
-
 /*!
   Returns the parent frame of this frame, or 0 if the frame is the web pages
   main frame.
@@ -1248,7 +1262,7 @@ QVariant QWebFrame::evaluateJavaScript(const QString& scriptSource)
     ScriptController *proxy = d->frame->script();
     QVariant rc;
     if (proxy) {
-        JSC::JSValue v = d->frame->loader()->executeScript(ScriptSourceCode(scriptSource)).jsValue();
+        JSC::JSValue v = d->frame->script()->executeScript(ScriptSourceCode(scriptSource)).jsValue();
         int distance = 0;
         rc = JSC::Bindings::convertValueToQVariant(proxy->globalObject()->globalExec(), v, QMetaType::Void, &distance);
     }
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
index 655fd0e376..31d193e489 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
@@ -271,7 +271,7 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
 {
     WebCore::InitializeLoggingChannelsIfNecessary();
     JSC::initializeThreading();
-    WebCore::FrameLoader::setLocalLoadPolicy(WebCore::FrameLoader::AllowLocalLoadsForLocalAndSubstituteData);
+    WebCore::SecurityOrigin::setLocalLoadPolicy(WebCore::SecurityOrigin::AllowLocalLoadsForLocalAndSubstituteData);
 
     chromeClient = new ChromeClientQt(q);
     contextMenuClient = new ContextMenuClientQt();
@@ -279,9 +279,6 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     page = new Page(chromeClient, contextMenuClient, editorClient,
                     new DragClientQt(q), new InspectorClientQt(q), 0);
 
-    // ### should be configurable
-    page->settings()->setDefaultTextEncodingName("iso-8859-1");
-
     settings = new QWebSettings(page->settings());
 
 #ifndef QT_NO_UNDOSTACK
@@ -461,10 +458,10 @@ void QWebPagePrivate::updateAction(QWebPage::WebAction action)
 
     switch (action) {
         case QWebPage::Back:
-            enabled = loader->canGoBackOrForward(-1);
+            enabled = page->canGoBackOrForward(-1);
             break;
         case QWebPage::Forward:
-            enabled = loader->canGoBackOrForward(1);
+            enabled = page->canGoBackOrForward(1);
             break;
         case QWebPage::Stop:
             enabled = loader->isLoading();
@@ -584,8 +581,6 @@ void QWebPagePrivate::timerEvent(QTimerEvent *ev)
 
 void QWebPagePrivate::mouseMoveEvent(QGraphicsSceneMouseEvent* ev)
 {
-    q->setView(ev->widget());
-
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
@@ -606,8 +601,6 @@ void QWebPagePrivate::mouseMoveEvent(QMouseEvent *ev)
 
 void QWebPagePrivate::mousePressEvent(QGraphicsSceneMouseEvent* ev)
 {
-    q->setView(ev->widget());
-
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
@@ -663,8 +656,6 @@ void QWebPagePrivate::mousePressEvent(QMouseEvent *ev)
 
 void QWebPagePrivate::mouseDoubleClickEvent(QGraphicsSceneMouseEvent *ev)
 {
-    q->setView(ev->widget());
-
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
@@ -750,8 +741,6 @@ void QWebPagePrivate::handleClipboard(QEvent* ev, Qt::MouseButton button)
 
 void QWebPagePrivate::mouseReleaseEvent(QGraphicsSceneMouseEvent* ev)
 {
-    q->setView(ev->widget());
-
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
@@ -833,8 +822,6 @@ QMenu *QWebPage::createStandardContextMenu()
 #ifndef QT_NO_WHEELEVENT
 void QWebPagePrivate::wheelEvent(QGraphicsSceneWheelEvent* ev)
 {
-    q->setView(ev->widget());
-
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
@@ -990,8 +977,6 @@ void QWebPagePrivate::focusOutEvent(QFocusEvent*)
 
 void QWebPagePrivate::dragEnterEvent(QGraphicsSceneDragDropEvent* ev)
 {
-    q->setView(ev->widget());
-
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(ev->mimeData(), ev->pos().toPoint(),
             QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
@@ -1016,8 +1001,6 @@ void QWebPagePrivate::dragEnterEvent(QDragEnterEvent* ev)
 
 void QWebPagePrivate::dragLeaveEvent(QGraphicsSceneDragDropEvent* ev)
 {
-    q->setView(ev->widget());
-
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(0, IntPoint(), QCursor::pos(), DragOperationNone);
     page->dragController()->dragExited(&dragData);
@@ -1036,8 +1019,6 @@ void QWebPagePrivate::dragLeaveEvent(QDragLeaveEvent* ev)
 
 void QWebPagePrivate::dragMoveEvent(QGraphicsSceneDragDropEvent* ev)
 {
-    q->setView(ev->widget());
-
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(ev->mimeData(), ev->pos().toPoint(),
             QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
@@ -1863,7 +1844,7 @@ void QWebPage::triggerAction(WebAction action, bool)
                 WTF::RefPtr<WebCore::Frame> wcFrame = targetFrame->d->frame;
                 targetFrame->d->frame->loader()->loadFrameRequest(frameLoadRequest(d->hitTestResult.linkUrl(), wcFrame.get()),
                                                                   /*lockHistory*/ false, /*lockBackForwardList*/ false, /*event*/ 0,
-                                                                  /*FormState*/ 0);
+                                                                  /*FormState*/ 0, SendReferrer);
                 break;
             }
             // fall through
@@ -1975,7 +1956,7 @@ void QWebPage::setViewportSize(const QSize &size) const
     }
 }
 
-QSize QWebPage::fixedContentsSize() const
+QSize QWebPage::preferredContentsSize() const
 {
     QWebFrame* frame = d->mainFrame;
     if (frame) {
@@ -1988,7 +1969,7 @@ QSize QWebPage::fixedContentsSize() const
 }
 
 /*!
-    \property QWebPage::fixedContentsSize
+    \property QWebPage::preferredContentsSize
     \since 4.6
     \brief the size of the fixed layout
 
@@ -1996,7 +1977,7 @@ QSize QWebPage::fixedContentsSize() const
     1024x768 for example then webkit will layout the page as if the viewport were that size
     rather than something different.
 */
-void QWebPage::setFixedContentsSize(const QSize &size) const
+void QWebPage::setPreferredContentsSize(const QSize &size) const
 {
     d->fixedLayoutSize = size;
 
@@ -2684,6 +2665,43 @@ void QWebPage::updatePositionDependentActions(const QPoint &pos)
 */
 
 /*!
+    \class QWebPage::ErrorPageExtensionOption
+    \since 4.6
+    \brief The ErrorPageExtensionOption class describes the option
+    for the error page extension.
+
+    \inmodule QtWebKit
+
+    The ErrorPageExtensionOption class holds the \a url for which an error occoured as well as
+    the associated \a frame.
+
+    The error itself is reported by an error \a domain, the \a error code as well as \a errorString.
+
+    \sa QWebPage::ErrorPageExtensionReturn
+*/
+
+/*!
+    \class QWebPage::ErrorPageExtensionReturn
+    \since 4.6
+    \brief The ErrorPageExtensionReturn describes the error page, which will be shown for the
+    frame for which the error occured.
+
+    \inmodule QtWebKit
+
+    The ErrorPageExtensionReturn class holds the data needed for creating an error page. Some are
+    optional such as \a contentType, which defaults to "text/html", as well as the \a encoding, which
+    is assumed to be UTF-8 if not indicated otherwise.
+
+    The error page is stored in the \a content byte array, as HTML content. In order to convert a
+    QString to a byte array, the QString::toUtf8() method can be used.
+
+    External objects such as stylesheets or images referenced in the HTML are located relative to
+    \a baseUrl.
+
+    \sa QWebPage::ErrorPageExtensionOption, QString::toUtf8()
+*/
+
+/*!
     \class QWebPage::ChooseMultipleFilesExtensionOption
     \since 4.5
     \brief The ChooseMultipleFilesExtensionOption class describes the option
@@ -2850,6 +2868,9 @@ QNetworkProxy QWebPage::networkProxy() const
     Sets the QNetworkAccessManager \a manager responsible for serving network requests for this
     QWebPage.
 
+    \note It is currently not supported to change the network access manager after the
+    QWebPage has used it. The results of doing this are undefined.
+
     \sa networkAccessManager()
 */
 void QWebPage::setNetworkAccessManager(QNetworkAccessManager *manager)
@@ -3359,6 +3380,16 @@ quint64 QWebPage::bytesReceived() const
 */
 
 /*!
+  \since 4.6
+  \fn void QWebPage::networkRequestStarted(QWebFrame* frame, QNetworkRequest* request);
+  \preliminary
+
+  This signal is emitted when a \a frame of the current page requests a web resource. The application
+  may want to associate the \a request with the \a frame that initiated it by storing the \a frame
+  as an attribute of the \a request.
+*/
+
+/*!
   \fn QWebPagePrivate* QWebPage::handle() const
   \internal
 */
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
index 41d1835911..f2bbde0ae2 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
@@ -56,6 +56,7 @@ namespace WebCore {
     class InspectorClientQt;
     class ResourceHandle;
     class HitTestResult;
+    class QNetworkReplyHandler;
 
     struct FrameLoadRequest;
 }
@@ -66,7 +67,7 @@ class QWEBKIT_EXPORT QWebPage : public QObject {
     Q_PROPERTY(bool modified READ isModified)
     Q_PROPERTY(QString selectedText READ selectedText)
     Q_PROPERTY(QSize viewportSize READ viewportSize WRITE setViewportSize)
-    Q_PROPERTY(QSize fixedContentsSize READ fixedContentsSize WRITE setFixedContentsSize)
+    Q_PROPERTY(QSize preferredContentsSize READ preferredContentsSize WRITE setPreferredContentsSize)
     Q_PROPERTY(bool forwardUnsupportedContent READ forwardUnsupportedContent WRITE setForwardUnsupportedContent)
     Q_PROPERTY(LinkDelegationPolicy linkDelegationPolicy READ linkDelegationPolicy WRITE setLinkDelegationPolicy)
     Q_PROPERTY(QPalette palette READ palette WRITE setPalette)
@@ -236,8 +237,8 @@ public:
     QSize viewportSize() const;
     void setViewportSize(const QSize &size) const;
 
-    QSize fixedContentsSize() const;
-    void setFixedContentsSize(const QSize &size) const;
+    QSize preferredContentsSize() const;
+    void setPreferredContentsSize(const QSize &size) const;
 
     virtual bool event(QEvent*);
     bool focusNextPrevChild(bool next);
@@ -288,6 +289,8 @@ public:
     enum ErrorDomain { QtNetwork, Http, WebKit };
     class ErrorPageExtensionOption : public ExtensionOption {
     public:
+        QUrl url;
+        QWebFrame* frame;
         ErrorDomain domain;
         int error;
         QString errorString;
@@ -344,6 +347,8 @@ Q_SIGNALS:
     void saveFrameStateRequested(QWebFrame* frame, QWebHistoryItem* item);
     void restoreFrameStateRequested(QWebFrame* frame);
 
+    void networkRequestStarted(QWebFrame* frame, QNetworkRequest* request);
+
 protected:
     virtual QWebPage *createWindow(WebWindowType type);
     virtual QObject *createPlugin(const QString &classid, const QUrl &url, const QStringList &paramNames, const QStringList &paramValues);
@@ -378,6 +383,7 @@ private:
     friend class WebCore::FrameLoaderClientQt;
     friend class WebCore::InspectorClientQt;
     friend class WebCore::ResourceHandle;
+    friend class WebCore::QNetworkReplyHandler;
 };
 
 Q_DECLARE_OPERATORS_FOR_FLAGS(QWebPage::FindFlags)
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
index eedf7d1571..ffa21e4fad 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
@@ -62,6 +62,8 @@ public:
     QString localStoragePath;
     QString offlineWebApplicationCachePath;
     qint64 offlineStorageDefaultQuota;
+    float printingMinimumShrinkFactor;
+    float printingMaximumShrinkFactor;
 
     void apply();
     WebCore::Settings* settings;
@@ -174,6 +176,12 @@ void QWebSettingsPrivate::apply()
         QString storagePath = !localStoragePath.isEmpty() ? localStoragePath : global->localStoragePath;
         settings->setLocalStorageDatabasePath(storagePath);
 
+        float minimumShrinkFactor = printingMinimumShrinkFactor > 0.0f ? printingMinimumShrinkFactor : global->printingMinimumShrinkFactor;
+        settings->setPrintingMinimumShrinkFactor(minimumShrinkFactor);
+
+        float maximumShrinkFactor = printingMaximumShrinkFactor > 0.0f ? printingMaximumShrinkFactor : global->printingMaximumShrinkFactor;
+        settings->setPrintingMaximumShrinkFactor(maximumShrinkFactor);
+
         value = attributes.value(QWebSettings::ZoomTextOnly,
                                  global->attributes.value(QWebSettings::ZoomTextOnly));
         settings->setZoomsTextOnly(value);
@@ -377,6 +385,9 @@ QWebSettings::QWebSettings()
     d->attributes.insert(QWebSettings::LocalContentCanAccessRemoteUrls, false);
     d->attributes.insert(QWebSettings::SessionStorageEnabled, true);
     d->offlineStorageDefaultQuota = 5 * 1024 * 1024;
+    d->defaultTextEncoding = QLatin1String("iso-8859-1");
+    d->printingMinimumShrinkFactor = 0.0f;
+    d->printingMaximumShrinkFactor = 0.0f;
 }
 
 /*!
@@ -491,6 +502,60 @@ QString QWebSettings::defaultTextEncoding() const
 }
 
 /*!
+    \since 4.7 
+    Specifies minimum shrink fator allowed for printing. If set to 0 a
+    default value is used.
+
+    When printing, content will be shrunk to reduce page usage, it
+    will reduced by a factor between printingMinimumShrinkFactor and
+    printingMaximumShrinkFactor. 
+
+    \sa printingMinimumShrinkFactor()
+    \sa setPrintingMaximumShrinkFactor()
+    \sa printingMaximumShrinkFactor()
+*/
+void QWebSettings::setPrintingMinimumShrinkFactor(float printingMinimumShrinkFactor)
+{
+    d->printingMinimumShrinkFactor = printingMinimumShrinkFactor;
+    d->apply();
+}
+
+/*!
+    \since 4.7 
+    returns the minimum shrink factor used for printing.
+
+    \sa setPrintingMinimumShrinkFactor()
+*/
+float QWebSettings::printingMinimumShrinkFactor() const
+{
+    return d->printingMinimumShrinkFactor;
+}
+
+/*!
+    \since 4.7 
+    Specifies maximum shrink fator allowed for printing. If set to 0 a
+    default value is used.
+
+    \sa setPrintingMinimumShrinkFactor()
+*/
+void QWebSettings::setPrintingMaximumShrinkFactor(float printingMaximumShrinkFactor)
+{
+    d->printingMaximumShrinkFactor = printingMaximumShrinkFactor;
+    d->apply();
+}
+
+/*!
+    \since 4.7 
+    returns the maximum shrink factor used for printing.
+
+    \sa setPrintingMinimumShrinkFactor()
+*/
+float QWebSettings::printingMaximumShrinkFactor() const
+{
+    return d->printingMaximumShrinkFactor;
+}
+
+/*!
     Sets the path of the icon database to \a path. The icon database is used
     to store "favicons" associated with web sites.
 
@@ -628,11 +693,6 @@ void QWebSettings::clearMemoryCaches()
     // Invalidating the font cache and freeing all inactive font data.
     WebCore::fontCache()->invalidate();
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    // Empty the application cache.
-    WebCore::cacheStorage().empty();
-#endif
-
     // Empty the Cross-Origin Preflight cache
     WebCore::CrossOriginPreflightResultCache::shared().empty();
 }
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
index 4790823e89..e68ea535d7 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
@@ -103,6 +103,12 @@ public:
     void setDefaultTextEncoding(const QString &encoding);
     QString defaultTextEncoding() const;
 
+    void setPrintingMinimumShrinkFactor(float printingMinimumShrinkFactor);
+    float printingMinimumShrinkFactor() const;
+
+    void setPrintingMaximumShrinkFactor(float printingMaximimShrinkFactor);
+    float printingMaximumShrinkFactor() const;
+
     static void setIconDatabasePath(const QString &location);
     static QString iconDatabasePath();
     static void clearIconDatabase();
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
index 41067f1895..95d7183351 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
@@ -1,6 +1,7 @@
 /*
     Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
     Copyright (C) 2008 Holger Hans Peter Freyther
+    Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -52,11 +53,16 @@ public:
     virtual void setInputMethodHint(Qt::InputMethodHint hint, bool enable);
 #endif
 
+#ifndef QT_NO_CURSOR
     virtual QCursor cursor() const;
     virtual void updateCursor(const QCursor& cursor);
+#endif
 
+    virtual QPalette palette() const;
     virtual int screenNumber() const;
-    virtual WId winId() const;
+    virtual QWidget* ownerWidget() const;
+
+    virtual QObject* pluginParent() const;
 
     void _q_pageDestroyed();
 
@@ -89,7 +95,7 @@ void QWebViewPrivate::setInputMethodHint(Qt::InputMethodHint hint, bool enable)
         view->setInputMethodHints(view->inputMethodHints() & ~hint);
 }
 #endif
-
+#ifndef QT_NO_CURSOR
 QCursor QWebViewPrivate::cursor() const
 {
     return view->cursor();
@@ -99,6 +105,12 @@ void QWebViewPrivate::updateCursor(const QCursor& cursor)
 {
     view->setCursor(cursor);
 }
+#endif
+
+QPalette QWebViewPrivate::palette() const
+{
+    return view->palette();
+}
 
 int QWebViewPrivate::screenNumber() const
 {
@@ -110,12 +122,14 @@ int QWebViewPrivate::screenNumber() const
     return 0;
 }
 
-WId QWebViewPrivate::winId() const
+QWidget* QWebViewPrivate::ownerWidget() const
 {
-    if (view)
-        return view->winId();
+    return view;
+}
 
-    return 0;
+QObject* QWebViewPrivate::pluginParent() const
+{
+    return view;
 }
 
 void QWebViewPrivate::_q_pageDestroyed()
@@ -231,8 +245,10 @@ QWebView::QWebView(QWidget *parent)
 */
 QWebView::~QWebView()
 {
-    if (d->page)
+    if (d->page) {
         d->page->d->view = 0;
+        d->page->d->client = 0;
+    }
 
     if (d->page && d->page->parent() == this)
         delete d->page;
diff --git a/src/3rdparty/webkit/WebKit/qt/ChangeLog b/src/3rdparty/webkit/WebKit/qt/ChangeLog
index 85d0e4f782..79876130eb 100644
--- a/src/3rdparty/webkit/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/qt/ChangeLog
@@ -1,3 +1,334 @@
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, build fix.
+
+        Update call to FrameLoader::loadFrameRequest().
+
+        * Api/qwebpage.cpp:
+        (QWebPage::triggerAction):
+
+2009-10-19  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Add QWebElement::render API which allows rendering of single
+        element.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::render):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::render):
+        * tests/qwebelement/qwebelement.qrc:
+        * tests/qwebelement/image.png: Added.
+
+2009-10-19  Markus Goetz <Markus.Goetz@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        QWebPage: Doc: setNetworkAccessManager should only be called once.
+
+        * Api/qwebpage.cpp:
+
+2009-10-19  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Tor Arne.
+
+        Wrong ifdef combination in QGraphicsWebView's event method.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::event):
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Don't crash when client is 0.
+        
+        Client is 0 when we use QWebPage without a QWebView or QGraphicsWebView.
+        In addition, setFrameRect()/updatePluginWidget() is called even if the
+        plugin was not succesfully loaded. updatePluginWidget() updates the
+        window rect which is, in theory, useful to draw something that indicates
+        that we didn't load successfully.
+        
+        So, a status check is added to setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30380
+
+        * tests/qwebpage/qwebpage.pro:
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (takeScreenshot):
+        (tst_QWebPage::screenshot_data):
+        (tst_QWebPage::screenshot):
+        * tests/resources/test.swf: Copied from LayoutTests/fast/replaced/resources/test.swf.
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Fix crash when QWebPage is deleted after QWebView.
+        
+        Fixes various sources of crashes:
+        1. The PluginContainer is a child of QWebView. When the view gets deleted,
+        the PluginView is not notified about the deletion of PluginContainer.
+        2. QWebView destructor does not set client to 0.
+        3. Sometimes pending paint events are sent after the plugin has died, so add
+        a check in PluginView::setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30354
+
+        * Api/qwebview.cpp:
+        (QWebView::~QWebView):
+        * tests/qwebview/qwebview.pro:
+        * tests/qwebview/tst_qwebview.cpp:
+        (tst_QWebView::reusePage_data):
+        (tst_QWebView::reusePage):
+
+2009-10-19  Jakob Truelsen  <antialize@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+
+        Allow one to costumize the minimal and maximal shrink factors,
+        Added methods setPrintingMinimumShrinkFactor, printingMinimumShrinkFactor,
+        setPrintingMaximumShrinkFactor, printingMaximumShrinkFactor to QWebSettings.
+
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        (QWebSettings::setPrintingMinimumShrinkFactor):
+        (QWebSettings::printingMinimumShrinkFactor):
+        (QWebSettings::setPrintingMaximumShrinkFactor):
+        (QWebSettings::printingMaximumShrinkFactor):
+        * Api/qwebsettings.h:
+
+2009-10-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Rename fixedContentsSize property to preferredContentsSize as
+        agreed upon with Simon Hausmann and Matthias Ettrich.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::preferredContentsSize):
+        (QWebPage::setPreferredContentsSize):
+        * Api/qwebpage.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::transitionToCommittedForNewPage):
+
+2009-10-16  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QGLauncher leaks WebPage object
+        https://bugs.webkit.org/show_bug.cgi?id=30465
+
+        Make 'SharedScene' to own 'WebPage' reference and delete it at its destructor.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::view):
+        * Api/qwebpage_p.h:
+        * QGVLauncher/main.cpp:
+        (SharedScene::SharedScene):
+        (SharedScene::~SharedScene):
+
+2009-10-16  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] "dangling" pointer to qwebpage's view object can leads QGLauncher to crash
+        https://bugs.webkit.org/show_bug.cgi?id=30459
+
+        Remove all setView(ev->widget()) calls in QWebPage and QGWV event handling methods,
+        since QWebPageClient would do the trick.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::hoverMoveEvent):
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::mouseMoveEvent):
+        (QWebPagePrivate::mousePressEvent):
+        (QWebPagePrivate::mouseDoubleClickEvent):
+        (QWebPagePrivate::mouseReleaseEvent):
+        (QWebPagePrivate::wheelEvent):
+        (QWebPagePrivate::dragEnterEvent):
+        (QWebPagePrivate::dragLeaveEvent):
+        (QWebPagePrivate::dragMoveEvent):
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Pull out r49676 as it caused build breakges on Symbian
+
+        * Api/qwebpage.cpp:
+
+2009-10-16  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Need a way to inform the application when a Netscape plugin is created or deleted
+        https://bugs.webkit.org/show_bug.cgi?id=30179
+
+        Added "c" style static methods for the application to hook up for
+        receiving notifications when a plugin is created or destroyed.
+
+        * Api/qwebpage.cpp:
+
+2009-10-15  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Rubberstamped by Tor Arne.
+
+        Make QGLauncher's WebPage class constructor to get a QObject* as parent (not QWidget*).
+
+        * QGVLauncher/main.cpp:
+        (WebPage::WebPage):
+
+2009-10-15  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Tor Arne.
+
+        [Qt] QGLauncher crashes while closing a window
+        https://bugs.webkit.org/show_bug.cgi?id=30385
+
+        Set page's pageClient reference to '0' at QGWV deletion.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::~QGraphicsWebView):
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (WebPage::WebPage):
+        (WebPage::aborting):
+        (tst_QGraphicsWebView::crashOnViewlessWebPages):
+
+2009-10-13  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make context menu to work in QGraphicsWebView
+        https://bugs.webkit.org/show_bug.cgi?id=30336
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::event):
+
+2009-10-13  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins : Remove all traces of winId. Use ownerWidget() instead.
+        
+        This is a bug for two reasons:
+        1. Everytime we use winId(), we end up creating a native widget. This causes an
+        unnecessary copy of contents from the backing store to the native widget.
+        2. Neither windowed nor windowless plugins require the winId of the QWebView or
+        QGraphicsView.
+        
+        Introduce ownerWidget() which returns a QWidget * without creating a native widget
+        (as opposed to QWidget::find(winId)).
+
+        https://bugs.webkit.org/show_bug.cgi?id=30170
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::ownerWidget):
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::ownerWidget):
+
+2009-10-13  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add some initial autotests for QWebPage's ErrorPageExtention
+        https://bugs.webkit.org/show_bug.cgi?id=30296
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (ErrorPage::ErrorPage):
+        (ErrorPage::supportsExtension):
+        (ErrorPage::extension):
+        (tst_QWebPage::errorPageExtension):
+
+2009-10-13  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] better handle possible edge cases on qwebframe::requestedUrl use
+        https://bugs.webkit.org/show_bug.cgi?id=30216
+
+        QWebFrame::requestedUrl can be called at any time during the load
+        process, including:
+
+        * An error handling (whereas an alternate error page for unsuccessful
+          load is being set);
+        * A ssl error exception call;
+        * During navigation notifications/callbacks (titleChanged, urlChanged,
+          progresses, addHistoryEntry, etc);
+        * Among others.
+
+        This patch makes requestedUrl calls to fallback to FrameLoaderClient
+        m_loadError's failingURL when an error has occurred, unless it is
+        null/empty.
+
+        Also, m_loadError is now being reset at each the main frame starts a
+        load, in order to avoid previous load errors footprints.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::requestedUrl):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::postProgressStartedNotification):
+
+2009-10-12  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Missing default value for the default text encoding.
+        https://bugs.webkit.org/show_bug.cgi?id=30311
+
+        QtWebKit has provided a default, hardcoded value for default charset but since
+        the addition of the defaultTextEncoding setting in QWebSettings, that hardcoded
+        value has had no effect.
+
+        Added a regression test and unskipped fast/dom/Document/document-charset.html,
+        which is passing now.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::defaultTextEncoding):
+
+2009-10-12  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Implement the new palette() methods on the page clients
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::palette):
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::palette):
+
+2009-10-12  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        QWebPage's createViewlessPlugin autotest crash fix.
+        
+        It is possible that plugins that are QWidgets or QGraphicsWidgets
+        are created before a view has been assigned to a QWebPage. The
+        plug-ins won't be fully functional, as by design, they should
+        visualise something, but they won't crash and will stay in memory.
+
+        An autotest that covers this use-case, is included.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30118
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createPlugin):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (PluginTrackedPageWidget::PluginTrackedPageWidget):
+        (PluginTrackedPageGraphicsWidget::PluginTrackedPageGraphicsWidget):
+        (PluginTrackedPageGraphicsWidget::createPlugin):
+        (tst_QWebPage::destroyPlugin):
+        (tst_QWebPage::createViewlessPlugin):
+
 2009-10-09  Joe Ligman  <joseph.ligman@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -24,6 +355,130 @@
         * tests/qwebpage/tst_qwebpage.cpp:
         (tst_QWebPage::inputMethods):
 
+2009-10-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move executeScript from FrameLoader to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=30200
+
+        Update API call.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::evaluateJavaScript):
+
+2009-10-08  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Part of testOptionalJSObjects autotest was marked as "expect to fail".
+
+        Two places in tst_QWebPage::testOptionalJSObjects were marked as
+        expected to fail. The problem concern checking if a feature is enabled
+        or disabled. According to discussion on webkit dev mailing list
+        a disabled feature should be invisible from java script level, but
+        there are exceptions from the rule. So we decided to disable the test
+        for now.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29867
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::testOptionalJSObjects):
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor PolicyChecker out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30155
+
+        Move the policy callback to the policy object.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::callPolicyFunction):
+
+2009-10-07  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Get rid of useless loadFailed signal in QGraphicsWebView
+        https://bugs.webkit.org/show_bug.cgi?id=30166
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::_q_doLoadFinished):
+        * Api/qgraphicswebview.h:
+        * QGVLauncher/main.cpp:
+        (MainWindow::init):
+        (MainWindow::loadFinished):
+
+2009-10-07  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        Add a simple rotation effect to QGVLauncher
+
+        https://bugs.webkit.org/show_bug.cgi?id=30162
+
+        * QGVLauncher/main.cpp:
+        (MainView::animatedFlip):
+        (MainWindow::animatedFlip):
+        (MainWindow::buildUI):
+
+2009-10-07  Volker Hilsheimer  <volker.hilsheimer@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Doc: Document HTML and status as properties.
+
+        * Api/qgraphicswebview.cpp:
+
+2009-10-07  Martin Smith  <msmith@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix qdoc warning about disabled renderHints property
+        on Symbian.
+
+        * Api/qwebview.cpp:
+        * Api/qwebview.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move setLocalLoadPolicy and friends to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30110
+
+        Call the new API.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+
+2009-10-06  Benjamin C Meyer  <bmeyer@rim.com>
+
+        Reviewed by Ariya Hidayat.
+        
+        When the drag data contains an image set it on the QDrag so it will be visible to the user.
+        
+        * WebCoreSupport/DragClientQt.cpp:
+        (WebCore::DragClientQt::startDrag):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: close inspector client view on
+        InspectorController::close API call.
+
+        In order to run batch web inspector layout tests (and not affect
+        subsequent tests) we should close inspector client's view upon
+        InspectorController::close API call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30009
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::createPage):
+
 2009-10-06  Janne Koskinen  <janne.p.koskinen@digia.com>
 
         Reviewed by Simon Hausmann.
@@ -37,6 +492,159 @@
         * Api/qwebview.cpp:
         (QWebView::QWebView):
 
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        QtLauncher: print the number of loaded urls
+        
+        When using the -r mode print the number of URLs loaded so far. This
+        is extremly useful when opening the same URL over and over again and
+        one wants to see the progress.
+
+        * QtLauncher/main.cpp:
+        (URLLoader::URLLoader):
+        (URLLoader::loadNext):
+
+2009-10-05  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        Add screenshot option to menubar
+
+        https://bugs.webkit.org/show_bug.cgi?id=30067
+
+        * QtLauncher/main.cpp:
+        (MainWindow::screenshot):
+        (MainWindow::setupUI):
+
+2009-10-05  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        Setting the env QTLAUNCHER_USE_ARGB_VISUALS makes Qt use WA_TranslucentWindow.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30068
+
+        * QtLauncher/main.cpp:
+        (MainWindow::MainWindow):
+
+2009-10-05  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by Simon Hausmann.
+
+        Add documentation to the ErrorPageExtension.
+
+        * Api/qwebpage.cpp:
+
+2009-10-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Inform the application when a new request is created
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        Add a signal to QWebPage, to inform the application when a request is created.
+
+        * Api/qwebpage.cpp:
+        * Api/qwebpage.h:
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::loadFinished):
+
+2009-10-05  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        ErrorPageExtension: Add a pointer to the QWebFrame that had
+        an error.
+
+        * Api/qwebpage.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::callErrorPageExtension):
+
+2009-10-05  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Do not empty the offline web appcache when clearing
+        memory caches. That one is not in memory, but stored
+        in sqlite.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::clearMemoryCaches):
+
+2009-10-05  J-P Nurmi  <jpnurmi@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Added QGraphicsWidget-plugins support to FrameLoaderClientQt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29710
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::pluginParent):
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::pluginParent):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::):
+        (WebCore::FrameLoaderClientQt::createPlugin):
+
+2009-10-03  Adam Barth  <abarth@webkit.org>
+
+        Unreview build fix.  I wish I had a try server...
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::updateAction):
+
+2009-10-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Conditionally guard cursor code (cursor and updateCursor functions) with !QT_NO_CURSOR.
+        Otherwise, it is inconsistent with class declaration of QCursor.
+
+        * Api/qgraphicswebview.cpp:
+        * Api/qwebview.cpp:
+
+2009-10-02  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compiler warnings about unused function arguments.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::scrollBarMinimum):
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::focusInEvent):
+        (QWebPagePrivate::focusOutEvent):
+        (QWebPagePrivate::leaveEvent):
+        (QWebPage::javaScriptAlert):
+        (QWebPage::javaScriptConfirm):
+        (QWebPage::javaScriptPrompt):
+        (QWebPage::triggerAction):
+        (QWebPage::acceptNavigationRequest):
+        (QWebPage::chooseFile):
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::repaint):
+        (WebCore::ChromeClientQt::mouseDidMoveOverElement):
+        (WebCore::ChromeClientQt::reachedMaxAppCacheSize):
+        * WebCoreSupport/ContextMenuClientQt.cpp:
+        (WebCore::ContextMenuClientQt::downloadURL):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchWillPerformClientRedirect):
+        (WebCore::FrameLoaderClientQt::setMainFrameDocumentReady):
+        (WebCore::FrameLoaderClientQt::representationExistsForURLScheme):
+        (WebCore::FrameLoaderClientQt::generatedMIMETypeForURLScheme):
+        (WebCore::FrameLoaderClientQt::shouldGoToHistoryItem):
+        (WebCore::FrameLoaderClientQt::pluginWillHandleLoadError):
+        (WebCore::FrameLoaderClientQt::assignIdentifierToInitialRequest):
+        (WebCore::FrameLoaderClientQt::dispatchDidFinishLoading):
+        (WebCore::FrameLoaderClientQt::createJavaAppletWidget):
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::setAttachedWindowHeight):
+        (WebCore::InspectorClientQt::highlight):
+        (WebCore::InspectorClientQt::removeSetting):
+
 2009-10-01  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
@@ -49,6 +657,37 @@
         (QWebPagePrivate::handleSoftwareInputPanel):
         * Api/qwebpage_p.h:
 
+2009-10-01  Alexis Menard  <alexis.menard@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Rename QWebGraphicsItem to QGraphicsWebView
+
+        * Api/headers.pri:
+        * Api/qwebpage.h:
+        * Api/qwebgraphicsitem.cpp: Renamed.
+        * Api/qwebgraphicsitem.h: Renamed.
+        * WebKit/qt/QGVLauncher/main.cpp:
+        * tests/tests.pro:
+        * tests/qwebgraphicsitem/qwebgraphicsitem.pro: Renamed.
+        * tests/qwebgraphicsitem/tst_qwebgraphicsitem.cpp: Renamed.
+
+2009-10-01  Antonio Gomes   <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29248
+        [Qt] [API] Make it possible to have 'invisible' loads
+
+        Make QWebFrame's setHtml and setContent methods to not change
+        session and global history at all.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::setHtml):
+        (QWebFrame::setContent):
+        * tests/qwebframe/qwebframe.pro:
+        * tests/qwebframe/tst_qwebframe.cpp:
+
 2009-10-01  Kristian Amlie  <kristian.amlie@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -85,6 +724,17 @@
         * tests/qwebpage/tst_qwebpage.cpp:
         (tst_QWebPage::inputMethods):
 
+2009-09-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Add the failed URL to the ErrorPageExtension, as it is quite
+        useful for creating error pages.
+
+        * Api/qwebpage.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::callErrorPageExtension):
+
 2009-09-29  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
 
         Reviewed by Tor Arne Vestbø.
diff --git a/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.cpp b/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.cpp
deleted file mode 100644
index d7fae07ca6..0000000000
--- a/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.cpp
+++ /dev/null
@@ -1,460 +0,0 @@
-/*
- * kimgio import filter for MS Windows .ico files
- *
- * Distributed under the terms of the LGPL
- * Copyright (c) 2000 Malte Starostik <malte@kde.org>
- *
- */
-
-#include "config.h"
-#include "ICOHandler.h"
-
-#include <cstring>
-#include <cstdlib>
-#include <algorithm>
-#include <vector>
-
-#include <QtGui/QImage>
-#include <QtGui/QBitmap>
-#include <QtGui/QApplication>
-#include <QtCore/QVector>
-#include <QtGui/QDesktopWidget>
-
-namespace
-{
-    // Global header (see http://www.daubnet.com/formats/ICO.html)
-    struct IcoHeader
-    {
-        enum Type { Icon = 1, Cursor };
-        quint16 reserved;
-        quint16 type;
-        quint16 count;
-    };
-
-    inline QDataStream& operator >>( QDataStream& s, IcoHeader& h )
-    {
-        return s >> h.reserved >> h.type >> h.count;
-    }
-
-    // Based on qt_read_dib et al. from qimage.cpp
-    // (c) 1992-2002 Nokia Corporation and/or its subsidiary(-ies).
-    struct BMP_INFOHDR
-    {
-        static const quint32 Size = 40;
-        quint32  biSize;                // size of this struct
-        quint32  biWidth;               // pixmap width
-        quint32  biHeight;              // pixmap height
-        quint16  biPlanes;              // should be 1
-        quint16  biBitCount;            // number of bits per pixel
-        enum Compression { RGB = 0 };
-        quint32  biCompression;         // compression method
-        quint32  biSizeImage;           // size of image
-        quint32  biXPelsPerMeter;       // horizontal resolution
-        quint32  biYPelsPerMeter;       // vertical resolution
-        quint32  biClrUsed;             // number of colors used
-        quint32  biClrImportant;        // number of important colors
-    };
-    const quint32 BMP_INFOHDR::Size;
-
-    QDataStream& operator >>( QDataStream &s, BMP_INFOHDR &bi )
-    {
-        s >> bi.biSize;
-        if ( bi.biSize == BMP_INFOHDR::Size )
-        {
-            s >> bi.biWidth >> bi.biHeight >> bi.biPlanes >> bi.biBitCount;
-            s >> bi.biCompression >> bi.biSizeImage;
-            s >> bi.biXPelsPerMeter >> bi.biYPelsPerMeter;
-            s >> bi.biClrUsed >> bi.biClrImportant;
-        }
-        return s;
-    }
-
-#if 0
-    QDataStream &operator<<( QDataStream &s, const BMP_INFOHDR &bi )
-    {
-        s << bi.biSize;
-        s << bi.biWidth << bi.biHeight;
-        s << bi.biPlanes;
-        s << bi.biBitCount;
-        s << bi.biCompression;
-        s << bi.biSizeImage;
-        s << bi.biXPelsPerMeter << bi.biYPelsPerMeter;
-        s << bi.biClrUsed << bi.biClrImportant;
-        return s;
-    }
-#endif
-
-    // Header for every icon in the file
-    struct IconRec
-    {
-        unsigned char width;
-        unsigned char height;
-        quint16 colors;
-        quint16 hotspotX;
-        quint16 hotspotY;
-        quint32 size;
-        quint32 offset;
-    };
-
-    inline QDataStream& operator >>( QDataStream& s, IconRec& r )
-    {
-        return s >> r.width >> r.height >> r.colors
-                 >> r.hotspotX >> r.hotspotY >> r.size >> r.offset;
-    }
-
-    struct LessDifference
-    {
-        LessDifference( unsigned s, unsigned c )
-            : size( s ), colors( c ) {}
-
-        bool operator ()( const IconRec& lhs, const IconRec& rhs ) const
-        {
-            // closest size match precedes everything else
-            if ( std::abs( int( lhs.width - size ) ) <
-                 std::abs( int( rhs.width - size ) ) ) return true;
-            else if ( std::abs( int( lhs.width - size ) ) >
-                 std::abs( int( rhs.width - size ) ) ) return false;
-            else if ( colors == 0 )
-            {
-                // high/true color requested
-                if ( lhs.colors == 0 ) return true;
-                else if ( rhs.colors == 0 ) return false;
-                else return lhs.colors > rhs.colors;
-            }
-            else
-            {
-                // indexed icon requested
-                if ( lhs.colors == 0 && rhs.colors == 0 ) return false;
-                else if ( lhs.colors == 0 ) return false;
-                else return std::abs( int( lhs.colors - colors ) ) <
-                            std::abs( int( rhs.colors - colors ) );
-            }
-        }
-        unsigned size;
-        unsigned colors;
-    };
-
-    bool loadFromDIB( QDataStream& stream, const IconRec& rec, QImage& icon )
-    {
-        BMP_INFOHDR header;
-        stream >> header;
-        if ( stream.atEnd() || header.biSize != BMP_INFOHDR::Size ||
-             header.biSize > rec.size ||
-             header.biCompression != BMP_INFOHDR::RGB ||
-             ( header.biBitCount != 1 && header.biBitCount != 4 &&
-               header.biBitCount != 8 && header.biBitCount != 24 &&
-               header.biBitCount != 32 ) ) return false;
-
-        unsigned paletteSize, paletteEntries;
-
-        if (header.biBitCount > 8)
-        {
-            paletteEntries = 0;
-            paletteSize    = 0;
-        }
-        else
-        {
-            paletteSize    = (1 << header.biBitCount);
-            paletteEntries = paletteSize;
-            if (header.biClrUsed && header.biClrUsed < paletteSize)
-                paletteEntries = header.biClrUsed;
-        }
-
-        // Always create a 32-bit image to get the mask right
-        // Note: this is safe as rec.width, rec.height are bytes
-        icon = QImage( rec.width, rec.height, QImage::Format_ARGB32 );
-        if ( icon.isNull() ) return false;
-
-        QVector< QRgb > colorTable( paletteSize );
-
-        colorTable.fill( QRgb( 0 ) );
-        for ( unsigned i = 0; i < paletteEntries; ++i )
-        {
-            unsigned char rgb[ 4 ];
-            stream.readRawData( reinterpret_cast< char* >( &rgb ),
-                                 sizeof( rgb ) );
-            colorTable[ i ] = qRgb( rgb[ 2 ], rgb[ 1 ], rgb[ 0 ] );
-        }
-
-        unsigned bpl = ( rec.width * header.biBitCount + 31 ) / 32 * 4;
-
-        unsigned char* buf = new unsigned char[ bpl ];
-        for ( unsigned y = rec.height; !stream.atEnd() && y--; )
-        {
-            stream.readRawData( reinterpret_cast< char* >( buf ), bpl );
-            unsigned char* pixel = buf;
-            QRgb* p = reinterpret_cast< QRgb* >( icon.scanLine( y ) );
-            switch ( header.biBitCount )
-            {
-                case 1:
-                    for ( unsigned x = 0; x < rec.width; ++x )
-                        *p++ = colorTable[
-                            ( pixel[ x / 8 ] >> ( 7 - ( x & 0x07 ) ) ) & 1 ];
-                    break;
-                case 4:
-                    for ( unsigned x = 0; x < rec.width; ++x )
-                        if ( x & 1 ) *p++ = colorTable[ pixel[ x / 2 ] & 0x0f ];
-                        else *p++ = colorTable[ pixel[ x / 2 ] >> 4 ];
-                    break;
-                case 8:
-                    for ( unsigned x = 0; x < rec.width; ++x )
-                        *p++ = colorTable[ pixel[ x ] ];
-                    break;
-                case 24:
-                    for ( unsigned x = 0; x < rec.width; ++x )
-                        *p++ = qRgb( pixel[ 3 * x + 2 ],
-                                     pixel[ 3 * x + 1 ],
-                                     pixel[ 3 * x ] );
-                    break;
-                case 32:
-                    for ( unsigned x = 0; x < rec.width; ++x )
-                        *p++ = qRgba( pixel[ 4 * x + 2 ],
-                                      pixel[ 4 * x + 1 ],
-                                      pixel[ 4 * x ],
-                                      pixel[ 4 * x  + 3] );
-                    break;
-            }
-        }
-        delete[] buf;
-
-        if ( header.biBitCount < 32 )
-        {
-            // Traditional 1-bit mask
-            bpl = ( rec.width + 31 ) / 32 * 4;
-            buf = new unsigned char[ bpl ];
-            for ( unsigned y = rec.height; y--; )
-            {
-                stream.readRawData( reinterpret_cast< char* >( buf ), bpl );
-                QRgb* p = reinterpret_cast< QRgb* >( icon.scanLine( y ) );
-                for ( unsigned x = 0; x < rec.width; ++x, ++p )
-                    if ( ( ( buf[ x / 8 ] >> ( 7 - ( x & 0x07 ) ) ) & 1 ) )
-                        *p &= RGB_MASK;
-            }
-            delete[] buf;
-        }
-        return true;
-    }
-}
-
-ICOHandler::ICOHandler()
-{
-}
-
-bool ICOHandler::canRead() const
-{
-    return canRead(device());
-}
-
-bool ICOHandler::read(QImage *outImage)
-{
-
-    qint64 offset = device()->pos();
-
-    QDataStream stream( device() );
-    stream.setByteOrder( QDataStream::LittleEndian );
-    IcoHeader header;
-    stream >> header;
-    if ( stream.atEnd() || !header.count ||
-         ( header.type != IcoHeader::Icon && header.type != IcoHeader::Cursor) )
-        return false;
-
-    unsigned requestedSize = 32;
-    unsigned requestedColors =  QApplication::desktop()->depth() > 8 ? 0 : QApplication::desktop()->depth();
-    int requestedIndex = -1;
-#if 0
-    if ( io->parameters() )
-    {
-        QStringList params = QString(io->parameters()).split( ';', QString::SkipEmptyParts );
-        QMap< QString, QString > options;
-        for ( QStringList::ConstIterator it = params.begin();
-              it != params.end(); ++it )
-        {
-            QStringList tmp = (*it).split( '=', QString::SkipEmptyParts );
-            if ( tmp.count() == 2 ) options[ tmp[ 0 ] ] = tmp[ 1 ];
-        }
-        if ( options[ "index" ].toUInt() )
-            requestedIndex = options[ "index" ].toUInt();
-        if ( options[ "size" ].toUInt() )
-            requestedSize = options[ "size" ].toUInt();
-        if ( options[ "colors" ].toUInt() )
-            requestedColors = options[ "colors" ].toUInt();
-    }
-#endif
-
-    typedef std::vector< IconRec > IconList;
-    IconList icons;
-    for ( unsigned i = 0; i < header.count; ++i )
-    {
-        if ( stream.atEnd() )
-            return false;
-        IconRec rec;
-        stream >> rec;
-        icons.push_back( rec );
-    }
-    IconList::const_iterator selected;
-    if (requestedIndex >= 0) {
-        selected = std::min( icons.begin() + requestedIndex, icons.end() );
-    } else {
-        selected = std::min_element( icons.begin(), icons.end(),
-                                     LessDifference( requestedSize, requestedColors ) );
-    }
-    if ( stream.atEnd() || selected == icons.end() ||
-         offset + selected->offset > device()->size() )
-        return false;
-
-    device()->seek( offset + selected->offset );
-    QImage icon;
-    if ( loadFromDIB( stream, *selected, icon ) )
-    {
-#ifndef QT_NO_IMAGE_TEXT
-        icon.setText( "X-Index", 0, QString::number( selected - icons.begin() ) );
-        if ( header.type == IcoHeader::Cursor )
-        {
-            icon.setText( "X-HotspotX", 0, QString::number( selected->hotspotX ) );
-            icon.setText( "X-HotspotY", 0, QString::number( selected->hotspotY ) );
-        }
-#endif
-        *outImage = icon;
-        return true;
-    }
-    return false;
-}
-
-bool ICOHandler::write(const QImage &/*image*/)
-{
-#if 0
-    if (image.isNull())
-        return;
-
-    QByteArray dibData;
-    QDataStream dib(dibData, QIODevice::ReadWrite);
-    dib.setByteOrder(QDataStream::LittleEndian);
-
-    QImage pixels = image;
-    QImage mask;
-    if (io->image().hasAlphaBuffer())
-        mask = image.createAlphaMask();
-    else
-        mask = image.createHeuristicMask();
-    mask.invertPixels();
-    for ( int y = 0; y < pixels.height(); ++y )
-        for ( int x = 0; x < pixels.width(); ++x )
-            if ( mask.pixel( x, y ) == 0 ) pixels.setPixel( x, y, 0 );
-
-    if (!qt_write_dib(dib, pixels))
-        return;
-
-   uint hdrPos = dib.device()->at();
-    if (!qt_write_dib(dib, mask))
-        return;
-    memmove(dibData.data() + hdrPos, dibData.data() + hdrPos + BMP_WIN + 8, dibData.size() - hdrPos - BMP_WIN - 8);
-    dibData.resize(dibData.size() - BMP_WIN - 8);
-
-    QDataStream ico(device());
-    ico.setByteOrder(QDataStream::LittleEndian);
-    IcoHeader hdr;
-    hdr.reserved = 0;
-    hdr.type = Icon;
-    hdr.count = 1;
-    ico << hdr.reserved << hdr.type << hdr.count;
-    IconRec rec;
-    rec.width = image.width();
-    rec.height = image.height();
-    if (image.numColors() <= 16)
-        rec.colors = 16;
-    else if (image.depth() <= 8)
-        rec.colors = 256;
-    else
-        rec.colors = 0;
-    rec.hotspotX = 0;
-    rec.hotspotY = 0;
-    rec.dibSize = dibData.size();
-    ico << rec.width << rec.height << rec.colors
-        << rec.hotspotX << rec.hotspotY << rec.dibSize;
-    rec.dibOffset = ico.device()->at() + sizeof(rec.dibOffset);
-    ico << rec.dibOffset;
-
-    BMP_INFOHDR dibHeader;
-    dib.device()->at(0);
-    dib >> dibHeader;
-    dibHeader.biHeight = image.height() << 1;
-    dib.device()->at(0);
-    dib << dibHeader;
-
-    ico.writeRawBytes(dibData.data(), dibData.size());
-    return true;
-#endif
-    return false;
-}
-
-QByteArray ICOHandler::name() const
-{
-    return "ico";
-}
-
-bool ICOHandler::canRead(QIODevice *device)
-{
-    if (!device) {
-        qWarning("ICOHandler::canRead() called with no device");
-        return false;
-    }
-
-    const qint64 oldPos = device->pos();
-
-    char head[8];
-    qint64 readBytes = device->read(head, sizeof(head));
-    const bool readOk = readBytes == sizeof(head);
-
-    if (device->isSequential()) {
-        while (readBytes > 0)
-            device->ungetChar(head[readBytes-- - 1]);
-    } else {
-        device->seek(oldPos);
-    }
-
-    if ( !readOk )
-        return false;
-
-    return head[2] == '\001' && head[3] == '\000' && // type should be 1
-        ( head[6] == 16 || head[6] == 32 || head[6] == 64 ) && // width can only be one of those
-        ( head[7] == 16 || head[7] == 32 || head[7] == 64 );   // same for height
-}
-
-class ICOPlugin : public QImageIOPlugin
-{
-public:
-    QStringList keys() const;
-    Capabilities capabilities(QIODevice *device, const QByteArray &format) const;
-    QImageIOHandler *create(QIODevice *device, const QByteArray &format = QByteArray()) const;
-};
-
-QStringList ICOPlugin::keys() const
-{
-    return QStringList() << "ico" << "ICO";
-}
-
-QImageIOPlugin::Capabilities ICOPlugin::capabilities(QIODevice *device, const QByteArray &format) const
-{
-    if (format == "ico" || format == "ICO")
-        return Capabilities(CanRead);
-    if (!format.isEmpty())
-        return 0;
-    if (!device->isOpen())
-        return 0;
-
-    Capabilities cap;
-    if (device->isReadable() && ICOHandler::canRead(device))
-        cap |= CanRead;
-    return cap;
-}
-
-QImageIOHandler *ICOPlugin::create(QIODevice *device, const QByteArray &format) const
-{
-    QImageIOHandler *handler = new ICOHandler;
-    handler->setDevice(device);
-    handler->setFormat(format);
-    return handler;
-}
-
-Q_EXPORT_STATIC_PLUGIN(ICOPlugin)
-Q_EXPORT_PLUGIN2(qtwebico, ICOPlugin)
diff --git a/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.h b/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.h
deleted file mode 100644
index 4f1f1d6b18..0000000000
--- a/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * ico.h - kimgio import filter for MS Windows .ico files
- *
- * Distributed under the terms of the LGPL
- * Copyright (c) 2000 Malte Starostik <malte@kde.org>
- *
- */
-
-// You can use QImageIO::setParameters() to request a specific
-// Icon out of an .ico file:
-//
-// Options consist of a name=value pair and are separated by a semicolon.
-// Available options are:
-//     size=<size>   select the icon that most closely matches <size> (pixels)
-//                   default: 32
-//     colors=<num>  select the icon that has <num> colors (or comes closest)
-//                   default: 1 << display depth or 0 (RGB) if display depth > 8
-//     index=<index> select the indexth icon from the file. If this option
-//                   is present, the size and colors options will be ignored.
-//                   default: none
-// If both size and colors are given, size takes precedence.
-//
-// The old format is still supported:
-//     the parameters consist of a single string in the form
-//     "<size>[:<colors>]" which correspond to the options above
-//
-// If an icon was returned (i.e. the file is valid and the index option
-// if present was not out of range), the icon's index within the .ico
-// file is returned in the text tag "X-Index" of the image.
-// If the icon is in fact a cursor, its hotspot coordinates are returned
-// in the text tags "X-HotspotX" and "X-HotspotY".
-
-#ifndef _ICOHANDLER_H_
-#define _ICOHANDLER_H_
-
-#include <QtGui/QImageIOPlugin>
-
-class ICOHandler : public QImageIOHandler
-{
-public:
-    ICOHandler();
-
-    bool canRead() const;
-    bool read(QImage *image);
-    bool write(const QImage &image);
-
-    QByteArray name() const;
-
-    static bool canRead(QIODevice *device);
-};
-
-#endif
diff --git a/src/3rdparty/webkit/WebKit/qt/Plugins/Plugins.pro b/src/3rdparty/webkit/WebKit/qt/Plugins/Plugins.pro
deleted file mode 100644
index a9b4f82f62..0000000000
--- a/src/3rdparty/webkit/WebKit/qt/Plugins/Plugins.pro
+++ /dev/null
@@ -1,14 +0,0 @@
-TEMPLATE = lib
-TARGET = qtwebico
-CONFIG += plugin
-HEADERS += ICOHandler.h
-SOURCES += ICOHandler.cpp
-
-include(../../WebKit.pri)
-
-contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols 
-unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
-
-target.path = $$[QT_INSTALL_PLUGINS]/imageformats
-INSTALLS += target
-
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp
index 0df0768add..99e438d50f 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp
@@ -66,6 +66,8 @@ void DragClientQt::startDrag(DragImageRef, const IntPoint&, const IntPoint&, Cli
     QWidget* view = m_webPage->view();
     if (view) {
         QDrag *drag = new QDrag(view);
+        if (clipboardData->hasImage())
+            drag->setPixmap(qvariant_cast<QPixmap>(clipboardData->imageData()));
         drag->setMimeData(clipboardData);
         drag->start();
     }
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index 905e11d11d..81ccbe85a0 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -55,8 +55,10 @@
 #include "ResourceHandle.h"
 #include "Settings.h"
 #include "ScriptString.h"
+#include "QWebPageClient.h"
 
 #include "qwebpage.h"
+#include "qwebpage_p.h"
 #include "qwebframe.h"
 #include "qwebframe_p.h"
 #include "qwebhistoryinterface.h"
@@ -67,6 +69,8 @@
 #include <QCoreApplication>
 #include <QDebug>
 #if QT_VERSION >= 0x040400
+#include <QGraphicsScene>
+#include <QGraphicsWidget>
 #include <QNetworkRequest>
 #include <QNetworkReply>
 #else
@@ -183,7 +187,7 @@ QWebFrame* FrameLoaderClientQt::webFrame() const
 
 void FrameLoaderClientQt::callPolicyFunction(FramePolicyFunction function, PolicyAction action)
 {
-    (m_frame->loader()->*function)(action);
+    (m_frame->loader()->policyChecker()->*function)(action);
 }
 
 bool FrameLoaderClientQt::hasWebView() const
@@ -210,12 +214,12 @@ void FrameLoaderClientQt::transitionToCommittedForNewPage()
     QColor backgroundColor = brush.style() == Qt::SolidPattern ? brush.color() : QColor();
 
     QWebPage* page = m_webFrame->page();
-    const QSize fixedLayoutSize = page->fixedContentsSize();
+    const QSize preferredLayoutSize = page->preferredContentsSize();
 
     m_frame->createView(m_webFrame->page()->viewportSize(),
                         backgroundColor, !backgroundColor.alpha(),
-                        fixedLayoutSize.isValid() ? IntSize(fixedLayoutSize) : IntSize(),
-                        fixedLayoutSize.isValid(),
+                        preferredLayoutSize.isValid() ? IntSize(preferredLayoutSize) : IntSize(),
+                        preferredLayoutSize.isValid(),
                         (ScrollbarMode)m_webFrame->scrollBarPolicy(Qt::Horizontal),
                         (ScrollbarMode)m_webFrame->scrollBarPolicy(Qt::Vertical));
 }
@@ -374,7 +378,8 @@ void FrameLoaderClientQt::dispatchDidFinishLoad()
     if (dumpFrameLoaderCallbacks)
         printf("%s - didFinishLoadForFrame\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
-    m_loadError = ResourceError(); // clears the previous error
+    // Clears the previous error.
+    m_loadError = ResourceError();
 
     if (!m_webFrame)
         return;
@@ -428,6 +433,8 @@ void FrameLoaderClientQt::revertToProvisionalState(DocumentLoader*)
 void FrameLoaderClientQt::postProgressStartedNotification()
 {
     if (m_webFrame && m_frame->page()) {
+        // A new load starts, so lets clear the previous error.
+        m_loadError = ResourceError();
         emit loadStarted();
         postProgressEstimateChangedNotification();
     }
@@ -875,6 +882,8 @@ void FrameLoaderClientQt::callErrorPageExtension(const WebCore::ResourceError& e
         else
             return;
 
+        option.url = QUrl(error.failingURL());
+        option.frame = m_webFrame;
         option.error = error.errorCode();
         option.errorString = error.localizedDescription();
 
@@ -883,7 +892,7 @@ void FrameLoaderClientQt::callErrorPageExtension(const WebCore::ResourceError& e
             return;
 
         KURL baseUrl(output.baseUrl);
-        KURL failingUrl(QUrl(error.failingURL()));
+        KURL failingUrl(option.url);
 
         WebCore::ResourceRequest request(baseUrl);
         WTF::RefPtr<WebCore::SharedBuffer> buffer = WebCore::SharedBuffer::create(output.content.constData(), output.content.length());
@@ -1116,6 +1125,53 @@ public:
     }
 };
 
+#if QT_VERSION >= 0x040600
+class QtPluginGraphicsWidget: public Widget
+{
+public:
+    static RefPtr<QtPluginGraphicsWidget> create(QGraphicsWidget* w = 0)
+    {
+        return adoptRef(new QtPluginGraphicsWidget(w));
+    }
+
+    ~QtPluginGraphicsWidget()
+    {
+        if (graphicsWidget)
+            graphicsWidget->deleteLater();
+    }
+    virtual void invalidateRect(const IntRect& r)
+    {
+        QGraphicsScene* scene = graphicsWidget ? graphicsWidget->scene() : 0;
+        if (scene)
+            scene->update(QRect(r));
+    }
+    virtual void frameRectsChanged()
+    {
+        if (!graphicsWidget)
+            return;
+
+        IntRect windowRect = convertToContainingWindow(IntRect(0, 0, frameRect().width(), frameRect().height()));
+        graphicsWidget->setGeometry(QRect(windowRect));
+
+        // FIXME: clipping of graphics widgets
+    }
+    virtual void show()
+    {
+        if (graphicsWidget)
+            graphicsWidget->show();
+    }
+    virtual void hide()
+    {
+        if (graphicsWidget)
+            graphicsWidget->hide();
+    }
+private:
+    QtPluginGraphicsWidget(QGraphicsWidget* w = 0): Widget(0), graphicsWidget(w) {}
+
+    QGraphicsWidget* graphicsWidget;
+};
+#endif
+
 PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize, HTMLPlugInElement* element, const KURL& url, const Vector<String>& paramNames,
                                           const Vector<String>& paramValues, const String& mimeType, bool loadManually)
 {
@@ -1177,15 +1233,34 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
         if (object) {
             QWidget* widget = qobject_cast<QWidget*>(object);
             if (widget) {
-                QWidget* view = m_webFrame->page()->view();
-                if (view)
-                    widget->setParent(view);
+                QWidget* parentWidget;
+                if (m_webFrame->page()->d->client)
+                    parentWidget = qobject_cast<QWidget*>(m_webFrame->page()->d->client->pluginParent());
+                else
+                    parentWidget = 0;  // The plug-in won't be fully functional because the QWebView doesn't exist.
+                widget->setParent(parentWidget);
                 RefPtr<QtPluginWidget> w = adoptRef(new QtPluginWidget());
                 w->setPlatformWidget(widget);
                 // Make sure it's invisible until properly placed into the layout
                 w->setFrameRect(IntRect(0, 0, 0, 0));
                 return w;
             }
+#if QT_VERSION >= 0x040600
+            QGraphicsWidget* graphicsWidget = qobject_cast<QGraphicsWidget*>(object);
+            if (graphicsWidget) {
+                QGraphicsObject* parentWidget;
+                if (m_webFrame->page()->d->client)
+                    parentWidget = qobject_cast<QGraphicsObject*>(m_webFrame->page()->d->client->pluginParent());
+                else
+                    parentWidget = 0;  // The plug-in won't be fully functional because the QWebView doesn't exist.
+                graphicsWidget->hide();
+                graphicsWidget->setParentItem(parentWidget);
+                RefPtr<QtPluginGraphicsWidget> w = QtPluginGraphicsWidget::create(graphicsWidget);
+                // Make sure it's invisible until properly placed into the layout
+                w->setFrameRect(IntRect(0, 0, 0, 0));
+                return w;
+            }
+#endif
             // FIXME: make things work for widgetless plugins as well
             delete object;
     } else { // NPAPI Plugins
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
index 3931a85267..12f405c53c 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
@@ -84,9 +84,6 @@ void InspectorClientQt::inspectorDestroyed()
 
 Page* InspectorClientQt::createPage()
 {
-    if (m_inspectorView)
-        return m_inspectorView->page()->d->page;
-
     QWebView* inspectorView = new QWebView;
     InspectorClientWebPage* inspectorPage = new InspectorClientWebPage(inspectorView);
     inspectorView->setPage(inspectorPage);
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
index 1a572860fe..4bdb7f5644 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
@@ -19,7 +19,33 @@
 
 #include <QtTest/QtTest>
 
+#include <QGraphicsView>
 #include <qgraphicswebview.h>
+#include <qwebpage.h>
+#include <qwebframe.h>
+
+/**
+ * Starts an event loop that runs until the given signal is received.
+ * Optionally the event loop
+ * can return earlier on a timeout.
+ *
+ * \return \p true if the requested signal was received
+ *         \p false on timeout
+ */
+static bool waitForSignal(QObject* obj, const char* signal, int timeout = 10000)
+{
+    QEventLoop loop;
+    QObject::connect(obj, signal, &loop, SLOT(quit()));
+    QTimer timer;
+    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
+    if (timeout > 0) {
+        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
+        timer.setSingleShot(true);
+        timer.start(timeout);
+    }
+    loop.exec();
+    return timeoutSpy.isEmpty();
+}
 
 class tst_QGraphicsWebView : public QObject
 {
@@ -27,6 +53,7 @@ class tst_QGraphicsWebView : public QObject
 
 private slots:
     void qgraphicswebview();
+    void crashOnViewlessWebPages();
 };
 
 void tst_QGraphicsWebView::qgraphicswebview()
@@ -53,6 +80,55 @@ void tst_QGraphicsWebView::qgraphicswebview()
     item.setContent(QByteArray());
 }
 
+class WebPage : public QWebPage
+{
+    Q_OBJECT
+
+public:
+    WebPage(QObject* parent = 0): QWebPage(parent)
+    {
+    }
+
+    QGraphicsWebView* webView;
+
+private slots:
+    // Force a webview deletion during the load.
+    // It should not cause WebPage to crash due to
+    // it accessing invalid pageClient pointer.
+    void aborting()
+    {
+        delete webView;
+    }
+};
+
+void tst_QGraphicsWebView::crashOnViewlessWebPages()
+{
+    QGraphicsScene scene;
+    QGraphicsView view(&scene);
+
+    QGraphicsWebView* webView = new QGraphicsWebView;
+    WebPage* page = new WebPage;
+    webView->setPage(page);
+    page->webView = webView;
+    connect(page->mainFrame(), SIGNAL(initialLayoutCompleted()), page, SLOT(aborting()));
+
+    scene.addItem(webView);
+
+    view.setSizePolicy(QSizePolicy::Expanding, QSizePolicy::Expanding);
+    view.resize(600, 480);
+    webView->resize(view.geometry().size());
+    QTest::qWait(200);
+    view.show();
+
+    page->mainFrame()->setHtml(QString("data:text/html,"
+                                            "<frameset cols=\"25%,75%\">"
+                                                "<frame src=\"data:text/html,foo \">"
+                                                "<frame src=\"data:text/html,bar\">"
+                                            "</frameset>"));
+
+    QVERIFY(::waitForSignal(page, SIGNAL(loadFinished(bool))));
+}
+
 QTEST_MAIN(tst_QGraphicsWebView)
 
 #include "tst_qgraphicswebview.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/image.png b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/image.png
new file mode 100644
index 0000000000..8d703640c1
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/image.png
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.qrc b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.qrc
index ed014407a2..28b9d7b3a1 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.qrc
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.qrc
@@ -2,5 +2,6 @@
 <qresource prefix="/">
 <file>style.css</file>
 <file>style2.css</file>
+<file>image.png</file>
 </qresource>
 </RCC>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
index 00783d12e6..db2f7d76c0 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
@@ -87,6 +87,7 @@ private slots:
     void firstChildNextSibling();
     void lastChildPreviousSibling();
     void hasSetFocus();
+    void render();
 
 private:
     QWebView* m_view;
@@ -825,5 +826,79 @@ void tst_QWebElement::hasSetFocus()
     QVERIFY(input2.hasFocus());
 }
 
+void tst_QWebElement::render()
+{
+    QString html( "<html>"
+                    "<head><style>"
+                       "body, iframe { margin: 0px; border: none; }"
+                    "</style></head>"
+                    "<body><table width='300px' height='300px' border='1'>"
+                           "<tr>"
+                               "<td>test"
+                               "</td>"
+                               "<td><img src='qrc:///image.png'>"
+                               "</td>"
+                           "</tr>"
+                          "</table>"
+                    "</body>"
+                 "</html>"
+                );
+
+    QWebPage page;
+    QSignalSpy loadSpy(&page, SIGNAL(loadFinished(bool)));
+    page.mainFrame()->setHtml(html);
+
+    waitForSignal(&page, SIGNAL(loadFinished(bool)));
+    QCOMPARE(loadSpy.count(), 1);
+
+    QList<QWebElement> imgs = page.mainFrame()->findAllElements("img");
+    QCOMPARE(imgs.count(), 1);
+
+    QImage resource(":/image.png");
+    QRect imageRect(0, 0, resource.width(), resource.height());
+
+    QImage testImage(resource.width(), resource.height(), QImage::Format_ARGB32);
+    QPainter painter0(&testImage);
+    painter0.fillRect(imageRect, Qt::white);
+    painter0.drawImage(0, 0, resource);
+    painter0.end();
+
+    QImage image1(resource.width(), resource.height(), QImage::Format_ARGB32);
+    QPainter painter1(&image1);
+    painter1.fillRect(imageRect, Qt::white);
+    imgs[0].render(&painter1);
+    painter1.end();
+
+    QVERIFY(image1 == testImage);
+
+    // render image 2nd time to make sure that cached rendering works fine
+    QImage image2(resource.width(), resource.height(), QImage::Format_ARGB32);
+    QPainter painter2(&image2);
+    painter2.fillRect(imageRect, Qt::white);
+    imgs[0].render(&painter2);
+    painter2.end();
+
+    QVERIFY(image2 == testImage);
+
+    // compare table rendered through QWebElement::render to whole page table rendering
+    QRect tableRect(0, 0, 300, 300);
+    QList<QWebElement> tables = page.mainFrame()->findAllElements("table");
+    QCOMPARE(tables.count(), 1);
+
+    QImage image3(300, 300, QImage::Format_ARGB32);
+    QPainter painter3(&image3);
+    painter3.fillRect(tableRect, Qt::white);
+    tables[0].render(&painter3);
+    painter3.end();
+
+    QImage image4(300, 300, QImage::Format_ARGB32);
+    QPainter painter4(&image4);
+    page.mainFrame()->setClipRenderToViewport(false);
+    page.mainFrame()->render(&painter4, tableRect);
+    painter4.end();
+
+    QVERIFY(image3 == image4);
+}
+
 QTEST_MAIN(tst_QWebElement)
 #include "tst_qwebelement.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro
index 81037c30ec..4c92e91dbc 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro
@@ -5,5 +5,6 @@ SOURCES  += tst_qwebframe.cpp
 RESOURCES += qwebframe.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+DEFINES += SRCDIR=\\\"$$PWD/resources\\\"
 
 symbian:TARGET.UID3 = 0xA000E53D
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 797446b988..80c9d72bf9 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -586,6 +586,7 @@ private slots:
     void javaScriptWindowObjectClearedOnEvaluate();
     void setHtml();
     void setHtmlWithResource();
+    void setHtmlWithBaseURL();
     void ipv6HostEncoding();
     void metaData();
     void popupFocus();
@@ -699,6 +700,7 @@ void tst_QWebFrame::init()
     m_page = m_view->page();
     m_myObject = new MyQObject();
     m_page->mainFrame()->addToJavaScriptWindowObject("myObject", m_myObject);
+    QDir::setCurrent(SRCDIR);
 }
 
 void tst_QWebFrame::cleanup()
@@ -2370,6 +2372,28 @@ void tst_QWebFrame::setHtmlWithResource()
     QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("red"));
 }
 
+void tst_QWebFrame::setHtmlWithBaseURL()
+{
+    QString html("<html><body><p>hello world</p><img src='resources/image2.png'/></body></html>");
+
+    QWebPage page;
+    QWebFrame* frame = page.mainFrame();
+
+    // in few seconds, the image should be completey loaded
+    QSignalSpy spy(&page, SIGNAL(loadFinished(bool)));
+
+    frame->setHtml(html, QUrl::fromLocalFile(QDir::currentPath()));
+    QTest::qWait(200);
+    QCOMPARE(spy.count(), 1);
+
+    QCOMPARE(frame->evaluateJavaScript("document.images.length").toInt(), 1);
+    QCOMPARE(frame->evaluateJavaScript("document.images[0].width").toInt(), 128);
+    QCOMPARE(frame->evaluateJavaScript("document.images[0].height").toInt(), 128);
+
+    // no history item has to be added.
+    QCOMPARE(m_view->page()->history()->count(), 0);
+}
+
 class TestNetworkManager : public QNetworkAccessManager
 {
 public:
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
index 82ffac68d6..101837aead 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
@@ -5,5 +5,6 @@ SOURCES  += tst_qwebpage.cpp
 RESOURCES  += tst_qwebpage.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+DEFINES += SRCDIR=\\\"$$PWD/\\\"
 
 symbian:TARGET.UID3 = 0xA000E53E
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index bdcc27ff83..21b3bc7f78 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -1,5 +1,6 @@
 /*
     Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -23,6 +24,7 @@
 #include <qwebelement.h>
 #include <qwebpage.h>
 #include <qwidget.h>
+#include <QGraphicsWidget>
 #include <qwebview.h>
 #include <qwebframe.h>
 #include <qwebhistory.h>
@@ -33,6 +35,7 @@
 #include <qwebsecurityorigin.h>
 #include <qwebdatabase.h>
 #include <QPushButton>
+#include <QDir>
 
 // Will try to wait for the condition while allowing event processing
 #define QTRY_COMPARE(__expr, __expected) \
@@ -101,7 +104,9 @@ private slots:
     void contextMenuCrash();
     void database();
     void createPlugin();
+    void destroyPlugin_data();
     void destroyPlugin();
+    void createViewlessPlugin_data();
     void createViewlessPlugin();
     void multiplePageGroupsAndLocalStorage();
     void cursorMovements();
@@ -116,9 +121,14 @@ private slots:
     void testEnablePersistentStorage();
     void consoleOutput();
     void inputMethods();
+    void defaultTextEncoding();
+    void errorPageExtension();
 
     void crashTests_LazyInitializationOfMainFrame();
 
+    void screenshot_data();
+    void screenshot();
+
 private:
     QWebView* m_view;
     QWebPage* m_page;
@@ -222,6 +232,9 @@ void tst_QWebPage::infiniteLoopJS()
 
 void tst_QWebPage::loadFinished()
 {
+    qRegisterMetaType<QWebFrame*>("QWebFrame*");
+    qRegisterMetaType<QNetworkRequest*>("QNetworkRequest*");
+    QSignalSpy spyNetworkRequestStarted(m_page, SIGNAL(networkRequestStarted(QWebFrame*, QNetworkRequest*)));
     QSignalSpy spyLoadStarted(m_view, SIGNAL(loadStarted()));
     QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
 
@@ -232,6 +245,7 @@ void tst_QWebPage::loadFinished()
 
     QTest::qWait(3000);
 
+    QVERIFY(spyNetworkRequestStarted.count() > 1);
     QVERIFY(spyLoadStarted.count() > 1);
     QVERIFY(spyLoadFinished.count() > 1);
 
@@ -617,50 +631,93 @@ void tst_QWebPage::createPlugin()
     QCOMPARE(newPage->calls.count(), 0);
 }
 
-class PluginTrackedPage : public QWebPage
-{
+
+// Standard base class for template PluginTracerPage. In tests it is used as interface.
+class PluginCounterPage : public QWebPage {
 public:
+    int m_count;
+    QPointer<QObject> m_widget;
+    PluginCounterPage(QObject* parent = 0) : QWebPage(parent), m_count(0), m_widget(0)
+    {
+       settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+    }
+};
 
-    int count;
-    QPointer<QWidget> widget;
+template<class T>
+class PluginTracerPage : public PluginCounterPage {
+public:
+    PluginTracerPage(QObject* parent = 0) : PluginCounterPage(parent) {}
+    virtual QObject* createPlugin(const QString&, const QUrl&, const QStringList&, const QStringList&)
+    {
+        m_count++;
+        return m_widget = new T();
+    }
+};
 
-    PluginTrackedPage(QWidget *parent = 0) : QWebPage(parent), count(0) {
-       settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+class PluginFactory {
+public:
+    enum FactoredType {QWidgetType, QGraphicsWidgetType};
+    static PluginCounterPage* create(FactoredType type, QObject* parent = 0)
+    {
+        PluginCounterPage* result = 0;
+        switch (type) {
+        case QWidgetType:
+            result = new PluginTracerPage<QWidget>(parent);
+            break;
+        case QGraphicsWidgetType:
+            result = new PluginTracerPage<QGraphicsWidget>(parent);
+            break;
+        default: {/*Oops*/};
+        }
+        return result;
     }
 
-    virtual QObject* createPlugin(const QString&, const QUrl&, const QStringList&, const QStringList&) {
-       count++;
-       QWidget *w = new QWidget;
-       widget = w;
-       return w;
+    static void prepareTestData()
+    {
+        QTest::addColumn<int>("type");
+        QTest::newRow("QWidget") << (int)PluginFactory::QWidgetType;
+        QTest::newRow("QGraphicsWidget") << (int)PluginFactory::QGraphicsWidgetType;
     }
 };
 
+void tst_QWebPage::destroyPlugin_data()
+{
+    PluginFactory::prepareTestData();
+}
+
 void tst_QWebPage::destroyPlugin()
 {
-    PluginTrackedPage* page = new PluginTrackedPage(m_view);
+    QFETCH(int, type);
+    PluginCounterPage* page = PluginFactory::create((PluginFactory::FactoredType)type, m_view);
     m_view->setPage(page);
 
     // we create the plugin, so the widget should be constructed
     QString content("<html><body><object type=\"application/x-qt-plugin\" classid=\"QProgressBar\"></object></body></html>");
     m_view->setHtml(content);
-    QVERIFY(page->widget != 0);
-    QCOMPARE(page->count, 1);
+    QVERIFY(page->m_widget);
+    QCOMPARE(page->m_count, 1);
 
     // navigate away, the plugin widget should be destructed
     m_view->setHtml("<html><body>Hi</body></html>");
     QTestEventLoop::instance().enterLoop(1);
-    QVERIFY(page->widget == 0);
+    QVERIFY(!page->m_widget);
+}
+
+void tst_QWebPage::createViewlessPlugin_data()
+{
+    PluginFactory::prepareTestData();
 }
 
 void tst_QWebPage::createViewlessPlugin()
 {
-    PluginTrackedPage* page = new PluginTrackedPage;
+    QFETCH(int, type);
+    PluginCounterPage* page = PluginFactory::create((PluginFactory::FactoredType)type);
     QString content("<html><body><object type=\"application/x-qt-plugin\" classid=\"QProgressBar\"></object></body></html>");
     page->mainFrame()->setHtml(content);
-    QCOMPARE(page->count, 1);
-    QVERIFY(page->widget != 0);
+    QCOMPARE(page->m_count, 1);
+    QVERIFY(page->m_widget);
     delete page;
+
 }
 
 // import private API
@@ -1370,8 +1427,10 @@ void tst_QWebPage::testOptionalJSObjects()
     webPage1.currentFrame()->setHtml(QString("<html><body>test</body></html>"), QUrl());
     webPage2.currentFrame()->setHtml(QString("<html><body>test</body></html>"), QUrl());
 
+    QEXPECT_FAIL("","Feature enabled/disabled checking problem. Look at bugs.webkit.org/show_bug.cgi?id=29867", Continue);
     QCOMPARE(testFlag(webPage1, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", false), false);
     QCOMPARE(testFlag(webPage2, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", true),  true);
+    QEXPECT_FAIL("","Feature enabled/disabled checking problem. Look at bugs.webkit.org/show_bug.cgi?id=29867", Continue);
     QCOMPARE(testFlag(webPage1, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", false), false);
     QCOMPARE(testFlag(webPage2, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", false), true);
 
@@ -1410,6 +1469,79 @@ void tst_QWebPage::testEnablePersistentStorage()
     QVERIFY(!webPage.settings()->iconDatabasePath().isEmpty());
 }
 
+void tst_QWebPage::defaultTextEncoding()
+{
+    QWebFrame* mainFrame = m_page->mainFrame();
+
+    QString defaultCharset = mainFrame->evaluateJavaScript("document.defaultCharset").toString();
+    QVERIFY(!defaultCharset.isEmpty());
+    QCOMPARE(QWebSettings::globalSettings()->defaultTextEncoding(), defaultCharset);
+
+    m_page->settings()->setDefaultTextEncoding(QString("utf-8"));
+    QString charset = mainFrame->evaluateJavaScript("document.defaultCharset").toString();
+    QCOMPARE(charset, QString("utf-8"));
+    QCOMPARE(m_page->settings()->defaultTextEncoding(), charset);
+
+    m_page->settings()->setDefaultTextEncoding(QString());
+    charset = mainFrame->evaluateJavaScript("document.defaultCharset").toString();
+    QVERIFY(!charset.isEmpty());
+    QCOMPARE(charset, defaultCharset);
+
+    QWebSettings::globalSettings()->setDefaultTextEncoding(QString("utf-8"));
+    charset = mainFrame->evaluateJavaScript("document.defaultCharset").toString();
+    QCOMPARE(charset, QString("utf-8"));
+    QCOMPARE(QWebSettings::globalSettings()->defaultTextEncoding(), charset);
+}
+
+class ErrorPage : public QWebPage
+{
+public:
+
+    ErrorPage(QWidget* parent = 0): QWebPage(parent)
+    {
+    }
+
+    virtual bool supportsExtension(Extension extension) const
+    {
+        return extension == ErrorPageExtension;
+    }
+
+    virtual bool extension(Extension, const ExtensionOption* option, ExtensionReturn* output)
+    {
+        const ErrorPageExtensionOption* info = static_cast<const ErrorPageExtensionOption*>(option);
+        ErrorPageExtensionReturn* errorPage = static_cast<ErrorPageExtensionReturn*>(output);
+
+        if (info->frame == mainFrame()) {
+            errorPage->content = "data:text/html,error";
+            return true;
+        }
+
+        return false;
+    }
+};
+
+void tst_QWebPage::errorPageExtension()
+{
+    ErrorPage* page = new ErrorPage;
+    m_view->setPage(page);
+
+    QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
+
+    page->mainFrame()->load(QUrl("qrc:///frametest/index.html"));
+    QTRY_COMPARE(spyLoadFinished.count(), 1);
+
+    page->mainFrame()->setUrl(QUrl("http://non.existent/url"));
+    QTest::qWait(2000);
+    QTRY_COMPARE(spyLoadFinished.count(), 2);
+    QCOMPARE(page->mainFrame()->toPlainText(), QString("data:text/html,error"));
+    QCOMPARE(page->history()->count(), 2);
+    QCOMPARE(page->history()->currentItem().url(), QUrl("http://non.existent/url"));
+    QCOMPARE(page->history()->canGoBack(), true);
+    QCOMPARE(page->history()->canGoForward(), false);
+
+    m_view->setPage(0);
+}
+
 void tst_QWebPage::crashTests_LazyInitializationOfMainFrame()
 {
     {
@@ -1430,6 +1562,52 @@ void tst_QWebPage::crashTests_LazyInitializationOfMainFrame()
     }
 }
 
+static void takeScreenshot(QWebPage* page)
+{
+    QWebFrame* mainFrame = page->mainFrame();
+    page->setViewportSize(mainFrame->contentsSize());
+    QImage image(page->viewportSize(), QImage::Format_ARGB32);
+    QPainter painter(&image);
+    mainFrame->render(&painter);
+    painter.end();
+}
+
+void tst_QWebPage::screenshot_data()
+{
+    QTest::addColumn<QString>("html");
+    QTest::newRow("WithoutPlugin") << "<html><body id='b'>text</body></html>";
+    QTest::newRow("WindowedPlugin") << QString("<html><body id='b'>text<embed src='resources/test.swf'></embed></body></html>");
+    QTest::newRow("WindowlessPlugin") << QString("<html><body id='b'>text<embed src='resources/test.swf' wmode='transparent'></embed></body></html>");
+}
+
+void tst_QWebPage::screenshot()
+{
+    QDir::setCurrent(SRCDIR);
+
+    QFETCH(QString, html);
+    QWebPage* page = new QWebPage;
+    page->settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+    QWebFrame* mainFrame = page->mainFrame();
+    mainFrame->setHtml(html, QUrl::fromLocalFile(QDir::currentPath()));
+    if (html.contains("</embed>")) {
+        // some reasonable time for the PluginStream to feed test.swf to flash and start painting
+        QTest::qWait(2000);
+    }
+
+    // take screenshot without a view
+    takeScreenshot(page);
+
+    QWebView* view = new QWebView;
+    view->setPage(page);
+
+    // take screenshot when attached to a view
+    takeScreenshot(page);
+
+    delete page;
+    delete view;
+
+    QDir::setCurrent(QApplication::applicationDirPath());
+}
 
 QTEST_MAIN(tst_QWebPage)
 #include "tst_qwebpage.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
index d9d122c8b1..bba7c39558 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
@@ -4,5 +4,6 @@ include(../../../../WebKit.pri)
 SOURCES  += tst_qwebview.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+DEFINES += SRCDIR=\\\"$$PWD/\\\"
 
 symbian:TARGET.UID3 = 0xA000E53F
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
index 01d0e9295e..920422359c 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
@@ -1,6 +1,7 @@
 /*
     Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
     Copyright (C) 2009 Torch Mobile Inc.
+    Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -26,6 +27,7 @@
 #include <qnetworkrequest.h>
 #include <qdiriterator.h>
 #include <qwebkitversion.h>
+#include <qwebframe.h>
 
 class tst_QWebView : public QObject
 {
@@ -42,6 +44,9 @@ private slots:
     void guessUrlFromString_data();
     void guessUrlFromString();
     void getWebKitVersion();
+
+    void reusePage_data();
+    void reusePage();
 };
 
 // This will be called before the first test function is executed.
@@ -167,6 +172,46 @@ void tst_QWebView::getWebKitVersion()
     QVERIFY(qWebKitVersion().toDouble() > 0);
 }
 
+void tst_QWebView::reusePage_data()
+{
+    QTest::addColumn<QString>("html");
+    QTest::newRow("WithoutPlugin") << "<html><body id='b'>text</body></html>";
+    QTest::newRow("WindowedPlugin") << QString("<html><body id='b'>text<embed src='resources/test.swf'></embed></body></html>");
+    QTest::newRow("WindowlessPlugin") << QString("<html><body id='b'>text<embed src='resources/test.swf' wmode=\"transparent\"></embed></body></html>");
+}
+
+void tst_QWebView::reusePage()
+{
+    QDir::setCurrent(SRCDIR);
+
+    QFETCH(QString, html);
+    QWebView* view1 = new QWebView;
+    QPointer<QWebPage> page = new QWebPage;
+    view1->setPage(page);
+    page->settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+    QWebFrame* mainFrame = page->mainFrame();
+    mainFrame->setHtml(html, QUrl::fromLocalFile(QDir::currentPath()));
+    if (html.contains("</embed>")) {
+        // some reasonable time for the PluginStream to feed test.swf to flash and start painting
+        QTest::qWait(2000);
+    }
+
+    view1->show();
+    QTest::qWait(2000);
+    delete view1;
+    QVERIFY(page != 0); // deleting view must not have deleted the page, since it's not a child of view
+
+    QWebView *view2 = new QWebView;
+    view2->setPage(page);
+    view2->show(); // in Windowless mode, you should still be able to see the plugin here
+    QTest::qWait(2000);
+    delete view2;
+
+    delete page; // must not crash
+
+    QDir::setCurrent(QApplication::applicationDirPath());
+}
+
 QTEST_MAIN(tst_QWebView)
 #include "tst_qwebview.moc"
 
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/resources/test.swf b/src/3rdparty/webkit/WebKit/qt/tests/resources/test.swf
new file mode 100644
index 0000000000..895298271a
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/resources/test.swf
diff --git a/src/corelib/animation/qabstractanimation.cpp b/src/corelib/animation/qabstractanimation.cpp
index c775a00a6d..f83c2a1ba8 100644
--- a/src/corelib/animation/qabstractanimation.cpp
+++ b/src/corelib/animation/qabstractanimation.cpp
@@ -272,7 +272,8 @@ void QUnifiedTimer::registerAnimation(QAbstractAnimation *animation, bool isTopL
         Q_ASSERT(!QAbstractAnimationPrivate::get(animation)->hasRegisteredTimer);
         QAbstractAnimationPrivate::get(animation)->hasRegisteredTimer = true;
         animationsToStart << animation;
-        startStopAnimationTimer.start(STARTSTOP_TIMER_DELAY, this);
+        if (!startStopAnimationTimer.isActive())
+            startStopAnimationTimer.start(STARTSTOP_TIMER_DELAY, this);
     }
 }
 
@@ -290,7 +291,7 @@ void QUnifiedTimer::unregisterAnimation(QAbstractAnimation *animation)
         if (idx <= currentAnimationIdx)
             --currentAnimationIdx;
 
-        if (animations.isEmpty())
+        if (animations.isEmpty() && !startStopAnimationTimer.isActive())
             startStopAnimationTimer.start(STARTSTOP_TIMER_DELAY, this);
     } else {
         animationsToStart.removeOne(animation);
@@ -318,6 +319,7 @@ void QUnifiedTimer::unregisterRunningAnimation(QAbstractAnimation *animation)
         runningPauseAnimations.removeOne(animation);
     else
         runningLeafAnimations--;
+    Q_ASSERT(runningLeafAnimations >= 0);
 }
 
 int QUnifiedTimer::closestPauseAnimationTimeToFinish()
@@ -328,9 +330,9 @@ int QUnifiedTimer::closestPauseAnimationTimeToFinish()
         int timeToFinish;
 
         if (animation->direction() == QAbstractAnimation::Forward)
-            timeToFinish = animation->totalDuration() - QAbstractAnimationPrivate::get(animation)->totalCurrentTime;
+            timeToFinish = animation->duration() - animation->currentTime();
         else
-            timeToFinish = QAbstractAnimationPrivate::get(animation)->totalCurrentTime;
+            timeToFinish = animation->currentTime();
 
         if (timeToFinish < closestTimeToFinish)
             closestTimeToFinish = timeToFinish;
@@ -382,25 +384,20 @@ void QAbstractAnimationPrivate::setState(QAbstractAnimation::State newState)
             QUnifiedTimer::instance()->ensureTimerUpdate(q);
         if (!guard)
             return;
+        //here we're sure that we were in running state before and that the
+        //animation is currently registered
         QUnifiedTimer::instance()->unregisterAnimation(q);
         break;
     case QAbstractAnimation::Running:
         {
             bool isTopLevel = !group || group->state() == QAbstractAnimation::Stopped;
+            QUnifiedTimer::instance()->registerAnimation(q, isTopLevel);
 
             // this ensures that the value is updated now that the animation is running
             if (oldState == QAbstractAnimation::Stopped) {
                 if (isTopLevel)
                     // currentTime needs to be updated if pauseTimer is active
                     QUnifiedTimer::instance()->ensureTimerUpdate(q);
-                if (!guard)
-                    return;
-            }
-
-            // test needed in case we stop in the setCurrentTime inside ensureTimerUpdate (zero duration)
-            if (state == QAbstractAnimation::Running) {
-                // register timer if our parent is not running
-                QUnifiedTimer::instance()->registerAnimation(q, isTopLevel);
             }
         }
         break;
@@ -413,7 +410,8 @@ void QAbstractAnimationPrivate::setState(QAbstractAnimation::State newState)
         if (deleteWhenStopped)
             q->deleteLater();
 
-        QUnifiedTimer::instance()->unregisterAnimation(q);
+        if (oldState == QAbstractAnimation::Running)
+            QUnifiedTimer::instance()->unregisterAnimation(q);
 
         if (dura == -1 || loopCount < 0
             || (oldDirection == QAbstractAnimation::Forward && (oldCurrentTime * (oldCurrentLoop + 1)) == (dura * loopCount))
@@ -460,7 +458,8 @@ QAbstractAnimation::~QAbstractAnimation()
         QAbstractAnimation::State oldState = d->state;
         d->state = Stopped;
         emit stateChanged(oldState, d->state);
-        QUnifiedTimer::instance()->unregisterAnimation(this);
+        if (oldState == QAbstractAnimation::Running)
+            QUnifiedTimer::instance()->unregisterAnimation(this);
     }
 }
 
@@ -648,13 +647,13 @@ int QAbstractAnimation::currentLoop() const
 */
 int QAbstractAnimation::totalDuration() const
 {
-    Q_D(const QAbstractAnimation);
-    if (d->loopCount < 0)
-        return -1;
     int dura = duration();
-    if (dura == -1)
+    if (dura <= 0)
+        return dura;
+    int loopcount = loopCount();
+    if (loopcount < 0)
         return -1;
-    return dura * d->loopCount;
+    return dura * loopcount;
 }
 
 /*!
@@ -685,7 +684,7 @@ void QAbstractAnimation::setCurrentTime(int msecs)
 
     // Calculate new time and loop.
     int dura = duration();
-    int totalDura = (d->loopCount < 0 || dura == -1) ? -1 : dura * d->loopCount;
+    int totalDura = dura <= 0 ? dura : ((d->loopCount < 0) ? -1 : dura * d->loopCount);
     if (totalDura != -1)
         msecs = qMin(totalDura, msecs);
     d->totalCurrentTime = msecs;
diff --git a/src/corelib/animation/qpauseanimation.cpp b/src/corelib/animation/qpauseanimation.cpp
index d90f0013d0..21e5b0849a 100644
--- a/src/corelib/animation/qpauseanimation.cpp
+++ b/src/corelib/animation/qpauseanimation.cpp
@@ -73,7 +73,7 @@ QT_BEGIN_NAMESPACE
 class QPauseAnimationPrivate : public QAbstractAnimationPrivate
 {
 public:
-    QPauseAnimationPrivate() : QAbstractAnimationPrivate(), duration(0)
+    QPauseAnimationPrivate() : QAbstractAnimationPrivate(), duration(250)
     {
         isPause = true;
     }
@@ -114,6 +114,7 @@ QPauseAnimation::~QPauseAnimation()
     \brief the duration of the pause.
 
     The duration of the pause. The duration should not be negative.
+    The default duration is 250 milliseconds.
 */
 int QPauseAnimation::duration() const
 {
diff --git a/src/corelib/global/qglobal.cpp b/src/corelib/global/qglobal.cpp
index 5a7b559d3d..7d4794402f 100644
--- a/src/corelib/global/qglobal.cpp
+++ b/src/corelib/global/qglobal.cpp
@@ -2479,7 +2479,7 @@ bool qputenv(const char *varName, const QByteArray& value)
 #endif
 }
 
-#if defined(Q_OS_UNIX) && !defined(QT_NO_THREAD) && !defined(Q_OS_SYMBIAN)
+#if (defined(Q_OS_UNIX) || defined(Q_OS_WIN)) && !defined(QT_NO_THREAD) && !defined(Q_OS_SYMBIAN)
 
 #  if defined(Q_OS_INTEGRITY) && defined(__GHS_VERSION_NUMBER) && (__GHS_VERSION_NUMBER < 500)
 // older versions of INTEGRITY used a long instead of a uint for the seed.
@@ -2535,20 +2535,35 @@ void qsrand(uint seed)
 */
 void qsrand()
 {
-#if defined(Q_OS_UNIX) && !defined(QT_NO_THREAD) && !defined(Q_OS_SYMBIAN)
+#if (defined(Q_OS_UNIX) || defined(Q_OS_WIN)) && !defined(QT_NO_THREAD) && !defined(Q_OS_SYMBIAN)
     SeedStorageType *pseed = randTLS()->localData();
     if (pseed) {
         // already seeded
         return;
     }
     randTLS()->setLocalData(pseed = new SeedStorageType);
-    static QBasicAtomicInt serial = Q_BASIC_ATOMIC_INITIALIZER(0);
+    // start beyond 1 to avoid the sequence reset
+    static QBasicAtomicInt serial = Q_BASIC_ATOMIC_INITIALIZER(2);
     *pseed = QDateTime::currentDateTime().toTime_t()
              + quintptr(&pseed)
              + serial.fetchAndAddRelaxed(1);
-#else
-    // On Windows, we assume that rand() already does the right thing
+#if defined(Q_OS_WIN)
+    // for Windows the srand function must still be called.
+    srand(*pseed);
 #endif
+
+#elif defined(Q_OS_WIN)
+    static unsigned int seed = 0;
+
+    if (seed)
+        return;
+
+    seed = GetTickCount();
+    srand(seed);
+#else 
+    // Symbian?
+
+#endif // defined(Q_OS_UNIX) || defined(Q_OS_WIN)) && !defined(QT_NO_THREAD) && !defined(Q_OS_SYMBIAN)
 }
 
 /*!
diff --git a/src/corelib/global/qnamespace.h b/src/corelib/global/qnamespace.h
index f28f94edc3..2b62c6bb99 100644
--- a/src/corelib/global/qnamespace.h
+++ b/src/corelib/global/qnamespace.h
@@ -1631,7 +1631,10 @@ public:
     enum GestureContext
     {
         WidgetGesture             = 0,
-        WidgetWithChildrenGesture = 3
+        WidgetWithChildrenGesture = 3,
+
+        ItemGesture                  = WidgetGesture,
+        ItemWithChildrenGesture      = WidgetWithChildrenGesture
     };
 
     enum NavigationMode
diff --git a/src/gui/animation/qguivariantanimation.cpp b/src/gui/animation/qguivariantanimation.cpp
index 0ae79b6a0e..1e9c166b2a 100644
--- a/src/gui/animation/qguivariantanimation.cpp
+++ b/src/gui/animation/qguivariantanimation.cpp
@@ -54,10 +54,10 @@ QT_BEGIN_NAMESPACE
 
 template<> Q_INLINE_TEMPLATE QColor _q_interpolate(const QColor &f,const QColor &t, qreal progress)
 {
-    return QColor(_q_interpolate(f.red(), t.red(), progress),
-                  _q_interpolate(f.green(), t.green(), progress),
-                  _q_interpolate(f.blue(), t.blue(), progress),
-                  _q_interpolate(f.alpha(), t.alpha(), progress));
+    return QColor(qBound(0,_q_interpolate(f.red(), t.red(), progress),255),
+                  qBound(0,_q_interpolate(f.green(), t.green(), progress),255),
+                  qBound(0,_q_interpolate(f.blue(), t.blue(), progress),255),
+                  qBound(0,_q_interpolate(f.alpha(), t.alpha(), progress),255));
 }
 
 template<> Q_INLINE_TEMPLATE QQuaternion _q_interpolate(const QQuaternion &f,const QQuaternion &t, qreal progress)
diff --git a/src/gui/egl/qegl.cpp b/src/gui/egl/qegl.cpp
index 840b9d6918..39291d31a3 100644
--- a/src/gui/egl/qegl.cpp
+++ b/src/gui/egl/qegl.cpp
@@ -61,6 +61,7 @@ QEglContext::QEglContext()
     , cfg(0)
     , currentSurface(EGL_NO_SURFACE)
     , current(false)
+    , ownsContext(true)
 {
 }
 
@@ -206,7 +207,7 @@ void QEglContext::destroySurface(EGLSurface surface)
 // Destroy the context.  Note: this does not destroy the surface.
 void QEglContext::destroy()
 {
-    if (ctx != EGL_NO_CONTEXT)
+    if (ctx != EGL_NO_CONTEXT && ownsContext)
         eglDestroyContext(dpy, ctx);
     dpy = EGL_NO_DISPLAY;
     ctx = EGL_NO_CONTEXT;
diff --git a/src/gui/egl/qegl_p.h b/src/gui/egl/qegl_p.h
index dc399daa8e..16b5b169c3 100644
--- a/src/gui/egl/qegl_p.h
+++ b/src/gui/egl/qegl_p.h
@@ -110,7 +110,7 @@ public:
     EGLDisplay display() const { return dpy; }
 
     EGLContext context() const { return ctx; }
-    void setContext(EGLContext context) { ctx = context; }
+    void setContext(EGLContext context) { ctx = context; ownsContext = false;}
 
     EGLConfig config() const { return cfg; }
     void setConfig(EGLConfig config) { cfg = config; }
@@ -131,6 +131,7 @@ private:
     EGLConfig cfg;
     EGLSurface currentSurface;
     bool current;
+    bool ownsContext;
 
     static EGLDisplay getDisplay(QPaintDevice *device);
 
diff --git a/src/gui/graphicsview/qgraphicsanchorlayout.cpp b/src/gui/graphicsview/qgraphicsanchorlayout.cpp
index c39e8a6b3e..081572f2bc 100644
--- a/src/gui/graphicsview/qgraphicsanchorlayout.cpp
+++ b/src/gui/graphicsview/qgraphicsanchorlayout.cpp
@@ -118,16 +118,26 @@ QGraphicsAnchor::~QGraphicsAnchor()
 }
 
 /*!
-    Sets the size policy of the anchor to \a policy.
+    \property QGraphicsAnchor::sizePolicy
+    \brief the size policy for the QGraphicsAnchor.
+
+    By setting the size policy on an anchor you can configure how the item can resize itself
+    from its preferred spacing. For instance, if the anchor has the size policy
+    QSizePolicy::Minimum, the spacing is the minimum size of the anchor. However, its size
+    can grow up to the anchors maximum size. If the default size policy is QSizePolicy::Fixed,
+    the anchor can neither grow or shrink, which means that the only size the anchor can have
+    is the spacing. QSizePolicy::Fixed is the default size policy.
+    QGraphicsAnchor always has a minimum spacing of 0 and a very large maximum spacing.
+
+    \sa QGraphicsAnchor::spacing
 */
+
 void QGraphicsAnchor::setSizePolicy(QSizePolicy::Policy policy)
 {
     Q_D(QGraphicsAnchor);
     d->setSizePolicy(policy);
 }
-/*!
-    Returns the size policy of the anchor. The default size policy is QSizePolicy::Fixed
-*/
+
 QSizePolicy::Policy QGraphicsAnchor::sizePolicy() const
 {
     Q_D(const QGraphicsAnchor);
@@ -136,12 +146,12 @@ QSizePolicy::Policy QGraphicsAnchor::sizePolicy() const
 
 /*!
     \property QGraphicsAnchor::spacing
-    \brief the space between items in the QGraphicsAnchorLayout.
+    \brief the preferred space between items in the QGraphicsAnchorLayout.
 
     Depending on the anchor type, the default spacing is either
     0 or a value returned from the style.
 
-    \sa QGraphicsAnchorLayout::anchor()
+    \sa QGraphicsAnchorLayout::addAnchor()
 */
 void QGraphicsAnchor::setSpacing(qreal spacing)
 {
@@ -215,6 +225,9 @@ QGraphicsAnchorLayout::~QGraphicsAnchorLayout()
 
     The spacing can also be set manually by using QGraphicsAnchor::setSpacing() method.
 
+    Calling this function where \a firstItem or \a secondItem are ancestors of the layout have
+    undefined behaviour.
+
     \sa addCornerAnchors(), addAnchors()
  */
 QGraphicsAnchor *
diff --git a/src/gui/graphicsview/qgraphicsanchorlayout.h b/src/gui/graphicsview/qgraphicsanchorlayout.h
index f09ac43ac1..01c3a86cab 100644
--- a/src/gui/graphicsview/qgraphicsanchorlayout.h
+++ b/src/gui/graphicsview/qgraphicsanchorlayout.h
@@ -62,12 +62,13 @@ class Q_GUI_EXPORT QGraphicsAnchor : public QObject
 {
     Q_OBJECT
     Q_PROPERTY(qreal spacing READ spacing WRITE setSpacing RESET unsetSpacing)
+    Q_PROPERTY(QSizePolicy::Policy sizePolicy READ sizePolicy WRITE setSizePolicy)
 public:
     void setSpacing(qreal spacing);
     void unsetSpacing();
+    qreal spacing() const;
     void setSizePolicy(QSizePolicy::Policy policy);
     QSizePolicy::Policy sizePolicy() const;
-    qreal spacing() const;
     ~QGraphicsAnchor();
 private:
     QGraphicsAnchor(QGraphicsAnchorLayout *parent);
diff --git a/src/gui/graphicsview/qgraphicsitem.cpp b/src/gui/graphicsview/qgraphicsitem.cpp
index 45627f6e83..709066c41d 100644
--- a/src/gui/graphicsview/qgraphicsitem.cpp
+++ b/src/gui/graphicsview/qgraphicsitem.cpp
@@ -1511,6 +1511,8 @@ const QGraphicsObject *QGraphicsItem::toGraphicsObject() const
     the parent. You should not \l{QGraphicsScene::addItem()}{add} the
     item to the scene yourself.
 
+    Calling this function on an item that is an ancestor of \a parent have undefined behaviour.
+
     \sa parentItem(), childItems()
 */
 void QGraphicsItem::setParentItem(QGraphicsItem *parent)
@@ -4735,7 +4737,7 @@ bool QGraphicsItem::isObscuredBy(const QGraphicsItem *item) const
 {
     if (!item)
         return false;
-    return QGraphicsSceneBspTreeIndexPrivate::closestItemFirst_withoutCache(item, this)
+    return qt_closestItemFirst(item, this)
         && qt_QGraphicsItem_isObscured(this, item, boundingRect());
 }
 
@@ -10740,6 +10742,23 @@ QDebug operator<<(QDebug debug, QGraphicsItem *item)
     return debug;
 }
 
+QDebug operator<<(QDebug debug, QGraphicsObject *item)
+{
+    if (!item) {
+        debug << "QGraphicsObject(0)";
+        return debug;
+    }
+
+    debug.nospace() << item->metaObject()->className() << '(' << (void*)item;
+    if (!item->objectName().isEmpty())
+        debug << ", name = " << item->objectName();
+    debug.nospace() << ", parent = " << ((void*)item->parentItem())
+          << ", pos = " << item->pos()
+          << ", z = " << item->zValue() << ", flags = "
+          << item->flags() << ')';
+    return debug.space();
+}
+
 QDebug operator<<(QDebug debug, QGraphicsItem::GraphicsItemChange change)
 {
     const char *str = "UnknownChange";
diff --git a/src/gui/graphicsview/qgraphicsitem.h b/src/gui/graphicsview/qgraphicsitem.h
index 2665235c48..f3fe99c18b 100644
--- a/src/gui/graphicsview/qgraphicsitem.h
+++ b/src/gui/graphicsview/qgraphicsitem.h
@@ -555,7 +555,7 @@ public:
     using QObject::children;
 #endif
 
-    void grabGesture(Qt::GestureType type, Qt::GestureContext context = Qt::WidgetWithChildrenGesture);
+    void grabGesture(Qt::GestureType type, Qt::GestureContext context = Qt::ItemWithChildrenGesture);
 
 Q_SIGNALS:
     void parentChanged();
@@ -1120,6 +1120,7 @@ template <class T> inline T qgraphicsitem_cast(const QGraphicsItem *item)
 
 #ifndef QT_NO_DEBUG_STREAM
 Q_GUI_EXPORT QDebug operator<<(QDebug debug, QGraphicsItem *item);
+Q_GUI_EXPORT QDebug operator<<(QDebug debug, QGraphicsObject *item);
 Q_GUI_EXPORT QDebug operator<<(QDebug debug, QGraphicsItem::GraphicsItemChange change);
 Q_GUI_EXPORT QDebug operator<<(QDebug debug, QGraphicsItem::GraphicsItemFlag flag);
 Q_GUI_EXPORT QDebug operator<<(QDebug debug, QGraphicsItem::GraphicsItemFlags flags);
diff --git a/src/gui/graphicsview/qgraphicsitem_p.h b/src/gui/graphicsview/qgraphicsitem_p.h
index 65503627b9..5b401ba371 100644
--- a/src/gui/graphicsview/qgraphicsitem_p.h
+++ b/src/gui/graphicsview/qgraphicsitem_p.h
@@ -539,7 +539,7 @@ struct QGraphicsItemPrivate::TransformData
             QMatrix4x4 m;
             for (int i = 0; i < graphicsTransforms.size(); ++i)
                 graphicsTransforms.at(i)->applyTo(&m);
-            x *= m.toTransform();
+            x *= m.toTransform(0);
         }
         x.translate(xOrigin, yOrigin);
         x.rotate(rotation);
@@ -623,6 +623,71 @@ public:
 
 
 /*!
+    Returns true if \a item1 is on top of \a item2.
+    The items dont need to be siblings.
+
+    \internal
+*/
+inline bool qt_closestItemFirst(const QGraphicsItem *item1, const QGraphicsItem *item2)
+{
+    // Siblings? Just check their z-values.
+    const QGraphicsItemPrivate *d1 = item1->d_ptr.data();
+    const QGraphicsItemPrivate *d2 = item2->d_ptr.data();
+    if (d1->parent == d2->parent)
+        return qt_closestLeaf(item1, item2);
+
+    // Find common ancestor, and each item's ancestor closest to the common
+    // ancestor.
+    int item1Depth = d1->depth();
+    int item2Depth = d2->depth();
+    const QGraphicsItem *p = item1;
+    const QGraphicsItem *t1 = item1;
+    while (item1Depth > item2Depth && (p = p->d_ptr->parent)) {
+        if (p == item2) {
+            // item2 is one of item1's ancestors; item1 is on top
+            return !(t1->d_ptr->flags & QGraphicsItem::ItemStacksBehindParent);
+        }
+        t1 = p;
+        --item1Depth;
+    }
+    p = item2;
+    const QGraphicsItem *t2 = item2;
+    while (item2Depth > item1Depth && (p = p->d_ptr->parent)) {
+        if (p == item1) {
+            // item1 is one of item2's ancestors; item1 is not on top
+            return (t2->d_ptr->flags & QGraphicsItem::ItemStacksBehindParent);
+        }
+        t2 = p;
+        --item2Depth;
+    }
+
+    // item1Ancestor is now at the same level as item2Ancestor, but not the same.
+    const QGraphicsItem *p1 = t1;
+    const QGraphicsItem *p2 = t2;
+    while (t1 && t1 != t2) {
+        p1 = t1;
+        p2 = t2;
+        t1 = t1->d_ptr->parent;
+        t2 = t2->d_ptr->parent;
+    }
+
+    // in case we have a common ancestor, we compare the immediate children in the ancestor's path.
+    // otherwise we compare the respective items' topLevelItems directly.
+    return qt_closestLeaf(p1, p2);
+}
+
+/*!
+    Returns true if \a item2 is on top of \a item1.
+    The items dont need to be siblings.
+
+    \internal
+*/
+inline bool qt_closestItemLast(const QGraphicsItem *item1, const QGraphicsItem *item2)
+{
+    return qt_closestItemFirst(item2, item1);
+}
+
+/*!
     \internal
 */
 inline bool qt_closestLeaf(const QGraphicsItem *item1, const QGraphicsItem *item2)
@@ -642,7 +707,7 @@ inline bool qt_closestLeaf(const QGraphicsItem *item1, const QGraphicsItem *item
 /*!
     \internal
 */
-static inline bool qt_notclosestLeaf(const QGraphicsItem *item1, const QGraphicsItem *item2)
+inline bool qt_notclosestLeaf(const QGraphicsItem *item1, const QGraphicsItem *item2)
 { return qt_closestLeaf(item2, item1); }
 
 /*
diff --git a/src/gui/graphicsview/qgraphicsproxywidget.cpp b/src/gui/graphicsview/qgraphicsproxywidget.cpp
index b7a39628ab..64c51ada6a 100644
--- a/src/gui/graphicsview/qgraphicsproxywidget.cpp
+++ b/src/gui/graphicsview/qgraphicsproxywidget.cpp
@@ -57,6 +57,9 @@
 #include <QtGui/qpainter.h>
 #include <QtGui/qstyleoption.h>
 #include <QtGui/qgraphicsview.h>
+#include <QtGui/qlistview.h>
+#include <QtGui/qlineedit.h>
+#include <QtGui/qtextedit.h>
 
 QT_BEGIN_NAMESPACE
 
@@ -86,7 +89,9 @@ QT_BEGIN_NAMESPACE
     of embedded widgets through creating a child proxy for each popup. This
     means that when an embedded QComboBox shows its popup list, a new
     QGraphicsProxyWidget is created automatically, embedding the popup, and
-    positioning it correctly.
+    positioning it correctly. This only works if the popup is child of the
+    embedded widget (for example QToolButton::setMenu() requires the QMenu instance
+    to be child of the QToolButton).
 
     \section1 Embedding a Widget with QGraphicsProxyWidget
 
@@ -184,6 +189,7 @@ QT_BEGIN_NAMESPACE
 */
 
 extern bool qt_sendSpontaneousEvent(QObject *, QEvent *);
+extern bool qt_tab_all_widgets;
 
 /*!
     \internal
@@ -369,6 +375,7 @@ QVariant QGraphicsProxyWidgetPrivate::inputMethodQueryHelper(Qt::InputMethodQuer
 
 /*!
     \internal
+    Some of the logic is shared with QApplicationPrivate::focusNextPrevChild_helper
 */
 QWidget *QGraphicsProxyWidgetPrivate::findFocusChild(QWidget *child, bool next) const
 {
@@ -382,14 +389,16 @@ QWidget *QGraphicsProxyWidgetPrivate::findFocusChild(QWidget *child, bool next)
         child = next ? child->d_func()->focus_next : child->d_func()->focus_prev;
         if ((next && child == widget) || (!next && child == widget->d_func()->focus_prev)) {
              return 0;
-	}
+        }
     }
 
     QWidget *oldChild = child;
+    uint focus_flag = qt_tab_all_widgets ? Qt::TabFocus : Qt::StrongFocus;
     do {
         if (child->isEnabled()
 	    && child->isVisibleTo(widget)
-            && (child->focusPolicy() & Qt::TabFocus)) {
+            && (child->focusPolicy() & focus_flag == focus_flag)
+            && !(child->d_func()->extra && child->d_func()->extra->focus_proxy)) {
             return child;
         }
         child = next ? child->d_func()->focus_next : child->d_func()->focus_prev;
diff --git a/src/gui/graphicsview/qgraphicsscene.cpp b/src/gui/graphicsview/qgraphicsscene.cpp
index a624b10356..005563e7dd 100644
--- a/src/gui/graphicsview/qgraphicsscene.cpp
+++ b/src/gui/graphicsview/qgraphicsscene.cpp
@@ -242,7 +242,6 @@
 #include <QtGui/qstyleoption.h>
 #include <QtGui/qtooltip.h>
 #include <QtGui/qtransform.h>
-#include <QtGui/qgesture.h>
 #include <QtGui/qinputcontext.h>
 #include <QtGui/qgraphicseffect.h>
 #include <private/qapplication_p.h>
@@ -251,6 +250,14 @@
 #include <private/qt_x11_p.h>
 #endif
 #include <private/qgraphicseffect_p.h>
+#include <private/qgesturemanager_p.h>
+
+// #define GESTURE_DEBUG
+#ifndef GESTURE_DEBUG
+# define DEBUG if (0) qDebug
+#else
+# define DEBUG qDebug
+#endif
 
 QT_BEGIN_NAMESPACE
 
@@ -1052,6 +1059,14 @@ bool QGraphicsScenePrivate::filterEvent(QGraphicsItem *item, QEvent *event)
 */
 bool QGraphicsScenePrivate::sendEvent(QGraphicsItem *item, QEvent *event)
 {
+    if (QGraphicsObject *object = item->toGraphicsObject()) {
+        QApplicationPrivate *qAppPriv = QApplicationPrivate::instance();
+        if (qAppPriv->gestureManager) {
+            if (qAppPriv->gestureManager->filterEvent(object, event))
+                return true;
+        }
+    }
+
     if (filterEvent(item, event))
         return false;
     if (filterDescendantEvent(item, event))
@@ -3365,6 +3380,10 @@ bool QGraphicsScene::event(QEvent *event)
     case QEvent::TouchEnd:
         d->touchEventHandler(static_cast<QTouchEvent *>(event));
         break;
+    case QEvent::Gesture:
+    case QEvent::GestureOverride:
+        d->gestureEventHandler(static_cast<QGestureEvent *>(event));
+        break;
     default:
         return QObject::event(event);
     }
@@ -5699,6 +5718,238 @@ void QGraphicsScenePrivate::leaveModal(QGraphicsItem *panel)
     dispatchHoverEvent(&hoverEvent);
 }
 
+void QGraphicsScenePrivate::getGestureTargets(const QSet<QGesture *> &gestures,
+                                              QWidget *viewport,
+                                              QMap<Qt::GestureType, QGesture *> *conflictedGestures,
+                                              QList<QList<QGraphicsObject *> > *conflictedItems,
+                                              QHash<QGesture *, QGraphicsObject *> *normalGestures)
+{
+    foreach (QGesture *gesture, gestures) {
+        Qt::GestureType gestureType = gesture->gestureType();
+        if (gesture->hasHotSpot()) {
+            QPoint screenPos = gesture->hotSpot().toPoint();
+            QList<QGraphicsItem *> items = itemsAtPosition(screenPos, QPointF(), viewport);
+            QList<QGraphicsObject *> result;
+            for (int j = 0; j < items.size(); ++j) {
+                QGraphicsObject *item = items.at(j)->toGraphicsObject();
+                if (!item)
+                    continue;
+                QGraphicsItemPrivate *d = item->QGraphicsItem::d_func();
+                if (d->gestureContext.contains(gestureType)) {
+                    result.append(item);
+                }
+            }
+            DEBUG() << "QGraphicsScenePrivate::getGestureTargets:"
+                    << gesture << result;
+            if (result.size() == 1) {
+                normalGestures->insert(gesture, result.first());
+            } else if (!result.isEmpty()) {
+                conflictedGestures->insert(gestureType, gesture);
+                conflictedItems->append(result);
+            }
+        }
+    }
+}
+
+void QGraphicsScenePrivate::gestureEventHandler(QGestureEvent *event)
+{
+    QWidget *viewport = event->widget();
+    if (!viewport)
+        return;
+    QList<QGesture *> allGestures = event->allGestures();
+    DEBUG() << "QGraphicsScenePrivate::gestureEventHandler:"
+            << "Delivering gestures:" <<  allGestures;
+
+    typedef QHash<QGraphicsObject *, QList<QGesture *> > GesturesPerItem;
+    GesturesPerItem gesturesPerItem;
+
+    QSet<QGesture *> startedGestures;
+    foreach (QGesture *gesture, allGestures) {
+        QGraphicsObject *target = gestureTargets.value(gesture, 0);
+        if (!target) {
+            // when we are not in started mode but don't have a target
+            // then the only one interested in gesture is the view/scene
+            if (gesture->state() == Qt::GestureStarted)
+                startedGestures.insert(gesture);
+        } else {
+            gesturesPerItem[target].append(gesture);
+        }
+    }
+
+    QMap<Qt::GestureType, QGesture *> conflictedGestures;
+    QList<QList<QGraphicsObject *> > conflictedItems;
+    QHash<QGesture *, QGraphicsObject *> normalGestures;
+    getGestureTargets(startedGestures, viewport, &conflictedGestures, &conflictedItems,
+                      &normalGestures);
+    DEBUG() << "QGraphicsScenePrivate::gestureEventHandler:"
+            << "Conflicting gestures:" <<  conflictedGestures.values() << conflictedItems;
+    Q_ASSERT((conflictedGestures.isEmpty() && conflictedItems.isEmpty()) ||
+              (!conflictedGestures.isEmpty() && !conflictedItems.isEmpty()));
+
+    // gestures that were sent as override events, but no one accepted them
+    QHash<QGesture *, QGraphicsObject *> ignoredConflictedGestures;
+
+    // deliver conflicted gestures as override events first
+    while (!conflictedGestures.isEmpty() && !conflictedItems.isEmpty()) {
+        // get the topmost item to deliver the override event
+        Q_ASSERT(!conflictedItems.isEmpty());
+        Q_ASSERT(!conflictedItems.first().isEmpty());
+        QGraphicsObject *topmost = conflictedItems.first().first();
+        for (int i = 1; i < conflictedItems.size(); ++i) {
+            QGraphicsObject *item = conflictedItems.at(i).first();
+            if (qt_closestItemFirst(item, topmost)) {
+                topmost = item;
+            }
+        }
+        // get a list of gestures to send to the item
+        QList<Qt::GestureType> grabbedGestures =
+                topmost->QGraphicsItem::d_func()->gestureContext.keys();
+        QList<QGesture *> gestures;
+        for (int i = 0; i < grabbedGestures.size(); ++i) {
+            if (QGesture *g = conflictedGestures.value(grabbedGestures.at(i), 0)) {
+                gestures.append(g);
+                if (!ignoredConflictedGestures.contains(g))
+                    ignoredConflictedGestures.insert(g, topmost);
+            }
+        }
+
+        // send gesture override to the topmost item
+        QGestureEvent ev(gestures);
+        ev.t = QEvent::GestureOverride;
+        ev.setWidget(event->widget());
+        // mark event and individual gestures as ignored
+        ev.ignore();
+        foreach(QGesture *g, gestures)
+            ev.setAccepted(g, false);
+        DEBUG() << "QGraphicsScenePrivate::gestureEventHandler:"
+                << "delivering override to"
+                << topmost << gestures;
+        sendEvent(topmost, &ev);
+        // mark all accepted gestures to deliver them as normal gesture events
+        foreach (QGesture *g, gestures) {
+            if (ev.isAccepted() || ev.isAccepted(g)) {
+                conflictedGestures.remove(g->gestureType());
+                gestureTargets.remove(g);
+                // add the gesture to the list of normal delivered gestures
+                normalGestures.insert(g, topmost);
+                DEBUG() << "QGraphicsScenePrivate::gestureEventHandler:"
+                        << "override was accepted:"
+                        << g << topmost;
+                ignoredConflictedGestures.remove(g);
+            }
+        }
+        // remove the item that we've already delivered from the list
+        for (int i = 0; i < conflictedItems.size(); ) {
+            QList<QGraphicsObject *> &items = conflictedItems[i];
+            if (items.first() == topmost) {
+                items.removeFirst();
+                if (items.isEmpty()) {
+                    conflictedItems.removeAt(i);
+                    continue;
+                }
+            }
+            ++i;
+        }
+    }
+
+    // put back those started gestures that are not in the conflicted state
+    // and remember their targets
+    QHash<QGesture *, QGraphicsObject *>::const_iterator it = normalGestures.begin(),
+                                                          e = normalGestures.end();
+    for (; it != e; ++it) {
+        QGesture *g = it.key();
+        QGraphicsObject *receiver = it.value();
+        Q_ASSERT(!gestureTargets.contains(g));
+        gestureTargets.insert(g, receiver);
+        gesturesPerItem[receiver].append(g);
+    }
+    it = ignoredConflictedGestures.begin();
+    e = ignoredConflictedGestures.end();
+    for (; it != e; ++it) {
+        QGesture *g = it.key();
+        QGraphicsObject *receiver = it.value();
+        Q_ASSERT(!gestureTargets.contains(g));
+        gestureTargets.insert(g, receiver);
+        gesturesPerItem[receiver].append(g);
+    }
+
+    DEBUG() << "QGraphicsScenePrivate::gestureEventHandler:"
+            << "Started gestures:" << normalGestures.keys()
+            << "All gestures:" << gesturesPerItem.values();
+
+    // deliver all events
+    QList<QGesture *> alreadyIgnoredGestures;
+    QHash<QGraphicsObject *, QSet<QGesture *> > itemIgnoredGestures;
+    QList<QGraphicsObject *> targetItems = gesturesPerItem.keys();
+    qSort(targetItems.begin(), targetItems.end(), qt_closestItemFirst);
+    for (int i = 0; i < targetItems.size(); ++i) {
+        QGraphicsObject *item = targetItems.at(i);
+        QList<QGesture *> gestures = gesturesPerItem.value(item);
+        // remove gestures that were already delivered once and were ignored
+        DEBUG() << "QGraphicsScenePrivate::gestureEventHandler:"
+                << "already ignored gestures for item"
+                << item << ":" << itemIgnoredGestures.value(item);
+
+        if (itemIgnoredGestures.contains(item)) // don't deliver twice to the same item
+            continue;
+
+        QGraphicsItemPrivate *gid = item->QGraphicsItem::d_func();
+        foreach(QGesture *g, alreadyIgnoredGestures) {
+            if (gid->gestureContext.contains(g->gestureType()))
+                gestures += g;
+        }
+        if (gestures.isEmpty())
+            continue;
+        DEBUG() << "QGraphicsScenePrivate::gestureEventHandler:"
+                << "delivering to"
+                << item << gestures;
+        QGestureEvent ev(gestures);
+        ev.setWidget(event->widget());
+        sendEvent(item, &ev);
+        QSet<QGesture *> ignoredGestures;
+        foreach (QGesture *g, gestures) {
+            if (!ev.isAccepted() && !ev.isAccepted(g))
+                ignoredGestures.insert(g);
+        }
+        if (!ignoredGestures.isEmpty()) {
+            // get a list of items under the (current) hotspot of each ignored
+            // gesture and start delivery again from the beginning
+            DEBUG() << "QGraphicsScenePrivate::gestureEventHandler:"
+                    << "item has ignored the event, will propagate."
+                    << item << ignoredGestures;
+            itemIgnoredGestures[item] += ignoredGestures;
+            QMap<Qt::GestureType, QGesture *> conflictedGestures;
+            QList<QList<QGraphicsObject *> > itemsForConflictedGestures;
+            QHash<QGesture *, QGraphicsObject *> normalGestures;
+            getGestureTargets(ignoredGestures, viewport,
+                              &conflictedGestures, &itemsForConflictedGestures,
+                              &normalGestures);
+            QSet<QGraphicsObject *> itemsSet = targetItems.toSet();
+            for (int k = 0; k < itemsForConflictedGestures.size(); ++k)
+                itemsSet += itemsForConflictedGestures.at(k).toSet();
+            targetItems = itemsSet.toList();
+            qSort(targetItems.begin(), targetItems.end(), qt_closestItemFirst);
+            alreadyIgnoredGestures = conflictedGestures.values();
+            DEBUG() << "QGraphicsScenePrivate::gestureEventHandler:"
+                    << "new targets:" << targetItems;
+            i = -1; // start delivery again
+            continue;
+        }
+    }
+
+    // forget about targets for gestures that have ended
+    foreach (QGesture *g, allGestures) {
+        switch (g->state()) {
+        case Qt::GestureFinished:
+        case Qt::GestureCanceled:
+            gestureTargets.remove(g);
+            break;
+        default:
+            break;
+        }
+    }
+}
+
 QT_END_NAMESPACE
 
 #include "moc_qgraphicsscene.cpp"
diff --git a/src/gui/graphicsview/qgraphicsscene_p.h b/src/gui/graphicsview/qgraphicsscene_p.h
index 807369584b..cd20fd038f 100644
--- a/src/gui/graphicsview/qgraphicsscene_p.h
+++ b/src/gui/graphicsview/qgraphicsscene_p.h
@@ -282,6 +282,13 @@ public:
     bool allItemsIgnoreTouchEvents;
     void enableTouchEventsOnViews();
 
+    QHash<QGesture *, QGraphicsObject *> gestureTargets;
+    void gestureEventHandler(QGestureEvent *event);
+    void getGestureTargets(const QSet<QGesture *> &gestures, QWidget *viewport,
+                           QMap<Qt::GestureType, QGesture *> *conflictedGestures,
+                           QList<QList<QGraphicsObject *> > *conflictedItems,
+                           QHash<QGesture *, QGraphicsObject *> *normalGestures);
+
     void updateInputMethodSensitivityInViews();
 
     QList<QGraphicsItem *> modalPanels;
diff --git a/src/gui/graphicsview/qgraphicsscenebsptreeindex.cpp b/src/gui/graphicsview/qgraphicsscenebsptreeindex.cpp
index e21183a0d5..47ae3f1752 100644
--- a/src/gui/graphicsview/qgraphicsscenebsptreeindex.cpp
+++ b/src/gui/graphicsview/qgraphicsscenebsptreeindex.cpp
@@ -405,70 +405,6 @@ QList<QGraphicsItem *> QGraphicsSceneBspTreeIndexPrivate::estimateItems(const QR
 }
 
 /*!
-    Returns true if \a item1 is on top of \a item2.
-
-    \internal
-*/
-bool QGraphicsSceneBspTreeIndexPrivate::closestItemFirst_withoutCache(const QGraphicsItem *item1, const QGraphicsItem *item2)
-{
-    // Siblings? Just check their z-values.
-    const QGraphicsItemPrivate *d1 = item1->d_ptr.data();
-    const QGraphicsItemPrivate *d2 = item2->d_ptr.data();
-    if (d1->parent == d2->parent)
-        return qt_closestLeaf(item1, item2);
-
-    // Find common ancestor, and each item's ancestor closest to the common
-    // ancestor.
-    int item1Depth = d1->depth();
-    int item2Depth = d2->depth();
-    const QGraphicsItem *p = item1;
-    const QGraphicsItem *t1 = item1;
-    while (item1Depth > item2Depth && (p = p->d_ptr->parent)) {
-        if (p == item2) {
-            // item2 is one of item1's ancestors; item1 is on top
-            return !(t1->d_ptr->flags & QGraphicsItem::ItemStacksBehindParent);
-        }
-        t1 = p;
-        --item1Depth;
-    }
-    p = item2;
-    const QGraphicsItem *t2 = item2;
-    while (item2Depth > item1Depth && (p = p->d_ptr->parent)) {
-        if (p == item1) {
-            // item1 is one of item2's ancestors; item1 is not on top
-            return (t2->d_ptr->flags & QGraphicsItem::ItemStacksBehindParent);
-        }
-        t2 = p;
-        --item2Depth;
-    }
-
-    // item1Ancestor is now at the same level as item2Ancestor, but not the same.
-    const QGraphicsItem *a1 = t1;
-    const QGraphicsItem *a2 = t2;
-    while (a1) {
-        const QGraphicsItem *p1 = a1;
-        const QGraphicsItem *p2 = a2;
-        a1 = a1->parentItem();
-        a2 = a2->parentItem();
-        if (a1 && a1 == a2)
-            return qt_closestLeaf(p1, p2);
-    }
-
-    // No common ancestor? Then just compare the items' toplevels directly.
-    return qt_closestLeaf(t1->topLevelItem(), t2->topLevelItem());
-}
-
-/*!
-    Returns true if \a item2 is on top of \a item1.
-
-    \internal
-*/
-bool QGraphicsSceneBspTreeIndexPrivate::closestItemLast_withoutCache(const QGraphicsItem *item1, const QGraphicsItem *item2)
-{
-    return closestItemFirst_withoutCache(item2, item1);
-}
-
-/*!
     Sort a list of \a itemList in a specific \a order and use the cache if requested.
 
     \internal
@@ -495,9 +431,9 @@ void QGraphicsSceneBspTreeIndexPrivate::sortItems(QList<QGraphicsItem *> *itemLi
         }
     } else {
         if (order == Qt::DescendingOrder) {
-            qSort(itemList->begin(), itemList->end(), closestItemFirst_withoutCache);
+            qSort(itemList->begin(), itemList->end(), qt_closestItemFirst);
         } else if (order == Qt::AscendingOrder) {
-            qSort(itemList->begin(), itemList->end(), closestItemLast_withoutCache);
+            qSort(itemList->begin(), itemList->end(), qt_closestItemLast);
         }
     }
 }
diff --git a/src/gui/graphicsview/qgraphicsscenebsptreeindex_p.h b/src/gui/graphicsview/qgraphicsscenebsptreeindex_p.h
index 0a86bb79ae..c130190b7c 100644
--- a/src/gui/graphicsview/qgraphicsscenebsptreeindex_p.h
+++ b/src/gui/graphicsview/qgraphicsscenebsptreeindex_p.h
@@ -145,8 +145,6 @@ public:
     QList<QGraphicsItem *> estimateItems(const QRectF &, Qt::SortOrder, bool b = false);
 
     static void climbTree(QGraphicsItem *item, int *stackingOrder);
-    static bool closestItemFirst_withoutCache(const QGraphicsItem *item1, const QGraphicsItem *item2);
-    static bool closestItemLast_withoutCache(const QGraphicsItem *item1, const QGraphicsItem *item2);
 
     static inline bool closestItemFirst_withCache(const QGraphicsItem *item1, const QGraphicsItem *item2)
     {
diff --git a/src/gui/graphicsview/qgraphicstransform.cpp b/src/gui/graphicsview/qgraphicstransform.cpp
index ec1a2f5ff4..49d8999539 100644
--- a/src/gui/graphicsview/qgraphicstransform.cpp
+++ b/src/gui/graphicsview/qgraphicstransform.cpp
@@ -547,7 +547,9 @@ void QGraphicsRotation::applyTo(QMatrix4x4 *matrix) const
         return;
 
     matrix->translate(d->origin);
-    matrix->rotate(d->angle, d->axis.x(), d->axis.y(), d->axis.z());
+    QMatrix4x4 m;
+    m.rotate(d->angle, d->axis.x(), d->axis.y(), d->axis.z());
+    *matrix *= m.toTransform();
     matrix->translate(-d->origin);
 }
 
diff --git a/src/gui/graphicsview/qgraphicsview.cpp b/src/gui/graphicsview/qgraphicsview.cpp
index 32747cc393..710c7455a8 100644
--- a/src/gui/graphicsview/qgraphicsview.cpp
+++ b/src/gui/graphicsview/qgraphicsview.cpp
@@ -2701,6 +2701,19 @@ bool QGraphicsView::viewportEvent(QEvent *event)
 
         return true;
     }
+    case QEvent::Gesture:
+    case QEvent::GestureOverride:
+    {
+        if (!isEnabled())
+            return false;
+
+        if (d->scene && d->sceneInteractionAllowed) {
+            QGestureEvent *gestureEvent = static_cast<QGestureEvent *>(event);
+            gestureEvent->setWidget(viewport());
+            (void) QApplication::sendEvent(d->scene, gestureEvent);
+        }
+        return true;
+    }
     default:
         break;
     }
diff --git a/src/gui/image/qimagepixmapcleanuphooks.cpp b/src/gui/image/qimagepixmapcleanuphooks.cpp
index d08d3ef738..ac30646dfc 100644
--- a/src/gui/image/qimagepixmapcleanuphooks.cpp
+++ b/src/gui/image/qimagepixmapcleanuphooks.cpp
@@ -70,19 +70,30 @@ QImagePixmapCleanupHooks *QImagePixmapCleanupHooks::instance()
     return qt_image_and_pixmap_cleanup_hooks;
 }
 
-void QImagePixmapCleanupHooks::addPixmapHook(_qt_pixmap_cleanup_hook_pm hook)
+void QImagePixmapCleanupHooks::addPixmapModificationHook(_qt_pixmap_cleanup_hook_pm hook)
 {
-    pixmapHooks.append(hook);
+    pixmapModificationHooks.append(hook);
 }
 
+void QImagePixmapCleanupHooks::addPixmapDestructionHook(_qt_pixmap_cleanup_hook_pm hook)
+{
+    pixmapDestructionHooks.append(hook);
+}
+
+
 void QImagePixmapCleanupHooks::addImageHook(_qt_image_cleanup_hook_64 hook)
 {
     imageHooks.append(hook);
 }
 
-void QImagePixmapCleanupHooks::removePixmapHook(_qt_pixmap_cleanup_hook_pm hook)
+void QImagePixmapCleanupHooks::removePixmapModificationHook(_qt_pixmap_cleanup_hook_pm hook)
+{
+    pixmapModificationHooks.removeAll(hook);
+}
+
+void QImagePixmapCleanupHooks::removePixmapDestructionHook(_qt_pixmap_cleanup_hook_pm hook)
 {
-    pixmapHooks.removeAll(hook);
+    pixmapDestructionHooks.removeAll(hook);
 }
 
 void QImagePixmapCleanupHooks::removeImageHook(_qt_image_cleanup_hook_64 hook)
@@ -91,18 +102,29 @@ void QImagePixmapCleanupHooks::removeImageHook(_qt_image_cleanup_hook_64 hook)
 }
 
 
-void QImagePixmapCleanupHooks::executePixmapHooks(QPixmap* pm)
+void QImagePixmapCleanupHooks::executePixmapModificationHooks(QPixmap* pm)
 {
-    for (int i = 0; i < qt_image_and_pixmap_cleanup_hooks->pixmapHooks.count(); ++i)
-        qt_image_and_pixmap_cleanup_hooks->pixmapHooks[i](pm);
+    Q_ASSERT(qt_image_and_pixmap_cleanup_hooks);
+    for (int i = 0; i < qt_image_and_pixmap_cleanup_hooks->pixmapModificationHooks.count(); ++i)
+        qt_image_and_pixmap_cleanup_hooks->pixmapModificationHooks[i](pm);
 
     if (qt_pixmap_cleanup_hook_64)
         qt_pixmap_cleanup_hook_64(pm->cacheKey());
 }
 
+void QImagePixmapCleanupHooks::executePixmapDestructionHooks(QPixmap* pm)
+{
+    Q_ASSERT(qt_image_and_pixmap_cleanup_hooks);
+    for (int i = 0; i < qt_image_and_pixmap_cleanup_hooks->pixmapDestructionHooks.count(); ++i)
+        qt_image_and_pixmap_cleanup_hooks->pixmapDestructionHooks[i](pm);
+
+    if (qt_pixmap_cleanup_hook_64)
+        qt_pixmap_cleanup_hook_64(pm->cacheKey());
+}
 
 void QImagePixmapCleanupHooks::executeImageHooks(qint64 key)
 {
+    Q_ASSERT(qt_image_and_pixmap_cleanup_hooks);
     for (int i = 0; i < qt_image_and_pixmap_cleanup_hooks->imageHooks.count(); ++i)
         qt_image_and_pixmap_cleanup_hooks->imageHooks[i](key);
 
diff --git a/src/gui/image/qimagepixmapcleanuphooks_p.h b/src/gui/image/qimagepixmapcleanuphooks_p.h
index dd2d0f7716..16c897473d 100644
--- a/src/gui/image/qimagepixmapcleanuphooks_p.h
+++ b/src/gui/image/qimagepixmapcleanuphooks_p.h
@@ -70,18 +70,27 @@ public:
 
     static QImagePixmapCleanupHooks *instance();
 
-    void addPixmapHook(_qt_pixmap_cleanup_hook_pm);
+    // Gets called when a pixmap is about to be modified:
+    void addPixmapModificationHook(_qt_pixmap_cleanup_hook_pm);
+
+    // Gets called when a pixmap is about to be destroyed:
+    void addPixmapDestructionHook(_qt_pixmap_cleanup_hook_pm);
+
+    // Gets called when an image is about to be modified or destroyed:
     void addImageHook(_qt_image_cleanup_hook_64);
 
-    void removePixmapHook(_qt_pixmap_cleanup_hook_pm);
+    void removePixmapModificationHook(_qt_pixmap_cleanup_hook_pm);
+    void removePixmapDestructionHook(_qt_pixmap_cleanup_hook_pm);
     void removeImageHook(_qt_image_cleanup_hook_64);
 
-    static void executePixmapHooks(QPixmap*);
+    static void executePixmapModificationHooks(QPixmap*);
+    static void executePixmapDestructionHooks(QPixmap*);
     static void executeImageHooks(qint64 key);
 
 private:
     QList<_qt_image_cleanup_hook_64> imageHooks;
-    QList<_qt_pixmap_cleanup_hook_pm> pixmapHooks;
+    QList<_qt_pixmap_cleanup_hook_pm> pixmapModificationHooks;
+    QList<_qt_pixmap_cleanup_hook_pm> pixmapDestructionHooks;
 };
 
 QT_END_NAMESPACE
diff --git a/src/gui/image/qpixmap.cpp b/src/gui/image/qpixmap.cpp
index c03a364493..f94552d1c3 100644
--- a/src/gui/image/qpixmap.cpp
+++ b/src/gui/image/qpixmap.cpp
@@ -322,8 +322,9 @@ QPixmap::QPixmap(const char * const xpm[])
 
 QPixmap::~QPixmap()
 {
-    if (data->is_cached && data->ref == 1)
-        QImagePixmapCleanupHooks::executePixmapHooks(this);
+    Q_ASSERT(data->ref >= 1); // Catch if ref-counting changes again
+    if (data->is_cached && data->ref == 1) // ref will be decrememnted after destructor returns
+        QImagePixmapCleanupHooks::executePixmapDestructionHooks(this);
 }
 
 /*!
@@ -959,7 +960,17 @@ void QPixmap::fill(const QColor &color)
         return;
     }
 
-    detach();
+    if (data->ref == 1) {
+        // detach() will also remove this pixmap from caches, so
+        // it has to be called even when ref == 1.
+        detach();
+    } else {
+        // Don't bother to make a copy of the data object, since
+        // it will be filled with new pixel data anyway.
+        QPixmapData *d = data->createCompatiblePixmapData();
+        d->resize(data->width(), data->height());
+        data = d;
+    }
     data->fill(color);
 }
 
@@ -1907,7 +1918,7 @@ void QPixmap::detach()
     }
 
     if (data->is_cached && data->ref == 1)
-        QImagePixmapCleanupHooks::executePixmapHooks(this);
+        QImagePixmapCleanupHooks::executePixmapModificationHooks(this);
 
 #if defined(Q_WS_MAC)
     QMacPixmapData *macData = id == QPixmapData::MacClass ? static_cast<QMacPixmapData*>(data.data()) : 0;
diff --git a/src/gui/image/qpixmap_x11_p.h b/src/gui/image/qpixmap_x11_p.h
index 2d6672d25a..8ce7c0d053 100644
--- a/src/gui/image/qpixmap_x11_p.h
+++ b/src/gui/image/qpixmap_x11_p.h
@@ -103,6 +103,7 @@ private:
     friend class QRasterWindowSurface;
     friend class QGLContextPrivate; // Needs to access xinfo, gl_surface & flags
     friend class QEglContext; // Needs gl_surface
+    friend class QX11GLPixmapData; // Needs gl_surface
     friend bool  qt_createEGLSurfaceForPixmap(QPixmapData*, bool); // Needs gl_surface
 
     void release();
diff --git a/src/gui/itemviews/qlistview.cpp b/src/gui/itemviews/qlistview.cpp
index 1d9b6e0231..f58f458474 100644
--- a/src/gui/itemviews/qlistview.cpp
+++ b/src/gui/itemviews/qlistview.cpp
@@ -1900,7 +1900,7 @@ void QListModeViewBase::updateVerticalScrollBar(const QSize &step)
     if (verticalScrollMode() == QAbstractItemView::ScrollPerItem
         && ((flow() == QListView::TopToBottom && !isWrapping())
         || (flow() == QListView::LeftToRight && isWrapping()))) {
-            const int steps = (flow() == QListView::TopToBottom ? flowPositions : segmentPositions).count() - 1;
+            const int steps = (flow() == QListView::TopToBottom ? scrollValueMap : segmentPositions).count() - 1;
             if (steps > 0) {
                 const int pageSteps = perItemScrollingPageSteps(viewport()->height(), contentsSize.height(), isWrapping());
                 verticalScrollBar()->setSingleStep(1);
@@ -1921,7 +1921,7 @@ void QListModeViewBase::updateHorizontalScrollBar(const QSize &step)
     if (horizontalScrollMode() == QAbstractItemView::ScrollPerItem
         && ((flow() == QListView::TopToBottom && isWrapping())
         || (flow() == QListView::LeftToRight && !isWrapping()))) {
-            int steps = (flow() == QListView::TopToBottom ? segmentPositions : flowPositions).count() - 1;
+            int steps = (flow() == QListView::TopToBottom ? segmentPositions : scrollValueMap).count() - 1;
             if (steps > 0) {
                 const int pageSteps = perItemScrollingPageSteps(viewport()->width(), contentsSize.width(), isWrapping());
                 horizontalScrollBar()->setSingleStep(1);
@@ -1939,7 +1939,11 @@ int QListModeViewBase::verticalScrollToValue(int index, QListView::ScrollHint hi
                                           bool above, bool below, const QRect &area, const QRect &rect) const
 {
     if (verticalScrollMode() == QAbstractItemView::ScrollPerItem) {
-        int value = qBound(0, verticalScrollBar()->value(), flowPositions.count() - 1);
+        int value;
+        if (scrollValueMap.isEmpty())
+            value = 0;
+        else
+            value = qBound(0, scrollValueMap.at(verticalScrollBar()->value()), flowPositions.count() - 1);
         if (above)
             hint = QListView::PositionAtTop;
         else if (below)
@@ -1966,8 +1970,8 @@ int QListModeViewBase::horizontalOffset() const
                 return (isRightToLeft() ? maximum - position : position);
             }
         } else if (flow() == QListView::LeftToRight && !flowPositions.isEmpty()) {
-            int position = flowPositions.at(horizontalScrollBar()->value());
-            int maximum = flowPositions.at(horizontalScrollBar()->maximum());
+            int position = flowPositions.at(scrollValueMap.at(horizontalScrollBar()->value()));
+            int maximum = flowPositions.at(scrollValueMap.at(horizontalScrollBar()->maximum()));
             return (isRightToLeft() ? maximum - position : position);
         }
     }
@@ -1986,9 +1990,9 @@ int QListModeViewBase::verticalOffset() const
             }
         } else if (flow() == QListView::TopToBottom && !flowPositions.isEmpty()) {
             int value = verticalScrollBar()->value();
-            if (value > flowPositions.count())
+            if (value > scrollValueMap.count())
                 return 0;
-            return flowPositions.at(value) - spacing();
+            return flowPositions.at(scrollValueMap.at(value)) - spacing();
         }
     }
     return QCommonListViewBase::verticalOffset();
@@ -2000,7 +2004,11 @@ int QListModeViewBase::horizontalScrollToValue(int index, QListView::ScrollHint
     if (horizontalScrollMode() != QAbstractItemView::ScrollPerItem)
         return QCommonListViewBase::horizontalScrollToValue(index, hint, leftOf, rightOf, area, rect);
 
-    int value = qBound(0, horizontalScrollBar()->value(), flowPositions.count() - 1);
+    int value;
+    if (scrollValueMap.isEmpty())
+        value = 0;
+    else
+        value = qBound(0, scrollValueMap.at(horizontalScrollBar()->value()), flowPositions.count() - 1);
     if (leftOf)
         hint = QListView::PositionAtTop;
     else if (rightOf)
@@ -2043,14 +2051,14 @@ void QListModeViewBase::scrollContentsBy(int dx, int dy, bool scrollElasticBand)
         if (vertical && flow() == QListView::TopToBottom && dy != 0) {
             int currentValue = qBound(0, verticalValue, max);
             int previousValue = qBound(0, currentValue + dy, max);
-            int currentCoordinate = flowPositions.at(currentValue);
-            int previousCoordinate = flowPositions.at(previousValue);
+            int currentCoordinate = flowPositions.at(scrollValueMap.at(currentValue));
+            int previousCoordinate = flowPositions.at(scrollValueMap.at(previousValue));
             dy = previousCoordinate - currentCoordinate;
         } else if (horizontal && flow() == QListView::LeftToRight && dx != 0) {
             int currentValue = qBound(0, horizontalValue, max);
             int previousValue = qBound(0, currentValue + dx, max);
-            int currentCoordinate = flowPositions.at(currentValue);
-            int previousCoordinate = flowPositions.at(previousValue);
+            int currentCoordinate = flowPositions.at(scrollValueMap.at(currentValue));
+            int previousCoordinate = flowPositions.at(scrollValueMap.at(previousValue));
             dx = previousCoordinate - currentCoordinate;
         }
     }
@@ -2113,6 +2121,7 @@ QPoint QListModeViewBase::initStaticLayout(const QListViewLayoutInfo &info)
         segmentPositions.clear();
         segmentStartRows.clear();
         segmentExtents.clear();
+        scrollValueMap.clear();
         x = info.bounds.left() + info.spacing;
         y = info.bounds.top() + info.spacing;
         segmentPositions.append(info.flow == QListView::LeftToRight ? y : x);
@@ -2204,6 +2213,7 @@ void QListModeViewBase::doStaticLayout(const QListViewLayoutInfo &info)
                 deltaSegPosition = 0;
             }
             // save the flow position of this item
+            scrollValueMap.append(flowPositions.count());
             flowPositions.append(flowPosition);
             // prepare for the next item
             deltaSegPosition = qMax(deltaSegHint, deltaSegPosition);
@@ -2229,6 +2239,7 @@ void QListModeViewBase::doStaticLayout(const QListViewLayoutInfo &info)
     // if it is the last batch, save the end of the segments
     if (info.last == info.max) {
         segmentExtents.append(flowPosition);
+        scrollValueMap.append(flowPositions.count());
         flowPositions.append(flowPosition);
         segmentPositions.append(info.wrap ? segPosition + deltaSegPosition : INT_MAX);
     }
@@ -2306,7 +2317,14 @@ QRect QListModeViewBase::mapToViewport(const QRect &rect) const
 
 int QListModeViewBase::perItemScrollingPageSteps(int length, int bounds, bool wrap) const
 {
-    const QVector<int> positions = (wrap ? segmentPositions : flowPositions);
+    QVector<int> positions;
+    if (wrap)
+        positions = segmentPositions;
+    else if (!flowPositions.isEmpty()) {
+        positions.reserve(scrollValueMap.size());
+        foreach (int itemShown, scrollValueMap)
+            positions.append(flowPositions.at(itemShown));
+    }
     if (positions.isEmpty() || bounds <= length)
         return positions.count();
     if (uniformItemSizes()) {
diff --git a/src/gui/itemviews/qlistview_p.h b/src/gui/itemviews/qlistview_p.h
index b6785da4eb..de4c7f3eab 100644
--- a/src/gui/itemviews/qlistview_p.h
+++ b/src/gui/itemviews/qlistview_p.h
@@ -205,6 +205,7 @@ public:
     QVector<int> segmentPositions;
     QVector<int> segmentStartRows;
     QVector<int> segmentExtents;
+    QVector<int> scrollValueMap;
 
     // used when laying out in batches
     int batchSavedPosition;
diff --git a/src/gui/itemviews/qtreeview.cpp b/src/gui/itemviews/qtreeview.cpp
index 210534e916..f37d8c75cc 100644
--- a/src/gui/itemviews/qtreeview.cpp
+++ b/src/gui/itemviews/qtreeview.cpp
@@ -2908,6 +2908,8 @@ void QTreeViewPrivate::expand(int item, bool emitSignal)
     layout(item);
     q->setState(oldState);
 
+    if (model->canFetchMore(index))
+        model->fetchMore(index);
     if (emitSignal) {
         emit q->expanded(index);
 #ifndef QT_NO_ANIMATION
@@ -2915,8 +2917,6 @@ void QTreeViewPrivate::expand(int item, bool emitSignal)
             beginAnimatedOperation();
 #endif //QT_NO_ANIMATION
     }
-    if (model->canFetchMore(index))
-        model->fetchMore(index);
 }
 
 void QTreeViewPrivate::collapse(int item, bool emitSignal)
@@ -3005,10 +3005,12 @@ void QTreeViewPrivate::beginAnimatedOperation()
         animatedOperation.setEndValue(animatedOperation.top() + h);
     }
 
-    animatedOperation.after = renderTreeToPixmapForAnimation(rect);
+    if (!rect.isEmpty()) {
+        animatedOperation.after = renderTreeToPixmapForAnimation(rect);
 
-    q->setState(QAbstractItemView::AnimatingState);
-    animatedOperation.start(); //let's start the animation
+        q->setState(QAbstractItemView::AnimatingState);
+        animatedOperation.start(); //let's start the animation
+    }
 }
 
 void QTreeViewPrivate::drawAnimatedOperation(QPainter *painter) const
diff --git a/src/gui/kernel/kernel.pri b/src/gui/kernel/kernel.pri
index 53c26115f7..8859358d06 100644
--- a/src/gui/kernel/kernel.pri
+++ b/src/gui/kernel/kernel.pri
@@ -84,6 +84,7 @@ SOURCES += \
 	kernel/qgesturerecognizer.cpp \
 	kernel/qgesturemanager.cpp \
 	kernel/qsoftkeymanager.cpp \
+        kernel/qdesktopwidget.cpp \
 	kernel/qguiplatformplugin.cpp
 
 win32 {
diff --git a/src/gui/kernel/qapplication.cpp b/src/gui/kernel/qapplication.cpp
index f48c551398..7c38d4b299 100644
--- a/src/gui/kernel/qapplication.cpp
+++ b/src/gui/kernel/qapplication.cpp
@@ -2495,6 +2495,7 @@ void QApplication::setActiveWindow(QWidget* act)
 /*!internal
  * Helper function that returns the new focus widget, but does not set the focus reason.
  * Returns 0 if a new focus widget could not be found.
+ * Shared with QGraphicsProxyWidgetPrivate::findFocusChild()
 */
 QWidget *QApplicationPrivate::focusNextPrevChild_helper(QWidget *toplevel, bool next)
 {
@@ -3638,8 +3639,13 @@ bool QApplication::notify(QObject *receiver, QEvent *e)
 
     // walk through parents and check for gestures
     if (d->gestureManager) {
-        if (d->gestureManager->filterEvent(receiver, e))
-            return true;
+        if (receiver->isWidgetType()) {
+            if (d->gestureManager->filterEvent(static_cast<QWidget *>(receiver), e))
+                return true;
+        } else if (QGesture *gesture = qobject_cast<QGesture *>(receiver)) {
+            if (d->gestureManager->filterEvent(gesture, e))
+                return true;
+        }
     }
 
 
@@ -4164,40 +4170,41 @@ bool QApplication::notify(QObject *receiver, QEvent *e)
                     if (wd->gestureContext.contains(type)) {
                         allGestures.removeAt(i);
                         gestures.append(g);
-                        gestureEvent->setAccepted(g, false);
                     } else {
                         ++i;
                     }
                 }
-                if (!gestures.isEmpty()) {
+                if (!gestures.isEmpty()) { // we have gestures for this w
                     QGestureEvent ge(gestures);
                     ge.t = gestureEvent->t;
                     ge.spont = gestureEvent->spont;
                     ge.m_accept = wasAccepted;
+                    ge.d_func()->accepted = gestureEvent->d_func()->accepted;
                     res = d->notify_helper(w, &ge);
                     gestureEvent->spont = false;
                     eventAccepted = ge.isAccepted();
-                    if (res && eventAccepted)
-                        break;
-                    if (!eventAccepted) {
-                        // ### two ways to ignore the event/gesture
-
-                        // if the whole event wasn't accepted, put back those
-                        // gestures that were not accepted.
-                        for (int i = 0; i < gestures.size(); ++i) {
-                            QGesture *g = gestures.at(i);
-                            if (!ge.isAccepted(g))
-                                allGestures.append(g);
+                    for (int i = 0; i < gestures.size(); ++i) {
+                        QGesture *g = gestures.at(i);
+                        if ((res && eventAccepted) || (!eventAccepted && ge.isAccepted(g))) {
+                            // if the gesture was accepted, mark the target widget for it
+                            gestureEvent->d_func()->targetWidgets[g->gestureType()] = w;
+                            gestureEvent->setAccepted(g, true);
+                        } else if (!eventAccepted && !ge.isAccepted(g)) {
+                            // if the gesture was explicitly ignored by the application,
+                            // put it back so a parent can get it
+                            allGestures.append(g);
                         }
                     }
                 }
-                if (allGestures.isEmpty())
+                if (allGestures.isEmpty()) // everything delivered
                     break;
                 if (w->isWindow())
                     break;
                 w = w->parentWidget();
             }
-            gestureEvent->m_accept = eventAccepted;
+            foreach (QGesture *g, allGestures)
+                gestureEvent->setAccepted(g, false);
+            gestureEvent->m_accept = false; // to make sure we check individual gestures
         } else {
             res = d->notify_helper(receiver, e);
         }
diff --git a/src/gui/kernel/qapplication_mac.mm b/src/gui/kernel/qapplication_mac.mm
index f9c8aa3e24..771cddc78c 100644
--- a/src/gui/kernel/qapplication_mac.mm
+++ b/src/gui/kernel/qapplication_mac.mm
@@ -203,6 +203,8 @@ static EventHandlerRef tablet_proximity_handler = 0;
 static EventHandlerUPP tablet_proximity_UPP = 0;
 bool QApplicationPrivate::native_modal_dialog_active;
 
+Q_GUI_EXPORT bool qt_applefontsmoothing_enabled;
+
 /*****************************************************************************
   External functions
  *****************************************************************************/
@@ -222,6 +224,12 @@ extern bool qt_sendSpontaneousEvent(QObject *obj, QEvent *event); // qapplicatio
 void onApplicationWindowChangedActivation( QWidget*widget, bool activated );
 void onApplicationChangedActivation( bool activated );
 
+static void qt_mac_read_fontsmoothing_settings()
+{
+    NSInteger appleFontSmoothing = [[NSUserDefaults standardUserDefaults] integerForKey:@"AppleFontSmoothing"];
+    qt_applefontsmoothing_enabled = (appleFontSmoothing > 0);
+}
+
 Q_GUI_EXPORT bool qt_mac_execute_apple_script(const char *script, long script_len, AEDesc *ret) {
     OSStatus err;
     AEDesc scriptTextDesc;
@@ -1203,6 +1211,9 @@ void qt_init(QApplicationPrivate *priv, int)
     }
     if (QApplication::desktopSettingsAware())
         QApplicationPrivate::qt_mac_apply_settings();
+
+    qt_mac_read_fontsmoothing_settings();
+
     // Cocoa application delegate
 #ifdef QT_MAC_USE_COCOA
     NSApplication *cocoaApp = [NSApplication sharedApplication];
diff --git a/src/gui/kernel/qdesktopwidget.cpp b/src/gui/kernel/qdesktopwidget.cpp
new file mode 100644
index 0000000000..b1e100879b
--- /dev/null
+++ b/src/gui/kernel/qdesktopwidget.cpp
@@ -0,0 +1,67 @@
+/****************************************************************************
+**
+** Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the QtGui module of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include "qglobal.h"
+
+QT_BEGIN_NAMESPACE
+
+#include "qdesktopwidget.h"
+#include "qwidget_p.h"
+
+const QRect QDesktopWidget::screenGeometry(const QWidget *widget) const
+{
+    QRect rect = QWidgetPrivate::screenGeometry(widget);
+    if (rect.isNull())
+        return screenGeometry(screenNumber(widget));
+    else return rect;
+}
+
+const QRect QDesktopWidget::availableGeometry(const QWidget *widget) const
+{
+    QRect rect = QWidgetPrivate::screenGeometry(widget);
+    if (rect.isNull())
+        return availableGeometry(screenNumber(widget));
+    else
+        return rect;
+}
+
+QT_END_NAMESPACE
+
diff --git a/src/gui/kernel/qdesktopwidget.h b/src/gui/kernel/qdesktopwidget.h
index 85f479e346..6e3447ce2a 100644
--- a/src/gui/kernel/qdesktopwidget.h
+++ b/src/gui/kernel/qdesktopwidget.h
@@ -75,14 +75,12 @@ public:
     QWidget *screen(int screen = -1);
 
     const QRect screenGeometry(int screen = -1) const;
-    const QRect screenGeometry(const QWidget *widget) const
-    { return screenGeometry(screenNumber(widget)); }
+    const QRect screenGeometry(const QWidget *widget) const;
     const QRect screenGeometry(const QPoint &point) const
     { return screenGeometry(screenNumber(point)); }
 
     const QRect availableGeometry(int screen = -1) const;
-    const QRect availableGeometry(const QWidget *widget) const
-    { return availableGeometry(screenNumber(widget)); }
+    const QRect availableGeometry(const QWidget *widget) const;
     const QRect availableGeometry(const QPoint &point) const
     { return availableGeometry(screenNumber(point)); }
 
diff --git a/src/gui/kernel/qevent.cpp b/src/gui/kernel/qevent.cpp
index 2ff6d65c0b..065bd095a9 100644
--- a/src/gui/kernel/qevent.cpp
+++ b/src/gui/kernel/qevent.cpp
@@ -45,6 +45,7 @@
 #include "private/qapplication_p.h"
 #include "private/qkeysequence_p.h"
 #include "qwidget.h"
+#include "qgraphicsview.h"
 #include "qdebug.h"
 #include "qmime.h"
 #include "qdnd_p.h"
@@ -4223,8 +4224,17 @@ QTouchEvent::TouchPoint &QTouchEvent::TouchPoint::operator=(const QTouchEvent::T
     Creates new QGestureEvent containing a list of \a gestures.
 */
 QGestureEvent::QGestureEvent(const QList<QGesture *> &gestures)
-    : QEvent(QEvent::Gesture), gestures_(gestures)
+    : QEvent(QEvent::Gesture)
 {
+    d = reinterpret_cast<QEventPrivate *>(new QGestureEventPrivate(gestures));
+}
+
+/*!
+    Destroys QGestureEvent.
+*/
+QGestureEvent::~QGestureEvent()
+{
+    delete reinterpret_cast<QGestureEventPrivate *>(d);
 }
 
 /*!
@@ -4232,7 +4242,7 @@ QGestureEvent::QGestureEvent(const QList<QGesture *> &gestures)
 */
 QList<QGesture *> QGestureEvent::allGestures() const
 {
-    return gestures_;
+    return d_func()->gestures;
 }
 
 /*!
@@ -4240,9 +4250,10 @@ QList<QGesture *> QGestureEvent::allGestures() const
 */
 QGesture *QGestureEvent::gesture(Qt::GestureType type) const
 {
-    for(int i = 0; i < gestures_.size(); ++i)
-        if (gestures_.at(i)->gestureType() == type)
-            return gestures_.at(i);
+    const QGestureEventPrivate *d = d_func();
+    for(int i = 0; i < d->gestures.size(); ++i)
+        if (d->gestures.at(i)->gestureType() == type)
+            return d->gestures.at(i);
     return 0;
 }
 
@@ -4251,7 +4262,7 @@ QGesture *QGestureEvent::gesture(Qt::GestureType type) const
 */
 QList<QGesture *> QGestureEvent::activeGestures() const
 {
-    return gestures_;
+    return d_func()->gestures;
 }
 
 /*!
@@ -4259,7 +4270,7 @@ QList<QGesture *> QGestureEvent::activeGestures() const
 */
 QList<QGesture *> QGestureEvent::canceledGestures() const
 {
-    return gestures_;
+    return d_func()->gestures;
 }
 
 /*!
@@ -4279,7 +4290,7 @@ void QGestureEvent::setAccepted(QGesture *gesture, bool value)
 {
     setAccepted(false);
     if (gesture)
-        gesture->d_func()->accept = value;
+        d_func()->accepted[gesture->gestureType()] = value;
 }
 
 /*!
@@ -4315,7 +4326,56 @@ void QGestureEvent::ignore(QGesture *gesture)
 */
 bool QGestureEvent::isAccepted(QGesture *gesture) const
 {
-    return gesture ? gesture->d_func()->accept : false;
+    return gesture ? d_func()->accepted.value(gesture->gestureType(), true) : false;
+}
+
+/*!
+    Sets the widget for this event.
+*/
+void QGestureEvent::setWidget(QWidget *widget)
+{
+    d_func()->widget = widget;
+}
+
+/*!
+    Returns the widget on which the event occurred.
+*/
+QWidget *QGestureEvent::widget() const
+{
+    return d_func()->widget;
+}
+
+/*!
+    Returns the scene-local coordinates if the \a gesturePoint is inside a graphics view.
+
+    \sa QPointF::isNull().
+*/
+QPointF QGestureEvent::mapToScene(const QPointF &gesturePoint) const
+{
+    QWidget *w = widget();
+    if (w) // we get the viewport as widget, not the graphics view
+        w = w->parentWidget();
+    QGraphicsView *view = qobject_cast<QGraphicsView*>(w);
+    if (view) {
+        return view->mapToScene(view->mapFromGlobal(gesturePoint.toPoint()));
+    }
+    return QPointF();
+}
+
+/*!
+    \internal
+*/
+QGestureEventPrivate *QGestureEvent::d_func()
+{
+    return reinterpret_cast<QGestureEventPrivate *>(d);
+}
+
+/*!
+    \internal
+*/
+const QGestureEventPrivate *QGestureEvent::d_func() const
+{
+    return reinterpret_cast<const QGestureEventPrivate *>(d);
 }
 
 #ifdef Q_NO_USING_KEYWORD
diff --git a/src/gui/kernel/qevent.h b/src/gui/kernel/qevent.h
index 3516222b13..b7370fdcd7 100644
--- a/src/gui/kernel/qevent.h
+++ b/src/gui/kernel/qevent.h
@@ -820,10 +820,12 @@ protected:
 };
 
 class QGesture;
+class QGestureEventPrivate;
 class Q_GUI_EXPORT QGestureEvent : public QEvent
 {
 public:
     QGestureEvent(const QList<QGesture *> &gestures);
+    ~QGestureEvent();
 
     QList<QGesture *> allGestures() const;
     QGesture *gesture(Qt::GestureType type) const;
@@ -849,8 +851,17 @@ public:
     void ignore(QGesture *);
     bool isAccepted(QGesture *) const;
 
+    void setWidget(QWidget *widget);
+    QWidget *widget() const;
+
+    QPointF mapToScene(const QPointF &gesturePoint) const;
+
 private:
-    QList<QGesture *> gestures_;
+    QGestureEventPrivate *d_func();
+    const QGestureEventPrivate *d_func() const;
+
+    friend class QApplication;
+    friend class QGestureManager;
 };
 
 QT_END_NAMESPACE
diff --git a/src/gui/kernel/qevent_p.h b/src/gui/kernel/qevent_p.h
index c7a4975ea5..6e6ab01e97 100644
--- a/src/gui/kernel/qevent_p.h
+++ b/src/gui/kernel/qevent_p.h
@@ -150,6 +150,20 @@ public:
 #endif
 };
 
+class QGestureEventPrivate
+{
+public:
+    inline QGestureEventPrivate(const QList<QGesture *> &list)
+        : gestures(list), widget(0)
+    {
+    }
+
+    QList<QGesture *> gestures;
+    QWidget *widget;
+    QMap<Qt::GestureType, bool> accepted;
+    QMap<Qt::GestureType, QWidget *> targetWidgets;
+};
+
 QT_END_NAMESPACE
 
 #endif // QEVENT_P_H
diff --git a/src/gui/kernel/qgesture.cpp b/src/gui/kernel/qgesture.cpp
index fc8df491f8..ecdd6614fd 100644
--- a/src/gui/kernel/qgesture.cpp
+++ b/src/gui/kernel/qgesture.cpp
@@ -129,6 +129,10 @@ QGesture::~QGesture()
 
     \brief The point that is used to find the receiver for the gesture event.
 
+    The hot-spot is a point in the global coordinate system, use
+    QWidget::mapFromGlobal() or QGestureEvent::mapToScene() to get a
+    local hot-spot.
+
     If the hot-spot is not set, the targetObject is used as the receiver of the
     gesture event.
 */
@@ -154,16 +158,6 @@ Qt::GestureState QGesture::state() const
     return d_func()->state;
 }
 
-QObject *QGesture::targetObject() const
-{
-    return d_func()->targetObject;
-}
-
-void QGesture::setTargetObject(QObject *value)
-{
-    d_func()->targetObject = value;
-}
-
 QPointF QGesture::hotSpot() const
 {
     return d_func()->hotSpot;
@@ -241,17 +235,17 @@ QPanGesture::QPanGesture(QObject *parent)
     d_func()->gestureType = Qt::PanGesture;
 }
 
-QSizeF QPanGesture::totalOffset() const
+QPointF QPanGesture::totalOffset() const
 {
     return d_func()->totalOffset;
 }
 
-QSizeF QPanGesture::lastOffset() const
+QPointF QPanGesture::lastOffset() const
 {
     return d_func()->lastOffset;
 }
 
-QSizeF QPanGesture::offset() const
+QPointF QPanGesture::offset() const
 {
     return d_func()->offset;
 }
@@ -262,17 +256,17 @@ qreal QPanGesture::acceleration() const
 }
 
 
-void QPanGesture::setTotalOffset(const QSizeF &value)
+void QPanGesture::setTotalOffset(const QPointF &value)
 {
     d_func()->totalOffset = value;
 }
 
-void QPanGesture::setLastOffset(const QSizeF &value)
+void QPanGesture::setLastOffset(const QPointF &value)
 {
     d_func()->lastOffset = value;
 }
 
-void QPanGesture::setOffset(const QSizeF &value)
+void QPanGesture::setOffset(const QPointF &value)
 {
     d_func()->offset = value;
 }
diff --git a/src/gui/kernel/qgesture.h b/src/gui/kernel/qgesture.h
index 02eb526096..64699590b9 100644
--- a/src/gui/kernel/qgesture.h
+++ b/src/gui/kernel/qgesture.h
@@ -67,7 +67,6 @@ class Q_GUI_EXPORT QGesture : public QObject
     Q_PROPERTY(Qt::GestureType gestureType READ gestureType)
     Q_PROPERTY(QPointF hotSpot READ hotSpot WRITE setHotSpot RESET unsetHotSpot)
     Q_PROPERTY(bool hasHotSpot READ hasHotSpot)
-    Q_PROPERTY(QObject* targetObject READ targetObject WRITE setTargetObject)
 
 public:
     explicit QGesture(QObject *parent = 0);
@@ -77,9 +76,6 @@ public:
 
     Qt::GestureState state() const;
 
-    QObject *targetObject() const;
-    void setTargetObject(QObject *value);
-
     QPointF hotSpot() const;
     void setHotSpot(const QPointF &value);
     bool hasHotSpot() const;
@@ -100,22 +96,22 @@ class Q_GUI_EXPORT QPanGesture : public QGesture
     Q_OBJECT
     Q_DECLARE_PRIVATE(QPanGesture)
 
-    Q_PROPERTY(QSizeF totalOffset READ totalOffset WRITE setTotalOffset)
-    Q_PROPERTY(QSizeF lastOffset READ lastOffset WRITE setLastOffset)
-    Q_PROPERTY(QSizeF offset READ offset WRITE setOffset)
+    Q_PROPERTY(QPointF totalOffset READ totalOffset WRITE setTotalOffset)
+    Q_PROPERTY(QPointF lastOffset READ lastOffset WRITE setLastOffset)
+    Q_PROPERTY(QPointF offset READ offset WRITE setOffset)
     Q_PROPERTY(qreal acceleration READ acceleration WRITE setAcceleration)
 
 public:
     QPanGesture(QObject *parent = 0);
 
-    QSizeF totalOffset() const;
-    QSizeF lastOffset() const;
-    QSizeF offset() const;
+    QPointF totalOffset() const;
+    QPointF lastOffset() const;
+    QPointF offset() const;
     qreal acceleration() const;
 
-    void setTotalOffset(const QSizeF &value);
-    void setLastOffset(const QSizeF &value);
-    void setOffset(const QSizeF &value);
+    void setTotalOffset(const QPointF &value);
+    void setLastOffset(const QPointF &value);
+    void setOffset(const QPointF &value);
     void setAcceleration(qreal value);
 
     friend class QPanGestureRecognizer;
diff --git a/src/gui/kernel/qgesture_p.h b/src/gui/kernel/qgesture_p.h
index 7f69a4e906..975c0c990d 100644
--- a/src/gui/kernel/qgesture_p.h
+++ b/src/gui/kernel/qgesture_p.h
@@ -68,7 +68,7 @@ class QGesturePrivate : public QObjectPrivate
 public:
     QGesturePrivate()
         : gestureType(Qt::CustomGesture), state(Qt::NoGesture), isHotSpotSet(false),
-          targetObject(0), accept(true)
+          targetObject(0)
     {
     }
 
@@ -77,7 +77,6 @@ public:
     QPointF hotSpot;
     bool isHotSpotSet;
     QObject *targetObject;
-    bool accept;
 };
 
 class QPanGesturePrivate : public QGesturePrivate
@@ -90,9 +89,9 @@ public:
     {
     }
 
-    QSizeF totalOffset;
-    QSizeF lastOffset;
-    QSizeF offset;
+    QPointF totalOffset;
+    QPointF lastOffset;
+    QPointF offset;
     QPoint lastPosition;
     qreal acceleration;
 };
diff --git a/src/gui/kernel/qgesturemanager.cpp b/src/gui/kernel/qgesturemanager.cpp
index 0f0aef2b75..ed8e7447f3 100644
--- a/src/gui/kernel/qgesturemanager.cpp
+++ b/src/gui/kernel/qgesturemanager.cpp
@@ -44,6 +44,7 @@
 #include "private/qwidget_p.h"
 #include "private/qgesture_p.h"
 #include "private/qgraphicsitem_p.h"
+#include "private/qevent_p.h"
 #include "qgesture.h"
 #include "qevent.h"
 #include "qgraphicsitem.h"
@@ -88,7 +89,8 @@ Qt::GestureType QGestureManager::registerGestureRecognizer(QGestureRecognizer *r
 {
     QGesture *dummy = recognizer->createGesture(0);
     if (!dummy) {
-        qWarning("QGestureManager::registerGestureRecognizer: the recognizer doesn't provide gesture object");
+        qWarning("QGestureManager::registerGestureRecognizer: "
+                 "the recognizer fails to create a gesture object, skipping registration.");
         return Qt::GestureType(0);
     }
     Qt::GestureType type = dummy->gestureType();
@@ -107,7 +109,7 @@ void QGestureManager::unregisterGestureRecognizer(Qt::GestureType)
 
 }
 
-QGesture* QGestureManager::getState(QObject *object, Qt::GestureType type)
+QGesture *QGestureManager::getState(QObject *object, Qt::GestureType type)
 {
     // if the widget is being deleted we should be carefull and not to
     // create a new state, as it will create QWeakPointer which doesnt work
@@ -115,28 +117,39 @@ QGesture* QGestureManager::getState(QObject *object, Qt::GestureType type)
     if (object->isWidgetType()) {
         if (static_cast<QWidget *>(object)->d_func()->data.in_destructor)
             return 0;
+    } else if (QGesture *g = qobject_cast<QGesture *>(object)) {
+        return g;
+    } else {
+        Q_ASSERT(qobject_cast<QGraphicsObject *>(object));
     }
 
-    QWeakPointer<QGesture> state = objectGestures.value(QGestureManager::ObjectGesture(object, type));
+    QGesture *state =
+            objectGestures.value(QGestureManager::ObjectGesture(object, type));
     if (!state) {
         QGestureRecognizer *recognizer = recognizers.value(type);
         if (recognizer) {
             state = recognizer->createGesture(object);
             if (!state)
                 return 0;
-            if (state.data()->gestureType() == Qt::CustomGesture) {
+            if (state->gestureType() == Qt::CustomGesture) {
                 // if the recognizer didn't fill in the gesture type, then this
                 // is a custom gesture with autogenerated it and we fill it.
-                state.data()->d_func()->gestureType = type;
+                state->d_func()->gestureType = type;
+#if defined(GESTURE_DEBUG)
+                state->setObjectName(QString::number((int)type));
+#endif
             }
             objectGestures.insert(QGestureManager::ObjectGesture(object, type), state);
-            gestureToRecognizer[state.data()] = recognizer;
+            gestureToRecognizer[state] = recognizer;
+            gestureOwners[state] = object;
         }
     }
-    return state.data();
+    return state;
 }
 
-bool QGestureManager::filterEvent(QObject *receiver, QEvent *event)
+bool QGestureManager::filterEventThroughContexts(const QMap<QObject *,
+                                                 Qt::GestureType> &contexts,
+                                                 QEvent *event)
 {
     QSet<QGesture *> triggeredGestures;
     QSet<QGesture *> finishedGestures;
@@ -144,93 +157,23 @@ bool QGestureManager::filterEvent(QObject *receiver, QEvent *event)
     QSet<QGesture *> canceledGestures;
     QSet<QGesture *> notGestures;
 
-    QGraphicsObject *graphicsObject = qobject_cast<QGraphicsObject *>(receiver);
-    if (receiver->isWidgetType() || graphicsObject) {
-        QMap<QObject *, Qt::GestureType> contexts;
-        if (receiver->isWidgetType()) {
-            QWidget *w = static_cast<QWidget *>(receiver);
-            if (!w->d_func()->gestureContext.isEmpty()) {
-                typedef QMap<Qt::GestureType, Qt::GestureContext>::const_iterator ContextIterator;
-                for(ContextIterator it = w->d_func()->gestureContext.begin(),
-                    e = w->d_func()->gestureContext.end(); it != e; ++it) {
-                    contexts.insertMulti(w, it.key());
-                }
-            }
-            // find all gesture contexts for the widget tree
-            w = w->parentWidget();
-            while (w)
-            {
-                typedef QMap<Qt::GestureType, Qt::GestureContext>::const_iterator ContextIterator;
-                for (ContextIterator it = w->d_func()->gestureContext.begin(),
-                     e = w->d_func()->gestureContext.end(); it != e; ++it) {
-                    if (it.value() == Qt::WidgetWithChildrenGesture)
-                        contexts.insertMulti(w, it.key());
-                }
-                w = w->parentWidget();
-            }
-        } else {
-            QGraphicsObject *item = graphicsObject;
-            if (!item->QGraphicsItem::d_func()->gestureContext.isEmpty()) {
-                typedef QMap<Qt::GestureType, Qt::GestureContext>::const_iterator ContextIterator;
-                for(ContextIterator it = item->QGraphicsItem::d_func()->gestureContext.begin(),
-                    e = item->QGraphicsItem::d_func()->gestureContext.end(); it != e; ++it) {
-                    contexts.insertMulti(item, it.key());
-                }
-            }
-            // find all gesture contexts for the widget tree
-            item = item->parentObject();
-            while (item)
-            {
-                typedef QMap<Qt::GestureType, Qt::GestureContext>::const_iterator ContextIterator;
-                for (ContextIterator it = item->QGraphicsItem::d_func()->gestureContext.begin(),
-                     e = item->QGraphicsItem::d_func()->gestureContext.end(); it != e; ++it) {
-                    if (it.value() == Qt::WidgetWithChildrenGesture)
-                        contexts.insertMulti(item, it.key());
-                }
-                item = item->parentObject();
-            }
-        }
-        // filter the event through recognizers
-        typedef QMap<QObject *, Qt::GestureType>::const_iterator ContextIterator;
-        for (ContextIterator cit = contexts.begin(), ce = contexts.end(); cit != ce; ++cit) {
-            Qt::GestureType gestureType = cit.value();
-            QMap<Qt::GestureType, QGestureRecognizer *>::const_iterator
-                    rit = recognizers.lowerBound(gestureType),
-                    re = recognizers.upperBound(gestureType);
-            for (; rit != re; ++rit) {
-                QGestureRecognizer *recognizer = rit.value();
-                QObject *target = cit.key();
-                QGesture *state = getState(target, gestureType);
-                if (!state)
-                    continue;
-                QGestureRecognizer::Result result = recognizer->filterEvent(state, target, event);
-                QGestureRecognizer::Result type = result & QGestureRecognizer::ResultState_Mask;
-                if (type == QGestureRecognizer::GestureTriggered) {
-                    DEBUG() << "QGestureManager: gesture triggered: " << state;
-                    triggeredGestures << state;
-                } else if (type == QGestureRecognizer::GestureFinished) {
-                    DEBUG() << "QGestureManager: gesture finished: " << state;
-                    finishedGestures << state;
-                } else if (type == QGestureRecognizer::MaybeGesture) {
-                    DEBUG() << "QGestureManager: maybe gesture: " << state;
-                    newMaybeGestures << state;
-                } else if (type == QGestureRecognizer::NotGesture) {
-                    DEBUG() << "QGestureManager: not gesture: " << state;
-                    notGestures << state;
-                } else if (type == QGestureRecognizer::Ignore) {
-                    DEBUG() << "QGestureManager: gesture ignored the event: " << state;
-                } else {
-                    DEBUG() << "QGestureManager: hm, lets assume the recognizer ignored the event: " << state;
-                }
-                if (result & QGestureRecognizer::ConsumeEventHint) {
-                    DEBUG() << "QGestureManager: we were asked to consume the event: " << state;
-                    //TODO: consume events if asked
-                }
-            }
-        }
-    } else if (QGesture *state = qobject_cast<QGesture*>(receiver)) {
-        if (QGestureRecognizer *recognizer = gestureToRecognizer.value(state)) {
-            QGestureRecognizer::Result result = recognizer->filterEvent(state, state, event);
+    // TODO: sort contexts by the gesture type and check if one of the contexts
+    //       is already active.
+
+    // filter the event through recognizers
+    typedef QMap<QObject *, Qt::GestureType>::const_iterator ContextIterator;
+    for (ContextIterator cit = contexts.begin(), ce = contexts.end(); cit != ce; ++cit) {
+        Qt::GestureType gestureType = cit.value();
+        QMap<Qt::GestureType, QGestureRecognizer *>::const_iterator
+                rit = recognizers.lowerBound(gestureType),
+                re = recognizers.upperBound(gestureType);
+        for (; rit != re; ++rit) {
+            QGestureRecognizer *recognizer = rit.value();
+            QObject *target = cit.key();
+            QGesture *state = getState(target, gestureType);
+            if (!state)
+                continue;
+            QGestureRecognizer::Result result = recognizer->filterEvent(state, target, event);
             QGestureRecognizer::Result type = result & QGestureRecognizer::ResultState_Mask;
             if (type == QGestureRecognizer::GestureTriggered) {
                 DEBUG() << "QGestureManager: gesture triggered: " << state;
@@ -247,11 +190,15 @@ bool QGestureManager::filterEvent(QObject *receiver, QEvent *event)
             } else if (type == QGestureRecognizer::Ignore) {
                 DEBUG() << "QGestureManager: gesture ignored the event: " << state;
             } else {
-                DEBUG() << "QGestureManager: hm, lets assume the recognizer ignored the event: " << state;
+                DEBUG() << "QGestureManager: hm, lets assume the recognizer"
+                        << "ignored the event: " << state;
+            }
+            if (result & QGestureRecognizer::ConsumeEventHint) {
+                DEBUG() << "QGestureManager: we were asked to consume the event: "
+                        << state;
+                //TODO: consume events if asked
             }
         }
-    } else {
-        return false;
     }
 
     QSet<QGesture *> startedGestures = triggeredGestures - activeGestures;
@@ -260,7 +207,8 @@ bool QGestureManager::filterEvent(QObject *receiver, QEvent *event)
     // check if a running gesture switched back to maybe state
     QSet<QGesture *> activeToMaybeGestures = activeGestures & newMaybeGestures;
 
-    // check if a running gesture switched back to not gesture state, i.e. were canceled
+    // check if a running gesture switched back to not gesture state,
+    // i.e. were canceled
     QSet<QGesture *> activeToCancelGestures = activeGestures & notGestures;
     canceledGestures += activeToCancelGestures;
 
@@ -271,7 +219,9 @@ bool QGestureManager::filterEvent(QObject *receiver, QEvent *event)
             timer.start(3000, this);
     }
     // kill timers for gestures that were in maybe state
-    QSet<QGesture *> notMaybeGestures = (startedGestures | triggeredGestures | finishedGestures | canceledGestures | notGestures);
+    QSet<QGesture *> notMaybeGestures = (startedGestures | triggeredGestures
+                                         | finishedGestures | canceledGestures
+                                         | notGestures);
     foreach(QGesture *gesture, notMaybeGestures) {
         QMap<QGesture *, QBasicTimer>::iterator it =
                 maybeGestures.find(gesture);
@@ -294,7 +244,9 @@ bool QGestureManager::filterEvent(QObject *receiver, QEvent *event)
         // probably those are "singleshot" gestures so we'll fake the started state.
         foreach (QGesture *gesture, notStarted)
             gesture->d_func()->state = Qt::GestureStarted;
-        deliverEvents(notStarted, receiver);
+        QSet<QGesture *> undeliveredGestures;
+        deliverEvents(notStarted, &undeliveredGestures);
+        finishedGestures -= undeliveredGestures;
     }
 
     activeGestures += startedGestures;
@@ -328,10 +280,15 @@ bool QGestureManager::filterEvent(QObject *receiver, QEvent *event)
                 << "\n\tcanceled:" << canceledGestures;
     }
 
-    deliverEvents(startedGestures+triggeredGestures+finishedGestures+canceledGestures, receiver);
+    QSet<QGesture *> undeliveredGestures;
+    deliverEvents(startedGestures+triggeredGestures+finishedGestures+canceledGestures,
+                  &undeliveredGestures);
+
+    activeGestures -= undeliveredGestures;
 
     // reset gestures that ended
-    QSet<QGesture *> endedGestures = finishedGestures + canceledGestures;
+    QSet<QGesture *> endedGestures =
+            finishedGestures + canceledGestures + undeliveredGestures;
     foreach (QGesture *gesture, endedGestures) {
         if (QGestureRecognizer *recognizer = gestureToRecognizer.value(gesture, 0)) {
             recognizer->reset(gesture);
@@ -341,100 +298,218 @@ bool QGestureManager::filterEvent(QObject *receiver, QEvent *event)
     return false;
 }
 
-void QGestureManager::deliverEvents(const QSet<QGesture*> &gestures, QObject *lastReceiver)
+bool QGestureManager::filterEvent(QWidget *receiver, QEvent *event)
+{
+    QSet<Qt::GestureType> types;
+    QMap<QObject *, Qt::GestureType> contexts;
+    QWidget *w = receiver;
+    typedef QMap<Qt::GestureType, Qt::GestureContext>::const_iterator ContextIterator;
+    if (!w->d_func()->gestureContext.isEmpty()) {
+        for(ContextIterator it = w->d_func()->gestureContext.begin(),
+            e = w->d_func()->gestureContext.end(); it != e; ++it) {
+            types.insert(it.key());
+            contexts.insertMulti(w, it.key());
+        }
+    }
+    // find all gesture contexts for the widget tree
+    w = w->isWindow() ? 0 : w->parentWidget();
+    while (w)
+    {
+        for (ContextIterator it = w->d_func()->gestureContext.begin(),
+             e = w->d_func()->gestureContext.end(); it != e; ++it) {
+            if (it.value() == Qt::WidgetWithChildrenGesture) {
+                if (!types.contains(it.key())) {
+                    types.insert(it.key());
+                    contexts.insertMulti(w, it.key());
+                }
+            }
+        }
+        if (w->isWindow())
+            break;
+        w = w->parentWidget();
+    }
+    return filterEventThroughContexts(contexts, event);
+}
+
+bool QGestureManager::filterEvent(QGraphicsObject *receiver, QEvent *event)
+{
+    QSet<Qt::GestureType> types;
+    QMap<QObject *, Qt::GestureType> contexts;
+    QGraphicsObject *item = receiver;
+    if (!item->QGraphicsItem::d_func()->gestureContext.isEmpty()) {
+        typedef QMap<Qt::GestureType, Qt::GestureContext>::const_iterator ContextIterator;
+        for(ContextIterator it = item->QGraphicsItem::d_func()->gestureContext.begin(),
+            e = item->QGraphicsItem::d_func()->gestureContext.end(); it != e; ++it) {
+            types.insert(it.key());
+            contexts.insertMulti(item, it.key());
+        }
+    }
+    // find all gesture contexts for the graphics object tree
+    item = item->parentObject();
+    while (item)
+    {
+        typedef QMap<Qt::GestureType, Qt::GestureContext>::const_iterator ContextIterator;
+        for (ContextIterator it = item->QGraphicsItem::d_func()->gestureContext.begin(),
+             e = item->QGraphicsItem::d_func()->gestureContext.end(); it != e; ++it) {
+            if (it.value() == Qt::ItemWithChildrenGesture) {
+                if (!types.contains(it.key()))
+                    contexts.insertMulti(item, it.key());
+            }
+        }
+        item = item->parentObject();
+    }
+    return filterEventThroughContexts(contexts, event);
+}
+
+bool QGestureManager::filterEvent(QGesture *state, QEvent *event)
+{
+    QMap<QObject *, Qt::GestureType> contexts;
+    contexts.insert(state, state->gestureType());
+    return filterEventThroughContexts(contexts, event);
+}
+
+void QGestureManager::getGestureTargets(const QSet<QGesture*> &gestures,
+    QMap<QWidget *, QList<QGesture *> > *conflicts,
+    QMap<QWidget *, QList<QGesture *> > *normal)
+{
+    typedef QHash<Qt::GestureType, QHash<QWidget *, QGesture *> > GestureByTypes;
+    GestureByTypes gestureByTypes;
+
+    // sort gestures by types
+    foreach (QGesture *gesture, gestures) {
+        QWidget *receiver = gestureTargets.value(gesture, 0);
+        Q_ASSERT(receiver);
+        gestureByTypes[gesture->gestureType()].insert(receiver, gesture);
+    }
+
+    // for each gesture type
+    foreach (Qt::GestureType type, gestureByTypes.keys()) {
+        QHash<QWidget *, QGesture *> gestures = gestureByTypes.value(type);
+        foreach (QWidget *widget, gestures.keys()) {
+            QWidget *w = widget->parentWidget();
+            while (w) {
+                QMap<Qt::GestureType, Qt::GestureContext>::const_iterator it
+                        = w->d_func()->gestureContext.find(type);
+                if (it != w->d_func()->gestureContext.end()) {
+                    // i.e. 'w' listens to gesture 'type'
+                    Qt::GestureContext context = it.value();
+                    if (context == Qt::WidgetWithChildrenGesture && w != widget) {
+                        // conflicting gesture!
+                        (*conflicts)[widget].append(gestures[widget]);
+                        break;
+                    }
+                }
+                if (w->isWindow()) {
+                    w = 0;
+                    break;
+                }
+                w = w->parentWidget();
+            }
+            if (!w)
+                (*normal)[widget].append(gestures[widget]);
+        }
+    }
+}
+
+void QGestureManager::deliverEvents(const QSet<QGesture *> &gestures,
+                                    QSet<QGesture *> *undeliveredGestures)
 {
     if (gestures.isEmpty())
         return;
 
-    // group gestures by widgets
-    typedef QMap<QObject *, QList<QGesture *> > GesturesPerReceiver;
-    GesturesPerReceiver groupedGestures;
-    // for conflicted gestures the key is always the innermost widget (i.e. the child)
-    GesturesPerReceiver conflictedGestures;
-    QMultiHash<QObject *, QGesture *> objectGestures;
+    typedef QMap<QWidget *, QList<QGesture *> > GesturesPerWidget;
+    GesturesPerWidget conflictedGestures;
+    GesturesPerWidget normalStartedGestures;
 
-    foreach (QGesture *gesture, gestures) {
-        QObject *target = gestureTargets.value(gesture, 0);
+    QSet<QGesture *> startedGestures;
+    // first figure out the initial receivers of gestures
+    for (QSet<QGesture *>::const_iterator it = gestures.begin(),
+         e = gestures.end(); it != e; ++it) {
+        QGesture *gesture = *it;
+        QWidget *target = gestureTargets.value(gesture, 0);
         if (!target) {
+            // the gesture has just started and doesn't have a target yet.
             Q_ASSERT(gesture->state() == Qt::GestureStarted);
             if (gesture->hasHotSpot()) {
-                // guess the target using the hotspot of the gesture
+                // guess the target widget using the hotspot of the gesture
                 QPoint pt = gesture->hotSpot().toPoint();
-                if (!pt.isNull()) {
-                    if (QWidget *w = qApp->topLevelAt(pt))
-                        target = w->childAt(w->mapFromGlobal(pt));
+                if (QWidget *w = qApp->topLevelAt(pt)) {
+                    target = w->childAt(w->mapFromGlobal(pt));
                 }
+            } else {
+                // or use the context of the gesture
+                QObject *context = gestureOwners.value(gesture, 0);
+                if (context->isWidgetType())
+                    target = static_cast<QWidget *>(context);
             }
-            if (!target) {
-                target = gesture->targetObject();
-                if (!target)
-                    target = lastReceiver;
-            }
+            if (target)
+                gestureTargets.insert(gesture, target);
         }
+
+        Qt::GestureType gestureType = gesture->gestureType();
+        Q_ASSERT(gestureType != Qt::CustomGesture);
+
         if (target) {
-            gestureTargets.insert(gesture, target);
-            if (target->isWidgetType())
-                objectGestures.insert(target, gesture);
-            groupedGestures[target].append(gesture);
+            if (gesture->state() == Qt::GestureStarted) {
+                startedGestures.insert(gesture);
+            } else {
+                normalStartedGestures[target].append(gesture);
+            }
         } else {
-            qWarning() << "QGestureManager::deliverEvent: could not find the target for gesture"
+            DEBUG() << "QGestureManager::deliverEvent: could not find the target for gesture"
                     << gesture->gestureType();
+            qWarning("QGestureManager::deliverEvent: could not find the target for gesture");
+            undeliveredGestures->insert(gesture);
         }
     }
 
-    typedef QMultiHash<QObject *, QGesture *>::const_iterator ObjectGesturesIterator;
-    for (ObjectGesturesIterator it = objectGestures.begin(), e = objectGestures.end(); it != e; ++it) {
-        QObject *object1 = it.key();
-        QWidget *widget1 = qobject_cast<QWidget *>(object1);
-        QGraphicsObject *item1 = qobject_cast<QGraphicsObject *>(object1);
-        QGesture *gesture1 = it.value();
-        ObjectGesturesIterator cit = it;
-        for (++cit; cit != e; ++cit) {
-            QObject *object2 = cit.key();
-            QWidget *widget2 = qobject_cast<QWidget *>(object2);
-            QGraphicsObject *item2 = qobject_cast<QGraphicsObject *>(object2);
-            QGesture *gesture2 = cit.value();
-            // TODO: ugly, rewrite this.
-            if ((widget1 && widget2 && widget2->isAncestorOf(widget1)) ||
-                (item1 && item2 && item2->isAncestorOf(item1))) {
-                groupedGestures[object2].removeOne(gesture2);
-                groupedGestures[object1].removeOne(gesture1);
-                conflictedGestures[object1].append(gesture1);
-            } else if ((widget1 && widget2 && widget1->isAncestorOf(widget2)) ||
-                       (item1 && item2 && item1->isAncestorOf(item2))) {
-                groupedGestures[object2].removeOne(gesture2);
-                groupedGestures[object1].removeOne(gesture1);
-                conflictedGestures[object2].append(gesture2);
-            }
-        }
-    }
-
-    DEBUG() << "deliverEvents: conflicted =" << conflictedGestures.values()
-            << " grouped =" << groupedGestures.values();
+    getGestureTargets(startedGestures, &conflictedGestures, &normalStartedGestures);
+    DEBUG() << "QGestureManager::deliverEvents:"
+            << "\nstarted: " << startedGestures
+            << "\nconflicted: " << conflictedGestures
+            << "\nnormal: " << normalStartedGestures
+            << "\n";
 
     // if there are conflicting gestures, send the GestureOverride event
-    for (GesturesPerReceiver::const_iterator it = conflictedGestures.begin(),
+    for (GesturesPerWidget::const_iterator it = conflictedGestures.begin(),
         e = conflictedGestures.end(); it != e; ++it) {
+        QWidget *receiver = it.key();
+        QList<QGesture *> gestures = it.value();
         DEBUG() << "QGestureManager::deliverEvents: sending GestureOverride to"
-                << it.key()
-                << " gestures:" << it.value();
-        QGestureEvent event(it.value());
+                << receiver
+                << "gestures:" << gestures;
+        QGestureEvent event(gestures);
         event.t = QEvent::GestureOverride;
+        // mark event and individual gestures as ignored
         event.ignore();
-        QApplication::sendEvent(it.key(), &event);
-        if (!event.isAccepted()) {
-            // nobody accepted the GestureOverride, put it back to deliver to
-            // the closest context (i.e. to the inner-most widget).
-            DEBUG() <<" override was not accepted";
-            groupedGestures[it.key()].append(it.value());
+        foreach(QGesture *g, gestures)
+            event.setAccepted(g, false);
+
+        QApplication::sendEvent(receiver, &event);
+        bool eventAccepted = event.isAccepted();
+        foreach(QGesture *gesture, event.allGestures()) {
+            if (eventAccepted || event.isAccepted(gesture)) {
+                QWidget *w = event.d_func()->targetWidgets.value(gesture->gestureType(), 0);
+                Q_ASSERT(w);
+                DEBUG() << "override event: gesture was accepted:" << gesture << w;
+                QList<QGesture *> &gestures = normalStartedGestures[w];
+                gestures.append(gesture);
+                // override the target
+                gestureTargets[gesture] = w;
+            } else {
+                DEBUG() << "override event: gesture wasn't accepted. putting back:" << gesture;
+                QList<QGesture *> &gestures = normalStartedGestures[receiver];
+                gestures.append(gesture);
+            }
         }
     }
 
-    for (GesturesPerReceiver::const_iterator it = groupedGestures.begin(),
-        e = groupedGestures.end(); it != e; ++it) {
+    // delivering gestures that are not in conflicted state
+    for (GesturesPerWidget::const_iterator it = normalStartedGestures.begin(),
+        e = normalStartedGestures.end(); it != e; ++it) {
         if (!it.value().isEmpty()) {
             DEBUG() << "QGestureManager::deliverEvents: sending to" << it.key()
-                    << " gestures:" << it.value();
+                    << "gestures:" << it.value();
             QGestureEvent event(it.value());
             QApplication::sendEvent(it.key(), &event);
         }
@@ -452,7 +527,8 @@ void QGestureManager::timerEvent(QTimerEvent *event)
             timer.stop();
             QGesture *gesture = it.key();
             it = maybeGestures.erase(it);
-            DEBUG() << "QGestureManager::timerEvent: gesture stopped due to timeout:" << gesture;
+            DEBUG() << "QGestureManager::timerEvent: gesture stopped due to timeout:"
+                    << gesture;
             QGestureRecognizer *recognizer = gestureToRecognizer.value(gesture, 0);
             if (recognizer)
                 recognizer->reset(gesture);
diff --git a/src/gui/kernel/qgesturemanager_p.h b/src/gui/kernel/qgesturemanager_p.h
index c61819f5c2..f0e72252bd 100644
--- a/src/gui/kernel/qgesturemanager_p.h
+++ b/src/gui/kernel/qgesturemanager_p.h
@@ -61,6 +61,7 @@
 QT_BEGIN_NAMESPACE
 
 class QBasicTimer;
+class QGraphicsObject;
 class QGestureManager : public QObject
 {
     Q_OBJECT
@@ -71,13 +72,17 @@ public:
     Qt::GestureType registerGestureRecognizer(QGestureRecognizer *recognizer);
     void unregisterGestureRecognizer(Qt::GestureType type);
 
-    bool filterEvent(QObject *receiver, QEvent *event);
+    bool filterEvent(QWidget *receiver, QEvent *event);
+    bool filterEvent(QGesture *receiver, QEvent *event);
+    bool filterEvent(QGraphicsObject *receiver, QEvent *event);
 
     // declared in qapplication.cpp
     static QGestureManager* instance();
 
 protected:
     void timerEvent(QTimerEvent *event);
+    bool filterEventThroughContexts(const QMap<QObject *, Qt::GestureType> &contexts,
+                                    QEvent *event);
 
 private:
     QMultiMap<Qt::GestureType, QGestureRecognizer *> recognizers;
@@ -109,15 +114,20 @@ private:
         }
     };
 
-    QMap<ObjectGesture, QWeakPointer<QGesture> > objectGestures;
+    QMap<ObjectGesture, QGesture *> objectGestures;
     QMap<QGesture *, QGestureRecognizer *> gestureToRecognizer;
+    QHash<QGesture *, QObject *> gestureOwners;
 
-    QHash<QGesture *, QObject *> gestureTargets;
+    QHash<QGesture *, QWidget *> gestureTargets;
 
     int lastCustomGestureId;
 
     QGesture *getState(QObject *widget, Qt::GestureType gesture);
-    void deliverEvents(const QSet<QGesture *> &gestures, QObject *lastReceiver);
+    void deliverEvents(const QSet<QGesture *> &gestures,
+                       QSet<QGesture *> *undeliveredGestures);
+    void getGestureTargets(const QSet<QGesture*> &gestures,
+                           QMap<QWidget *, QList<QGesture *> > *conflicts,
+                           QMap<QWidget *, QList<QGesture *> > *normal);
 };
 
 QT_END_NAMESPACE
diff --git a/src/gui/kernel/qmacgesturerecognizer_mac.mm b/src/gui/kernel/qmacgesturerecognizer_mac.mm
index 7b19a547c3..70195809a6 100644
--- a/src/gui/kernel/qmacgesturerecognizer_mac.mm
+++ b/src/gui/kernel/qmacgesturerecognizer_mac.mm
@@ -218,7 +218,7 @@ QMacPanGestureRecognizer::filterEvent(QGesture *gesture, QObject *target, QEvent
                 const QPointF p = QCursor::pos();
                 const QPointF posOffset = p - _lastPos;
                 g->setLastOffset(g->offset());
-                g->setOffset(QSizeF(posOffset.x(), posOffset.y()));
+                g->setOffset(QPointF(posOffset.x(), posOffset.y()));
                 g->setTotalOffset(g->lastOffset() + g->offset());
                 _lastPos = p;
                 return QGestureRecognizer::GestureTriggered;
@@ -256,9 +256,9 @@ void QMacPanGestureRecognizer::reset(QGesture *gesture)
     _startPos = QPointF();
     _lastPos = QPointF();
     _panCanceled = true;
-    g->setOffset(QSizeF(0, 0));
-    g->setLastOffset(QSizeF(0, 0));
-    g->setTotalOffset(QSizeF(0, 0));
+    g->setOffset(QPointF(0, 0));
+    g->setLastOffset(QPointF(0, 0));
+    g->setTotalOffset(QPointF(0, 0));
     g->setAcceleration(qreal(1));
     QGestureRecognizer::reset(gesture);
 }
diff --git a/src/gui/kernel/qstandardgestures.cpp b/src/gui/kernel/qstandardgestures.cpp
index dfc349965b..a1363798e6 100644
--- a/src/gui/kernel/qstandardgestures.cpp
+++ b/src/gui/kernel/qstandardgestures.cpp
@@ -73,7 +73,7 @@ QGestureRecognizer::Result QPanGestureRecognizer::filterEvent(QGesture *state, Q
         result = QGestureRecognizer::MaybeGesture;
         QTouchEvent::TouchPoint p = ev->touchPoints().at(0);
         d->lastPosition = p.pos().toPoint();
-        d->lastOffset = d->totalOffset = d->offset = QSize();
+        d->lastOffset = d->totalOffset = d->offset = QPointF();
         break;
     }
     case QEvent::TouchEnd: {
@@ -83,7 +83,7 @@ QGestureRecognizer::Result QPanGestureRecognizer::filterEvent(QGesture *state, Q
                 QTouchEvent::TouchPoint p2 = ev->touchPoints().at(1);
                 d->lastOffset = d->offset;
                 d->offset =
-                        QSize(p1.pos().x() - p1.lastPos().x() + p2.pos().x() - p2.lastPos().x(),
+                        QPointF(p1.pos().x() - p1.lastPos().x() + p2.pos().x() - p2.lastPos().x(),
                               p1.pos().y() - p1.lastPos().y() + p2.pos().y() - p2.lastPos().y()) / 2;
                 d->totalOffset += d->offset;
             }
@@ -99,11 +99,11 @@ QGestureRecognizer::Result QPanGestureRecognizer::filterEvent(QGesture *state, Q
             QTouchEvent::TouchPoint p2 = ev->touchPoints().at(1);
             d->lastOffset = d->offset;
             d->offset =
-                    QSize(p1.pos().x() - p1.lastPos().x() + p2.pos().x() - p2.lastPos().x(),
+                    QPointF(p1.pos().x() - p1.lastPos().x() + p2.pos().x() - p2.lastPos().x(),
                           p1.pos().y() - p1.lastPos().y() + p2.pos().y() - p2.lastPos().y()) / 2;
             d->totalOffset += d->offset;
-            if (d->totalOffset.width() > 10  || d->totalOffset.height() > 10 ||
-                d->totalOffset.width() < -10 || d->totalOffset.height() < -10) {
+            if (d->totalOffset.x() > 10  || d->totalOffset.y() > 10 ||
+                d->totalOffset.x() < -10 || d->totalOffset.y() < -10) {
                 result = QGestureRecognizer::GestureTriggered;
             } else {
                 result = QGestureRecognizer::MaybeGesture;
@@ -128,7 +128,7 @@ void QPanGestureRecognizer::reset(QGesture *state)
     QPanGesture *pan = static_cast<QPanGesture*>(state);
     QPanGesturePrivate *d = pan->d_func();
 
-    d->totalOffset = d->lastOffset = d->offset = QSizeF();
+    d->totalOffset = d->lastOffset = d->offset = QPointF();
     d->lastPosition = QPoint();
     d->acceleration = 0;
 
diff --git a/src/gui/kernel/qwidget.cpp b/src/gui/kernel/qwidget.cpp
index de0831265c..c36c68ab43 100644
--- a/src/gui/kernel/qwidget.cpp
+++ b/src/gui/kernel/qwidget.cpp
@@ -149,24 +149,6 @@ static inline bool hasBackingStoreSupport()
 #endif
 }
 
-/*!
-    \internal
-
-    Returns true if \a p or any of its parents enable the
-    Qt::BypassGraphicsProxyWidget window flag. Used in QWidget::show() and
-    QWidget::setParent() to determine whether it's necessary to embed the
-    widget into a QGraphicsProxyWidget or not.
-*/
-static inline bool bypassGraphicsProxyWidget(QWidget *p)
-{
-    while (p) {
-        if (p->windowFlags() & Qt::BypassGraphicsProxyWidget)
-            return true;
-        p = p->parentWidget();
-    }
-    return false;
-}
-
 #ifdef Q_WS_MAC
 #  define QT_NO_PAINT_DEBUG
 #endif
@@ -5487,6 +5469,7 @@ QPixmap QWidgetEffectSourcePrivate::pixmap(Qt::CoordinateSystem system, QPoint *
     return pixmap;
 }
 
+#ifndef QT_NO_GRAPHICSVIEW
 /*!
     \internal
 
@@ -5495,7 +5478,7 @@ QPixmap QWidgetEffectSourcePrivate::pixmap(Qt::CoordinateSystem system, QPoint *
     If successful, the function returns the proxy that embeds the widget, or 0 if no embedded
     widget was found.
 */
-QGraphicsProxyWidget * QWidgetPrivate::nearestGraphicsProxyWidget(QWidget *origin)
+QGraphicsProxyWidget * QWidgetPrivate::nearestGraphicsProxyWidget(const QWidget *origin)
 {
     if (origin) {
         QWExtra *extra = origin->d_func()->extra;
@@ -5505,6 +5488,7 @@ QGraphicsProxyWidget * QWidgetPrivate::nearestGraphicsProxyWidget(QWidget *origi
     }
     return 0;
 }
+#endif
 
 /*!
     \property QWidget::locale
@@ -7739,6 +7723,10 @@ void QWidget::adjustSize()
     Q_D(QWidget);
     ensurePolished();
     QSize s = d->adjustedSize();
+
+    if (d->layout)
+        d->layout->activate();
+
     if (s.isValid())
         resize(s);
 }
diff --git a/src/gui/kernel/qwidget_p.h b/src/gui/kernel/qwidget_p.h
index f7c27123b2..24699c4616 100644
--- a/src/gui/kernel/qwidget_p.h
+++ b/src/gui/kernel/qwidget_p.h
@@ -63,7 +63,9 @@
 #include "QtGui/qstyle.h"
 #include "QtGui/qapplication.h"
 #include <private/qgraphicseffect_p.h>
-
+#include "QtGui/qgraphicsproxywidget.h"
+#include "QtGui/qgraphicsscene.h"
+#include "QtGui/qgraphicsview.h"
 #include <private/qgesture_p.h>
 
 #ifdef Q_WS_WIN
@@ -180,7 +182,9 @@ struct QWExtra {
     // Regular pointers (keep them together to avoid gaps on 64 bits architectures).
     void *glContext; // if the widget is hijacked by QGLWindowSurface
     QTLWExtra *topextra; // only useful for TLWs
+#ifndef QT_NO_GRAPHICSVIEW
     QGraphicsProxyWidget *proxyWidget; // if the widget is embedded
+#endif
 #ifndef QT_NO_CURSOR
     QCursor *curs;
 #endif
@@ -235,6 +239,24 @@ struct QWExtra {
 #endif
 };
 
+/*!
+    \internal
+
+    Returns true if \a p or any of its parents enable the
+    Qt::BypassGraphicsProxyWidget window flag. Used in QWidget::show() and
+    QWidget::setParent() to determine whether it's necessary to embed the
+    widget into a QGraphicsProxyWidget or not.
+*/
+static inline bool bypassGraphicsProxyWidget(const QWidget *p)
+{
+    while (p) {
+        if (p->windowFlags() & Qt::BypassGraphicsProxyWidget)
+            return true;
+        p = p->parentWidget();
+    }
+    return false;
+}
+
 class Q_GUI_EXPORT QWidgetPrivate : public QObjectPrivate
 {
     Q_DECLARE_PUBLIC(QWidget)
@@ -345,7 +367,9 @@ public:
 
     QPainter *beginSharedPainter();
     bool endSharedPainter();
-    static QGraphicsProxyWidget * nearestGraphicsProxyWidget(QWidget *origin);
+#ifndef QT_NO_GRAPHICSVIEW
+    static QGraphicsProxyWidget * nearestGraphicsProxyWidget(const QWidget *origin);
+#endif
     QWindowSurface *createDefaultWindowSurface();
     QWindowSurface *createDefaultWindowSurface_sys();
     void repaint_sys(const QRegion &rgn);
@@ -442,6 +466,31 @@ public:
 
     void setModal_sys();
 
+    // This is an helper function that return the available geometry for
+    // a widget and takes care is this one is in QGraphicsView.
+    // If the widget is not embed in a scene then the geometry available is
+    // null, we let QDesktopWidget decide for us.
+    static QRect screenGeometry(const QWidget *widget)
+    {
+        QRect screen;
+#ifndef QT_NO_GRAPHICSVIEW
+        QGraphicsProxyWidget *ancestorProxy = widget->d_func()->nearestGraphicsProxyWidget(widget);
+        //It's embedded if it has an ancestor
+        if (ancestorProxy) {
+            if (!bypassGraphicsProxyWidget(widget)) {
+                // One view, let be smart and return the viewport rect then the popup is aligned
+                if (ancestorProxy->scene()->views().size() == 1) {
+                    QGraphicsView *view = ancestorProxy->scene()->views().at(0);
+                    screen = view->mapToScene(view->viewport()->rect()).boundingRect().toRect();
+                } else {
+                    screen = ancestorProxy->scene()->sceneRect().toRect();
+                }
+            }
+        }
+#endif
+        return screen;
+    }
+
     inline void setRedirected(QPaintDevice *replacement, const QPoint &offset)
     {
         Q_ASSERT(q_func()->testAttribute(Qt::WA_WState_InPaintEvent));
diff --git a/src/gui/kernel/qwinnativepangesturerecognizer_win.cpp b/src/gui/kernel/qwinnativepangesturerecognizer_win.cpp
index 461959410e..12d3058188 100644
--- a/src/gui/kernel/qwinnativepangesturerecognizer_win.cpp
+++ b/src/gui/kernel/qwinnativepangesturerecognizer_win.cpp
@@ -97,11 +97,11 @@ QGestureRecognizer::Result QWinNativePanGestureRecognizer::filterEvent(QGesture
             return QGestureRecognizer::Ignore;
         }
         if (q->state() == Qt::NoGesture) {
-            d->lastOffset = d->totalOffset = d->offset = QSize();
+            d->lastOffset = d->totalOffset = d->offset = QPointF();
         } else {
             d->lastOffset = d->offset;
-            d->offset = QSize(ev->position.x() - d->lastPosition.x(),
-                              ev->position.y() - d->lastPosition.y());
+            d->offset = QPointF(ev->position.x() - d->lastPosition.x(),
+                                ev->position.y() - d->lastPosition.y());
             d->totalOffset += d->offset;
         }
         d->lastPosition = ev->position;
@@ -114,7 +114,7 @@ void QWinNativePanGestureRecognizer::reset(QGesture *state)
     QPanGesture *pan = static_cast<QPanGesture*>(state);
     QPanGesturePrivate *d = pan->d_func();
 
-    d->totalOffset = d->lastOffset = d->offset = QSizeF();
+    d->totalOffset = d->lastOffset = d->offset = QPointF();
     d->lastPosition = QPoint();
     d->acceleration = 0;
 
diff --git a/src/gui/painting/qpaintengine.h b/src/gui/painting/qpaintengine.h
index 5b82e7b395..bf4b4eaffe 100644
--- a/src/gui/painting/qpaintengine.h
+++ b/src/gui/painting/qpaintengine.h
@@ -278,6 +278,7 @@ private:
     friend class QWin32PaintEnginePrivate;
     friend class QMacCGContext;
     friend class QPreviewPaintEngine;
+    friend class QX11GLPixmapData;
 };
 
 
diff --git a/src/gui/painting/qpaintengine_raster.cpp b/src/gui/painting/qpaintengine_raster.cpp
index fab2d8d32e..fd0e810021 100644
--- a/src/gui/painting/qpaintengine_raster.cpp
+++ b/src/gui/painting/qpaintengine_raster.cpp
@@ -132,6 +132,10 @@ static const qreal aliasedCoordinateDelta = 0.5 - 0.015625;
 extern bool qt_cleartype_enabled;
 #endif
 
+#ifdef Q_WS_MAC
+extern bool qt_applefontsmoothing_enabled;
+#endif
+
 
 /********************************************************************************
  * Span functions
@@ -508,7 +512,7 @@ bool QRasterPaintEngine::begin(QPaintDevice *device)
 #if defined(Q_WS_WIN)
     else if (qt_cleartype_enabled)
 #elif defined (Q_WS_MAC)
-    else if (true)
+    else if (qt_applefontsmoothing_enabled)
 #else
     else if (false)
 #endif
diff --git a/src/gui/painting/qtextureglyphcache.cpp b/src/gui/painting/qtextureglyphcache.cpp
index 9e5707d716..a192e8776c 100644
--- a/src/gui/painting/qtextureglyphcache.cpp
+++ b/src/gui/painting/qtextureglyphcache.cpp
@@ -229,16 +229,9 @@ void QImageTextureGlyphCache::createTextureData(int width, int height)
 
 int QImageTextureGlyphCache::glyphMargin() const
 {
-#ifdef Q_WS_MAC
-
-#ifdef QT_MAC_USE_COCOA
-    // For cocoa the margin is built into the glyph it seems..
+#if defined(Q_WS_MAC) && defined(QT_MAC_USE_COCOA)
     return 0;
 #else
-    return 2;
-#endif
-
-#else
     return m_type == QFontEngineGlyphCache::Raster_RGBMask ? 2 : 0;
 #endif
 }
diff --git a/src/gui/text/qfontengine_win.cpp b/src/gui/text/qfontengine_win.cpp
index cc555a39ff..d781c70bb2 100644
--- a/src/gui/text/qfontengine_win.cpp
+++ b/src/gui/text/qfontengine_win.cpp
@@ -125,6 +125,7 @@ HDC shared_dc()
 }
 #endif
 
+#ifndef Q_WS_WINCE
 typedef BOOL (WINAPI *PtrGetCharWidthI)(HDC, UINT, UINT, LPWORD, LPINT);
 static PtrGetCharWidthI ptrGetCharWidthI = 0;
 static bool resolvedGetCharWidthI = false;
@@ -136,6 +137,7 @@ static void resolveGetCharWidthI()
     resolvedGetCharWidthI = true;
     ptrGetCharWidthI = (PtrGetCharWidthI)QLibrary::resolve(QLatin1String("gdi32"), "GetCharWidthI");
 }
+#endif // !defined(Q_WS_WINCE)
 
 // defined in qtextengine_win.cpp
 typedef void *SCRIPT_CACHE;
@@ -340,8 +342,10 @@ QFontEngineWin::QFontEngineWin(const QString &name, HFONT _hfont, bool stockFont
     designAdvances = 0;
     designAdvancesSize = 0;
 
+#ifndef Q_WS_WINCE
     if (!resolvedGetCharWidthI)
         resolveGetCharWidthI();
+#endif
 }
 
 QFontEngineWin::~QFontEngineWin()
@@ -381,80 +385,18 @@ bool QFontEngineWin::stringToCMap(const QChar *str, int len, QGlyphLayout *glyph
     if (flags & QTextEngine::GlyphIndicesOnly)
         return true;
 
-#if defined(Q_WS_WINCE)
-    HDC hdc = shared_dc();
-    if (flags & QTextEngine::DesignMetrics) {
-        HGDIOBJ oldFont = 0;
-        int glyph_pos = 0;
-        for(register int i = 0; i < len; i++) {
-            bool surrogate = (str[i].unicode() >= 0xd800 && str[i].unicode() < 0xdc00 && i < len-1
-                              && str[i+1].unicode() >= 0xdc00 && str[i+1].unicode() < 0xe000);
-            unsigned int glyph = glyphs->glyphs[glyph_pos];
-            if(int(glyph) >= designAdvancesSize) {
-                int newSize = (glyph + 256) >> 8 << 8;
-                designAdvances = q_check_ptr((QFixed *)realloc(designAdvances, newSize*sizeof(QFixed)));
-                for(int i = designAdvancesSize; i < newSize; ++i)
-                    designAdvances[i] = -1000000;
-                designAdvancesSize = newSize;
-            }
-            if(designAdvances[glyph] < -999999) {
-                if(!oldFont)
-                    oldFont = selectDesignFont();
-                SIZE size = {0, 0};
-                GetTextExtentPoint32(hdc, (wchar_t *)(str+i), surrogate ? 2 : 1, &size);
-                designAdvances[glyph] = QFixed((int)size.cx)/designToDevice;
-            }
-            glyphs->advances_x[glyph_pos] = designAdvances[glyph];
-            glyphs->advances_y[glyph_pos] = 0;
-            if (surrogate)
-                ++i;
-            ++glyph_pos;
-        }
-        if(oldFont)
-            DeleteObject(SelectObject(hdc, oldFont));
-    } else {
-        int glyph_pos = 0;
-        HGDIOBJ oldFont = 0;
-
-        for(register int i = 0; i < len; i++) {
-            bool surrogate = (str[i].unicode() >= 0xd800 && str[i].unicode() < 0xdc00 && i < len-1
-                              && str[i+1].unicode() >= 0xdc00 && str[i+1].unicode() < 0xe000);
-            unsigned int glyph = glyphs->glyphs[glyph_pos];
-
-            glyphs->advances_y[glyph_pos] = 0;
-
-            if (glyph >= widthCacheSize) {
-                int newSize = (glyph + 256) >> 8 << 8;
-                widthCache = q_check_ptr((unsigned char *)realloc(widthCache,
-                            newSize*sizeof(QFixed)));
-                memset(widthCache + widthCacheSize, 0, newSize - widthCacheSize);
-                widthCacheSize = newSize;
-            }
-            glyphs->advances_x[glyph_pos] = widthCache[glyph];
-            // font-width cache failed
-            if (glyphs->advances_x[glyph_pos] == 0) {
-                SIZE size = {0, 0};
-                if (!oldFont)
-                    oldFont = SelectObject(hdc, hfont);
-                GetTextExtentPoint32(hdc, (wchar_t *)str + i, surrogate ? 2 : 1, &size);
-                glyphs->advances_x[glyph_pos] = size.cx;
-                // if glyph's within cache range, store it for later
-                if (size.cx > 0 && size.cx < 0x100)
-                    widthCache[glyph] = size.cx;
-            }
-
-            if (surrogate)
-                ++i;
-            ++glyph_pos;
-        }
+    recalcAdvances(glyphs, flags);
+    return true;
+}
 
-        if (oldFont)
-            SelectObject(hdc, oldFont);
-    }
+inline void calculateTTFGlyphWidth(HDC hdc, UINT glyph, int &width)
+{
+#if defined(Q_WS_WINCE)
+    GetCharWidth32(hdc, glyph, glyph, &width);
 #else
-    recalcAdvances(glyphs, flags);
+    if (ptrGetCharWidthI)
+        ptrGetCharWidthI(hdc, glyph, 1, 0, &width);
 #endif
-    return true;
 }
 
 void QFontEngineWin::recalcAdvances(QGlyphLayout *glyphs, QTextEngine::ShaperFlags flags) const
@@ -477,8 +419,7 @@ void QFontEngineWin::recalcAdvances(QGlyphLayout *glyphs, QTextEngine::ShaperFla
                     oldFont = selectDesignFont();
 
                 int width = 0;
-                if (ptrGetCharWidthI)
-                    ptrGetCharWidthI(hdc, glyph, 1, 0, &width);
+                calculateTTFGlyphWidth(hdc, glyph, width);
                 designAdvances[glyph] = QFixed(width) / designToDevice;
             }
             glyphs->advances_x[i] = designAdvances[glyph];
@@ -517,8 +458,8 @@ void QFontEngineWin::recalcAdvances(QGlyphLayout *glyphs, QTextEngine::ShaperFla
                     SIZE size = {0, 0};
                     GetTextExtentPoint32(hdc, (wchar_t *)ch, chrLen, &size);
                     width = size.cx;
-                } else if (ptrGetCharWidthI) {
-                    ptrGetCharWidthI(hdc, glyph, 1, 0, &width);
+                } else {
+                    calculateTTFGlyphWidth(hdc, glyph, width);
                 }
                 glyphs->advances_x[i] = width;
                 // if glyph's within cache range, store it for later
diff --git a/src/gui/widgets/qmenu.cpp b/src/gui/widgets/qmenu.cpp
index 687e1bc3b4..ea259012c1 100644
--- a/src/gui/widgets/qmenu.cpp
+++ b/src/gui/widgets/qmenu.cpp
@@ -180,6 +180,21 @@ int QMenuPrivate::scrollerHeight() const
 }
 
 //Windows and KDE allows menus to cover the taskbar, while GNOME and Mac don't
+QRect QMenuPrivate::popupGeometry(const QWidget *widget) const
+{
+#ifdef Q_WS_WIN
+    return QApplication::desktop()->screenGeometry(widget);
+#elif defined Q_WS_X11
+    if (X11->desktopEnvironment == DE_KDE)
+        return QApplication::desktop()->screenGeometry(widget);
+    else
+        return QApplication::desktop()->availableGeometry(widget);
+#else
+        return QApplication::desktop()->availableGeometry(widget);
+#endif
+}
+
+//Windows and KDE allows menus to cover the taskbar, while GNOME and Mac don't
 QRect QMenuPrivate::popupGeometry(int screen) const
 {
 #ifdef Q_WS_WIN
@@ -234,7 +249,7 @@ void QMenuPrivate::updateActionRects() const
     }
 
     int max_column_width = 0,
-        dh = popupGeometry(QApplication::desktop()->screenNumber(q)).height(),
+        dh = popupGeometry(q).height(),
         y = 0;
     QStyle *style = q->style();
     QStyleOption opt;
@@ -744,7 +759,7 @@ void QMenuPrivate::scrollMenu(QAction *action, QMenuScroller::ScrollLocation loc
     if (newScrollFlags & QMenuScroller::ScrollUp)
         newOffset -= vmargin;
 
-    QRect screen = popupGeometry(QApplication::desktop()->screenNumber(q));
+    QRect screen = popupGeometry(q);
     const int desktopFrame = q->style()->pixelMetric(QStyle::PM_MenuDesktopFrameWidth, 0, q);
     if (q->height() < screen.height()-(desktopFrame*2)-1) {
         QRect geom = q->geometry();
@@ -960,10 +975,19 @@ bool QMenuPrivate::mouseEventTaken(QMouseEvent *e)
     return false;
 }
 
+class ExceptionGuard
+{
+public:
+    inline ExceptionGuard(bool *w = 0) : watched(w) { Q_ASSERT(!(*watched)); *watched = true; }
+    inline ~ExceptionGuard() { *watched = false; }
+    inline operator bool() { return *watched; }
+private:
+    bool *watched;
+};
+
 void QMenuPrivate::activateCausedStack(const QList<QPointer<QWidget> > &causedStack, QAction *action, QAction::ActionEvent action_e, bool self)
 {
-    Q_ASSERT(!activationRecursionGuard);
-    activationRecursionGuard = true;
+    ExceptionGuard guard(&activationRecursionGuard);
 #ifdef QT3_SUPPORT
     const int actionId = q_func()->findIdForAction(action);
 #endif
@@ -1008,7 +1032,6 @@ void QMenuPrivate::activateCausedStack(const QList<QPointer<QWidget> > &causedSt
 #endif
         }
     }
-    activationRecursionGuard = false;
 }
 
 void QMenuPrivate::activateAction(QAction *action, QAction::ActionEvent action_e, bool self)
@@ -1789,7 +1812,15 @@ void QMenu::popup(const QPoint &p, QAction *atAction)
     d->updateActionRects();
     QPoint pos = p;
     QSize size = sizeHint();
-    QRect screen = d->popupGeometry(QApplication::desktop()->screenNumber(p));
+    QRect screen;
+#ifndef QT_NO_GRAPHICSVIEW
+    bool isEmbedded = d->nearestGraphicsProxyWidget(this);
+    if (isEmbedded)
+        screen = d->popupGeometry(this);
+    else
+#endif
+    screen = d->popupGeometry(QApplication::desktop()->screenNumber(p));
+
     const int desktopFrame = style()->pixelMetric(QStyle::PM_MenuDesktopFrameWidth, 0, this);
     bool adjustToDesktop = !window()->testAttribute(Qt::WA_DontShowOnScreen);
 #ifdef QT_KEYPAD_NAVIGATION
@@ -2927,7 +2958,7 @@ void QMenu::internalDelayedPopup()
     QPoint pos(rightPos);
     QMenu *caused = qobject_cast<QMenu*>(d->activeMenu->d_func()->causedPopup.widget);
 
-    const QRect availGeometry(d->popupGeometry(QApplication::desktop()->screenNumber(caused)));
+    const QRect availGeometry(d->popupGeometry(caused));
     if (isRightToLeft()) {
         pos = leftPos;
         if ((caused && caused->x() < x()) || pos.x() < availGeometry.left()) {
diff --git a/src/gui/widgets/qmenu_p.h b/src/gui/widgets/qmenu_p.h
index 9c4f260896..9348f7bd53 100644
--- a/src/gui/widgets/qmenu_p.h
+++ b/src/gui/widgets/qmenu_p.h
@@ -192,11 +192,12 @@ public:
     mutable QVector<QRect> actionRects;
     mutable QWidgetList widgetItems;
     void updateActionRects() const;
-    QRect popupGeometry(int screen=-1) const;
+    QRect popupGeometry(const QWidget *widget) const;
+    QRect popupGeometry(int screen = -1) const;
     mutable uint ncols : 4; //4 bits is probably plenty
     uint collapsibleSeparators : 1;
 
-    uint activationRecursionGuard : 1;
+    bool activationRecursionGuard;
 
     //selection
     static QPointer<QMenu> mouseDown;
diff --git a/src/gui/widgets/qpushbutton.cpp b/src/gui/widgets/qpushbutton.cpp
index 1352e1b614..eb34336a53 100644
--- a/src/gui/widgets/qpushbutton.cpp
+++ b/src/gui/widgets/qpushbutton.cpp
@@ -590,7 +590,7 @@ void QPushButtonPrivate::_q_popupPressed()
     int x = globalPos.x();
     int y = globalPos.y();
     if (horizontal) {
-        if (globalPos.y() + rect.height() + menuSize.height() <= QApplication::desktop()->height()) {
+        if (globalPos.y() + rect.height() + menuSize.height() <= QApplication::desktop()->availableGeometry(q).height()) {
             y += rect.height();
         } else {
             y -= menuSize.height();
@@ -598,7 +598,7 @@ void QPushButtonPrivate::_q_popupPressed()
         if (q->layoutDirection() == Qt::RightToLeft)
             x += rect.width() - menuSize.width();
     } else {
-        if (globalPos.x() + rect.width() + menu->sizeHint().width() <= QApplication::desktop()->width())
+        if (globalPos.x() + rect.width() + menu->sizeHint().width() <= QApplication::desktop()->availableGeometry(q).width())
             x += rect.width();
         else
             x -= menuSize.width();
diff --git a/src/gui/widgets/qtextedit.cpp b/src/gui/widgets/qtextedit.cpp
index b894aa8292..f477feeddc 100644
--- a/src/gui/widgets/qtextedit.cpp
+++ b/src/gui/widgets/qtextedit.cpp
@@ -2079,8 +2079,8 @@ void QTextEdit::setReadOnly(bool ro)
     } else {
         flags = Qt::TextEditorInteraction;
     }
-    setAttribute(Qt::WA_InputMethodEnabled, shouldEnableInputMethod(this));
     d->control->setTextInteractionFlags(flags);
+    setAttribute(Qt::WA_InputMethodEnabled, shouldEnableInputMethod(this));
 }
 
 /*!
diff --git a/src/network/access/qhttp.cpp b/src/network/access/qhttp.cpp
index 69faee3177..f006fbadce 100644
--- a/src/network/access/qhttp.cpp
+++ b/src/network/access/qhttp.cpp
@@ -121,6 +121,9 @@ public:
     void _q_slotError(QAbstractSocket::SocketError);
     void _q_slotClosed();
     void _q_slotBytesWritten(qint64 numBytes);
+#ifndef QT_NO_OPENSSL
+    void _q_slotEncryptedBytesWritten(qint64 numBytes);
+#endif
     void _q_slotDoFinished();
     void _q_slotSendRequest();
     void _q_continuePost();
@@ -135,6 +138,8 @@ public:
     void closeConn();
     void setSock(QTcpSocket *sock);
 
+    void postMoreData();
+
     QTcpSocket *socket;
     int reconnectAttempts;
     bool deleteSocket;
@@ -2659,19 +2664,40 @@ void QHttpPrivate::_q_slotError(QAbstractSocket::SocketError err)
     closeConn();
 }
 
+#ifndef QT_NO_OPENSSL
+void QHttpPrivate::_q_slotEncryptedBytesWritten(qint64 written)
+{
+    Q_UNUSED(written);
+    postMoreData();
+}
+#endif
+
 void QHttpPrivate::_q_slotBytesWritten(qint64 written)
 {
     Q_Q(QHttp);
     bytesDone += written;
     emit q->dataSendProgress(bytesDone, bytesTotal);
+    postMoreData();
+}
 
+// Send the POST data
+void QHttpPrivate::postMoreData()
+{
     if (pendingPost)
         return;
 
     if (!postDevice)
         return;
 
+    // the following is backported code from Qt 4.6 QNetworkAccessManager.
+    // We also have to check the encryptedBytesToWrite() if it is an SSL socket.
+#ifndef QT_NO_OPENSSL
+    QSslSocket *sslSocket = qobject_cast<QSslSocket*>(socket);
+    // if it is really an ssl socket, check more than just bytesToWrite()
+    if ((socket->bytesToWrite() + (sslSocket ? sslSocket->encryptedBytesToWrite() : 0)) == 0) {
+#else
     if (socket->bytesToWrite() == 0) {
+#endif
         int max = qMin<qint64>(4096, postDevice->size() - postDevice->pos());
         QByteArray arr;
         arr.resize(max);
@@ -3097,6 +3123,8 @@ void QHttpPrivate::setSock(QTcpSocket *sock)
     if (qobject_cast<QSslSocket *>(socket)) {
         QObject::connect(socket, SIGNAL(sslErrors(const QList<QSslError> &)),
                          q, SIGNAL(sslErrors(const QList<QSslError> &)));
+        QObject::connect(socket, SIGNAL(encryptedBytesWritten(qint64)),
+                         q, SLOT(_q_slotEncryptedBytesWritten(qint64)));
     }
 #endif
 }
diff --git a/src/network/access/qhttp.h b/src/network/access/qhttp.h
index e5061ca999..f30def2263 100644
--- a/src/network/access/qhttp.h
+++ b/src/network/access/qhttp.h
@@ -290,6 +290,9 @@ private:
     Q_PRIVATE_SLOT(d_func(), void _q_slotError(QAbstractSocket::SocketError))
     Q_PRIVATE_SLOT(d_func(), void _q_slotClosed())
     Q_PRIVATE_SLOT(d_func(), void _q_slotBytesWritten(qint64 numBytes))
+#ifndef QT_NO_OPENSSL
+    Q_PRIVATE_SLOT(d_func(), void _q_slotEncryptedBytesWritten(qint64 numBytes))
+#endif
     Q_PRIVATE_SLOT(d_func(), void _q_slotDoFinished())
     Q_PRIVATE_SLOT(d_func(), void _q_slotSendRequest())
     Q_PRIVATE_SLOT(d_func(), void _q_continuePost())
diff --git a/src/network/ssl/qsslsocket.cpp b/src/network/ssl/qsslsocket.cpp
index ad766c1d03..2c881303de 100644
--- a/src/network/ssl/qsslsocket.cpp
+++ b/src/network/ssl/qsslsocket.cpp
@@ -1740,6 +1740,11 @@ qint64 QSslSocket::readData(char *data, qint64 maxlen)
 #ifdef QSSLSOCKET_DEBUG
     qDebug() << "QSslSocket::readData(" << (void *)data << ',' << maxlen << ") ==" << readBytes;
 #endif
+
+    // possibly trigger another transmit() to decrypt more data from the socket
+    if (d->readBuffer.isEmpty() && d->plainSocket->bytesAvailable())
+        QMetaObject::invokeMethod(this, "_q_flushReadBuffer", Qt::QueuedConnection);
+
     return readBytes;
 }
 
@@ -2134,6 +2139,16 @@ void QSslSocketPrivate::_q_flushWriteBuffer()
         q->flush();
 }
 
+/*!
+    \internal
+*/
+void QSslSocketPrivate::_q_flushReadBuffer()
+{
+    // trigger a read from the plainSocket into SSL
+    if (mode != QSslSocket::UnencryptedMode)
+        transmit();
+}
+
 QT_END_NAMESPACE
 
 // For private slots
diff --git a/src/network/ssl/qsslsocket.h b/src/network/ssl/qsslsocket.h
index adb206c4eb..82cda357e2 100644
--- a/src/network/ssl/qsslsocket.h
+++ b/src/network/ssl/qsslsocket.h
@@ -207,6 +207,7 @@ private:
     Q_PRIVATE_SLOT(d_func(), void _q_readyReadSlot())
     Q_PRIVATE_SLOT(d_func(), void _q_bytesWrittenSlot(qint64))
     Q_PRIVATE_SLOT(d_func(), void _q_flushWriteBuffer())
+    Q_PRIVATE_SLOT(d_func(), void _q_flushReadBuffer())
     friend class QSslSocketBackendPrivate;
 };
 
diff --git a/src/network/ssl/qsslsocket_p.h b/src/network/ssl/qsslsocket_p.h
index 24d4ebe187..ee21956fb9 100644
--- a/src/network/ssl/qsslsocket_p.h
+++ b/src/network/ssl/qsslsocket_p.h
@@ -120,6 +120,7 @@ public:
     void _q_readyReadSlot();
     void _q_bytesWrittenSlot(qint64);
     void _q_flushWriteBuffer();
+    void _q_flushReadBuffer();
 
     // Platform specific functions
     virtual void startClientEncryption() = 0;
diff --git a/src/opengl/gl2paintengineex/qpaintengineex_opengl2.cpp b/src/opengl/gl2paintengineex/qpaintengineex_opengl2.cpp
index 13efbda653..bcc6bdb08d 100644
--- a/src/opengl/gl2paintengineex/qpaintengineex_opengl2.cpp
+++ b/src/opengl/gl2paintengineex/qpaintengineex_opengl2.cpp
@@ -81,6 +81,8 @@
 #include "qglengineshadermanager_p.h"
 #include "qgl2pexvertexarray_p.h"
 
+#include "qtriangulatingstroker_p.h"
+
 #include <QDebug>
 
 QT_BEGIN_NAMESPACE
@@ -572,7 +574,6 @@ void QGL2PaintEngineExPrivate::updateMatrix()
     //
     // We expand out the multiplication to save the cost of a full 4x4
     // matrix multiplication as most of the components are trivial.
-
     const QTransform& transform = q->state()->matrix;
 
     if (mode == TextDrawingMode) {
@@ -628,6 +629,9 @@ void QGL2PaintEngineExPrivate::updateMatrix()
     // The actual data has been updated so both shader program's uniforms need updating
     simpleShaderMatrixUniformDirty = true;
     shaderMatrixUniformDirty = true;
+
+    dasher.setInvScale(inverseScale);
+    stroker.setInvScale(inverseScale);
 }
 
 
@@ -838,28 +842,6 @@ void QGL2PaintEngineExPrivate::transferMode(EngineMode newMode)
     mode = newMode;
 }
 
-void QGL2PaintEngineExPrivate::drawOutline(const QVectorPath& path)
-{
-    transferMode(BrushDrawingMode);
-
-    // Might need to call updateMatrix to re-calculate inverseScale
-    if (matrixDirty)
-        updateMatrix();
-
-    vertexCoordinateArray.clear();
-    vertexCoordinateArray.addPath(path, inverseScale);
-
-    if (path.hasImplicitClose()) {
-        // Close the path's outline
-        vertexCoordinateArray.lineToArray(path.points()[0], path.points()[1]);
-        vertexCoordinateArray.stops().last() += 1;
-    }
-
-    prepareForDraw(currentBrush->isOpaque());
-    drawVertexArrays(vertexCoordinateArray, GL_LINE_STRIP);
-}
-
-
 // Assumes everything is configured for the brush you want to use
 void QGL2PaintEngineExPrivate::fill(const QVectorPath& path)
 {
@@ -922,8 +904,14 @@ void QGL2PaintEngineExPrivate::fill(const QVectorPath& path)
 }
 
 
-void QGL2PaintEngineExPrivate::fillStencilWithVertexArray(QGL2PEXVertexArray& vertexArray, bool useWindingFill)
+void QGL2PaintEngineExPrivate::fillStencilWithVertexArray(const float *data,
+                                                          int count,
+                                                          const QVector<int> *stops,
+                                                          const QGLRect &bounds,
+                                                          StencilFillMode mode)
 {
+    Q_ASSERT(count || stops);
+
 //     qDebug("QGL2PaintEngineExPrivate::fillStencilWithVertexArray()");
     glStencilMask(0xff); // Enable stencil writes
 
@@ -955,19 +943,20 @@ void QGL2PaintEngineExPrivate::fillStencilWithVertexArray(QGL2PEXVertexArray& ve
     }
 #endif
 
-    if (useWindingFill) {
+    if (mode == WindingFillMode) {
+        Q_ASSERT(stops && !count);
         if (q->state()->clipTestEnabled) {
             // Flatten clip values higher than current clip, and set high bit to match current clip
             glStencilFunc(GL_LEQUAL, GL_STENCIL_HIGH_BIT | q->state()->currentClip, ~GL_STENCIL_HIGH_BIT);
             glStencilOp(GL_KEEP, GL_REPLACE, GL_REPLACE);
-            composite(vertexArray.boundingRect());
+            composite(bounds);
 
             glStencilFunc(GL_EQUAL, GL_STENCIL_HIGH_BIT, GL_STENCIL_HIGH_BIT);
         } else if (!stencilClean) {
             // Clear stencil buffer within bounding rect
             glStencilFunc(GL_ALWAYS, 0, 0xff);
             glStencilOp(GL_ZERO, GL_ZERO, GL_ZERO);
-            composite(vertexArray.boundingRect());
+            composite(bounds);
         }
 
         // Inc. for front-facing triangle
@@ -975,19 +964,43 @@ void QGL2PaintEngineExPrivate::fillStencilWithVertexArray(QGL2PEXVertexArray& ve
         // Dec. for back-facing "holes"
         glStencilOpSeparate(GL_BACK, GL_KEEP, GL_DECR_WRAP, GL_DECR_WRAP);
         glStencilMask(~GL_STENCIL_HIGH_BIT);
-        drawVertexArrays(vertexArray, GL_TRIANGLE_FAN);
+        drawVertexArrays(data, stops, GL_TRIANGLE_FAN);
 
         if (q->state()->clipTestEnabled) {
             // Clear high bit of stencil outside of path
             glStencilFunc(GL_EQUAL, q->state()->currentClip, ~GL_STENCIL_HIGH_BIT);
             glStencilOp(GL_KEEP, GL_REPLACE, GL_REPLACE);
             glStencilMask(GL_STENCIL_HIGH_BIT);
-            composite(vertexArray.boundingRect());
+            composite(bounds);
         }
-    } else {
+    } else if (mode == OddEvenFillMode) {
+        glStencilMask(GL_STENCIL_HIGH_BIT);
+        glStencilOp(GL_KEEP, GL_KEEP, GL_INVERT); // Simply invert the stencil bit
+        drawVertexArrays(data, stops, GL_TRIANGLE_FAN);
+
+    } else { // TriStripStrokeFillMode
+        Q_ASSERT(count && !stops); // tristrips generated directly, so no vertexArray or stops
         glStencilMask(GL_STENCIL_HIGH_BIT);
+#if 0
         glStencilOp(GL_KEEP, GL_KEEP, GL_INVERT); // Simply invert the stencil bit
-        drawVertexArrays(vertexArray, GL_TRIANGLE_FAN);
+        glEnableVertexAttribArray(QT_VERTEX_COORDS_ATTR);
+        glVertexAttribPointer(QT_VERTEX_COORDS_ATTR, 2, GL_FLOAT, GL_FALSE, 0, data);
+        glDrawArrays(GL_TRIANGLE_STRIP, 0, count);
+        glDisableVertexAttribArray(QT_VERTEX_COORDS_ATTR);
+#else
+
+        glStencilOp(GL_KEEP, GL_KEEP, GL_REPLACE);
+        if (q->state()->clipTestEnabled) {
+            glStencilFunc(GL_LEQUAL, q->state()->currentClip | GL_STENCIL_HIGH_BIT,
+                          ~GL_STENCIL_HIGH_BIT);
+        } else {
+            glStencilFunc(GL_ALWAYS, GL_STENCIL_HIGH_BIT, 0xff);
+        }
+        glEnableVertexAttribArray(QT_VERTEX_COORDS_ATTR);
+        glVertexAttribPointer(QT_VERTEX_COORDS_ATTR, 2, GL_FLOAT, GL_FALSE, 0, data);
+        glDrawArrays(GL_TRIANGLE_STRIP, 0, count);
+        glDisableVertexAttribArray(QT_VERTEX_COORDS_ATTR);
+#endif
     }
 
     // Enable color writes & disable stencil writes
@@ -1122,14 +1135,15 @@ void QGL2PaintEngineExPrivate::composite(const QGLRect& boundingRect)
 }
 
 // Draws the vertex array as a set of <vertexArrayStops.size()> triangle fans.
-void QGL2PaintEngineExPrivate::drawVertexArrays(QGL2PEXVertexArray& vertexArray, GLenum primitive)
+void QGL2PaintEngineExPrivate::drawVertexArrays(const float *data, const QVector<int> *stops,
+                                                GLenum primitive)
 {
     // Now setup the pointer to the vertex array:
     glEnableVertexAttribArray(QT_VERTEX_COORDS_ATTR);
-    glVertexAttribPointer(QT_VERTEX_COORDS_ATTR, 2, GL_FLOAT, GL_FALSE, 0, vertexArray.data());
+    glVertexAttribPointer(QT_VERTEX_COORDS_ATTR, 2, GL_FLOAT, GL_FALSE, 0, data);
 
     int previousStop = 0;
-    foreach(int stop, vertexArray.stops()) {
+    foreach(int stop, *stops) {
 /*
         qDebug("Drawing triangle fan for vertecies %d -> %d:", previousStop, stop-1);
         for (int i=previousStop; i<stop; ++i)
@@ -1180,12 +1194,29 @@ void QGL2PaintEngineEx::fill(const QVectorPath &path, const QBrush &brush)
 {
     Q_D(QGL2PaintEngineEx);
 
-    if (qbrush_style(brush) == Qt::NoBrush)
+    Qt::BrushStyle style = qbrush_style(brush);
+    if (style == Qt::NoBrush)
         return;
     if (!d->inRenderText)
         ensureActive();
+
+    QOpenGL2PaintEngineState *s = state();
+    bool doOffset = !(s->renderHints & QPainter::Antialiasing) && style == Qt::SolidPattern;
+
+    if (doOffset) {
+        d->temporaryTransform = s->matrix;
+        QTransform tx = QTransform::fromTranslate(.49, .49);
+        s->matrix = s->matrix * tx;
+        d->matrixDirty = true;
+    }
+
     d->setBrush(&brush);
     d->fill(path);
+
+    if (doOffset) {
+        s->matrix = d->temporaryTransform;
+        d->matrixDirty = true;
+    }
 }
 
 void QGL2PaintEngineEx::stroke(const QVectorPath &path, const QPen &pen)
@@ -1197,23 +1228,89 @@ void QGL2PaintEngineEx::stroke(const QVectorPath &path, const QPen &pen)
     if (penStyle == Qt::NoPen || qbrush_style(penBrush) == Qt::NoBrush)
         return;
 
+    QOpenGL2PaintEngineState *s = state();
+
     ensureActive();
 
-    qreal penWidth = qpen_widthf(pen);
-    if ( (pen.isCosmetic() && (penStyle == Qt::SolidLine)) && (penWidth < 2.5f) )
-    {
-        // We only handle solid, cosmetic pens with a width of 1 pixel
-        const QBrush& brush = pen.brush();
-        d->setBrush(&brush);
+    bool doOffset = !(s->renderHints & QPainter::Antialiasing);
+    if (doOffset) {
+        d->temporaryTransform = s->matrix;
+        QTransform tx = QTransform::fromTranslate(0.49, .49);
+        s->matrix = s->matrix * tx;
+        d->matrixDirty = true;
+    }
 
-        if (penWidth < 0.01f)
-            glLineWidth(1.0);
-        else
-            glLineWidth(penWidth);
+    bool opaque = penBrush.isOpaque() && s->opacity > 0.99;
+    d->setBrush(&penBrush);
+    d->transferMode(BrushDrawingMode);
+
+    // updateMatrix() is responsible for setting the inverse scale on
+    // the strokers, so we need to call it here and not wait for
+    // prepareForDraw() down below.
+    d->updateMatrix();
+
+    if (penStyle == Qt::SolidLine) {
+        d->stroker.process(path, pen);
+
+    } else { // Some sort of dash
+        d->dasher.process(path, pen);
+
+        QVectorPath dashStroke(d->dasher.points(),
+                               d->dasher.elementCount(),
+                               d->dasher.elementTypes());
+        d->stroker.process(dashStroke, pen);
+    }
+
+
+    QGLContext *ctx = d->ctx;
+
+    if (opaque) {
+        d->prepareForDraw(opaque);
+        glEnableVertexAttribArray(QT_VERTEX_COORDS_ATTR);
+        glVertexAttribPointer(QT_VERTEX_COORDS_ATTR, 2, GL_FLOAT, false, 0, d->stroker.vertices());
+        glDrawArrays(GL_TRIANGLE_STRIP, 0, d->stroker.vertexCount() / 2);
+
+//         QBrush b(Qt::green);
+//         d->setBrush(&b);
+//         d->prepareForDraw(true);
+//         glDrawArrays(GL_LINE_STRIP, 0, d->stroker.vertexCount() / 2);
 
-        d->drawOutline(path);
-    } else
-        return QPaintEngineEx::stroke(path, pen);
+        glDisableVertexAttribArray(QT_VERTEX_COORDS_ATTR);
+
+    } else {
+        qreal width = qpen_widthf(pen) / 2;
+        if (width == 0)
+            width = 0.5;
+        qreal extra = pen.joinStyle() == Qt::MiterJoin
+                      ? qMax(pen.miterLimit() * width, width)
+                      : width;
+
+        if (pen.isCosmetic())
+            extra = extra * d->inverseScale;
+
+        QRectF bounds = path.controlPointRect().adjusted(-extra, -extra, extra, extra);
+
+        d->fillStencilWithVertexArray(d->stroker.vertices(), d->stroker.vertexCount() / 2,
+                                      0, bounds, QGL2PaintEngineExPrivate::TriStripStrokeFillMode);
+
+        glStencilOp(GL_KEEP, GL_REPLACE, GL_REPLACE);
+
+        // Pass when any bit is set, replace stencil value with 0
+        glStencilFunc(GL_NOTEQUAL, 0, GL_STENCIL_HIGH_BIT);
+        d->prepareForDraw(false);
+
+        // Stencil the brush onto the dest buffer
+        d->composite(bounds);
+
+        glStencilMask(0);
+
+        d->updateClipScissorTest();
+    }
+
+    if (doOffset) {
+        s->matrix = d->temporaryTransform;
+        d->matrixDirty = true;
+    }
 }
 
 void QGL2PaintEngineEx::penChanged() { }
@@ -1542,7 +1639,7 @@ void QGL2PaintEngineEx::drawPixmaps(const QDrawPixmaps::Data *drawingData, int d
             s = qFastSin(drawingData[i].rotation * Q_PI / 180);
             c = qFastCos(drawingData[i].rotation * Q_PI / 180);
         }
-        
+
         qreal right = 0.5 * drawingData[i].scaleX * drawingData[i].source.width();
         qreal bottom = 0.5 * drawingData[i].scaleY * drawingData[i].source.height();
         QGLPoint bottomRight(right * c - bottom * s, right * s + bottom * c);
diff --git a/src/opengl/gl2paintengineex/qpaintengineex_opengl2_p.h b/src/opengl/gl2paintengineex/qpaintengineex_opengl2_p.h
index 5704a04ac0..209cd36b79 100644
--- a/src/opengl/gl2paintengineex/qpaintengineex_opengl2_p.h
+++ b/src/opengl/gl2paintengineex/qpaintengineex_opengl2_p.h
@@ -62,6 +62,7 @@
 #include <private/qglpixmapfilter_p.h>
 #include <private/qfontengine_p.h>
 #include <private/qdatabuffer_p.h>
+#include <private/qtriangulatingstroker_p.h>
 
 enum EngineMode {
     ImageDrawingMode,
@@ -160,6 +161,12 @@ class QGL2PaintEngineExPrivate : public QPaintEngineExPrivate
 {
     Q_DECLARE_PUBLIC(QGL2PaintEngineEx)
 public:
+    enum StencilFillMode {
+        OddEvenFillMode,
+        WindingFillMode,
+        TriStripStrokeFillMode
+    };
+
     QGL2PaintEngineExPrivate(QGL2PaintEngineEx *q_ptr) :
             q(q_ptr),
             width(0), height(0),
@@ -185,15 +192,24 @@ public:
 
     // fill, drawOutline, drawTexture & drawCachedGlyphs are the rendering entry points:
     void fill(const QVectorPath &path);
-    void drawOutline(const QVectorPath& path);
     void drawTexture(const QGLRect& dest, const QGLRect& src, const QSize &textureSize, bool opaque, bool pattern = false);
     void drawCachedGlyphs(const QPointF &p, QFontEngineGlyphCache::Type glyphType, const QTextItemInt &ti);
 
-    void drawVertexArrays(QGL2PEXVertexArray& vertexArray, GLenum primitive);
+    void drawVertexArrays(const float *data, const QVector<int> *stops, GLenum primitive);
+    void drawVertexArrays(QGL2PEXVertexArray &vertexArray, GLenum primitive) {
+        drawVertexArrays((const float *) vertexArray.data(), &vertexArray.stops(), primitive);
+    }
+
         // ^ draws whatever is in the vertex array
     void composite(const QGLRect& boundingRect);
         // ^ Composites the bounding rect onto dest buffer
-    void fillStencilWithVertexArray(QGL2PEXVertexArray& vertexArray, bool useWindingFill);
+
+    void fillStencilWithVertexArray(const float *data, int count, const QVector<int> *stops, const QGLRect &bounds, StencilFillMode mode);
+    void fillStencilWithVertexArray(QGL2PEXVertexArray& vertexArray, bool useWindingFill) {
+        fillStencilWithVertexArray((const float *) vertexArray.data(), 0, &vertexArray.stops(),
+                                   vertexArray.boundingRect(),
+                                   useWindingFill ? WindingFillMode : OddEvenFillMode);
+    }
         // ^ Calls drawVertexArrays to render into stencil buffer
 
     bool prepareForDraw(bool srcPixelsAreOpaque);
@@ -266,6 +282,10 @@ public:
 
     float textureInvertedY;
 
+    QTriangulatingStroker stroker;
+    QDashedStrokeProcessor dasher;
+    QTransform temporaryTransform;
+
     QScopedPointer<QPixmapFilter> convolutionFilter;
     QScopedPointer<QPixmapFilter> colorizeFilter;
     QScopedPointer<QPixmapFilter> blurFilter;
diff --git a/src/opengl/gl2paintengineex/qtriangulatingstroker.cpp b/src/opengl/gl2paintengineex/qtriangulatingstroker.cpp
new file mode 100644
index 0000000000..250dab6d3e
--- /dev/null
+++ b/src/opengl/gl2paintengineex/qtriangulatingstroker.cpp
@@ -0,0 +1,299 @@
+#include "qtriangulatingstroker_p.h"
+#include <qmath.h>
+
+
+#define CURVE_FLATNESS Q_PI / 8
+
+
+
+
+void QTriangulatingStroker::endCapOrJoinClosed(const qreal *start, const qreal *cur,
+                                               bool implicitClose, bool endsAtStart)
+{
+    if (endsAtStart) {
+        join(start + 2);
+    } else if (implicitClose) {
+        join(start);
+        lineTo(start);
+        join(start+2);
+    } else {
+        endCap(cur);
+    }
+}
+
+
+void QTriangulatingStroker::process(const QVectorPath &path, const QPen &pen)
+{
+    const qreal *pts = path.points();
+    const QPainterPath::ElementType *types = path.elements();
+    int count = path.elementCount();
+    if (count < 2)
+        return;
+
+    float realWidth = qpen_widthf(pen);
+    if (realWidth == 0)
+        realWidth = 1;
+
+    m_width = realWidth / 2;
+
+    bool cosmetic = pen.isCosmetic();
+    if (cosmetic) {
+        m_width = m_width * m_inv_scale;
+    }
+
+    m_join_style = qpen_joinStyle(pen);
+    m_cap_style = qpen_capStyle(pen);
+    m_vertices.reset();
+    m_miter_limit = pen.miterLimit() * qpen_widthf(pen);
+
+    // The curvyness is based on the notion that I originally wanted
+    // roughly one line segment pr 4 pixels. This may seem little, but
+    // because we sample at constantly incrementing B(t) E [0<t<1], we
+    // will get longer segments where the curvature is small and smaller
+    // segments when the curvature is high.
+    //
+    // To get a rough idea of the length of each curve, I pretend that
+    // the curve is a 90 degree arc, whose radius is
+    // qMax(curveBounds.width, curveBounds.height). Based on this
+    // logic we can estimate the length of the outline edges based on
+    // the radius + a pen width and adjusting for scale factors
+    // depending on if the pen is cosmetic or not.
+    //
+    // The curvyness value of PI/14 was based on,
+    // arcLength=2*PI*r/4=PI/2 and splitting length into somewhere
+    // between 3 and 8 where 5 seemed to be give pretty good results
+    // hence: Q_PI/14. Lower divisors will give more detail at the
+    // direct cost of performance.
+
+    // simplfy pens that are thin in device size (2px wide or less)
+    if (realWidth < 2.5 && (cosmetic || m_inv_scale == 1)) {
+        if (m_cap_style == Qt::RoundCap)
+            m_cap_style = Qt::SquareCap;
+        if (m_join_style == Qt::RoundJoin)
+            m_join_style = Qt::MiterJoin;
+        m_curvyness_add = 0.5;
+        m_curvyness_mul = CURVE_FLATNESS;
+        m_roundness = 1;
+    } else if (cosmetic) {
+        m_curvyness_add = realWidth / 2;
+        m_curvyness_mul = CURVE_FLATNESS;
+        m_roundness = qMax<int>(4, realWidth * CURVE_FLATNESS);
+    } else {
+        m_curvyness_add = m_width;
+        m_curvyness_mul = CURVE_FLATNESS / m_inv_scale;
+        m_roundness = qMax<int>(4, realWidth * m_curvyness_mul);
+    }
+
+    // Over this level of segmentation, there doesn't seem to be any
+    // benefit, even for huge penWidth
+    if (m_roundness > 24)
+        m_roundness = 24;
+
+    m_sin_theta = qSin(Q_PI / m_roundness); // ### Use qFastSin
+    m_cos_theta = qCos(Q_PI / m_roundness);
+
+    const qreal *endPts = pts + (count<<1);
+    const qreal *startPts;
+
+    Qt::PenCapStyle cap = m_cap_style;
+
+    if (!types) {
+        startPts = pts;
+
+        bool endsAtStart = startPts[0] == *(endPts-2) && startPts[1] == *(endPts-1);
+
+        Qt::PenCapStyle cap = m_cap_style;
+        if (endsAtStart || path.hasImplicitClose())
+            m_cap_style = Qt::FlatCap;
+        moveTo(pts);
+        m_cap_style = cap;
+        pts += 2;
+        lineTo(pts);
+        pts += 2;
+        while (pts < endPts) {
+            join(pts);
+            lineTo(pts);
+            pts += 2;
+        }
+
+        endCapOrJoinClosed(startPts, pts-2, path.hasImplicitClose(), endsAtStart);
+
+    } else {
+        bool endsAtStart;
+        while (pts < endPts) {
+            switch (*types) {
+            case QPainterPath::MoveToElement: {
+                if (pts != path.points())
+                    endCapOrJoinClosed(startPts, pts, path.hasImplicitClose(), endsAtStart);
+
+                startPts = pts;
+                int end = (endPts - pts) / 2;
+                int i = 2; // Start looking to ahead since we never have two moveto's in a row
+                while (i<end && types[i] != QPainterPath::MoveToElement) {
+                    ++i;
+                }
+                endsAtStart = startPts[0] == pts[i*2 - 2] && startPts[1] == pts[i*2 - 1];
+                if (endsAtStart || path.hasImplicitClose())
+                    m_cap_style = Qt::FlatCap;
+
+                moveTo(pts);
+                m_cap_style = cap;
+                pts+=2;
+                ++types;
+                break; }
+            case QPainterPath::LineToElement:
+                if (*(types - 1) != QPainterPath::MoveToElement)
+                    join(pts);
+                lineTo(pts);
+                pts+=2;
+                ++types;
+                break;
+            case QPainterPath::CurveToElement:
+                if (*(types - 1) != QPainterPath::MoveToElement)
+                    join(pts);
+                cubicTo(pts);
+                pts+=6;
+                types+=3;
+                break;
+            default:
+                Q_ASSERT(false);
+                break;
+            }
+        }
+
+        endCapOrJoinClosed(startPts, pts-2, path.hasImplicitClose(), endsAtStart);
+    }
+}
+
+void QTriangulatingStroker::cubicTo(const qreal *pts)
+{
+    const QPointF *p = (const QPointF *) pts;
+    QBezier bezier = QBezier::fromPoints(*(p - 1), p[0], p[1], p[2]);
+
+    QRectF bounds = bezier.bounds();
+    float rad = qMax(bounds.width(), bounds.height());
+    int threshold = qMin<float>(64, (rad + m_curvyness_add) * m_curvyness_mul);
+    if (threshold < 4)
+        threshold = 4;
+    qreal threshold_minus_1 = threshold - 1;
+    float vx, vy;
+
+    float cx = m_cx, cy = m_cy;
+    float x, y;
+
+    for (int i=1; i<threshold; ++i) {
+        qreal t = qreal(i) / threshold_minus_1;
+        QPointF p = bezier.pointAt(t);
+        x = p.x();
+        y = p.y();
+
+        normalVector(cx, cy, x, y, &vx, &vy);
+
+        emitLineSegment(x, y, vx, vy);
+
+        cx = x;
+        cy = y;
+    }
+
+    m_cx = cx;
+    m_cy = cy;
+
+    m_nvx = vx;
+    m_nvy = vy;
+}
+
+
+
+static void qdashprocessor_moveTo(qreal x, qreal y, void *data)
+{
+    ((QDashedStrokeProcessor *) data)->addElement(QPainterPath::MoveToElement, x, y);
+}
+
+static void qdashprocessor_lineTo(qreal x, qreal y, void *data)
+{
+    ((QDashedStrokeProcessor *) data)->addElement(QPainterPath::LineToElement, x, y);
+}
+
+static void qdashprocessor_cubicTo(qreal, qreal, qreal, qreal, qreal, qreal, void *)
+{
+    Q_ASSERT(0); // The dasher should not produce curves...
+}
+
+QDashedStrokeProcessor::QDashedStrokeProcessor()
+    : m_dash_stroker(0), m_inv_scale(1)
+{
+    m_dash_stroker.setMoveToHook(qdashprocessor_moveTo);
+    m_dash_stroker.setLineToHook(qdashprocessor_lineTo);
+    m_dash_stroker.setCubicToHook(qdashprocessor_cubicTo);
+}
+
+void QDashedStrokeProcessor::process(const QVectorPath &path, const QPen &pen)
+{
+
+    const qreal *pts = path.points();
+    const QPainterPath::ElementType *types = path.elements();
+    int count = path.elementCount();
+
+    m_points.reset();
+    m_types.reset();
+
+    qreal width = pen.width();
+    if (width == 0)
+        width = 1;
+
+    m_dash_stroker.setDashPattern(pen.dashPattern());
+    m_dash_stroker.setStrokeWidth(width);
+    m_dash_stroker.setMiterLimit(pen.miterLimit());
+    qreal curvyness = sqrt(width) * m_inv_scale / 8;
+
+    if (count < 2)
+        return;
+
+    const qreal *endPts = pts + (count<<1);
+
+    m_dash_stroker.begin(this);
+
+    if (!types) {
+        m_dash_stroker.moveTo(pts[0], pts[1]);
+        pts += 2;
+        while (pts < endPts) {
+            m_dash_stroker.lineTo(pts[0], pts[1]);
+            pts += 2;
+        }
+    } else {
+        while (pts < endPts) {
+            switch (*types) {
+            case QPainterPath::MoveToElement:
+                m_dash_stroker.moveTo(pts[0], pts[1]);
+                pts += 2;
+                ++types;
+                break;
+            case QPainterPath::LineToElement:
+                m_dash_stroker.lineTo(pts[0], pts[1]);
+                pts += 2;
+                ++types;
+                break;
+            case QPainterPath::CurveToElement: {
+                QBezier b = QBezier::fromPoints(*(((const QPointF *) pts) - 1),
+                                                *(((const QPointF *) pts)),
+                                                *(((const QPointF *) pts) + 1),
+                                                *(((const QPointF *) pts) + 2));
+                QRectF bounds = b.bounds();
+                int threshold = qMin<float>(64, qMax(bounds.width(), bounds.height()) * curvyness);
+                if (threshold < 4)
+                    threshold = 4;
+                qreal threshold_minus_1 = threshold - 1;
+                for (int i=0; i<threshold; ++i) {
+                    QPointF pt = b.pointAt(i / threshold_minus_1);
+                    m_dash_stroker.lineTo(pt.x(), pt.y());
+                }
+                pts += 6;
+                types += 3;
+                break; }
+            default: break;
+            }
+        }
+    }
+
+    m_dash_stroker.end();
+}
diff --git a/src/opengl/gl2paintengineex/qtriangulatingstroker_p.h b/src/opengl/gl2paintengineex/qtriangulatingstroker_p.h
new file mode 100644
index 0000000000..a28fc45c5e
--- /dev/null
+++ b/src/opengl/gl2paintengineex/qtriangulatingstroker_p.h
@@ -0,0 +1,258 @@
+#ifndef QTRIANGULATINGSTROKER_P_H
+#define QTRIANGULATINGSTROKER_P_H
+
+#include <private/qdatabuffer_p.h>
+#include <private/qvectorpath_p.h>
+#include <private/qbezier_p.h>
+#include <private/qnumeric_p.h>
+#include <private/qmath_p.h>
+
+
+class QTriangulatingStroker
+{
+public:
+    void process(const QVectorPath &path, const QPen &pen);
+
+    inline int vertexCount() const { return m_vertices.size(); }
+    inline const float *vertices() const { return m_vertices.data(); }
+
+    inline void setInvScale(qreal invScale) { m_inv_scale = invScale; }
+
+private:
+    inline void emitLineSegment(float x, float y, float nx, float ny);
+    inline void moveTo(const qreal *pts);
+    inline void lineTo(const qreal *pts);
+    void cubicTo(const qreal *pts);
+    inline void join(const qreal *pts);
+    inline void normalVector(float x1, float y1, float x2, float y2, float *nx, float *ny);
+    inline void endCap(const qreal *pts);
+    inline void arc(float x, float y);
+    void endCapOrJoinClosed(const qreal *start, const qreal *cur, bool implicitClose, bool endsAtStart);
+
+
+    QDataBuffer<float> m_vertices;
+
+    float m_cx, m_cy;           // current points
+    float m_nvx, m_nvy;         // normal vector...
+    float m_width;
+    qreal m_miter_limit;
+
+    int m_roundness;            // Number of line segments in a round join
+    qreal m_sin_theta;          // sin(m_roundness / 360);
+    qreal m_cos_theta;          // cos(m_roundness / 360);
+    qreal m_inv_scale;
+    float m_curvyness_mul;
+    float m_curvyness_add;
+
+    Qt::PenJoinStyle m_join_style;
+    Qt::PenCapStyle m_cap_style;
+};
+
+class QDashedStrokeProcessor
+{
+public:
+    QDashedStrokeProcessor();
+
+    void process(const QVectorPath &path, const QPen &pen);
+
+    inline void addElement(QPainterPath::ElementType type, qreal x, qreal y) {
+        m_points.add(x);
+        m_points.add(y);
+        m_types.add(type);
+    }
+
+    inline int elementCount() const { return m_types.size(); }
+    inline qreal *points() const { return m_points.data(); }
+    inline QPainterPath::ElementType *elementTypes() const { return m_types.data(); }
+
+    inline void setInvScale(qreal invScale) { m_inv_scale = invScale; }
+
+private:
+    QDataBuffer<qreal> m_points;
+    QDataBuffer<QPainterPath::ElementType> m_types;
+    QDashStroker m_dash_stroker;
+    qreal m_inv_scale;
+};
+
+
+
+
+
+inline void QTriangulatingStroker::normalVector(float x1, float y1, float x2, float y2,
+                                                float *nx, float *ny)
+{
+    float dx = x2 - x1;
+    float dy = y2 - y1;
+    float pw = m_width / sqrt(dx*dx + dy*dy);
+    *nx = -dy * pw;
+    *ny = dx * pw;
+}
+
+
+
+inline void QTriangulatingStroker::emitLineSegment(float x, float y, float vx, float vy)
+{
+    m_vertices.add(x + vx);
+    m_vertices.add(y + vy);
+    m_vertices.add(x - vx);
+    m_vertices.add(y - vy);
+}
+
+
+
+// We draw a full circle for any round join or round cap which is a
+// bit of overkill...
+inline void QTriangulatingStroker::arc(float x, float y)
+{
+    float dx = m_width;
+    float dy = 0;
+    for (int i=0; i<=m_roundness; ++i) {
+        float tmpx = dx * m_cos_theta - dy * m_sin_theta;
+        float tmpy = dx * m_sin_theta + dy * m_cos_theta;
+        dx = tmpx;
+        dy = tmpy;
+        emitLineSegment(x, y, dx, dy);
+    }
+}
+
+
+
+inline void QTriangulatingStroker::endCap(const qreal *pts)
+{
+    switch (m_cap_style) {
+    case Qt::FlatCap:
+        break;
+    case Qt::SquareCap: {
+        float dx = m_cx - *(pts - 2);
+        float dy = m_cy - *(pts - 1);
+
+        float len = m_width / sqrt(dx * dx + dy * dy);
+        dx = dx * len;
+        dy = dy * len;
+
+        emitLineSegment(m_cx + dx, m_cy + dy, m_nvx, m_nvy);
+        break; }
+    case Qt::RoundCap:
+        arc(m_cx, m_cy);
+        break;
+    default: break; // to shut gcc up...
+    }
+
+    int count = m_vertices.size();
+    m_vertices.add(m_vertices.at(count-2));
+    m_vertices.add(m_vertices.at(count-1));
+}
+
+
+void QTriangulatingStroker::moveTo(const qreal *pts)
+{
+    m_cx = pts[0];
+    m_cy = pts[1];
+
+    float x2 = pts[2];
+    float y2 = pts[3];
+    normalVector(m_cx, m_cy, x2, y2, &m_nvx, &m_nvy);
+
+
+    // To acheive jumps we insert zero-area tringles. This is done by
+    // adding two identical points in both the end of previous strip
+    // and beginning of next strip
+    bool invisibleJump = m_vertices.size();
+
+    switch (m_cap_style) {
+    case Qt::FlatCap:
+        if (invisibleJump) {
+            m_vertices.add(m_cx + m_nvx);
+            m_vertices.add(m_cy + m_nvy);
+        }
+        break;
+    case Qt::SquareCap: {
+        float dx = x2 - m_cx;
+        float dy = y2 - m_cy;
+        float len = m_width / sqrt(dx * dx + dy * dy);
+        dx = dx * len;
+        dy = dy * len;
+        float sx = m_cx - dx;
+        float sy = m_cy - dy;
+        if (invisibleJump) {
+            m_vertices.add(sx + m_nvx);
+            m_vertices.add(sy + m_nvy);
+        }
+        emitLineSegment(sx, sy, m_nvx, m_nvy);
+        break; }
+    case Qt::RoundCap:
+        if (invisibleJump) {
+            m_vertices.add(m_cx + m_nvx);
+            m_vertices.add(m_cy + m_nvy);
+        }
+
+        // This emitLineSegment is not needed for the arc, but we need
+        // to start where we put the invisibleJump vertex, otherwise
+        // we'll have visible triangles between subpaths.
+        emitLineSegment(m_cx, m_cy, m_nvx, m_nvy);
+        arc(m_cx, m_cy);
+        break;
+    default: break; // ssssh gcc...
+    }
+    emitLineSegment(m_cx, m_cy, m_nvx, m_nvy);
+}
+
+
+
+void QTriangulatingStroker::lineTo(const qreal *pts)
+{
+    emitLineSegment(pts[0], pts[1], m_nvx, m_nvy);
+    m_cx = pts[0];
+    m_cy = pts[1];
+}
+
+
+
+
+
+void QTriangulatingStroker::join(const qreal *pts)
+{
+    // Creates a join to the next segment (m_cx, m_cy) -> (pts[0], pts[1])
+    normalVector(m_cx, m_cy, pts[0], pts[1], &m_nvx, &m_nvy);
+
+    switch (m_join_style) {
+    case Qt::BevelJoin:
+        break;
+    case Qt::MiterJoin: {
+        int p1 = m_vertices.size() - 6;
+        int p2 = m_vertices.size() - 2;
+        QLineF line(m_vertices.at(p1), m_vertices.at(p1+1),
+                    m_vertices.at(p2), m_vertices.at(p2+1));
+        QLineF nextLine(m_cx - m_nvx, m_cy - m_nvy,
+                        pts[0] - m_nvx, pts[1] - m_nvy);
+
+        QPointF isect;
+        if (line.intersect(nextLine, &isect) != QLineF::NoIntersection
+            && QLineF(line.p2(), isect).length() <= m_miter_limit) {
+            // The intersection point mirrored over the m_cx, m_cy point
+            m_vertices.add(m_cx - (isect.x() - m_cx));
+            m_vertices.add(m_cy - (isect.y() - m_cy));
+
+            // The intersection point
+            m_vertices.add(isect.x());
+            m_vertices.add(isect.y());
+        }
+        // else
+        // Do a plain bevel join if the miter limit is exceeded or if
+        // the lines are parallel. This is not what the raster
+        // engine's stroker does, but it is both faster and similar to
+        // what some other graphics API's do.
+
+        break; }
+    case Qt::RoundJoin:
+        arc(m_cx, m_cy);
+        break;
+
+    default: break; // gcc warn--
+    }
+
+    emitLineSegment(m_cx, m_cy, m_nvx, m_nvy);
+}
+
+
+#endif
diff --git a/src/opengl/opengl.pro b/src/opengl/opengl.pro
index e561932a02..a212675303 100644
--- a/src/opengl/opengl.pro
+++ b/src/opengl/opengl.pro
@@ -60,7 +60,8 @@ SOURCES	+= qgl.cpp \
                 gl2paintengineex/qgl2pexvertexarray_p.h \
                 gl2paintengineex/qpaintengineex_opengl2_p.h \
                 gl2paintengineex/qglengineshadersource_p.h \
-                gl2paintengineex/qglcustomshaderstage_p.h
+                gl2paintengineex/qglcustomshaderstage_p.h \
+                gl2paintengineex/qtriangulatingstroker_p.h 
 
     SOURCES +=  qglshaderprogram.cpp \
                 qglpixmapfilter.cpp \
@@ -72,7 +73,8 @@ SOURCES	+= qgl.cpp \
                 gl2paintengineex/qglengineshadermanager.cpp \
                 gl2paintengineex/qgl2pexvertexarray.cpp \
                 gl2paintengineex/qpaintengineex_opengl2.cpp \
-                gl2paintengineex/qglcustomshaderstage.cpp
+                gl2paintengineex/qglcustomshaderstage.cpp \
+                gl2paintengineex/qtriangulatingstroker.cpp
 
 }
 
@@ -80,9 +82,13 @@ x11 {
     contains(QT_CONFIG, opengles1)|contains(QT_CONFIG, opengles1cl)|contains(QT_CONFIG, opengles2) {
         SOURCES +=  qgl_x11egl.cpp \
                     qglpixelbuffer_egl.cpp \
-                    qgl_egl.cpp
+                    qgl_egl.cpp \
+                    qpixmapdata_x11gl_egl.cpp \
+                    qwindowsurface_x11gl.cpp
 
-        HEADERS +=  qgl_egl_p.h
+        HEADERS +=  qgl_egl_p.h \
+                    qpixmapdata_x11gl_p.h \
+                    qwindowsurface_x11gl_p.h
 
     } else {
         SOURCES +=  qgl_x11.cpp \
diff --git a/src/opengl/qgl.cpp b/src/opengl/qgl.cpp
index 39f04d41b4..6720ae77d1 100644
--- a/src/opengl/qgl.cpp
+++ b/src/opengl/qgl.cpp
@@ -151,22 +151,6 @@ class QGLEngineSelector
 public:
     QGLEngineSelector() : engineType(QPaintEngine::MaxUser)
     {
-#ifdef Q_WS_MAC
-        // The ATI X1600 driver for Mac OS X does not support return
-        // values from functions in GLSL. Since working around this in
-        // the GL2 engine would require a big, ugly rewrite, we're
-        // falling back to the GL 1 engine..
-        QGLWidget *tmp = 0;
-        if (!QGLContext::currentContext()) {
-            tmp = new QGLWidget();
-            tmp->makeCurrent();
-        }
-        if (strstr((char *) glGetString(GL_RENDERER), "X1600"))
-            setPreferredPaintEngine(QPaintEngine::OpenGL);
-        if (tmp)
-            delete tmp;
-#endif
-
     }
 
     void setPreferredPaintEngine(QPaintEngine::Type type) {
@@ -175,6 +159,25 @@ public:
     }
 
     QPaintEngine::Type preferredPaintEngine() {
+#ifdef Q_WS_MAC
+        // The ATI X1600 driver for Mac OS X does not support return
+        // values from functions in GLSL. Since working around this in
+        // the GL2 engine would require a big, ugly rewrite, we're
+        // falling back to the GL 1 engine..
+        static bool mac_x1600_check_done = false;
+        if (!mac_x1600_check_done) {
+            QGLWidget *tmp = 0;
+            if (!QGLContext::currentContext()) {
+                tmp = new QGLWidget();
+                tmp->makeCurrent();
+            }
+            if (strstr((char *) glGetString(GL_RENDERER), "X1600"))
+                engineType = QPaintEngine::OpenGL;
+            if (tmp)
+                delete tmp;
+            mac_x1600_check_done = true;
+        }
+#endif
         if (engineType == QPaintEngine::MaxUser) {
             // No user-set engine - use the defaults
 #if defined(QT_OPENGL_ES_2)
@@ -1584,7 +1587,10 @@ QGLTextureCache::QGLTextureCache()
     Q_ASSERT(qt_gl_texture_cache == 0);
     qt_gl_texture_cache = this;
 
-    QImagePixmapCleanupHooks::instance()->addPixmapHook(pixmapCleanupHook);
+    QImagePixmapCleanupHooks::instance()->addPixmapModificationHook(cleanupTextures);
+#ifdef Q_WS_X11
+    QImagePixmapCleanupHooks::instance()->addPixmapDestructionHook(cleanupPixmapSurfaces);
+#endif
     QImagePixmapCleanupHooks::instance()->addImageHook(imageCleanupHook);
 }
 
@@ -1592,7 +1598,10 @@ QGLTextureCache::~QGLTextureCache()
 {
     qt_gl_texture_cache = 0;
 
-    QImagePixmapCleanupHooks::instance()->removePixmapHook(pixmapCleanupHook);
+    QImagePixmapCleanupHooks::instance()->removePixmapModificationHook(cleanupTextures);
+#ifdef Q_WS_X11
+    QImagePixmapCleanupHooks::instance()->removePixmapDestructionHook(cleanupPixmapSurfaces);
+#endif
     QImagePixmapCleanupHooks::instance()->removeImageHook(imageCleanupHook);
 }
 
@@ -1660,7 +1669,7 @@ void QGLTextureCache::imageCleanupHook(qint64 cacheKey)
 }
 
 
-void QGLTextureCache::pixmapCleanupHook(QPixmap* pixmap)
+void QGLTextureCache::cleanupTextures(QPixmap* pixmap)
 {
     // ### remove when the GL texture cache becomes thread-safe
     if (qApp->thread() == QThread::currentThread()) {
@@ -1669,14 +1678,21 @@ void QGLTextureCache::pixmapCleanupHook(QPixmap* pixmap)
         if (texture && texture->options & QGLContext::MemoryManagedBindOption)
             instance()->remove(cacheKey);
     }
+}
+
 #if defined(Q_WS_X11)
+void QGLTextureCache::cleanupPixmapSurfaces(QPixmap* pixmap)
+{
+    // Remove any bound textures first:
+    cleanupTextures(pixmap);
+
     QPixmapData *pd = pixmap->data_ptr().data();
     if (pd->classId() == QPixmapData::X11Class) {
         Q_ASSERT(pd->ref == 1); // Make sure reference counting isn't broken
         QGLContextPrivate::destroyGlSurfaceForPixmap(pd);
     }
-#endif
 }
+#endif
 
 void QGLTextureCache::deleteIfEmpty()
 {
diff --git a/src/opengl/qgl.h b/src/opengl/qgl.h
index b1c1317c99..e14e7fbe56 100644
--- a/src/opengl/qgl.h
+++ b/src/opengl/qgl.h
@@ -411,6 +411,7 @@ private:
     friend class QGLFramebufferObjectPrivate;
     friend class QGLFBOGLPaintDevice;
     friend class QGLPaintDevice;
+    friend class QX11GLPixmapData;
 private:
     Q_DISABLE_COPY(QGLContext)
 };
diff --git a/src/opengl/qgl_p.h b/src/opengl/qgl_p.h
index 129e7f7c13..9a17c67367 100644
--- a/src/opengl/qgl_p.h
+++ b/src/opengl/qgl_p.h
@@ -498,7 +498,11 @@ public:
     static QGLTextureCache *instance();
     static void deleteIfEmpty();
     static void imageCleanupHook(qint64 cacheKey);
-    static void pixmapCleanupHook(QPixmap* pixmap);
+    static void cleanupTextures(QPixmap* pixmap);
+#ifdef Q_WS_X11
+    // X11 needs to catch pixmap data destruction to delete EGL/GLX pixmap surfaces
+    static void cleanupPixmapSurfaces(QPixmap* pixmap);
+#endif
 
 private:
     QCache<qint64, QGLTexture> m_cache;
diff --git a/src/opengl/qgl_x11egl.cpp b/src/opengl/qgl_x11egl.cpp
index 971a66073a..3894ed1c2d 100644
--- a/src/opengl/qgl_x11egl.cpp
+++ b/src/opengl/qgl_x11egl.cpp
@@ -513,11 +513,22 @@ bool Q_OPENGL_EXPORT qt_createEGLSurfaceForPixmap(QPixmapData* pmd, bool readOnl
                                            pixmapConfig,
                                            (EGLNativePixmapType) pixmapData->handle(),
                                            pixmapAttribs.properties());
+//    qDebug("qt_createEGLSurfaceForPixmap() created surface 0x%x for pixmap 0x%x",
+//           pixmapSurface, pixmapData->handle());
     if (pixmapSurface == EGL_NO_SURFACE) {
-        qWarning("Failed to create a pixmap surface using config %d", (int)pixmapConfig);
+        qWarning() << "Failed to create a pixmap surface using config" << (int)pixmapConfig
+                   << ":" << QEglContext::errorString(eglGetError());
         return false;
     }
 
+    static bool doneOnce = false;
+    if (!doneOnce) {
+        // Make sure QGLTextureCache is instanciated so it can install cleanup hooks
+        // which cleanup the EGL surface.
+        QGLTextureCache::instance();
+        doneOnce = true;
+    }
+
     Q_ASSERT(sizeof(Qt::HANDLE) >= sizeof(EGLSurface)); // Just to make totally sure!
     pixmapData->gl_surface = (Qt::HANDLE)pixmapSurface;
     pixmapData->is_cached = true; // Make sure the cleanup hook gets called
diff --git a/src/opengl/qglpaintdevice.cpp b/src/opengl/qglpaintdevice.cpp
index e68a4b9792..2867de58c2 100644
--- a/src/opengl/qglpaintdevice.cpp
+++ b/src/opengl/qglpaintdevice.cpp
@@ -44,6 +44,9 @@
 #include <private/qglpixelbuffer_p.h>
 #include <private/qglframebufferobject_p.h>
 #include <private/qwindowsurface_gl_p.h>
+#ifdef Q_WS_X11
+#include <private/qpixmapdata_x11gl_p.h>
+#endif
 
 #if !defined(QT_OPENGL_ES_1) && !defined(QT_OPENGL_ES_1_CL)
 #include <private/qpixmapdata_gl_p.h>
@@ -81,6 +84,7 @@ void QGLPaintDevice::beginPaint()
     // explicitly unbind.  Otherwise the painting will go into
     // the previous FBO instead of to the window.
     m_previousFBO = ctx->d_func()->current_fbo;
+
     if (m_previousFBO != m_thisFBO) {
         ctx->d_ptr->current_fbo = m_thisFBO;
         glBindFramebuffer(GL_FRAMEBUFFER_EXT, m_thisFBO);
@@ -186,8 +190,14 @@ QGLPaintDevice* QGLPaintDevice::getDevice(QPaintDevice* pd)
         case QInternal::Pixmap: {
 #if !defined(QT_OPENGL_ES_1) && !defined(QT_OPENGL_ES_1_CL)
             QPixmapData* pmd = static_cast<QPixmap*>(pd)->pixmapData();
-            Q_ASSERT(pmd->classId() == QPixmapData::OpenGLClass);
-            glpd = static_cast<QGLPixmapData*>(pmd)->glDevice();
+            if (pmd->classId() == QPixmapData::OpenGLClass)
+                glpd = static_cast<QGLPixmapData*>(pmd)->glDevice();
+#ifdef Q_WS_X11
+            else if (pmd->classId() == QPixmapData::X11Class)
+                glpd = static_cast<QX11GLPixmapData*>(pmd);
+#endif
+            else
+                qWarning("Pixmap type not supported for GL rendering");
 #else
             qWarning("Pixmap render targets not supported on OpenGL ES 1.x");
 #endif
diff --git a/src/opengl/qgraphicssystem_gl.cpp b/src/opengl/qgraphicssystem_gl.cpp
index 3e7fece15d..c0d9233f9d 100644
--- a/src/opengl/qgraphicssystem_gl.cpp
+++ b/src/opengl/qgraphicssystem_gl.cpp
@@ -47,12 +47,22 @@
 #include "private/qgl_p.h"
 #include <private/qwindowsurface_raster_p.h>
 
+#if defined(Q_WS_X11) && defined(QT_OPENGL_ES)
+#include "private/qpixmapdata_x11gl_p.h"
+#include "private/qwindowsurface_x11gl_p.h"
+#endif
+
 QT_BEGIN_NAMESPACE
 
 extern QGLWidget *qt_gl_getShareWidget();
 
 QPixmapData *QGLGraphicsSystem::createPixmapData(QPixmapData::PixelType type) const
 {
+#if defined(Q_WS_X11) && defined(QT_OPENGL_ES)
+    if (type == QPixmapData::PixmapType && QX11GLPixmapData::hasX11GLPixmaps())
+        return new QX11GLPixmapData();
+#endif
+
     return new QGLPixmapData(type);
 }
 
@@ -66,6 +76,11 @@ QWindowSurface *QGLGraphicsSystem::createWindowSurface(QWidget *widget) const
         return new QRasterWindowSurface(widget);
 #endif
 
+#if defined(Q_WS_X11) && defined(QT_OPENGL_ES)
+    if (QX11GLPixmapData::hasX11GLPixmaps())
+        return new QX11GLWindowSurface(widget);
+#endif
+
     return new QGLWindowSurface(widget);
 }
 
diff --git a/src/opengl/qpaintengine_opengl.cpp b/src/opengl/qpaintengine_opengl.cpp
index 80628a228f..aa6b6c9ac2 100644
--- a/src/opengl/qpaintengine_opengl.cpp
+++ b/src/opengl/qpaintengine_opengl.cpp
@@ -746,7 +746,6 @@ public:
     uint has_brush : 1;
     uint has_fast_pen : 1;
     uint use_stencil_method : 1;
-    uint dirty_stencil : 1;
     uint dirty_drawable_texture : 1;
     uint has_stencil_face_ext : 1;
     uint use_fragment_programs : 1;
@@ -757,6 +756,8 @@ public:
     uint use_system_clip : 1;
     uint use_emulation : 1;
 
+    QRegion dirty_stencil;
+
     void updateUseEmulation();
 
     QTransform matrix;
@@ -1259,7 +1260,9 @@ bool QOpenGLPaintEngine::begin(QPaintDevice *pdev)
     d->matrix = QTransform();
     d->has_antialiasing = false;
     d->high_quality_antialiasing = false;
-    d->dirty_stencil = true;
+
+    QSize sz(d->device->size());
+    d->dirty_stencil = QRect(0, 0, sz.width(), sz.height());
 
     d->use_emulation = false;
 
@@ -1347,7 +1350,6 @@ bool QOpenGLPaintEngine::begin(QPaintDevice *pdev)
 
     d->offscreen.begin();
 
-    QSize sz(d->device->size());
     glViewport(0, 0, sz.width(), sz.height()); // XXX (Embedded): We need a solution for GLWidgets that draw in a part or a bigger surface...
     glMatrixMode(GL_PROJECTION);
     glLoadIdentity();
@@ -1949,34 +1951,34 @@ void QOpenGLPaintEnginePrivate::fillVertexArray(Qt::FillRule fillRule)
 {
     Q_Q(QOpenGLPaintEngine);
 
-    if (dirty_stencil) {
-        disableClipping();
+    QRect rect = dirty_stencil.boundingRect();
 
-        if (use_system_clip) {
-            glEnable(GL_SCISSOR_TEST);
+    if (use_system_clip)
+        rect = q->systemClip().intersected(dirty_stencil).boundingRect();
 
-            QRect rect = q->systemClip().boundingRect();
+    glStencilMask(~0);
 
-            const int left = rect.left();
-            const int width = rect.width();
-            const int bottom = device->size().height() - (rect.bottom() + 1);
-            const int height = rect.height();
+    if (!rect.isEmpty()) {
+        disableClipping();
 
-            glScissor(left, bottom, width, height);
-        }
+        glEnable(GL_SCISSOR_TEST);
+
+        const int left = rect.left();
+        const int width = rect.width();
+        const int bottom = device->size().height() - (rect.bottom() + 1);
+        const int height = rect.height();
+
+        glScissor(left, bottom, width, height);
 
         glClearStencil(0);
         glClear(GL_STENCIL_BUFFER_BIT);
-        dirty_stencil = false;
+        dirty_stencil -= rect;
 
-        if (use_system_clip)
-            glDisable(GL_SCISSOR_TEST);
+        glDisable(GL_SCISSOR_TEST);
 
         enableClipping();
     }
 
-    glStencilMask(~0);
-
     // Enable stencil.
     glEnable(GL_STENCIL_TEST);
 
diff --git a/src/opengl/qpixmapdata_x11gl_egl.cpp b/src/opengl/qpixmapdata_x11gl_egl.cpp
new file mode 100644
index 0000000000..813e6c89a1
--- /dev/null
+++ b/src/opengl/qpixmapdata_x11gl_egl.cpp
@@ -0,0 +1,252 @@
+/****************************************************************************
+**
+** Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the QtOpenGL module of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include <private/qgl_p.h>
+#include <private/qegl_p.h>
+#include <private/qeglproperties_p.h>
+#include <private/qpaintengineex_opengl2_p.h>
+
+#include "qpixmapdata_x11gl_p.h"
+
+QT_BEGIN_NAMESPACE
+
+extern EGLConfig qt_chooseEGLConfigForPixmap(bool hasAlpha, bool readOnly); // in qgl_x11egl.cpp
+extern bool qt_createEGLSurfaceForPixmap(QPixmapData* pmd, bool readOnly); // in qgl_x11egl.cpp
+
+// On 16bpp systems, RGB & ARGB pixmaps are different bit-depths and therefore need
+// different contexts:
+static EGLContext qPixmapARGBSharedEglContext = EGL_NO_CONTEXT;
+static EGLContext qPixmapRGBSharedEglContext = EGL_NO_CONTEXT;
+
+bool QX11GLPixmapData::hasX11GLPixmaps()
+{
+    static bool checkedForX11Pixmaps = false;
+    static bool haveX11Pixmaps = false;
+
+    if (checkedForX11Pixmaps)
+        return haveX11Pixmaps;
+
+    checkedForX11Pixmaps = true;
+
+    QX11PixmapData *argbPixmapData = 0;
+    QX11PixmapData *rgbPixmapData = 0;
+    do {
+        if (qgetenv("QT_USE_X11GL_PIXMAPS").isEmpty())
+            break;
+
+        // Check we actually have EGL configs which support pixmaps
+        EGLConfig argbConfig = qt_chooseEGLConfigForPixmap(true, false);
+        EGLConfig rgbConfig = qt_chooseEGLConfigForPixmap(false, false);
+
+        if (argbConfig == 0 || rgbConfig == 0)
+            break;
+
+        // Create the shared contexts:
+        eglBindAPI(EGL_OPENGL_ES_API);
+        EGLint contextAttribs[] = {
+#if defined(QT_OPENGL_ES_2)
+            EGL_CONTEXT_CLIENT_VERSION, 2,
+#endif
+            EGL_NONE
+        };
+        qPixmapARGBSharedEglContext = eglCreateContext(QEglContext::defaultDisplay(0),
+                                                       argbConfig, 0, contextAttribs);
+
+        if (argbConfig == rgbConfig) {
+            // If the configs are the same, we can re-use the same context.
+            qPixmapRGBSharedEglContext = qPixmapARGBSharedEglContext;
+        } else {
+            qPixmapRGBSharedEglContext = eglCreateContext(QEglContext::defaultDisplay(0),
+                                                           rgbConfig, 0, contextAttribs);
+        }
+
+        argbPixmapData = new QX11PixmapData(QPixmapData::PixmapType);
+        argbPixmapData->resize(100, 100);
+        argbPixmapData->fill(Qt::transparent); // Force ARGB
+
+        if (!qt_createEGLSurfaceForPixmap(argbPixmapData, false))
+            break;
+
+        haveX11Pixmaps = eglMakeCurrent(QEglContext::defaultDisplay(0),
+                                        (EGLSurface)argbPixmapData->gl_surface,
+                                        (EGLSurface)argbPixmapData->gl_surface,
+                                        qPixmapARGBSharedEglContext);
+        if (!haveX11Pixmaps) {
+            EGLint err = eglGetError();
+            qWarning() << "Unable to make pixmap config current:" << err << QEglContext::errorString(err);
+            break;
+        }
+
+        // If the ARGB & RGB configs are the same, we don't need to check RGB too
+        if (haveX11Pixmaps && (argbConfig != rgbConfig)) {
+            rgbPixmapData = new QX11PixmapData(QPixmapData::PixmapType);
+            rgbPixmapData->resize(100, 100);
+            rgbPixmapData->fill(Qt::red);
+
+            // Try to actually create an EGL pixmap surface
+            if (!qt_createEGLSurfaceForPixmap(rgbPixmapData, false))
+                break;
+
+            haveX11Pixmaps = eglMakeCurrent(QEglContext::defaultDisplay(0),
+                                            (EGLSurface)rgbPixmapData->gl_surface,
+                                            (EGLSurface)rgbPixmapData->gl_surface,
+                                            qPixmapRGBSharedEglContext);
+            if (!haveX11Pixmaps) {
+                EGLint err = eglGetError();
+                qWarning() << "Unable to make pixmap config current:" << err << QEglContext::errorString(err);
+                break;
+            }
+        }
+    } while (0);
+
+    if (qPixmapARGBSharedEglContext || qPixmapRGBSharedEglContext) {
+        eglMakeCurrent(QEglContext::defaultDisplay(0),
+                       EGL_NO_SURFACE, EGL_NO_SURFACE, EGL_NO_CONTEXT);
+    }
+
+    if (argbPixmapData) {
+        if (argbPixmapData->gl_surface)
+            QGLContextPrivate::destroyGlSurfaceForPixmap(argbPixmapData);
+        delete argbPixmapData;
+        argbPixmapData = 0;
+    }
+    if (rgbPixmapData) {
+        if (rgbPixmapData->gl_surface)
+            QGLContextPrivate::destroyGlSurfaceForPixmap(rgbPixmapData);
+        delete rgbPixmapData;
+        rgbPixmapData = 0;
+    }
+
+    if (!haveX11Pixmaps) {
+        // Clean up the context(s) if we can't use X11GL pixmaps
+        if (qPixmapARGBSharedEglContext != EGL_NO_CONTEXT)
+            eglDestroyContext(QEglContext::defaultDisplay(0), qPixmapARGBSharedEglContext);
+
+        if (qPixmapRGBSharedEglContext != qPixmapARGBSharedEglContext &&
+            qPixmapRGBSharedEglContext != EGL_NO_CONTEXT)
+        {
+            eglDestroyContext(QEglContext::defaultDisplay(0), qPixmapRGBSharedEglContext);
+        }
+        qPixmapRGBSharedEglContext = EGL_NO_CONTEXT;
+        qPixmapARGBSharedEglContext = EGL_NO_CONTEXT;
+    }
+
+    if (haveX11Pixmaps)
+        qDebug("QX11GLPixmapData is supported");
+    else
+        qDebug("QX11GLPixmapData is *NOT* being used");
+
+    return haveX11Pixmaps;
+}
+
+QX11GLPixmapData::QX11GLPixmapData()
+    : QX11PixmapData(QPixmapData::PixmapType),
+      ctx(0)
+{
+}
+
+QX11GLPixmapData::~QX11GLPixmapData()
+{
+}
+
+static QGL2PaintEngineEx* qt_gl2_engine_for_pixmaps = 0;
+
+QPaintEngine* QX11GLPixmapData::paintEngine() const
+{
+    // We need to create the context before beginPaint - do it here:
+    if (!ctx) {
+        ctx = new QGLContext(glFormat());
+        if (ctx->d_func()->eglContext == 0)
+            ctx->d_func()->eglContext = new QEglContext();
+        ctx->d_func()->eglContext->openDisplay(0); // ;-)
+        ctx->d_func()->eglContext->setApi(QEgl::OpenGL);
+        ctx->d_func()->eglContext->setContext(hasAlphaChannel() ? qPixmapARGBSharedEglContext
+                                                                : qPixmapRGBSharedEglContext);
+    }
+
+    if (!qt_gl2_engine_for_pixmaps)
+        qt_gl2_engine_for_pixmaps = new QGL2PaintEngineEx();
+
+    // Support multiple painters on multiple pixmaps simultaniously
+    if (qt_gl2_engine_for_pixmaps->isActive()) {
+        qWarning("Pixmap paint engine already active");
+        QPaintEngine* engine = new QGL2PaintEngineEx();
+        engine->setAutoDestruct(true);
+        return engine;
+    }
+
+    return qt_gl2_engine_for_pixmaps;
+}
+
+void QX11GLPixmapData::beginPaint()
+{
+//    qDebug("QX11GLPixmapData::beginPaint()");
+    if ((EGLSurface)gl_surface == EGL_NO_SURFACE) {
+        qt_createEGLSurfaceForPixmap(this, false);
+        ctx->d_func()->eglSurface = (EGLSurface)gl_surface;
+        ctx->d_func()->valid = true; // ;-)
+    }
+    QGLPaintDevice::beginPaint();
+}
+
+void QX11GLPixmapData::endPaint()
+{
+    glFinish();
+    QGLPaintDevice::endPaint();
+}
+
+QGLContext* QX11GLPixmapData::context() const
+{
+    return ctx;
+}
+
+QSize QX11GLPixmapData::size() const
+{
+    return QSize(w, h);
+}
+
+
+QGLFormat QX11GLPixmapData::glFormat()
+{
+    return QGLFormat::defaultFormat(); //###
+}
+
+QT_END_NAMESPACE
diff --git a/src/opengl/qpixmapdata_x11gl_p.h b/src/opengl/qpixmapdata_x11gl_p.h
new file mode 100644
index 0000000000..bba9bb3803
--- /dev/null
+++ b/src/opengl/qpixmapdata_x11gl_p.h
@@ -0,0 +1,86 @@
+/****************************************************************************
+**
+** Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the QtOpenGL module of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#ifndef QPIXMAPDATA_X11GL_P_H
+#define QPIXMAPDATA_X11GL_P_H
+
+//
+//  W A R N I N G
+//  -------------
+//
+// This file is not part of the Qt API.  It exists purely as an
+// implementation detail.  This header file may change from version to
+// version without notice, or even be removed.
+//
+// We mean it.
+//
+
+#include <private/qpixmapdata_p.h>
+#include <private/qpixmap_x11_p.h>
+#include <private/qglpaintdevice_p.h>
+
+#include <qgl.h>
+
+QT_BEGIN_NAMESPACE
+
+class QX11GLPixmapData : public QX11PixmapData, public QGLPaintDevice
+{
+public:
+    QX11GLPixmapData();
+    virtual ~QX11GLPixmapData();
+
+    // Re-implemented from QGLPaintDevice
+    QPaintEngine* paintEngine() const; // Also re-implements QX11PixmapData::paintEngine
+    void beginPaint();
+    void endPaint();
+    QGLContext* context() const;
+    QSize size() const;
+
+    static bool hasX11GLPixmaps();
+    static QGLFormat glFormat();
+private:
+    mutable QGLContext* ctx;
+};
+
+
+QT_END_NAMESPACE
+
+#endif // QPIXMAPDATA_X11GL_P_H
diff --git a/src/opengl/qwindowsurface_gl.cpp b/src/opengl/qwindowsurface_gl.cpp
index 2816ecabef..4547416836 100644
--- a/src/opengl/qwindowsurface_gl.cpp
+++ b/src/opengl/qwindowsurface_gl.cpp
@@ -364,6 +364,7 @@ void QGLWindowSurface::hijackWindow(QWidget *widget)
     if (ctxpriv->eglSurface == EGL_NO_SURFACE) {
         qWarning() << "hijackWindow() could not create EGL surface";
     }
+    qDebug("QGLWindowSurface - using EGLConfig %d", ctxpriv->eglContext->config());
 #endif
 
     widgetPrivate->extraData()->glContext = ctx;
diff --git a/src/opengl/qwindowsurface_x11gl.cpp b/src/opengl/qwindowsurface_x11gl.cpp
new file mode 100644
index 0000000000..8ef239dc0a
--- /dev/null
+++ b/src/opengl/qwindowsurface_x11gl.cpp
@@ -0,0 +1,144 @@
+/****************************************************************************
+**
+** Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the QtOpenGL module of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include <QTime>
+#include <QDebug>
+
+#include <private/qt_x11_p.h>
+#include <private/qimagepixmapcleanuphooks_p.h>
+
+#include "qwindowsurface_x11gl_p.h"
+#include "qpixmapdata_x11gl_p.h"
+
+QT_BEGIN_NAMESPACE
+
+QX11GLWindowSurface::QX11GLWindowSurface(QWidget* window)
+    : QWindowSurface(window), m_GC(0), m_window(window)
+{
+}
+
+QX11GLWindowSurface::~QX11GLWindowSurface()
+{
+    if (m_GC)
+        XFree(m_GC);
+}
+
+QPaintDevice *QX11GLWindowSurface::paintDevice()
+{
+    return &m_backBuffer;
+}
+
+extern void *qt_getClipRects(const QRegion &r, int &num); // in qpaintengine_x11.cpp
+
+void QX11GLWindowSurface::flush(QWidget *widget, const QRegion &widgetRegion, const QPoint &offset)
+{
+//    qDebug("QX11GLWindowSurface::flush()");
+    QTime startTime = QTime::currentTime();
+    if (m_backBuffer.isNull()) {
+        qDebug("QHarmattanWindowSurface::flush() - backBuffer is null, not flushing anything");
+        return;
+    }
+
+    QPoint widgetOffset = qt_qwidget_data(widget)->wrect.topLeft();
+    QRegion windowRegion(widgetRegion);
+    QRect boundingRect = widgetRegion.boundingRect();
+    if (!widgetOffset.isNull())
+        windowRegion.translate(-widgetOffset);
+    QRect windowBoundingRect = windowRegion.boundingRect();
+
+    int rectCount;
+    XRectangle *rects = (XRectangle *)qt_getClipRects(windowRegion, rectCount);
+    if (rectCount <= 0)
+        return;
+//         qDebug() << "XSetClipRectangles";
+//         for  (int i = 0; i < num; ++i)
+//             qDebug() << ' ' << i << rects[i].x << rects[i].x << rects[i].y << rects[i].width << rects[i].height;
+
+    if (m_GC == 0) {
+        m_GC = XCreateGC(X11->display, m_window->handle(), 0, 0);
+        XSetGraphicsExposures(X11->display, m_GC, False);
+    }
+
+    XSetClipRectangles(X11->display, m_GC, 0, 0, rects, rectCount, YXBanded);
+    XCopyArea(X11->display, m_backBuffer.handle(), m_window->handle(), m_GC,
+              boundingRect.x() + offset.x(), boundingRect.y() + offset.y(),
+              boundingRect.width(), boundingRect.height(),
+              windowBoundingRect.x(), windowBoundingRect.y());
+}
+
+void QX11GLWindowSurface::setGeometry(const QRect &rect)
+{
+    if (rect.width() > m_backBuffer.size().width() || rect.height() > m_backBuffer.size().height()) {
+        QSize newSize = rect.size();
+//        QSize newSize(1024,512);
+        qDebug() << "QX11GLWindowSurface::setGeometry() - creating a pixmap of size" << newSize;
+        QX11GLPixmapData *pd = new QX11GLPixmapData;
+        pd->resize(newSize.width(), newSize.height());
+        m_backBuffer = QPixmap(pd);
+    }
+
+//    if (gc)
+//        XFreeGC(X11->display, gc);
+//    gc = XCreateGC(X11->display, d_ptr->device.handle(), 0, 0);
+//    XSetGraphicsExposures(X11->display, gc, False);
+    QWindowSurface::setGeometry(rect);
+}
+
+bool QX11GLWindowSurface::scroll(const QRegion &area, int dx, int dy)
+{
+    return false;
+}
+
+/*
+void QX11GLWindowSurface::beginPaint(const QRegion &region)
+{
+}
+
+void QX11GLWindowSurface::endPaint(const QRegion &region)
+{
+}
+
+QImage *QX11GLWindowSurface::buffer(const QWidget *widget)
+{
+}
+*/
+
+QT_END_NAMESPACE
diff --git a/src/opengl/qwindowsurface_x11gl_p.h b/src/opengl/qwindowsurface_x11gl_p.h
new file mode 100644
index 0000000000..5ba4dc5422
--- /dev/null
+++ b/src/opengl/qwindowsurface_x11gl_p.h
@@ -0,0 +1,81 @@
+/****************************************************************************
+**
+** Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the QtOpenGL module of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#ifndef QWINDOWSURFACE_X11GL_P_H
+#define QWINDOWSURFACE_X11GL_P_H
+
+//
+//  W A R N I N G
+//  -------------
+//
+// This file is not part of the Qt API.  It exists purely as an
+// implementation detail.  This header file may change from version to
+// version without notice, or even be removed.
+//
+// We mean it.
+//
+
+#include <private/qwindowsurface_p.h>
+
+QT_BEGIN_NAMESPACE
+
+class QX11GLWindowSurface : public QWindowSurface
+{
+public:
+    QX11GLWindowSurface(QWidget* window);
+    virtual ~QX11GLWindowSurface();
+
+    // Inherreted from QWindowSurface
+    QPaintDevice *paintDevice();
+    void flush(QWidget *widget, const QRegion &region, const QPoint &offset);
+    void setGeometry(const QRect &rect);
+    bool scroll(const QRegion &area, int dx, int dy);
+
+private:
+    GC      m_GC;
+    QPixmap m_backBuffer;
+    QWidget *m_window;
+};
+
+
+QT_END_NAMESPACE
+
+#endif // QWINDOWSURFACE_X11GL_P_H
diff --git a/src/plugins/gfxdrivers/directfb/qdirectfbscreen.h b/src/plugins/gfxdrivers/directfb/qdirectfbscreen.h
index 0520cdc944..6330582041 100644
--- a/src/plugins/gfxdrivers/directfb/qdirectfbscreen.h
+++ b/src/plugins/gfxdrivers/directfb/qdirectfbscreen.h
@@ -154,7 +154,6 @@ public:
     void shutdownDevice();
 
     void exposeRegion(QRegion r, int changing);
-    void scroll(const QRegion &region, const QPoint &offset);
     void solidFill(const QColor &color, const QRegion &region);
 
     void setMode(int width, int height, int depth);
diff --git a/src/plugins/gfxdrivers/directfb/qdirectfbwindowsurface.cpp b/src/plugins/gfxdrivers/directfb/qdirectfbwindowsurface.cpp
index 27ec668776..3fbefc35ef 100644
--- a/src/plugins/gfxdrivers/directfb/qdirectfbwindowsurface.cpp
+++ b/src/plugins/gfxdrivers/directfb/qdirectfbwindowsurface.cpp
@@ -168,6 +168,16 @@ void QDirectFBWindowSurface::createWindow(const QRect &rect)
     if (result != DFB_OK)
         DirectFBErrorFatal("QDirectFBWindowSurface::createWindow", result);
 
+    if (window()) {
+        DFBWindowID winid;
+        result = dfbWindow->GetID(dfbWindow, &winid);
+        if (result != DFB_OK) {
+            DirectFBError("QDirectFBWindowSurface::createWindow. Can't get ID", result);
+        } else {
+            window()->setProperty("_q_DirectFBWindowID", winid);
+        }
+    }
+
     Q_ASSERT(!dfbSurface);
     dfbWindow->GetSurface(dfbWindow, &dfbSurface);
     updateFormat();
@@ -220,6 +230,9 @@ void QDirectFBWindowSurface::setGeometry(const QRect &rect)
     if (rect.isNull()) {
 #ifndef QT_NO_DIRECTFB_WM
         if (dfbWindow) {
+            if (window())
+                window()->setProperty("_q_DirectFBWindowID", QVariant());
+
             dfbWindow->Release(dfbWindow);
             dfbWindow = 0;
         }
diff --git a/src/script/api/qscriptengine.cpp b/src/script/api/qscriptengine.cpp
index 360036a195..3f2c9b4c58 100644
--- a/src/script/api/qscriptengine.cpp
+++ b/src/script/api/qscriptengine.cpp
@@ -797,6 +797,10 @@ QScriptEnginePrivate::QScriptEnginePrivate()
       registeredScriptStrings(0), inEval(false)
 {
     qMetaTypeId<QScriptValue>();
+    qMetaTypeId<QList<int> >();
+#ifndef QT_NO_QOBJECT
+    qMetaTypeId<QObjectList>();
+#endif
 
     JSC::initializeThreading(); // ### hmmm
 
@@ -2573,7 +2577,7 @@ QScriptValue QScriptEnginePrivate::create(int type, const void *ptr)
 #endif
             break;
         case QMetaType::Double:
-            result = QScriptValue(*reinterpret_cast<const double*>(ptr));
+            result = QScriptValue(qsreal(*reinterpret_cast<const double*>(ptr)));
             break;
         case QMetaType::QString:
             result = QScriptValue(q_func(), *reinterpret_cast<const QString*>(ptr));
diff --git a/src/script/api/qscriptengine_p.h b/src/script/api/qscriptengine_p.h
index cde116d058..3766559dcd 100644
--- a/src/script/api/qscriptengine_p.h
+++ b/src/script/api/qscriptengine_p.h
@@ -451,7 +451,7 @@ inline void QScriptValuePrivate::initFrom(JSC::JSValue value)
         engine->registerScriptValue(this);
 }
 
-inline void QScriptValuePrivate::initFrom(double value)
+inline void QScriptValuePrivate::initFrom(qsreal value)
 {
     type = Number;
     numberValue = value;
diff --git a/src/script/api/qscriptvalue.cpp b/src/script/api/qscriptvalue.cpp
index b8340a7e51..26cd314b3a 100644
--- a/src/script/api/qscriptvalue.cpp
+++ b/src/script/api/qscriptvalue.cpp
@@ -213,7 +213,7 @@ qint32 ToInt32(qsreal n)
     if (qIsNaN(n) || qIsInf(n) || (n == 0))
         return 0;
 
-    double sign = (n < 0) ? -1.0 : 1.0;
+    qsreal sign = (n < 0) ? -1.0 : 1.0;
     qsreal abs_n = fabs(n);
 
     n = ::fmod(sign * ::floor(abs_n), D32);
@@ -233,7 +233,7 @@ quint32 ToUint32(qsreal n)
     if (qIsNaN(n) || qIsInf(n) || (n == 0))
         return 0;
 
-    double sign = (n < 0) ? -1.0 : 1.0;
+    qsreal sign = (n < 0) ? -1.0 : 1.0;
     qsreal abs_n = fabs(n);
 
     n = ::fmod(sign * ::floor(abs_n), D32);
@@ -251,7 +251,7 @@ quint16 ToUint16(qsreal n)
     if (qIsNaN(n) || qIsInf(n) || (n == 0))
         return 0;
 
-    double sign = (n < 0) ? -1.0 : 1.0;
+    qsreal sign = (n < 0) ? -1.0 : 1.0;
     qsreal abs_n = fabs(n);
 
     n = ::fmod(sign * ::floor(abs_n), D16);
diff --git a/src/script/api/qscriptvalue_p.h b/src/script/api/qscriptvalue_p.h
index 77b5084966..9634515cf8 100644
--- a/src/script/api/qscriptvalue_p.h
+++ b/src/script/api/qscriptvalue_p.h
@@ -81,7 +81,7 @@ public:
     inline ~QScriptValuePrivate();
 
     inline void initFrom(JSC::JSValue value);
-    inline void initFrom(double value);
+    inline void initFrom(qsreal value);
     inline void initFrom(const QString &value);
 
     inline bool isJSC() const;
@@ -124,7 +124,7 @@ public:
     QScriptEnginePrivate *engine;
     Type type;
     JSC::JSValue jscValue;
-    double numberValue;
+    qsreal numberValue;
     QString stringValue;
 
     // linked list of engine's script values
diff --git a/src/svg/qsvggenerator.cpp b/src/svg/qsvggenerator.cpp
index da3123fb7e..2f80a92736 100644
--- a/src/svg/qsvggenerator.cpp
+++ b/src/svg/qsvggenerator.cpp
@@ -1063,6 +1063,7 @@ void QSvgPaintEngine::drawTextItem(const QPointF &pt, const QTextItem &textItem)
                   "fill=\"" << d->attributes.stroke << "\" "
                   "fill-opacity=\"" << d->attributes.strokeOpacity << "\" "
                   "stroke=\"none\" "
+                  "xml:space=\"preserve\" "
                   "x=\"" << pt.x() << "\" y=\"" << pt.y() << "\" ";
     qfontToSvg(textItem.font());
     *d->stream << " >"
diff --git a/tests/auto/auto.pro b/tests/auto/auto.pro
index 8e3ce8149b..0f7a7f1eb2 100644
--- a/tests/auto/auto.pro
+++ b/tests/auto/auto.pro
@@ -127,6 +127,7 @@ SUBDIRS += \
            qexplicitlyshareddatapointer \
            qfile \
            qfiledialog \
+           qfiledialog2 \
            qfileinfo \
            qfilesystemwatcher \
            qfilesystemmodel \
diff --git a/tests/auto/gestures/tst_gestures.cpp b/tests/auto/gestures/tst_gestures.cpp
index 46ed45e5ad..92f979f86d 100644
--- a/tests/auto/gestures/tst_gestures.cpp
+++ b/tests/auto/gestures/tst_gestures.cpp
@@ -56,6 +56,11 @@
 //TESTED_CLASS=
 //TESTED_FILES=
 
+static QPointF mapToGlobal(const QPointF &pt, QGraphicsItem *item, QGraphicsView *view)
+{
+    return view->mapToGlobal(view->mapFromScene(item->mapToScene(pt)));
+}
+
 class CustomGesture : public QGesture
 {
     Q_OBJECT
@@ -63,11 +68,10 @@ public:
     static Qt::GestureType GestureType;
 
     CustomGesture(QObject *parent = 0)
-        : QGesture(parent), target(0), serial(0)
+        : QGesture(parent), serial(0)
     {
     }
 
-    QObject *target;
     int serial;
 
     static const int SerialMaybeThreshold;
@@ -86,13 +90,13 @@ public:
 
     CustomEvent(int serial_ = 0)
         : QEvent(QEvent::Type(CustomEvent::EventType)),
-          serial(serial_), targetObject(0)
+          serial(serial_), hasHotSpot(false)
     {
     }
 
     int serial;
-    QObject *targetObject;
-    QPoint hotSpot;
+    QPointF hotSpot;
+    bool hasHotSpot;
 };
 int CustomEvent::EventType = 0;
 
@@ -101,8 +105,8 @@ class CustomGestureRecognizer : public QGestureRecognizer
 public:
     CustomGestureRecognizer()
     {
-        CustomEvent::EventType = QEvent::registerEventType();
-        eventsCounter = 0;
+        if (!CustomEvent::EventType)
+            CustomEvent::EventType = QEvent::registerEventType();
     }
 
     QGesture* createGesture(QObject *)
@@ -117,9 +121,8 @@ public:
             CustomGesture *g = static_cast<CustomGesture*>(state);
             CustomEvent *e = static_cast<CustomEvent*>(event);
             g->serial = e->serial;
-            g->setTargetObject(e->targetObject);
-            g->setHotSpot(e->hotSpot);
-            ++eventsCounter;
+            if (e->hasHotSpot)
+                g->setHotSpot(e->hotSpot);
             if (g->serial >= CustomGesture::SerialFinishedThreshold)
                 result |= QGestureRecognizer::GestureFinished;
             else if (g->serial >= CustomGesture::SerialStartedThreshold)
@@ -139,16 +142,57 @@ public:
         g->serial = 0;
         QGestureRecognizer::reset(state);
     }
+};
+
+// same as CustomGestureRecognizer but triggers early without the maybe state
+class CustomContinuousGestureRecognizer : public QGestureRecognizer
+{
+public:
+    CustomContinuousGestureRecognizer()
+    {
+        if (!CustomEvent::EventType)
+            CustomEvent::EventType = QEvent::registerEventType();
+    }
+
+    QGesture* createGesture(QObject *)
+    {
+        return new CustomGesture;
+    }
+
+    QGestureRecognizer::Result filterEvent(QGesture *state, QObject*, QEvent *event)
+    {
+        if (event->type() == CustomEvent::EventType) {
+            QGestureRecognizer::Result result = QGestureRecognizer::ConsumeEventHint;
+            CustomGesture *g = static_cast<CustomGesture*>(state);
+            CustomEvent *e = static_cast<CustomEvent*>(event);
+            g->serial = e->serial;
+            if (e->hasHotSpot)
+                g->setHotSpot(e->hotSpot);
+            if (g->serial >= CustomGesture::SerialFinishedThreshold)
+                result |= QGestureRecognizer::GestureFinished;
+            else if (g->serial >= CustomGesture::SerialMaybeThreshold)
+                result |= QGestureRecognizer::GestureTriggered;
+            else
+                result = QGestureRecognizer::NotGesture;
+            return result;
+        }
+        return QGestureRecognizer::Ignore;
+    }
 
-    int eventsCounter;
-    QString name;
+    void reset(QGesture *state)
+    {
+        CustomGesture *g = static_cast<CustomGesture*>(state);
+        g->serial = 0;
+        QGestureRecognizer::reset(state);
+    }
 };
 
 class GestureWidget : public QWidget
 {
     Q_OBJECT
 public:
-    GestureWidget(const char *name = 0)
+    GestureWidget(const char *name = 0, QWidget *parent = 0)
+        : QWidget(parent)
     {
         if (name)
             setObjectName(QLatin1String(name));
@@ -162,6 +206,7 @@ public:
         gestureOverrideEventsReceived = 0;
         events.clear();
         overrideEvents.clear();
+        ignoredGestures.clear();
     }
 
     int customEventsReceived;
@@ -186,14 +231,18 @@ public:
     } events, overrideEvents;
 
     bool acceptGestureOverride;
+    QSet<Qt::GestureType> ignoredGestures;
 
 protected:
     bool event(QEvent *event)
     {
         Events *eventsPtr = 0;
         if (event->type() == QEvent::Gesture) {
+            QGestureEvent *e = static_cast<QGestureEvent*>(event);
             ++gestureEventsReceived;
             eventsPtr = &events;
+            foreach(Qt::GestureType type, ignoredGestures)
+                e->ignore(e->gesture(type));
         } else if (event->type() == QEvent::GestureOverride) {
             ++gestureOverrideEventsReceived;
             eventsPtr = &overrideEvents;
@@ -231,14 +280,15 @@ protected:
     }
 };
 
-static void sendCustomGesture(QObject *object)
+static void sendCustomGesture(CustomEvent *event, QObject *object, QGraphicsScene *scene = 0)
 {
-    CustomEvent ev;
-    ev.targetObject = object;
     for (int i = CustomGesture::SerialMaybeThreshold;
          i <= CustomGesture::SerialFinishedThreshold; ++i) {
-        ev.serial = i;
-        QApplication::sendEvent(object, &ev);
+        event->serial = i;
+        if (scene)
+            scene->sendEvent(qobject_cast<QGraphicsObject *>(object), event);
+        else
+            QApplication::sendEvent(object, event);
     }
 }
 
@@ -265,6 +315,13 @@ private slots:
     void finishedWithoutStarted();
     void unknownGesture();
     void graphicsItemGesture();
+    void graphicsItemTreeGesture();
+    void explicitGraphicsObjectTarget();
+    void gestureOverChildGraphicsItem();
+    void twoGesturesOnDifferentLevel();
+    void multipleGesturesInTree();
+    void multipleGesturesInComplexTree();
+    void testMapToScene();
 };
 
 tst_Gestures::tst_Gestures()
@@ -298,7 +355,8 @@ void tst_Gestures::customGesture()
 {
     GestureWidget widget;
     widget.grabGesture(CustomGesture::GestureType, Qt::WidgetGesture);
-    sendCustomGesture(&widget);
+    CustomEvent event;
+    sendCustomGesture(&event, &widget);
 
     static const int TotalGestureEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialStartedThreshold + 1;
     static const int TotalCustomEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialMaybeThreshold + 1;
@@ -343,7 +401,8 @@ void tst_Gestures::gestureOverChild()
 
     widget.grabGesture(CustomGesture::GestureType, Qt::WidgetGesture);
 
-    sendCustomGesture(child);
+    CustomEvent event;
+    sendCustomGesture(&event, child);
 
     static const int TotalGestureEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialStartedThreshold + 1;
     static const int TotalCustomEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialMaybeThreshold + 1;
@@ -361,7 +420,7 @@ void tst_Gestures::gestureOverChild()
     widget.reset();
     child->reset();
 
-    sendCustomGesture(child);
+    sendCustomGesture(&event, child);
 
     QCOMPARE(child->customEventsReceived, TotalCustomEventsCount);
     QCOMPARE(widget.customEventsReceived, 0);
@@ -392,7 +451,8 @@ void tst_Gestures::multipleWidgetOnlyGestureInTree()
     static const int TotalCustomEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialMaybeThreshold + 1;
 
     // sending events to the child and making sure there is no conflict
-    sendCustomGesture(child);
+    CustomEvent event;
+    sendCustomGesture(&event, child);
 
     QCOMPARE(child->customEventsReceived, TotalCustomEventsCount);
     QCOMPARE(parent.customEventsReceived, 0);
@@ -405,7 +465,7 @@ void tst_Gestures::multipleWidgetOnlyGestureInTree()
     child->reset();
 
     // same for the parent widget
-    sendCustomGesture(&parent);
+    sendCustomGesture(&event, &parent);
 
     QCOMPARE(child->customEventsReceived, 0);
     QCOMPARE(parent.customEventsReceived, TotalCustomEventsCount);
@@ -432,10 +492,11 @@ void tst_Gestures::conflictingGestures()
     child->acceptGestureOverride = true;
 
     // sending events to the child and making sure there is no conflict
-    sendCustomGesture(child);
+    CustomEvent event;
+    sendCustomGesture(&event, child);
 
-    QCOMPARE(child->gestureOverrideEventsReceived, TotalGestureEventsCount);
-    QCOMPARE(child->gestureEventsReceived, 0);
+    QCOMPARE(child->gestureOverrideEventsReceived, 1);
+    QCOMPARE(child->gestureEventsReceived, TotalGestureEventsCount);
     QCOMPARE(parent.gestureOverrideEventsReceived, 0);
     QCOMPARE(parent.gestureEventsReceived, 0);
 
@@ -447,12 +508,12 @@ void tst_Gestures::conflictingGestures()
     child->acceptGestureOverride = false;
 
     // sending events to the child and making sure there is no conflict
-    sendCustomGesture(child);
+    sendCustomGesture(&event, child);
 
-    QCOMPARE(child->gestureOverrideEventsReceived, TotalGestureEventsCount);
+    QCOMPARE(child->gestureOverrideEventsReceived, 1);
     QCOMPARE(child->gestureEventsReceived, 0);
-    QCOMPARE(parent.gestureOverrideEventsReceived, TotalGestureEventsCount);
-    QCOMPARE(parent.gestureEventsReceived, 0);
+    QCOMPARE(parent.gestureOverrideEventsReceived, 1);
+    QCOMPARE(parent.gestureEventsReceived, TotalGestureEventsCount);
 
     parent.reset();
     child->reset();
@@ -460,13 +521,31 @@ void tst_Gestures::conflictingGestures()
     // nobody accepts the override, we will send normal events to the closest context (to the child)
     parent.acceptGestureOverride = false;
     child->acceptGestureOverride = false;
+    child->ignoredGestures << CustomGesture::GestureType;
 
     // sending events to the child and making sure there is no conflict
-    sendCustomGesture(child);
+    sendCustomGesture(&event, child);
 
-    QCOMPARE(child->gestureOverrideEventsReceived, TotalGestureEventsCount);
+    QCOMPARE(child->gestureOverrideEventsReceived, 1);
     QCOMPARE(child->gestureEventsReceived, TotalGestureEventsCount);
-    QCOMPARE(parent.gestureOverrideEventsReceived, TotalGestureEventsCount);
+    QCOMPARE(parent.gestureOverrideEventsReceived, 1);
+    QCOMPARE(parent.gestureEventsReceived, TotalGestureEventsCount);
+
+    parent.reset();
+    child->reset();
+
+    Qt::GestureType ContinuousGesture = qApp->registerGestureRecognizer(new CustomContinuousGestureRecognizer);
+    static const int ContinuousGestureEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialMaybeThreshold + 1;
+    child->grabGesture(ContinuousGesture);
+    // child accepts override. And it also receives another custom gesture.
+    parent.acceptGestureOverride = false;
+    child->acceptGestureOverride = true;
+    sendCustomGesture(&event, child);
+
+    QCOMPARE(child->gestureOverrideEventsReceived, 1);
+    QVERIFY(child->gestureEventsReceived > TotalGestureEventsCount);
+    QCOMPARE(child->events.all.count(), TotalGestureEventsCount + ContinuousGestureEventsCount);
+    QCOMPARE(parent.gestureOverrideEventsReceived, 0);
     QCOMPARE(parent.gestureEventsReceived, 0);
 }
 
@@ -497,18 +576,28 @@ void tst_Gestures::unknownGesture()
     widget.grabGesture(Qt::CustomGesture, Qt::WidgetGesture);
     widget.grabGesture(Qt::GestureType(Qt::PanGesture+512), Qt::WidgetGesture);
 
-    sendCustomGesture(&widget);
+    CustomEvent event;
+    sendCustomGesture(&event, &widget);
 
     static const int TotalGestureEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialStartedThreshold + 1;
 
     QCOMPARE(widget.gestureEventsReceived, TotalGestureEventsCount);
 }
 
+static const QColor InstanceColors[] = {
+    Qt::blue, Qt::red, Qt::green, Qt::gray, Qt::yellow
+};
+
 class GestureItem : public QGraphicsObject
 {
+    static int InstanceCount;
+
 public:
-    GestureItem()
+    GestureItem(const char *name = 0)
     {
+        instanceNumber = InstanceCount++;
+        if (name)
+            setObjectName(QLatin1String(name));
         size = QRectF(0, 0, 100, 100);
         customEventsReceived = 0;
         gestureEventsReceived = 0;
@@ -517,6 +606,10 @@ public:
         overrideEvents.clear();
         acceptGestureOverride = false;
     }
+    ~GestureItem()
+    {
+        --InstanceCount;
+    }
 
     int customEventsReceived;
     int gestureEventsReceived;
@@ -540,8 +633,20 @@ public:
     } events, overrideEvents;
 
     bool acceptGestureOverride;
+    QSet<Qt::GestureType> ignoredGestures;
 
     QRectF size;
+    int instanceNumber;
+
+    void reset()
+    {
+        customEventsReceived = 0;
+        gestureEventsReceived = 0;
+        gestureOverrideEventsReceived = 0;
+        events.clear();
+        overrideEvents.clear();
+        ignoredGestures.clear();
+    }
 
 protected:
     QRectF boundingRect() const
@@ -550,7 +655,8 @@ protected:
     }
     void paint(QPainter *p, const QStyleOptionGraphicsItem *, QWidget *)
     {
-        p->fillRect(boundingRect(), Qt::blue);
+        QColor color = InstanceColors[instanceNumber % (sizeof(InstanceColors)/sizeof(InstanceColors[0]))];
+        p->fillRect(boundingRect(), color);
     }
 
     bool event(QEvent *event)
@@ -559,6 +665,9 @@ protected:
         if (event->type() == QEvent::Gesture) {
             ++gestureEventsReceived;
             eventsPtr = &events;
+            QGestureEvent *e = static_cast<QGestureEvent *>(event);
+            foreach(Qt::GestureType type, ignoredGestures)
+                e->ignore(e->gesture(type));
         } else if (event->type() == QEvent::GestureOverride) {
             ++gestureOverrideEventsReceived;
             eventsPtr = &overrideEvents;
@@ -595,23 +704,46 @@ protected:
         return true;
     }
 };
+int GestureItem::InstanceCount = 0;
 
 void tst_Gestures::graphicsItemGesture()
 {
     QGraphicsScene scene;
     QGraphicsView view(&scene);
 
-    GestureItem *item = new GestureItem;
+    GestureItem *item = new GestureItem("item");
     scene.addItem(item);
     item->setPos(100, 100);
 
-    item->grabGesture(CustomGesture::GestureType);
+    view.show();
+    QTest::qWaitForWindowShown(&view);
+    view.ensureVisible(scene.sceneRect());
 
-    sendCustomGesture(item);
+    view.viewport()->grabGesture(CustomGesture::GestureType, Qt::WidgetGesture);
+    item->grabGesture(CustomGesture::GestureType);
 
     static const int TotalGestureEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialStartedThreshold + 1;
     static const int TotalCustomEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialMaybeThreshold + 1;
 
+    CustomEvent event;
+    // gesture without hotspot should not be delivered to items in the view
+    QTest::ignoreMessage(QtWarningMsg, "QGestureManager::deliverEvent: could not find the target for gesture");
+    QTest::ignoreMessage(QtWarningMsg, "QGestureManager::deliverEvent: could not find the target for gesture");
+    QTest::ignoreMessage(QtWarningMsg, "QGestureManager::deliverEvent: could not find the target for gesture");
+    QTest::ignoreMessage(QtWarningMsg, "QGestureManager::deliverEvent: could not find the target for gesture");
+    sendCustomGesture(&event, item, &scene);
+
+    QCOMPARE(item->customEventsReceived, TotalCustomEventsCount);
+    QCOMPARE(item->gestureEventsReceived, 0);
+    QCOMPARE(item->gestureOverrideEventsReceived, 0);
+
+    item->reset();
+
+    // make sure the event is properly delivered if only the hotspot is set.
+    event.hotSpot = mapToGlobal(QPointF(10, 10), item, &view);
+    event.hasHotSpot = true;
+    sendCustomGesture(&event, item, &scene);
+
     QCOMPARE(item->customEventsReceived, TotalCustomEventsCount);
     QCOMPARE(item->gestureEventsReceived, TotalGestureEventsCount);
     QCOMPARE(item->gestureOverrideEventsReceived, 0);
@@ -622,6 +754,416 @@ void tst_Gestures::graphicsItemGesture()
     QCOMPARE(item->events.updated.size(), TotalGestureEventsCount - 2);
     QCOMPARE(item->events.finished.size(), 1);
     QCOMPARE(item->events.canceled.size(), 0);
+
+    item->reset();
+
+    // send gesture to the item which ignores it.
+    item->ignoredGestures << CustomGesture::GestureType;
+
+    event.hotSpot = mapToGlobal(QPointF(10, 10), item, &view);
+    event.hasHotSpot = true;
+    sendCustomGesture(&event, item, &scene);
+    QCOMPARE(item->customEventsReceived, TotalCustomEventsCount);
+    QCOMPARE(item->gestureEventsReceived, TotalGestureEventsCount);
+    QCOMPARE(item->gestureOverrideEventsReceived, 0);
+}
+
+void tst_Gestures::graphicsItemTreeGesture()
+{
+    QGraphicsScene scene;
+    QGraphicsView view(&scene);
+
+    GestureItem *item1 = new GestureItem("item1");
+    item1->setPos(100, 100);
+    item1->size = QRectF(0, 0, 350, 200);
+    scene.addItem(item1);
+
+    GestureItem *item1_child1 = new GestureItem("item1_child1");
+    item1_child1->setPos(50, 50);
+    item1_child1->size = QRectF(0, 0, 100, 100);
+    item1_child1->setParentItem(item1);
+
+    GestureItem *item1_child2 = new GestureItem("item1_child2");
+    item1_child2->size = QRectF(0, 0, 100, 100);
+    item1_child2->setPos(200, 50);
+    item1_child2->setParentItem(item1);
+
+    view.show();
+    QTest::qWaitForWindowShown(&view);
+    view.ensureVisible(scene.sceneRect());
+
+    view.viewport()->grabGesture(CustomGesture::GestureType, Qt::WidgetGesture);
+    item1->grabGesture(CustomGesture::GestureType);
+
+    static const int TotalGestureEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialStartedThreshold + 1;
+
+    CustomEvent event;
+    event.hotSpot = mapToGlobal(QPointF(10, 10), item1_child1, &view);
+    event.hasHotSpot = true;
+
+    item1->ignoredGestures << CustomGesture::GestureType;
+    sendCustomGesture(&event, item1_child1, &scene);
+    QCOMPARE(item1_child1->gestureOverrideEventsReceived, 0);
+    QCOMPARE(item1_child1->gestureEventsReceived, 0);
+    QCOMPARE(item1_child2->gestureEventsReceived, 0);
+    QCOMPARE(item1_child2->gestureOverrideEventsReceived, 0);
+    QCOMPARE(item1->gestureOverrideEventsReceived, 0);
+    QCOMPARE(item1->gestureEventsReceived, TotalGestureEventsCount);
+
+    item1->reset(); item1_child1->reset(); item1_child2->reset();
+
+    item1_child1->grabGesture(CustomGesture::GestureType);
+
+    item1->ignoredGestures << CustomGesture::GestureType;
+    item1_child1->ignoredGestures << CustomGesture::GestureType;
+    sendCustomGesture(&event, item1_child1, &scene);
+    QCOMPARE(item1_child1->gestureOverrideEventsReceived, 1);
+    QCOMPARE(item1_child1->gestureEventsReceived, TotalGestureEventsCount);
+    QCOMPARE(item1_child2->gestureEventsReceived, 0);
+    QCOMPARE(item1_child2->gestureOverrideEventsReceived, 0);
+    QCOMPARE(item1->gestureOverrideEventsReceived, 1);
+    QCOMPARE(item1->gestureEventsReceived, TotalGestureEventsCount);
+}
+
+void tst_Gestures::explicitGraphicsObjectTarget()
+{
+    QGraphicsScene scene;
+    QGraphicsView view(&scene);
+
+    GestureItem *item1 = new GestureItem("item1");
+    scene.addItem(item1);
+    item1->setPos(100, 100);
+    item1->setZValue(1);
+
+    GestureItem *item2 = new GestureItem("item2");
+    scene.addItem(item2);
+    item2->setPos(100, 100);
+    item2->setZValue(5);
+
+    GestureItem *item2_child1 = new GestureItem("item2_child1");
+    scene.addItem(item2_child1);
+    item2_child1->setParentItem(item2);
+    item2_child1->setPos(10, 10);
+
+    view.show();
+    QTest::qWaitForWindowShown(&view);
+    view.ensureVisible(scene.sceneRect());
+
+    view.viewport()->grabGesture(CustomGesture::GestureType, Qt::WidgetGesture);
+    item1->grabGesture(CustomGesture::GestureType, Qt::ItemGesture);
+    item2->grabGesture(CustomGesture::GestureType, Qt::ItemGesture);
+    item2_child1->grabGesture(CustomGesture::GestureType, Qt::ItemGesture);
+
+    static const int TotalGestureEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialStartedThreshold + 1;
+
+    // sending events to item1, but the hotSpot is set to item2
+    CustomEvent event;
+    event.hotSpot = mapToGlobal(QPointF(15, 15), item2, &view);
+    event.hasHotSpot = true;
+
+    sendCustomGesture(&event, item1, &scene);
+
+    QCOMPARE(item1->gestureEventsReceived, 0);
+    QCOMPARE(item1->gestureOverrideEventsReceived, 1);
+    QCOMPARE(item2_child1->gestureEventsReceived, TotalGestureEventsCount);
+    QCOMPARE(item2_child1->gestureOverrideEventsReceived, 1);
+    QCOMPARE(item2_child1->events.all.size(), TotalGestureEventsCount);
+    for(int i = 0; i < item2_child1->events.all.size(); ++i)
+        QCOMPARE(item2_child1->events.all.at(i), CustomGesture::GestureType);
+    QCOMPARE(item2_child1->events.started.size(), 1);
+    QCOMPARE(item2_child1->events.updated.size(), TotalGestureEventsCount - 2);
+    QCOMPARE(item2_child1->events.finished.size(), 1);
+    QCOMPARE(item2_child1->events.canceled.size(), 0);
+    QCOMPARE(item2->gestureEventsReceived, 0);
+    QCOMPARE(item2->gestureOverrideEventsReceived, 1);
+}
+
+void tst_Gestures::gestureOverChildGraphicsItem()
+{
+    QGraphicsScene scene;
+    QGraphicsView view(&scene);
+
+    GestureItem *item0 = new GestureItem("item0");
+    scene.addItem(item0);
+    item0->setPos(0, 0);
+    item0->grabGesture(CustomGesture::GestureType);
+    item0->setZValue(1);
+
+    GestureItem *item1 = new GestureItem("item1");
+    scene.addItem(item1);
+    item1->setPos(100, 100);
+    item1->setZValue(5);
+
+    GestureItem *item2 = new GestureItem("item2");
+    scene.addItem(item2);
+    item2->setPos(100, 100);
+    item2->setZValue(10);
+
+    GestureItem *item2_child1 = new GestureItem("item2_child1");
+    scene.addItem(item2_child1);
+    item2_child1->setParentItem(item2);
+    item2_child1->setPos(0, 0);
+
+    view.show();
+    QTest::qWaitForWindowShown(&view);
+    view.ensureVisible(scene.sceneRect());
+
+    view.viewport()->grabGesture(CustomGesture::GestureType, Qt::WidgetGesture);
+    item1->grabGesture(CustomGesture::GestureType);
+
+    static const int TotalGestureEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialStartedThreshold + 1;
+    static const int TotalCustomEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialMaybeThreshold + 1;
+
+    CustomEvent event;
+    event.hotSpot = mapToGlobal(QPointF(10, 10), item2_child1, &view);
+    event.hasHotSpot = true;
+    sendCustomGesture(&event, item0, &scene);
+
+    QCOMPARE(item0->customEventsReceived, TotalCustomEventsCount);
+    QCOMPARE(item2_child1->gestureEventsReceived, 0);
+    QCOMPARE(item2_child1->gestureOverrideEventsReceived, 0);
+    QCOMPARE(item2->gestureEventsReceived, 0);
+    QCOMPARE(item2->gestureOverrideEventsReceived, 0);
+    QCOMPARE(item1->gestureEventsReceived, TotalGestureEventsCount);
+    QCOMPARE(item1->gestureOverrideEventsReceived, 0);
+
+    item0->reset(); item1->reset(); item2->reset(); item2_child1->reset();
+    item2->grabGesture(CustomGesture::GestureType);
+    item2->ignoredGestures << CustomGesture::GestureType;
+
+    event.hotSpot = mapToGlobal(QPointF(10, 10), item2_child1, &view);
+    event.hasHotSpot = true;
+    sendCustomGesture(&event, item0, &scene);
+
+    QCOMPARE(item0->customEventsReceived, TotalCustomEventsCount);
+    QCOMPARE(item2_child1->gestureEventsReceived, 0);
+    QCOMPARE(item2_child1->gestureOverrideEventsReceived, 0);
+    QCOMPARE(item2->gestureEventsReceived, TotalGestureEventsCount);
+    QCOMPARE(item2->gestureOverrideEventsReceived, 1);
+    QCOMPARE(item1->gestureEventsReceived, TotalGestureEventsCount);
+    QCOMPARE(item1->gestureOverrideEventsReceived, 1);
+}
+
+void tst_Gestures::twoGesturesOnDifferentLevel()
+{
+    GestureWidget parent("parent");
+    QVBoxLayout *l = new QVBoxLayout(&parent);
+    GestureWidget *child = new GestureWidget("child");
+    l->addWidget(child);
+
+    Qt::GestureType SecondGesture = qApp->registerGestureRecognizer(new CustomGestureRecognizer);
+
+    parent.grabGesture(CustomGesture::GestureType, Qt::WidgetWithChildrenGesture);
+    child->grabGesture(SecondGesture, Qt::WidgetWithChildrenGesture);
+
+    CustomEvent event;
+    // sending events that form a gesture to one widget, but they will be
+    // filtered by two different gesture recognizers and will generate two
+    // QGesture objects. Check that those gesture objects are delivered to
+    // different widgets properly.
+    sendCustomGesture(&event, child);
+
+    static const int TotalGestureEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialStartedThreshold + 1;
+    static const int TotalCustomEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialMaybeThreshold + 1;
+
+    QCOMPARE(child->customEventsReceived, TotalCustomEventsCount);
+    QCOMPARE(child->gestureEventsReceived, TotalGestureEventsCount);
+    QCOMPARE(child->gestureOverrideEventsReceived, 0);
+    QCOMPARE(child->events.all.size(), TotalGestureEventsCount);
+    for(int i = 0; i < child->events.all.size(); ++i)
+        QCOMPARE(child->events.all.at(i), SecondGesture);
+
+    QCOMPARE(parent.gestureEventsReceived, TotalGestureEventsCount);
+    QCOMPARE(parent.gestureOverrideEventsReceived, 0);
+    QCOMPARE(parent.events.all.size(), TotalGestureEventsCount);
+    for(int i = 0; i < child->events.all.size(); ++i)
+        QCOMPARE(parent.events.all.at(i), CustomGesture::GestureType);
+}
+
+void tst_Gestures::multipleGesturesInTree()
+{
+    GestureWidget a("A");
+    GestureWidget *A = &a;
+    GestureWidget *B = new GestureWidget("B", A);
+    GestureWidget *C = new GestureWidget("C", B);
+    GestureWidget *D = new GestureWidget("D", C);
+
+    Qt::GestureType FirstGesture  = CustomGesture::GestureType;
+    Qt::GestureType SecondGesture = qApp->registerGestureRecognizer(new CustomGestureRecognizer);
+    Qt::GestureType ThirdGesture  = qApp->registerGestureRecognizer(new CustomGestureRecognizer);
+
+    A->grabGesture(FirstGesture, Qt::WidgetWithChildrenGesture);   // A [1   3]
+    A->grabGesture(ThirdGesture, Qt::WidgetWithChildrenGesture);   // |
+    B->grabGesture(SecondGesture, Qt::WidgetWithChildrenGesture);  // B [  2 3]
+    B->grabGesture(ThirdGesture, Qt::WidgetWithChildrenGesture);   // |
+    C->grabGesture(FirstGesture, Qt::WidgetWithChildrenGesture);   // C [1 2 3]
+    C->grabGesture(SecondGesture, Qt::WidgetWithChildrenGesture);  // |
+    C->grabGesture(ThirdGesture, Qt::WidgetWithChildrenGesture);   // D [1   3]
+    D->grabGesture(FirstGesture, Qt::WidgetWithChildrenGesture);
+    D->grabGesture(ThirdGesture, Qt::WidgetWithChildrenGesture);
+
+    // make sure all widgets ignore events, so they get propagated.
+    A->ignoredGestures << FirstGesture << ThirdGesture;
+    B->ignoredGestures << SecondGesture << ThirdGesture;
+    C->ignoredGestures << FirstGesture << SecondGesture << ThirdGesture;
+    D->ignoredGestures << FirstGesture << ThirdGesture;
+
+    CustomEvent event;
+    sendCustomGesture(&event, D);
+
+    static const int TotalGestureEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialStartedThreshold + 1;
+
+    // gesture override events
+    QCOMPARE(D->overrideEvents.all.count(FirstGesture), 1);
+    QCOMPARE(D->overrideEvents.all.count(SecondGesture), 0);
+    QCOMPARE(D->overrideEvents.all.count(ThirdGesture), 1);
+
+    QCOMPARE(C->overrideEvents.all.count(FirstGesture), 1);
+    QCOMPARE(C->overrideEvents.all.count(SecondGesture), 1);
+    QCOMPARE(C->overrideEvents.all.count(ThirdGesture), 1);
+
+    QCOMPARE(B->overrideEvents.all.count(FirstGesture), 0);
+    QCOMPARE(B->overrideEvents.all.count(SecondGesture), 1);
+    QCOMPARE(B->overrideEvents.all.count(ThirdGesture), 1);
+
+    QCOMPARE(A->overrideEvents.all.count(FirstGesture), 1);
+    QCOMPARE(A->overrideEvents.all.count(SecondGesture), 0);
+    QCOMPARE(A->overrideEvents.all.count(ThirdGesture), 1);
+
+    // normal gesture events
+    QCOMPARE(D->events.all.count(FirstGesture), TotalGestureEventsCount);
+    QCOMPARE(D->events.all.count(SecondGesture), 0);
+    QCOMPARE(D->events.all.count(ThirdGesture), TotalGestureEventsCount);
+
+    QCOMPARE(C->events.all.count(FirstGesture), TotalGestureEventsCount);
+    QCOMPARE(C->events.all.count(SecondGesture), TotalGestureEventsCount);
+    QCOMPARE(C->events.all.count(ThirdGesture), TotalGestureEventsCount);
+
+    QCOMPARE(B->events.all.count(FirstGesture), 0);
+    QCOMPARE(B->events.all.count(SecondGesture), TotalGestureEventsCount);
+    QCOMPARE(B->events.all.count(ThirdGesture), TotalGestureEventsCount);
+
+    QCOMPARE(A->events.all.count(FirstGesture), TotalGestureEventsCount);
+    QCOMPARE(A->events.all.count(SecondGesture), 0);
+    QCOMPARE(A->events.all.count(ThirdGesture), TotalGestureEventsCount);
+}
+
+void tst_Gestures::multipleGesturesInComplexTree()
+{
+    GestureWidget a("A");
+    GestureWidget *A = &a;
+    GestureWidget *B = new GestureWidget("B", A);
+    GestureWidget *C = new GestureWidget("C", B);
+    GestureWidget *D = new GestureWidget("D", C);
+
+    Qt::GestureType FirstGesture   = CustomGesture::GestureType;
+    Qt::GestureType SecondGesture  = qApp->registerGestureRecognizer(new CustomGestureRecognizer);
+    Qt::GestureType ThirdGesture   = qApp->registerGestureRecognizer(new CustomGestureRecognizer);
+    Qt::GestureType FourthGesture  = qApp->registerGestureRecognizer(new CustomGestureRecognizer);
+    Qt::GestureType FifthGesture   = qApp->registerGestureRecognizer(new CustomGestureRecognizer);
+    Qt::GestureType SixthGesture   = qApp->registerGestureRecognizer(new CustomGestureRecognizer);
+    Qt::GestureType SeventhGesture = qApp->registerGestureRecognizer(new CustomGestureRecognizer);
+
+    A->grabGesture(FirstGesture, Qt::WidgetWithChildrenGesture);   // A [1,3,4]
+    A->grabGesture(ThirdGesture, Qt::WidgetWithChildrenGesture);   // |
+    A->grabGesture(FourthGesture, Qt::WidgetWithChildrenGesture);  // B [2,3,5]
+    B->grabGesture(SecondGesture, Qt::WidgetWithChildrenGesture);  // |
+    B->grabGesture(ThirdGesture, Qt::WidgetWithChildrenGesture);   // C [1,2,3,6]
+    B->grabGesture(FifthGesture, Qt::WidgetWithChildrenGesture);   // |
+    C->grabGesture(FirstGesture, Qt::WidgetWithChildrenGesture);   // D [1,3,7]
+    C->grabGesture(SecondGesture, Qt::WidgetWithChildrenGesture);
+    C->grabGesture(ThirdGesture, Qt::WidgetWithChildrenGesture);
+    C->grabGesture(SixthGesture, Qt::WidgetWithChildrenGesture);
+    D->grabGesture(FirstGesture, Qt::WidgetWithChildrenGesture);
+    D->grabGesture(ThirdGesture, Qt::WidgetWithChildrenGesture);
+    D->grabGesture(SeventhGesture, Qt::WidgetWithChildrenGesture);
+
+    // make sure all widgets ignore events, so they get propagated.
+    QSet<Qt::GestureType> allGestureTypes;
+    allGestureTypes << FirstGesture << SecondGesture << ThirdGesture
+            << FourthGesture << FifthGesture << SixthGesture << SeventhGesture;
+    A->ignoredGestures = B->ignoredGestures = allGestureTypes;
+    C->ignoredGestures = D->ignoredGestures = allGestureTypes;
+
+    CustomEvent event;
+    sendCustomGesture(&event, D);
+
+    static const int TotalGestureEventsCount = CustomGesture::SerialFinishedThreshold - CustomGesture::SerialStartedThreshold + 1;
+
+    // gesture override events
+    QCOMPARE(D->overrideEvents.all.count(FirstGesture), 1);
+    QCOMPARE(D->overrideEvents.all.count(SecondGesture), 0);
+    QCOMPARE(D->overrideEvents.all.count(ThirdGesture), 1);
+
+    QCOMPARE(C->overrideEvents.all.count(FirstGesture), 1);
+    QCOMPARE(C->overrideEvents.all.count(SecondGesture), 1);
+    QCOMPARE(C->overrideEvents.all.count(ThirdGesture), 1);
+
+    QCOMPARE(B->overrideEvents.all.count(FirstGesture), 0);
+    QCOMPARE(B->overrideEvents.all.count(SecondGesture), 1);
+    QCOMPARE(B->overrideEvents.all.count(ThirdGesture), 1);
+
+    QCOMPARE(A->overrideEvents.all.count(FirstGesture), 1);
+    QCOMPARE(A->overrideEvents.all.count(SecondGesture), 0);
+    QCOMPARE(A->overrideEvents.all.count(ThirdGesture), 1);
+
+    // normal gesture events
+    QCOMPARE(D->events.all.count(FirstGesture), TotalGestureEventsCount);
+    QCOMPARE(D->events.all.count(SecondGesture), 0);
+    QCOMPARE(D->events.all.count(ThirdGesture), TotalGestureEventsCount);
+    QCOMPARE(D->events.all.count(FourthGesture), 0);
+    QCOMPARE(D->events.all.count(FifthGesture), 0);
+    QCOMPARE(D->events.all.count(SixthGesture), 0);
+    QCOMPARE(D->events.all.count(SeventhGesture), TotalGestureEventsCount);
+
+    QCOMPARE(C->events.all.count(FirstGesture), TotalGestureEventsCount);
+    QCOMPARE(C->events.all.count(SecondGesture), TotalGestureEventsCount);
+    QCOMPARE(C->events.all.count(ThirdGesture), TotalGestureEventsCount);
+    QCOMPARE(C->events.all.count(FourthGesture), 0);
+    QCOMPARE(C->events.all.count(FifthGesture), 0);
+    QCOMPARE(C->events.all.count(SixthGesture), TotalGestureEventsCount);
+    QCOMPARE(C->events.all.count(SeventhGesture), 0);
+
+    QCOMPARE(B->events.all.count(FirstGesture), 0);
+    QCOMPARE(B->events.all.count(SecondGesture), TotalGestureEventsCount);
+    QCOMPARE(B->events.all.count(ThirdGesture), TotalGestureEventsCount);
+    QCOMPARE(B->events.all.count(FourthGesture), 0);
+    QCOMPARE(B->events.all.count(FifthGesture), TotalGestureEventsCount);
+    QCOMPARE(B->events.all.count(SixthGesture), 0);
+    QCOMPARE(B->events.all.count(SeventhGesture), 0);
+
+    QCOMPARE(A->events.all.count(FirstGesture), TotalGestureEventsCount);
+    QCOMPARE(A->events.all.count(SecondGesture), 0);
+    QCOMPARE(A->events.all.count(ThirdGesture), TotalGestureEventsCount);
+    QCOMPARE(A->events.all.count(FourthGesture), TotalGestureEventsCount);
+    QCOMPARE(A->events.all.count(FifthGesture), 0);
+    QCOMPARE(A->events.all.count(SixthGesture), 0);
+    QCOMPARE(A->events.all.count(SeventhGesture), 0);
+}
+
+void tst_Gestures::testMapToScene()
+{
+    QGesture gesture;
+    QList<QGesture*> list;
+    list << &gesture;
+    QGestureEvent event(list);
+    QCOMPARE(event.mapToScene(gesture.hotSpot()), QPointF()); // not set, can't do much
+
+    QGraphicsScene scene;
+    QGraphicsView view(&scene);
+
+    GestureItem *item0 = new GestureItem;
+    scene.addItem(item0);
+    item0->setPos(14, 16);
+
+    view.show(); // need to show to give it a global coordinate
+    QTest::qWaitForWindowShown(&view);
+    view.ensureVisible(scene.sceneRect());
+
+    QPoint origin = view.mapToGlobal(QPoint());
+    event.setWidget(view.viewport());
+
+    QCOMPARE(event.mapToScene(origin + QPoint(100, 200)), view.mapToScene(QPoint(100, 200)));
 }
 
 QTEST_MAIN(tst_Gestures)
diff --git a/tests/auto/linguist/lrelease/testdata/idbased.ts b/tests/auto/linguist/lrelease/testdata/idbased.ts
index 61497deecb..c7555c846e 100644
--- a/tests/auto/linguist/lrelease/testdata/idbased.ts
+++ b/tests/auto/linguist/lrelease/testdata/idbased.ts
@@ -9,6 +9,7 @@
     </message>
     <message id="untranslated_id">
         <source>This has no translation.</source>
+        <translation type="unfinished"></translation>
     </message>
     <message id="this_another_id">
         <source>Foo bar.</source>
@@ -17,5 +18,11 @@
     <message>
         <source>Drop me!</source>
     </message>
+    <message id="one_id">
+        <source></source>
+    </message>
+    <message id="two_id">
+        <source></source>
+    </message>
 </context>
 </TS>
diff --git a/tests/auto/qdom/tst_qdom.cpp b/tests/auto/qdom/tst_qdom.cpp
index 6637202a08..0d58554ea8 100644
--- a/tests/auto/qdom/tst_qdom.cpp
+++ b/tests/auto/qdom/tst_qdom.cpp
@@ -322,6 +322,7 @@ void tst_QDom::toString_01_data()
 */
 void tst_QDom::toString_01()
 {
+    QFAIL("make test fail instead of timing out, will be fixed later (QT-2357)");
     QFETCH(QString, fileName);
 
     QFile f(fileName);
diff --git a/tests/auto/qfiledialog2/tst_qfiledialog2.cpp b/tests/auto/qfiledialog2/tst_qfiledialog2.cpp
index 18f94a9ef2..83ddd39e11 100644
--- a/tests/auto/qfiledialog2/tst_qfiledialog2.cpp
+++ b/tests/auto/qfiledialog2/tst_qfiledialog2.cpp
@@ -136,7 +136,10 @@ private:
 };
 
 tst_QFiledialog::tst_QFiledialog()
-{
+{   
+#if defined(Q_OS_WINCE)
+    qApp->setAutoMaximizeThreshold(-1);
+#endif
 }
 
 tst_QFiledialog::~tst_QFiledialog()
@@ -168,13 +171,21 @@ void tst_QFiledialog::cleanup()
 void tst_QFiledialog::listRoot()
 {
 #if defined QT_BUILD_INTERNAL
+    QFileInfoGatherer fileInfoGatherer;
+    fileInfoGatherer.start();
+    QTest::qWait(1500);
+
     QFileInfoGatherer::fetchedRoot = false;
     QString dir(QDir::currentPath());
     QNonNativeFileDialog fd(0, QString(), dir);
     fd.show();
     QCOMPARE(QFileInfoGatherer::fetchedRoot,false);
     fd.setDirectory("");
+#ifdef Q_OS_WINCE
+    QTest::qWait(1500);
+#else
     QTest::qWait(500);
+#endif
     QCOMPARE(QFileInfoGatherer::fetchedRoot,true);
 #endif
 }
@@ -297,6 +308,7 @@ void tst_QFiledialog::emptyUncPath()
 void tst_QFiledialog::task178897_minimumSize()
 {
     QNonNativeFileDialog fd;
+    QSize oldMs = fd.layout()->minimumSize();
     QStringList history = fd.history();
     history << QDir::toNativeSeparators("/verylongdirectory/"
             "aaaaaaaaaabbbbbbbbcccccccccccddddddddddddddeeeeeeeeeeeeffffffffffgggtggggggggghhhhhhhhiiiiiijjjk");
@@ -304,7 +316,7 @@ void tst_QFiledialog::task178897_minimumSize()
     fd.show();
 
     QSize ms = fd.layout()->minimumSize();
-    QVERIFY(ms.width() < 400);
+    QVERIFY(ms.width() <= oldMs.width());
 }
 
 void tst_QFiledialog::task180459_lastDirectory_data()
@@ -653,22 +665,33 @@ void tst_QFiledialog::task228844_ensurePreviousSorting()
     fd.setDirectory(current.absolutePath());
     fd.setViewMode(QFileDialog::Detail);
     fd.show();
+#if defined(Q_OS_WINCE)
+    QTest::qWait(1500);
+#else
     QTest::qWait(500);
+#endif
     QTreeView *tree = qFindChild<QTreeView*>(&fd, "treeView");
     tree->header()->setSortIndicator(3,Qt::DescendingOrder);
     QTest::qWait(200);
     QDialogButtonBox *buttonBox = qFindChild<QDialogButtonBox*>(&fd, "buttonBox");
     QPushButton *button = buttonBox->button(QDialogButtonBox::Open);
     QTest::mouseClick(button, Qt::LeftButton);
+#if defined(Q_OS_WINCE)
+    QTest::qWait(1500);
+#else
     QTest::qWait(500);
-
+#endif
     QNonNativeFileDialog fd2;
     fd2.setFileMode(QFileDialog::Directory);
     fd2.restoreState(fd.saveState());
     current.cd("aaaaaaaaaaaaaaaaaa");
     fd2.setDirectory(current.absolutePath());
     fd2.show();
+#if defined(Q_OS_WINCE)
+    QTest::qWait(1500);
+#else
     QTest::qWait(500);
+#endif
     QTreeView *tree2 = qFindChild<QTreeView*>(&fd2, "treeView");
     tree2->setFocus();
 
@@ -678,15 +701,22 @@ void tst_QFiledialog::task228844_ensurePreviousSorting()
     QPushButton *button2 = buttonBox2->button(QDialogButtonBox::Open);
     fd2.selectFile("g");
     QTest::mouseClick(button2, Qt::LeftButton);
+#if defined(Q_OS_WINCE)
+    QTest::qWait(1500);
+#else
     QTest::qWait(500);
-
+#endif
     QCOMPARE(fd2.selectedFiles().first(), current.absolutePath() + QChar('/') + QLatin1String("g"));
 
     QNonNativeFileDialog fd3(0, "This is a third file dialog", tempFile->fileName());
     fd3.restoreState(fd.saveState());
     fd3.setFileMode(QFileDialog::Directory);
     fd3.show();
+#if defined(Q_OS_WINCE)
+    QTest::qWait(1500);
+#else
     QTest::qWait(500);
+#endif
     QTreeView *tree3 = qFindChild<QTreeView*>(&fd3, "treeView");
     tree3->setFocus();
 
@@ -695,8 +725,11 @@ void tst_QFiledialog::task228844_ensurePreviousSorting()
     QDialogButtonBox *buttonBox3 = qFindChild<QDialogButtonBox*>(&fd3, "buttonBox");
     QPushButton *button3 = buttonBox3->button(QDialogButtonBox::Open);
     QTest::mouseClick(button3, Qt::LeftButton);
+#if defined(Q_OS_WINCE)
+    QTest::qWait(1500);
+#else
     QTest::qWait(500);
-
+#endif
     QCOMPARE(fd3.selectedFiles().first(), tempFile->fileName());
 
     current.cd("aaaaaaaaaaaaaaaaaa");
@@ -777,7 +810,12 @@ void tst_QFiledialog::task251321_sideBarHiddenEntries()
     sidebar->setFocus();
     sidebar->selectUrl(QUrl::fromLocalFile(hiddenSubDir.absolutePath()));
     QTest::mouseClick(sidebar->viewport(), Qt::LeftButton, 0, sidebar->visualRect(sidebar->model()->index(0, 0)).center());
+    // give the background processes more time on windows mobile
+#ifdef Q_OS_WINCE
+    QTest::qWait(1000);
+#else
     QTest::qWait(250);
+#endif
 
     QFileSystemModel *model = qFindChild<QFileSystemModel*>(&fd, "qt_filesystem_model");
     QCOMPARE(model->rowCount(model->index(hiddenSubDir.absolutePath())), 2);
diff --git a/tests/auto/qgraphicsitem/tst_qgraphicsitem.cpp b/tests/auto/qgraphicsitem/tst_qgraphicsitem.cpp
index 0a6f60ed20..dcad8e17c8 100644
--- a/tests/auto/qgraphicsitem/tst_qgraphicsitem.cpp
+++ b/tests/auto/qgraphicsitem/tst_qgraphicsitem.cpp
@@ -398,6 +398,7 @@ private slots:
     void modality_mouseGrabber();
     void modality_clickFocus();
     void modality_keyEvents();
+    void itemIsInFront();
 
     // task specific tests below me
     void task141694_textItemEnsureVisible();
@@ -9541,5 +9542,47 @@ void tst_QGraphicsItem::modality_keyEvents()
     QCOMPARE(rect1Spy.counts[QEvent::KeyRelease], 0);
 }
 
+void tst_QGraphicsItem::itemIsInFront()
+{
+    QGraphicsScene scene;
+    QGraphicsRectItem *rect1 = new QGraphicsRectItem;
+    rect1->setData(0, "rect1");
+    scene.addItem(rect1);
+
+    QGraphicsRectItem *rect1child1 = new QGraphicsRectItem(rect1);
+    rect1child1->setZValue(1);
+    rect1child1->setData(0, "rect1child1");
+
+    QGraphicsRectItem *rect1child2 = new QGraphicsRectItem(rect1);
+    rect1child2->setParentItem(rect1);
+    rect1child2->setData(0, "rect1child2");
+
+    QGraphicsRectItem *rect1child1_1 = new QGraphicsRectItem(rect1child1);
+    rect1child1_1->setData(0, "rect1child1_1");
+
+    QGraphicsRectItem *rect1child1_2 = new QGraphicsRectItem(rect1child1);
+    rect1child1_2->setFlag(QGraphicsItem::ItemStacksBehindParent);
+    rect1child1_2->setData(0, "rect1child1_2");
+
+    QGraphicsRectItem *rect2 = new QGraphicsRectItem;
+    rect2->setData(0, "rect2");
+    scene.addItem(rect2);
+
+    QGraphicsRectItem *rect2child1 = new QGraphicsRectItem(rect2);
+    rect2child1->setData(0, "rect2child1");
+
+    QCOMPARE(qt_closestItemFirst(rect1, rect1), false);
+    QCOMPARE(qt_closestItemFirst(rect1, rect2), false);
+    QCOMPARE(qt_closestItemFirst(rect1child1, rect2child1), false);
+    QCOMPARE(qt_closestItemFirst(rect1child1, rect1child2), true);
+    QCOMPARE(qt_closestItemFirst(rect1child1_1, rect1child2), true);
+    QCOMPARE(qt_closestItemFirst(rect1child1_1, rect1child1), true);
+    QCOMPARE(qt_closestItemFirst(rect1child1_2, rect1child2), true);
+    QCOMPARE(qt_closestItemFirst(rect1child1_2, rect1child1), false);
+    QCOMPARE(qt_closestItemFirst(rect1child1_2, rect1), true);
+    QCOMPARE(qt_closestItemFirst(rect1child1_2, rect2), false);
+    QCOMPARE(qt_closestItemFirst(rect1child1_2, rect2child1), false);
+}
+
 QTEST_MAIN(tst_QGraphicsItem)
 #include "tst_qgraphicsitem.moc"
diff --git a/tests/auto/qgraphicsproxywidget/tst_qgraphicsproxywidget.cpp b/tests/auto/qgraphicsproxywidget/tst_qgraphicsproxywidget.cpp
index 2426ce93f2..9269164898 100644
--- a/tests/auto/qgraphicsproxywidget/tst_qgraphicsproxywidget.cpp
+++ b/tests/auto/qgraphicsproxywidget/tst_qgraphicsproxywidget.cpp
@@ -2007,8 +2007,10 @@ void tst_QGraphicsProxyWidget::tabFocus_complexTwoWidgets()
     edit1->setText("QLineEdit 1");
     QLineEdit *edit2 = new QLineEdit;
     edit2->setText("QLineEdit 2");
+    QFontComboBox *fontComboBox = new QFontComboBox;
     QVBoxLayout *vlayout = new QVBoxLayout;
     vlayout->addWidget(edit1);
+    vlayout->addWidget(fontComboBox);
     vlayout->addWidget(edit2);
 
     QGroupBox *box = new QGroupBox("QGroupBox");
@@ -2020,8 +2022,10 @@ void tst_QGraphicsProxyWidget::tabFocus_complexTwoWidgets()
     edit1_2->setText("QLineEdit 1_2");
     QLineEdit *edit2_2 = new QLineEdit;
     edit2_2->setText("QLineEdit 2_2");
+    QFontComboBox *fontComboBox2 = new QFontComboBox;
     vlayout = new QVBoxLayout;
     vlayout->addWidget(edit1_2);
+    vlayout->addWidget(fontComboBox2);
     vlayout->addWidget(edit2_2);
 
     QGroupBox *box_2 = new QGroupBox("QGroupBox 2");
@@ -2062,8 +2066,10 @@ void tst_QGraphicsProxyWidget::tabFocus_complexTwoWidgets()
 
     EventSpy eventSpy(edit1);
     EventSpy eventSpy2(edit2);
+    EventSpy eventSpy3(fontComboBox);
     EventSpy eventSpy1_2(edit1_2);
     EventSpy eventSpy2_2(edit2_2);
+    EventSpy eventSpy2_3(fontComboBox2);
     EventSpy eventSpyBox(box);
 
     // Tab into group box
@@ -2084,11 +2090,24 @@ void tst_QGraphicsProxyWidget::tabFocus_complexTwoWidgets()
     QCOMPARE(eventSpy.counts[QEvent::FocusIn], 1);
     QCOMPARE(eventSpy.counts[QEvent::FocusOut], 0);
 
+    // Tab to the font combobox
+    QTest::keyPress(QApplication::focusWidget(), Qt::Key_Tab);
+    QApplication::processEvents();
+    fontComboBox->hasFocus();
+    QVERIFY(!edit2->hasFocus());
+    QCOMPARE(eventSpy3.counts[QEvent::FocusIn], 1);
+    QCOMPARE(eventSpy3.counts[QEvent::FocusOut], 0);
+    QCOMPARE(eventSpy.counts[QEvent::FocusIn], 1);
+    QCOMPARE(eventSpy.counts[QEvent::FocusOut], 1);
+
     // Tab into line edit 2
     QTest::keyPress(QApplication::focusWidget(), Qt::Key_Tab);
     QApplication::processEvents();
     edit2->hasFocus();
     QVERIFY(!edit1->hasFocus());
+    QCOMPARE(eventSpy2.counts[QEvent::FocusIn], 1);
+    QCOMPARE(eventSpy2.counts[QEvent::FocusOut], 0);
+    QCOMPARE(eventSpy3.counts[QEvent::FocusOut], 1);
     QCOMPARE(eventSpy.counts[QEvent::FocusIn], 1);
     QCOMPARE(eventSpy.counts[QEvent::FocusOut], 1);
 
@@ -2106,6 +2125,16 @@ void tst_QGraphicsProxyWidget::tabFocus_complexTwoWidgets()
     QCOMPARE(eventSpy1_2.counts[QEvent::FocusIn], 1);
     QCOMPARE(eventSpy1_2.counts[QEvent::FocusOut], 0);
 
+    // Tab into right font combobox
+    QTest::keyPress(QApplication::focusWidget(), Qt::Key_Tab);
+    QApplication::processEvents();
+    QVERIFY(!edit1_2->hasFocus());
+    fontComboBox2->hasFocus();
+    QCOMPARE(eventSpy1_2.counts[QEvent::FocusIn], 1);
+    QCOMPARE(eventSpy1_2.counts[QEvent::FocusOut], 1);
+    QCOMPARE(eventSpy2_3.counts[QEvent::FocusIn], 1);
+    QCOMPARE(eventSpy2_3.counts[QEvent::FocusOut], 0);
+
     // Tab into right bottom line edit
     QTest::keyPress(QApplication::focusWidget(), Qt::Key_Tab);
     QApplication::processEvents();
@@ -2113,6 +2142,8 @@ void tst_QGraphicsProxyWidget::tabFocus_complexTwoWidgets()
     edit2_2->hasFocus();
     QCOMPARE(eventSpy1_2.counts[QEvent::FocusIn], 1);
     QCOMPARE(eventSpy1_2.counts[QEvent::FocusOut], 1);
+    QCOMPARE(eventSpy2_3.counts[QEvent::FocusIn], 1);
+    QCOMPARE(eventSpy2_3.counts[QEvent::FocusOut], 1);
     QCOMPARE(eventSpy2_2.counts[QEvent::FocusIn], 1);
     QCOMPARE(eventSpy2_2.counts[QEvent::FocusOut], 0);
 
@@ -2129,6 +2160,12 @@ void tst_QGraphicsProxyWidget::tabFocus_complexTwoWidgets()
     QVERIFY(!rightDial->hasFocus());
     edit2_2->hasFocus();
 
+    // Backtab into the right font combobox
+    QTest::keyPress(QApplication::focusWidget(), Qt::Key_Backtab);
+    QApplication::processEvents();
+    QVERIFY(!edit2_2->hasFocus());
+    fontComboBox2->hasFocus();
+
     // Backtab into line edit 1
     QTest::keyPress(QApplication::focusWidget(), Qt::Key_Backtab);
     QApplication::processEvents();
@@ -2147,10 +2184,16 @@ void tst_QGraphicsProxyWidget::tabFocus_complexTwoWidgets()
     QVERIFY(!rightDial->hasFocus());
     edit2->hasFocus();
 
-    // Backtab into line edit 1
+    // Backtab into the font combobox
     QTest::keyPress(QApplication::focusWidget(), Qt::Key_Backtab);
     QApplication::processEvents();
     QVERIFY(!edit2->hasFocus());
+    fontComboBox->hasFocus();
+
+    // Backtab into line edit 1
+    QTest::keyPress(QApplication::focusWidget(), Qt::Key_Backtab);
+    QApplication::processEvents();
+    QVERIFY(!fontComboBox->hasFocus());
     edit1->hasFocus();
 
     // Backtab into line box
diff --git a/tests/auto/qgraphicstransform/tst_qgraphicstransform.cpp b/tests/auto/qgraphicstransform/tst_qgraphicstransform.cpp
index b407fef2a2..eb5c09959f 100644
--- a/tests/auto/qgraphicstransform/tst_qgraphicstransform.cpp
+++ b/tests/auto/qgraphicstransform/tst_qgraphicstransform.cpp
@@ -88,7 +88,7 @@ static QTransform transform2D(const QGraphicsTransform& t)
 {
     QMatrix4x4 m;
     t.applyTo(&m);
-    return m.toTransform();
+    return m.toTransform(0);
 }
 
 void tst_QGraphicsTransform::scale()
diff --git a/tests/auto/qhttp/tst_qhttp.cpp b/tests/auto/qhttp/tst_qhttp.cpp
index f6d5e3e5fc..0ea0d15fdc 100644
--- a/tests/auto/qhttp/tst_qhttp.cpp
+++ b/tests/auto/qhttp/tst_qhttp.cpp
@@ -484,6 +484,7 @@ void tst_QHttp::post_data()
     QTest::addColumn<bool>("useProxy");
     QTest::addColumn<QString>("host");
     QTest::addColumn<int>("port");
+    QTest::addColumn<bool>("ssl");
     QTest::addColumn<QString>("path");
     QTest::addColumn<QByteArray>("result");
 
@@ -491,25 +492,48 @@ void tst_QHttp::post_data()
     md5sum = "d41d8cd98f00b204e9800998ecf8427e";
     QTest::newRow("empty-data")
         << QString() << false << false
-        << QtNetworkSettings::serverName() << 80 << "/qtest/cgi-bin/md5sum.cgi" << md5sum;
+        << QtNetworkSettings::serverName() << 80 << false << "/qtest/cgi-bin/md5sum.cgi" << md5sum;
     QTest::newRow("empty-device")
         << QString() << true << false
-        << QtNetworkSettings::serverName() << 80 << "/qtest/cgi-bin/md5sum.cgi" << md5sum;
+        << QtNetworkSettings::serverName() << 80 << false << "/qtest/cgi-bin/md5sum.cgi" << md5sum;
     QTest::newRow("proxy-empty-data")
         << QString() << false << true
-        << QtNetworkSettings::serverName() << 80 << "/qtest/cgi-bin/md5sum.cgi" << md5sum;
+        << QtNetworkSettings::serverName() << 80 << false << "/qtest/cgi-bin/md5sum.cgi" << md5sum;
 
     md5sum = "b3e32ac459b99d3f59318f3ac31e4bee";
     QTest::newRow("data") << "rfc3252.txt" << false << false
-                          << QtNetworkSettings::serverName() << 80 << "/qtest/cgi-bin/md5sum.cgi"
+                          << QtNetworkSettings::serverName() << 80 << false << "/qtest/cgi-bin/md5sum.cgi"
                           << md5sum;
     QTest::newRow("device") << "rfc3252.txt" << true << false
-                          << QtNetworkSettings::serverName() << 80 << "/qtest/cgi-bin/md5sum.cgi"
+                          << QtNetworkSettings::serverName() << 80 << false << "/qtest/cgi-bin/md5sum.cgi"
                           << md5sum;
     QTest::newRow("proxy-data") << "rfc3252.txt" << false << true
-                                << QtNetworkSettings::serverName() << 80 << "/qtest/cgi-bin/md5sum.cgi"
+                                << QtNetworkSettings::serverName() << 80 << false << "/qtest/cgi-bin/md5sum.cgi"
                                 << md5sum;
 
+#ifndef QT_NO_OPENSSL
+    md5sum = "d41d8cd98f00b204e9800998ecf8427e";
+    QTest::newRow("empty-data-ssl")
+        << QString() << false << false
+        << QtNetworkSettings::serverName() << 443 << true << "/qtest/cgi-bin/md5sum.cgi" << md5sum;
+    QTest::newRow("empty-device-ssl")
+        << QString() << true << false
+        << QtNetworkSettings::serverName() << 443 << true << "/qtest/cgi-bin/md5sum.cgi" << md5sum;
+    QTest::newRow("proxy-empty-data-ssl")
+        << QString() << false << true
+        << QtNetworkSettings::serverName() << 443 << true << "/qtest/cgi-bin/md5sum.cgi" << md5sum;
+    md5sum = "b3e32ac459b99d3f59318f3ac31e4bee";
+    QTest::newRow("data-ssl") << "rfc3252.txt" << false << false
+        << QtNetworkSettings::serverName() << 443 << true << "/qtest/cgi-bin/md5sum.cgi"
+        << md5sum;
+    QTest::newRow("device-ssl") << "rfc3252.txt" << true << false
+        << QtNetworkSettings::serverName() << 443 << true << "/qtest/cgi-bin/md5sum.cgi"
+        << md5sum;
+    QTest::newRow("proxy-data-ssl") << "rfc3252.txt" << false << true
+        << QtNetworkSettings::serverName() << 443 << true << "/qtest/cgi-bin/md5sum.cgi"
+        << md5sum;
+#endif
+
     // the following test won't work. See task 185996
 /*
     QTest::newRow("proxy-device") << "rfc3252.txt" << true << true
@@ -525,14 +549,19 @@ void tst_QHttp::post()
     QFETCH(bool, useProxy);
     QFETCH(QString, host);
     QFETCH(int, port);
+    QFETCH(bool, ssl);
     QFETCH(QString, path);
 
     http = newHttp(useProxy);
+#ifndef QT_NO_OPENSSL
+    QObject::connect(http, SIGNAL(sslErrors(const QList<QSslError> &)),
+        http, SLOT(ignoreSslErrors()));
+#endif
     QCOMPARE(http->currentId(), 0);
     QCOMPARE((int)http->state(), (int)QHttp::Unconnected);
     if (useProxy)
         addRequest(QHttpRequestHeader(), http->setProxy(QtNetworkSettings::serverName(), 3129));
-    addRequest(QHttpRequestHeader(), http->setHost(host, port));
+    addRequest(QHttpRequestHeader(), http->setHost(host, (ssl ? QHttp::ConnectionModeHttps : QHttp::ConnectionModeHttp), port));
 
     // add the POST request
     QFile file(SRCDIR + source);
diff --git a/tests/auto/qlayout/tst_qlayout.cpp b/tests/auto/qlayout/tst_qlayout.cpp
index 9d6110dfa7..efe14c37ca 100644
--- a/tests/auto/qlayout/tst_qlayout.cpp
+++ b/tests/auto/qlayout/tst_qlayout.cpp
@@ -83,6 +83,7 @@ private slots:
     void layoutItemRect();
     void warnIfWrongParent();
     void controlTypes();
+    void adjustSizeShouldMakeSureLayoutIsActivated();
 };
 
 tst_QLayout::tst_QLayout()
@@ -110,8 +111,8 @@ void tst_QLayout::getSetCheck()
 class SizeHinterFrame : public QFrame
 {
 public:
-    SizeHinterFrame(const QSize &s) 
-    : QFrame(0), sh(s) {
+    SizeHinterFrame(const QSize &sh, const QSize &msh = QSize())
+    : QFrame(0), sh(sh), msh(msh) {
         setFrameStyle(QFrame::Box | QFrame::Plain);
     }
 
@@ -119,9 +120,11 @@ public:
 
     void setSizeHint(const QSize &s) { sh = s; }
     QSize sizeHint() const { return sh; }
+    QSize minimumSizeHint() const { return msh; }
 
 private:
     QSize sh;
+    QSize msh;
 };
 
 
@@ -333,5 +336,26 @@ void tst_QLayout::controlTypes()
 
 }
 
+void tst_QLayout::adjustSizeShouldMakeSureLayoutIsActivated()
+{
+    QWidget main;
+
+    QVBoxLayout *const layout = new QVBoxLayout(&main);
+    layout->setMargin(0);
+    SizeHinterFrame *frame = new SizeHinterFrame(QSize(200, 10), QSize(200, 8));
+    frame->setSizePolicy(QSizePolicy::Preferred, QSizePolicy::Preferred);
+    layout->addWidget(frame);
+
+    SizeHinterFrame *frame2 = new SizeHinterFrame(QSize(200, 10), QSize(200, 8));
+    frame2->setSizePolicy(QSizePolicy::Preferred, QSizePolicy::Preferred);
+    layout->addWidget(frame2);
+
+    main.show();
+
+    frame2->hide();
+    main.adjustSize();
+    QCOMPARE(main.size(), QSize(200, 10));
+}
+
 QTEST_MAIN(tst_QLayout)
 #include "tst_qlayout.moc"
diff --git a/tests/auto/qlistview/tst_qlistview.cpp b/tests/auto/qlistview/tst_qlistview.cpp
index 3ee6889f50..6e211ae045 100644
--- a/tests/auto/qlistview/tst_qlistview.cpp
+++ b/tests/auto/qlistview/tst_qlistview.cpp
@@ -117,6 +117,8 @@ private slots:
     void shiftSelectionWithNonUniformItemSizes();
     void clickOnViewportClearsSelection();
     void task262152_setModelColumnNavigate();
+    void taskQTBUG_2233_scrollHiddenItems_data();
+    void taskQTBUG_2233_scrollHiddenItems();
 };
 
 // Testing get/set functions
@@ -1780,17 +1782,52 @@ void tst_QListView::task262152_setModelColumnNavigate()
     view.setModelColumn(1);
 
     view.show();
-    QTest::qWait(30);
+    QTest::qWait(100);
     QTest::keyClick(&view, Qt::Key_Down);
-    QTest::qWait(10);
+    QTest::qWait(100);
     QCOMPARE(view.currentIndex(), model.index(1,1));
     QTest::keyClick(&view, Qt::Key_Down);
-    QTest::qWait(10);
+    QTest::qWait(100);
     QCOMPARE(view.currentIndex(), model.index(2,1));
 
 }
 
+void tst_QListView::taskQTBUG_2233_scrollHiddenItems_data()
+{
+    QTest::addColumn<int>("flow");
+
+    QTest::newRow("TopToBottom") << static_cast<int>(QListView::TopToBottom);
+    QTest::newRow("LeftToRight") << static_cast<int>(QListView::LeftToRight);
+}
+
+void tst_QListView::taskQTBUG_2233_scrollHiddenItems()
+{
+    QFETCH(int, flow);
+    const int rowCount = 200;
 
+    QListView view;
+    QStringListModel model(&view);
+    QStringList list;
+    for (int i = 0; i < rowCount; ++i)
+        list << QString::fromAscii("Item %1").arg(i);
+
+    model.setStringList(list);
+    view.setModel(&model);
+    view.setViewMode(QListView::ListMode);
+    for (int i = 0; i < rowCount / 2; ++i)
+        view.setRowHidden(2 * i, true);
+    view.setFlow(static_cast<QListView::Flow>(flow));
+    view.resize(130, 130);
+
+    for (int i = 0; i < 10; ++i) {
+        (view.flow() == QListView::TopToBottom
+            ? view.verticalScrollBar()
+            : view.horizontalScrollBar())->setValue(i);
+        QModelIndex index = view.indexAt(QPoint(0,0));
+        QVERIFY(index.isValid());
+        QCOMPARE(index.row(), 2 * i + 1);
+    }
+}
 
 QTEST_MAIN(tst_QListView)
 #include "tst_qlistview.moc"
diff --git a/tests/auto/qpauseanimation/tst_qpauseanimation.cpp b/tests/auto/qpauseanimation/tst_qpauseanimation.cpp
index 62b43c4f0a..b11efa0c8f 100644
--- a/tests/auto/qpauseanimation/tst_qpauseanimation.cpp
+++ b/tests/auto/qpauseanimation/tst_qpauseanimation.cpp
@@ -169,7 +169,7 @@ void tst_QPauseAnimation::noTimerUpdates()
     animation.start();
     QTest::qWait(animation.totalDuration() + 100);
     QVERIFY(animation.state() == QAbstractAnimation::Stopped);
-    QCOMPARE(animation.m_updateCurrentTimeCount, 2);
+    QCOMPARE(animation.m_updateCurrentTimeCount, 1 + loopCount);
 
     timer->setConsistentTiming(false);
 }
@@ -399,6 +399,7 @@ void tst_QPauseAnimation::multipleSequentialGroups()
 void tst_QPauseAnimation::zeroDuration()
 {
     TestablePauseAnimation animation;
+    animation.setDuration(0);
     animation.start();
     QTest::qWait(animation.totalDuration() + 100);
     QVERIFY(animation.state() == QAbstractAnimation::Stopped);
diff --git a/tests/auto/qpropertyanimation/tst_qpropertyanimation.cpp b/tests/auto/qpropertyanimation/tst_qpropertyanimation.cpp
index 51ef2dad1a..7dd17e532f 100644
--- a/tests/auto/qpropertyanimation/tst_qpropertyanimation.cpp
+++ b/tests/auto/qpropertyanimation/tst_qpropertyanimation.cpp
@@ -130,6 +130,7 @@ private slots:
     void valueChanged();
     void twoAnimations();
     void deletedInUpdateCurrentTime();
+    void totalDuration();
 };
 
 tst_QPropertyAnimation::tst_QPropertyAnimation()
@@ -1199,5 +1200,18 @@ void tst_QPropertyAnimation::deletedInUpdateCurrentTime()
     QCOMPARE(o.value(), 1000);
 }
 
+void tst_QPropertyAnimation::totalDuration()
+{
+    QPropertyAnimation anim;
+    QCOMPARE(anim.totalDuration(), 250);
+    anim.setLoopCount(2);
+    QCOMPARE(anim.totalDuration(), 2*250);
+    anim.setLoopCount(-1);
+    QCOMPARE(anim.totalDuration(), -1);
+    anim.setDuration(0);
+    QCOMPARE(anim.totalDuration(), 0);
+}
+
+
 QTEST_MAIN(tst_QPropertyAnimation)
 #include "tst_qpropertyanimation.moc"
diff --git a/tests/auto/qscriptextqobject/tst_qscriptextqobject.cpp b/tests/auto/qscriptextqobject/tst_qscriptextqobject.cpp
index 320a429d04..44adf7e45d 100644
--- a/tests/auto/qscriptextqobject/tst_qscriptextqobject.cpp
+++ b/tests/auto/qscriptextqobject/tst_qscriptextqobject.cpp
@@ -317,6 +317,11 @@ public:
     Q_INVOKABLE QObject* myInvokableReturningMyQObjectAsQObject()
         { m_qtFunctionInvoked = 57; return this; }
 
+    Q_INVOKABLE QObjectList findObjects() const
+    {  return findChildren<QObject *>();  }
+    Q_INVOKABLE QList<int> myInvokableNumbers() const
+    {  return QList<int>() << 1 << 2 << 3; }
+
     void emitMySignal()
         { emit mySignal(); }
     void emitMySignalWithIntArg(int arg)
@@ -493,6 +498,7 @@ protected slots:
     }
 
 private slots:
+    void registeredTypes();
     void getSetStaticProperty();
     void getSetDynamicProperty();
     void getSetChildren();
@@ -543,6 +549,24 @@ void tst_QScriptExtQObject::cleanup()
     delete m_myObject;
 }
 
+// this test has to be first and test that some types are automatically registered
+void tst_QScriptExtQObject::registeredTypes()
+{
+    QScriptEngine e;
+    QObject *t = new MyQObject;
+    QObject *c = new QObject(t);
+    c->setObjectName ("child1");
+
+    e.globalObject().setProperty("MyTest", e.newQObject(t));
+
+    QScriptValue v1 = e.evaluate("MyTest.findObjects()[0].objectName;");
+    QCOMPARE(v1.toString(), c->objectName());
+
+    QScriptValue v2 = e.evaluate("MyTest.myInvokableNumbers()");
+    QCOMPARE(qscriptvalue_cast<QList<int> >(v2), (QList<int>() << 1 << 2 << 3));
+}
+
+
 static QScriptValue getSetProperty(QScriptContext *ctx, QScriptEngine *)
 {
     if (ctx->argumentCount() != 0)
diff --git a/tests/auto/qsslsocket/tst_qsslsocket.cpp b/tests/auto/qsslsocket/tst_qsslsocket.cpp
index d57620194e..2bd1684a76 100644
--- a/tests/auto/qsslsocket/tst_qsslsocket.cpp
+++ b/tests/auto/qsslsocket/tst_qsslsocket.cpp
@@ -170,6 +170,7 @@ private slots:
     void setEmptyKey();
     void spontaneousWrite();
     void setReadBufferSize();
+    void setReadBufferSize_task_250027();
     void waitForMinusOne();
     void verifyMode();
     void verifyDepth();
@@ -1241,6 +1242,66 @@ void tst_QSslSocket::setReadBufferSize()
     QVERIFY(receiver->bytesAvailable() > oldBytesAvailable);
 }
 
+class SetReadBufferSize_task_250027_handler : public QObject {
+    Q_OBJECT
+public slots:
+    void readyReadSlot() {
+        QTestEventLoop::instance().exitLoop();
+    }
+    void waitSomeMore(QSslSocket *socket) {
+        QTime t;
+        t.start();
+        while (!socket->encryptedBytesAvailable()) {
+            QCoreApplication::processEvents(QEventLoop::AllEvents | QEventLoop::WaitForMoreEvents, 250);
+            if (t.elapsed() > 1000 || socket->state() != QAbstractSocket::ConnectedState)
+                return;
+        }
+    }
+};
+
+void tst_QSslSocket::setReadBufferSize_task_250027()
+{
+    // do not execute this when a proxy is set.
+    QFETCH_GLOBAL(bool, setProxy);
+    if (setProxy)
+        return;
+
+    QSslSocketPtr socket = newSocket();
+    socket->setReadBufferSize(1000); // limit to 1 kb/sec
+    socket->ignoreSslErrors();
+    socket->connectToHostEncrypted(QtNetworkSettings::serverName(), 443);
+    socket->ignoreSslErrors();
+    QVERIFY(socket->waitForConnected(10*1000));
+    QVERIFY(socket->waitForEncrypted(10*1000));
+
+    // exit the event loop as soon as we receive a readyRead()
+    SetReadBufferSize_task_250027_handler setReadBufferSize_task_250027_handler;
+    connect(socket, SIGNAL(readyRead()), &setReadBufferSize_task_250027_handler, SLOT(readyReadSlot()));
+
+    // provoke a response by sending a request
+    socket->write("GET /gif/fluke.gif HTTP/1.0\n"); // this file is 27 KB
+    socket->write("Host: ");
+    socket->write(QtNetworkSettings::serverName().toLocal8Bit().constData());
+    socket->write("\n");
+    socket->write("Connection: close\n");
+    socket->write("\n");
+    socket->flush();
+
+    QTestEventLoop::instance().enterLoop(10);
+    setReadBufferSize_task_250027_handler.waitSomeMore(socket);
+    QByteArray firstRead = socket->readAll();
+    // First read should be some data, but not the whole file
+    QVERIFY(firstRead.size() > 0 && firstRead.size() < 20*1024);
+
+    QTestEventLoop::instance().enterLoop(10);
+    setReadBufferSize_task_250027_handler.waitSomeMore(socket);
+    QByteArray secondRead = socket->readAll();
+    // second read should be some more data
+    QVERIFY(secondRead.size() > 0);
+
+    socket->close();
+}
+
 class SslServer3 : public QTcpServer
 {
     Q_OBJECT
diff --git a/tests/auto/qtreeview/tst_qtreeview.cpp b/tests/auto/qtreeview/tst_qtreeview.cpp
index 91b2cc5529..da58725c7c 100644
--- a/tests/auto/qtreeview/tst_qtreeview.cpp
+++ b/tests/auto/qtreeview/tst_qtreeview.cpp
@@ -172,6 +172,7 @@ private slots:
     void expandAndCollapse_data();
     void expandAndCollapse();
     void expandAndCollapseAll();
+    void expandWithNoChildren();
     void keyboardNavigation();
     void headerSections();
     void moveCursor_data();
@@ -1548,6 +1549,19 @@ void tst_QTreeView::expandAndCollapseAll()
 //    QCOMPARE(collapsedSpy.count(), count);
 }
 
+void tst_QTreeView::expandWithNoChildren()
+{
+    QTreeView tree;
+    QStandardItemModel model(1,1);
+    tree.setModel(&model);
+    tree.setAnimated(true);
+    tree.doItemsLayout();
+    //this test should not output warnings
+    tree.expand(model.index(0,0));
+}
+
+
+
 void tst_QTreeView::keyboardNavigation()
 {
     const int rows = 10;
diff --git a/tests/manual/gestures/graphicsview/main.cpp b/tests/manual/gestures/graphicsview/main.cpp
index 263a963678..e9065eb0b7 100644
--- a/tests/manual/gestures/graphicsview/main.cpp
+++ b/tests/manual/gestures/graphicsview/main.cpp
@@ -66,11 +66,11 @@ protected:
                 default: qDebug("view: Pan: <unknown state>"); break;
                 }
 
-                const QSizeF offset = pan->offset();
+                const QPointF offset = pan->offset();
                 QScrollBar *vbar = verticalScrollBar();
                 QScrollBar *hbar = horizontalScrollBar();
-                vbar->setValue(vbar->value() - offset.height());
-                hbar->setValue(hbar->value() - offset.width());
+                vbar->setValue(vbar->value() - offset.y());
+                hbar->setValue(hbar->value() - offset.x());
                 ge->accept(pan);
                 return true;
             }
@@ -126,6 +126,8 @@ public:
         scene = new QGraphicsScene(this);
         scene->setSceneRect(-2000, -2000, 4000, 4000);
         view = new QGraphicsView(scene, 0);
+        view->viewport()->grabGesture(Qt::PanGesture);
+        view->viewport()->grabGesture(ThreeFingerSlideGesture::Type);
         QVBoxLayout *l = new QVBoxLayout(this);
         l->addWidget(view);
     }
diff --git a/tests/manual/gestures/graphicsview/mousepangesturerecognizer.cpp b/tests/manual/gestures/graphicsview/mousepangesturerecognizer.cpp
index 0e7f538198..6cdbe12847 100644
--- a/tests/manual/gestures/graphicsview/mousepangesturerecognizer.cpp
+++ b/tests/manual/gestures/graphicsview/mousepangesturerecognizer.cpp
@@ -42,6 +42,8 @@
 #include "mousepangesturerecognizer.h"
 
 #include <QEvent>
+#include <QVariant>
+#include <QGraphicsSceneMouseEvent>
 #include <QMouseEvent>
 #include <QGesture>
 
@@ -57,21 +59,36 @@ QGesture* MousePanGestureRecognizer::createGesture(QObject *)
 QGestureRecognizer::Result MousePanGestureRecognizer::filterEvent(QGesture *state, QObject *, QEvent *event)
 {
     QPanGesture *g = static_cast<QPanGesture *>(state);
-    QMouseEvent *me = static_cast<QMouseEvent *>(event);
+    QPoint globalPos;
+    switch (event->type()) {
+    case QEvent::GraphicsSceneMousePress:
+    case QEvent::GraphicsSceneMouseDoubleClick:
+    case QEvent::GraphicsSceneMouseMove:
+    case QEvent::GraphicsSceneMouseRelease:
+        globalPos = static_cast<QGraphicsSceneMouseEvent *>(event)->screenPos();
+        break;
+    case QEvent::MouseButtonPress:
+    case QEvent::MouseMove:
+    case QEvent::MouseButtonRelease:
+        globalPos = static_cast<QMouseEvent *>(event)->globalPos();
+        break;
+    default:
+        break;
+    }
     if (event->type() == QEvent::MouseButtonPress || event->type() == QEvent::MouseButtonDblClick
         || event->type() == QEvent::GraphicsSceneMousePress || event->type() == QEvent::GraphicsSceneMouseDoubleClick) {
-        g->setHotSpot(me->globalPos());
-        g->setProperty("lastPos", me->globalPos());
+        g->setHotSpot(globalPos);
+        g->setProperty("lastPos", globalPos);
         g->setProperty("pressed", QVariant::fromValue<bool>(true));
         return QGestureRecognizer::GestureTriggered | QGestureRecognizer::ConsumeEventHint;
     } else if (event->type() == QEvent::MouseMove || event->type() == QEvent::GraphicsSceneMouseMove) {
         if (g->property("pressed").toBool()) {
-            QPoint pos = me->globalPos();
+            QPoint pos = globalPos;
             QPoint lastPos = g->property("lastPos").toPoint();
             g->setLastOffset(g->offset());
             lastPos = pos - lastPos;
-            g->setOffset(QSizeF(lastPos.x(), lastPos.y()));
-            g->setTotalOffset(g->totalOffset() + QSizeF(lastPos.x(), lastPos.y()));
+            g->setOffset(QPointF(lastPos.x(), lastPos.y()));
+            g->setTotalOffset(g->totalOffset() + QPointF(lastPos.x(), lastPos.y()));
             g->setProperty("lastPos", pos);
             return QGestureRecognizer::GestureTriggered | QGestureRecognizer::ConsumeEventHint;
         }
@@ -85,9 +102,9 @@ QGestureRecognizer::Result MousePanGestureRecognizer::filterEvent(QGesture *stat
 void MousePanGestureRecognizer::reset(QGesture *state)
 {
     QPanGesture *g = static_cast<QPanGesture *>(state);
-    g->setTotalOffset(QSizeF());
-    g->setLastOffset(QSizeF());
-    g->setOffset(QSizeF());
+    g->setTotalOffset(QPointF());
+    g->setLastOffset(QPointF());
+    g->setOffset(QPointF());
     g->setAcceleration(0);
     g->setProperty("lastPos", QVariant());
     g->setProperty("pressed", QVariant::fromValue<bool>(false));
diff --git a/tests/manual/gestures/scrollarea/main.cpp b/tests/manual/gestures/scrollarea/main.cpp
index 27966370da..f90f6c66e4 100644
--- a/tests/manual/gestures/scrollarea/main.cpp
+++ b/tests/manual/gestures/scrollarea/main.cpp
@@ -87,23 +87,23 @@ protected:
             if (outside)
                 return;
 
-            const QSizeF offset = pan->offset();
-            const QSizeF totalOffset = pan->totalOffset();
+            const QPointF offset = pan->offset();
+            const QPointF totalOffset = pan->totalOffset();
             QScrollBar *vbar = verticalScrollBar();
             QScrollBar *hbar = horizontalScrollBar();
 
-            if ((vbar->value() == vbar->minimum() && totalOffset.height() > 10) ||
-                (vbar->value() == vbar->maximum() && totalOffset.height() < -10)) {
+            if ((vbar->value() == vbar->minimum() && totalOffset.y() > 10) ||
+                (vbar->value() == vbar->maximum() && totalOffset.y() < -10)) {
                 outside = true;
                 return;
             }
-            if ((hbar->value() == hbar->minimum() && totalOffset.width() > 10) ||
-                (hbar->value() == hbar->maximum() && totalOffset.width() < -10)) {
+            if ((hbar->value() == hbar->minimum() && totalOffset.x() > 10) ||
+                (hbar->value() == hbar->maximum() && totalOffset.x() < -10)) {
                 outside = true;
                 return;
             }
-            vbar->setValue(vbar->value() - offset.height());
-            hbar->setValue(hbar->value() - offset.width());
+            vbar->setValue(vbar->value() - offset.y());
+            hbar->setValue(hbar->value() - offset.x());
             event->accept(pan);
         }
     }
@@ -147,28 +147,28 @@ protected:
             event->ignore(pan);
             if (outside)
                 return;
-            const QSizeF offset = pan->offset();
-            const QSizeF totalOffset = pan->totalOffset();
+            const QPointF offset = pan->offset();
+            const QPointF totalOffset = pan->totalOffset();
             if (orientation() == Qt::Horizontal) {
-                if ((value() == minimum() && totalOffset.width() < -10) ||
-                    (value() == maximum() && totalOffset.width() > 10)) {
+                if ((value() == minimum() && totalOffset.x() < -10) ||
+                    (value() == maximum() && totalOffset.x() > 10)) {
                     outside = true;
                     return;
                 }
-                if (totalOffset.height() < 40 && totalOffset.height() > -40) {
-                    setValue(value() + offset.width());
+                if (totalOffset.y() < 40 && totalOffset.y() > -40) {
+                    setValue(value() + offset.x());
                     event->accept(pan);
                 } else {
                     outside = true;
                 }
             } else if (orientation() == Qt::Vertical) {
-                if ((value() == maximum() && totalOffset.height() < -10) ||
-                    (value() == minimum() && totalOffset.height() > 10)) {
+                if ((value() == maximum() && totalOffset.y() < -10) ||
+                    (value() == minimum() && totalOffset.y() > 10)) {
                     outside = true;
                     return;
                 }
-                if (totalOffset.width() < 40 && totalOffset.width() > -40) {
-                    setValue(value() - offset.height());
+                if (totalOffset.x() < 40 && totalOffset.x() > -40) {
+                    setValue(value() - offset.y());
                     event->accept(pan);
                 } else {
                     outside = true;
diff --git a/tests/manual/gestures/scrollarea/mousepangesturerecognizer.cpp b/tests/manual/gestures/scrollarea/mousepangesturerecognizer.cpp
index 79b633e0d3..5f94dbc862 100644
--- a/tests/manual/gestures/scrollarea/mousepangesturerecognizer.cpp
+++ b/tests/manual/gestures/scrollarea/mousepangesturerecognizer.cpp
@@ -69,8 +69,8 @@ QGestureRecognizer::Result MousePanGestureRecognizer::filterEvent(QGesture *stat
             QPoint lastPos = g->property("lastPos").toPoint();
             g->setLastOffset(g->offset());
             lastPos = pos - lastPos;
-            g->setOffset(QSizeF(lastPos.x(), lastPos.y()));
-            g->setTotalOffset(g->totalOffset() + QSizeF(lastPos.x(), lastPos.y()));
+            g->setOffset(QPointF(lastPos.x(), lastPos.y()));
+            g->setTotalOffset(g->totalOffset() + QPointF(lastPos.x(), lastPos.y()));
             g->setProperty("lastPos", pos);
             return QGestureRecognizer::GestureTriggered | QGestureRecognizer::ConsumeEventHint;
         }
@@ -84,9 +84,9 @@ QGestureRecognizer::Result MousePanGestureRecognizer::filterEvent(QGesture *stat
 void MousePanGestureRecognizer::reset(QGesture *state)
 {
     QPanGesture *g = static_cast<QPanGesture *>(state);
-    g->setTotalOffset(QSizeF());
-    g->setLastOffset(QSizeF());
-    g->setOffset(QSizeF());
+    g->setTotalOffset(QPointF());
+    g->setLastOffset(QPointF());
+    g->setOffset(QPointF());
     g->setAcceleration(0);
     g->setProperty("lastPos", QVariant());
     g->setProperty("pressed", QVariant::fromValue<bool>(false));
diff --git a/tools/linguist/lupdate/main.cpp b/tools/linguist/lupdate/main.cpp
index 6b554e0bb9..bdaec4f59b 100644
--- a/tools/linguist/lupdate/main.cpp
+++ b/tools/linguist/lupdate/main.cpp
@@ -160,6 +160,8 @@ static void updateTsFiles(const Translator &fetchedTor, const QStringList &tsFil
                 tor.setCodecName(codecForTr);
             if (!targetLanguage.isEmpty())
                 tor.setLanguageCode(targetLanguage);
+            else
+                tor.setLanguageCode(Translator::guessLanguageCodeFromFileName(fileName));
             if (!sourceLanguage.isEmpty())
                 tor.setSourceLanguageCode(sourceLanguage);
         }
diff --git a/tools/linguist/shared/qm.cpp b/tools/linguist/shared/qm.cpp
index fefe91c9b4..317a07ef67 100644
--- a/tools/linguist/shared/qm.cpp
+++ b/tools/linguist/shared/qm.cpp
@@ -440,9 +440,10 @@ void Releaser::insert(const TranslatorMessage &message, bool forceComment)
 void Releaser::insertIdBased(const TranslatorMessage &message)
 {
     QStringList tlns = message.translations();
-    for (int i = 0; i < tlns.size(); ++i)
-        if (tlns.at(i).isEmpty())
-            tlns[i] = message.sourceText();
+    if (message.type() == TranslatorMessage::Unfinished)
+        for (int i = 0; i < tlns.size(); ++i)
+            if (tlns.at(i).isEmpty())
+                tlns[i] = message.sourceText();
     ByteTranslatorMessage bmsg("", originalBytes(message.id(), false), "", tlns);
     m_messages.insert(bmsg, 0);
 }
@@ -713,7 +714,7 @@ static bool saveQM(const Translator &translator, QIODevice &dev, ConversionData
                 continue;
             }
             if (typ == TranslatorMessage::Unfinished) {
-                if (msg.translation().isEmpty()) {
+                if (!cd.m_idBased && msg.translation().isEmpty()) {
                     ++untranslated;
                     continue;
                 } else {
diff --git a/tools/linguist/shared/translatormessage.cpp b/tools/linguist/shared/translatormessage.cpp
index 417f6b1646..db6f3339fb 100644
--- a/tools/linguist/shared/translatormessage.cpp
+++ b/tools/linguist/shared/translatormessage.cpp
@@ -151,6 +151,7 @@ bool TranslatorMessage::operator==(const TranslatorMessage& m) const
     return (m_context == m.m_context)
         && m_sourcetext == m.m_sourcetext
         && m_extra[msgIdPlural] == m.m_extra[msgIdPlural]
+        && m_id == m.m_id
         && (m_sourcetext.isEmpty() || m_comment == m.m_comment);
 }
 
@@ -161,7 +162,9 @@ bool TranslatorMessage::operator<(const TranslatorMessage& m) const
         return m_context < m.m_context;
     if (m_sourcetext != m.m_sourcetext)
         return m_sourcetext < m.m_sourcetext;
-    return m_comment < m.m_comment;
+    if (m_comment != m.m_comment)
+        return m_comment < m.m_comment;
+    return m_id < m.m_id;
 }
 
 int qHash(const TranslatorMessage &msg)
@@ -170,7 +173,8 @@ int qHash(const TranslatorMessage &msg)
         qHash(msg.context()) ^
         qHash(msg.sourceText()) ^
         qHash(msg.extra(QLatin1String("po-msgid_plural"))) ^
-        qHash(msg.comment());
+        qHash(msg.comment()) ^
+        qHash(msg.id());
 }
 
 bool TranslatorMessage::hasExtra(const QString &key) const
diff --git a/util/webkit/mkdist-webkit b/util/webkit/mkdist-webkit
index 9611d380db..f88f10ecc3 100755
--- a/util/webkit/mkdist-webkit
+++ b/util/webkit/mkdist-webkit
@@ -5,7 +5,7 @@ die() {
     exit 1
 }
 
-default_tag="qtwebkit-4.6-snapshot-30092009-2"
+default_tag="qtwebkit-4.6-snapshot-22102009"
 
 if [ $# -eq 0 ]; then
     tag="$default_tag"